AWS Systems Manager Automation用のRun BookをCfnで作成 ～EC2とRedshiftをまとめて起動・停止～

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  TagKey:
    Type: String
    Default: AutoStop  # 停止・起動対象とするEC2のタグ名
  ClusterIdentifier:
    Type: String  # Redshift Clusterの識別子（NestedStackでRedshift作成Stackの結果から設定してもよい）
  CronPattern:
    Type: String
    Default: 00 09 * * ? *  # 毎日PM18(JST)にイベント実行
  EventInitState:
    Type: String
    Default: DISABLED  # Cfnで作成したイベントの初期ステータス

Resources:
# Execution Role 
  AutomationAssumeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            Service: 
              - ssm.amazonaws.com
              - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole
      Policies:
        - PolicyName: CmDwhTestSSMAtomationPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:StartInstances
                  - ec2:StopInstances
                  - ec2:DescribeInstanceStatus
                Resource: 
                - !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
              - Effect: Allow
                Action:
                - tag:GetResources 
                Resource: 
                - "*"
              - Effect: Allow
                Action:
                  - redshift:PauseCluster
                  - redshift:ResumeCluster
                Resource: 
                - !Sub "arn:aws:redshift:ap-northeast-1:${AWS::AccountId}:cluster:${ClusterIdentifier}"     
              - Effect: Allow
                Action:
                  - redshift:DescribeClusters
                Resource: 
                - !Sub "arn:aws:redshift:ap-northeast-1:${AWS::AccountId}:cluster:*"               
              - Effect: Allow
                Action: iam:PassRole
                Resource:
                - !Sub "arn:aws:iam::${AWS::AccountId}:role/SSMAtomationRole"
                Condition:
                  StringLikeIfExists:
                    iam:PassedToService: ssm.amazonaws.com
      Path: "/"
      RoleName: SSMAtomationRole
      Tags:
        - Key: Name
          Value: SSMAutomationRole

# SSM Document
  StopSSMDocument:
    Type: AWS::SSM::Document
    Properties:
      Name: Stop-InstanceAndRedshiftCluster  # 任意の名前
      DocumentFormat: YAML
      DocumentType: Automation  # Automation実行用の場合
      Content:
        schemaVersion: "0.3"  # DocumentTypeがAutomationの場合、2021/11時点では0.3を選択
        description: Stop Target Tag EC2Instance and Redshift
        assumeRole: !GetAtt AutomationAssumeRole.Arn
        parameters:  # Automation実行の入力パラメータ
          tagname:
            type: String
            default: !Ref TagKey   
        mainSteps:  # Automationで実行する内容（ステップ）
          - name: StopEC2Instances  # ステップ名
            action: aws:executeAwsApi
            inputs:
              Service: ssm
              Api: StartAutomationExecution
              DocumentName: AWS-StopEC2Instance  # AWSが用意しているAutomation RunBookの呼び出し
              TargetParameterName: InstanceId
              Targets:
                - Key: 'tag:{{ tagname }}'
                  Values: 
                    - 'true'  #「AutoStop」タグの値がtrueのインスタンスを停止対象とする
          - name: RedshiftStatusCheck  
            # Redshiftのステータス確認（pause状態でpause実行するとエラーになるため）
            action: aws:executeAwsApi
            inputs:
              Service: redshift
              Api: DescribeClusters
              ClusterIdentifier: !Ref ClusterIdentifier
            outputs:
              - Name: status
                Selector: $.Clusters[0].ClusterAvailabilityStatus
                Type: String
          - name: ChoiceStopOrExit
            action: aws:branch  # 条件分岐のアクション
            inputs:
              Choices: # 条件に一致したNextStepを実行。一致がなければDefaultを実行
              - NextStep: StopRedshiftCluster
                Variable: "{{RedshiftStatusCheck.status}}"
                StringEquals: Available   # Statusがavailableの場合このNextStepを実行
              Default: 
                sleepActionForSkip
          - name: sleepActionForSkip # 終了のためのダミーStep
            action: aws:sleep
            inputs:
              Duration: PT10S
            isEnd: true
          - name: StopRedshiftCluster 
            action: aws:executeAwsApi
            inputs:
              Service: redshift
              Api: PauseCluster
              ClusterIdentifier: !Ref ClusterIdentifier
            outputs:
              - Name: Response
                Selector: $
                Type: StringMap
      Tags:
        - Key: Name
          Value: "stop-ssm-docs"

  StartSSMDocument:
    Type: AWS::SSM::Document
    Properties:
      Name: "Start-InstanceAndRedshiftCluster"
      DocumentFormat: YAML
      DocumentType: Automation
      Content:
        schemaVersion: "0.3"
        description: Start Target Tag EC2Instance and Redshift
        assumeRole: !GetAtt AutomationAssumeRole.Arn
        parameters:
          tagname:
            type: String
            default: !Ref TagKey
        mainSteps:
          - name: StartEC2Instance
            action: aws:executeAwsApi
            inputs:
              Service: ssm
              Api: StartAutomationExecution
              DocumentName: AWS-StartEC2Instance
              TargetParameterName: InstanceId
              Targets:
                - Key: 'tag:{{ tagname }}'
                  Values: 
                    - 'true'
          - name: RedshiftStatusCheck
            action: aws:executeAwsApi
            inputs:
              Service: redshift
              Api: DescribeClusters
              ClusterIdentifier: !Ref ClusterIdentifier
            outputs:
              - Name: status
                Selector: $.Clusters[0].ClusterStatus
                Type: String
          - name: ChoiceStopOrExit
            action: aws:branch
            inputs:
              Choices:
              - NextStep: StartRedshiftCluster
                Variable: "{{RedshiftStatusCheck.status}}"
                StringEquals: paused
              Default: 
                sleepActionForSkip
          - name: sleepActionForSkip #終了のためのダミーStep
            action: aws:sleep
            inputs:
              Duration: PT10S
            isEnd: true
          - name: StartRedshiftCluster
            action: aws:executeAwsApi
            inputs:
              Service: redshift
              Api: ResumeCluster
              ClusterIdentifier: !Ref ClusterIdentifier
            outputs:
              - Name: Response
                Selector: $
                Type: StringMap
      Tags:
        - Key: Name
          Value: "start-ssm-docs"

# Event
  StopAutomationEvent:
    Type: AWS::Events::Rule
    Properties:
      Name: "StopAutomationEvent"
      ScheduleExpression: !Sub 'cron(${CronPattern})'
      State: !Ref EventInitState
      Targets:
        - Arn: !Sub "arn:aws:ssm:ap-northeast-1:${AWS::AccountId}:automation-definition/${StopSSMDocument}:$DEFAULT"
          Id: TargetStopRedshiftAndEC2Instance
          RoleArn: !GetAtt AutomationAssumeRole.Arn

Outputs:
  StopSSMDocument:
    Value: !Sub "https://ap-northeast-1.console.aws.amazon.com/systems-manager/documents/${StopSSMDocument}/description?region=ap-northeast-1"
  StartSSMDocument:
    Value: !Sub "https://ap-northeast-1.console.aws.amazon.com/systems-manager/documents/${StartSSMDocument}/description?region=ap-northeast-1"