「rsync」を用いてデータ移行をする際のシンボリックリンク動作の検証まとめ

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as fsx from 'aws-cdk-lib/aws-fsx';
import * as iam from 'aws-cdk-lib/aws-iam';

export class DemoFsxOpenzfsEc2MigrationStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // VPC
    const vpc = new ec2.Vpc(this, 'FsxMigrationVpc', {
      ipAddresses: ec2.IpAddresses.cidr('192.168.0.0/24'),
      maxAzs: 1,
      natGateways: 0,
      restrictDefaultSecurityGroup: false,
      subnetConfiguration: [
        {
          cidrMask: 26,
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
    });

    // VPCエンドポイント用セキュリティグループ
    const vpcEndpointSg = new ec2.SecurityGroup(this, 'VpcEndpointSg', {
      vpc,
      description: 'Security group for VPC Endpoints',
      allowAllOutbound: true,
    });

    vpcEndpointSg.addIngressRule(
      ec2.Peer.ipv4(vpc.vpcCidrBlock),
      ec2.Port.tcp(443),
      'Allow HTTPS from VPC'
    );

    // SSM用VPCエンドポイント（SSM Agent 3.3.40.0以降は ssm と ssmmessages の2つでOK）
    vpc.addInterfaceEndpoint('SsmEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.SSM,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      securityGroups: [vpcEndpointSg],
    });

    vpc.addInterfaceEndpoint('SsmMessagesEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.SSM_MESSAGES,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      securityGroups: [vpcEndpointSg],
    });

    // S3ゲートウェイエンドポイント
    vpc.addGatewayEndpoint('S3Endpoint', {
      service: ec2.GatewayVpcEndpointAwsService.S3,
      subnets: [{ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }],
    });

    // アプリEC2用セキュリティグループ
    const appEc2Sg = new ec2.SecurityGroup(this, 'AppEc2Sg', {
      vpc,
      securityGroupName: 'app-ec2-sg',
      description: 'Security group for App EC2',
      allowAllOutbound: true,
    });

    // EC2ファイルサーバー用セキュリティグループ
    const ec2FileServerSg = new ec2.SecurityGroup(this, 'Ec2FileServerSg', {
      vpc,
      securityGroupName: 'ec2-fileserver-sg',
      description: 'Security group for EC2 File Server',
      allowAllOutbound: true,
    });

    // アプリEC2からファイルサーバーEC2へのNFSアクセス許可
    ec2FileServerSg.addIngressRule(appEc2Sg, ec2.Port.tcp(111), 'NFS RPC');
    ec2FileServerSg.addIngressRule(appEc2Sg, ec2.Port.tcp(2049), 'NFS');
    ec2FileServerSg.addIngressRule(appEc2Sg, ec2.Port.tcpRange(20001, 20003), 'NFS mount/status/lock');

    // FSx用セキュリティグループ
    const fsxSg = new ec2.SecurityGroup(this, 'FsxOpenzfsSg', {
      vpc,
      securityGroupName: 'fsx-openzfs-sg',
      description: 'Security group for FSx OpenZFS',
      allowAllOutbound: false,
    });

    // ファイルサーバーEC2からFSxへのNFSアクセス許可（rsync用）
    fsxSg.addIngressRule(ec2FileServerSg, ec2.Port.tcp(111), 'NFS RPC');
    fsxSg.addIngressRule(ec2FileServerSg, ec2.Port.tcp(2049), 'NFS');
    fsxSg.addIngressRule(ec2FileServerSg, ec2.Port.tcpRange(20001, 20003), 'NFS mount/status/lock');

    // アプリEC2からFSxへのNFSアクセス許可（移行後マウント用）
    fsxSg.addIngressRule(appEc2Sg, ec2.Port.tcp(111), 'NFS RPC');
    fsxSg.addIngressRule(appEc2Sg, ec2.Port.tcp(2049), 'NFS');
    fsxSg.addIngressRule(appEc2Sg, ec2.Port.tcpRange(20001, 20003), 'NFS mount/status/lock');

    // アプリEC2（Amazon Linux 2023）
    new ec2.Instance(this, 'AppEc2', {
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),
      securityGroup: appEc2Sg,
      role: new iam.Role(this, 'AppEc2Role', {
        assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        ],
      }),
      blockDevices: [
        {
          deviceName: '/dev/xvda',
          volume: ec2.BlockDeviceVolume.ebs(20, {
            volumeType: ec2.EbsDeviceVolumeType.GP3,
          }),
        },
      ],
    });

    // EC2ファイルサーバー（Amazon Linux 2023）
    new ec2.Instance(this, 'Ec2FileServer', {
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),
      securityGroup: ec2FileServerSg,
      role: new iam.Role(this, 'Ec2FileServerRole', {
        assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        ],
      }),
      blockDevices: [
        {
          deviceName: '/dev/xvda',
          volume: ec2.BlockDeviceVolume.ebs(20, {
            volumeType: ec2.EbsDeviceVolumeType.GP3,
          }),
        },
      ],
    });

    // FSx for OpenZFS
    new fsx.CfnFileSystem(this, 'FsxOpenzfs', {
      fileSystemType: 'OPENZFS',
      storageCapacity: 64,
      subnetIds: [vpc.isolatedSubnets[0].subnetId],
      securityGroupIds: [fsxSg.securityGroupId],
      openZfsConfiguration: {
        deploymentType: 'SINGLE_AZ_2',
        throughputCapacity: 160,
        rootVolumeConfiguration: {
          dataCompressionType: 'LZ4',
          nfsExports: [
            {
              clientConfigurations: [
                {
                  clients: '192.168.0.0/24',
                  options: ['rw','async', 'crossmnt', 'no_root_squash'],
                },
              ],
            },
          ],
        },
        automaticBackupRetentionDays: 0,
      },
      tags: [
        {
          key: 'Name',
          value: 'fsx-openzfs-migration',
        },
      ],
    });
  }
}