FSx for OpenZFSのストレージ容量使用率をパーセンテージでアラーム通知する

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as fsx from 'aws-cdk-lib/aws-fsx';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as sns from 'aws-cdk-lib/aws-sns';

export class DemoFsxStorageAlarmStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // VPC
    const vpc = new ec2.Vpc(this, 'FsxStorageAlarmVpc', {
      ipAddresses: ec2.IpAddresses.cidr('192.168.0.0/24'),
      maxAzs: 1,
      natGateways: 0,
      restrictDefaultSecurityGroup: false,
      subnetConfiguration: [
        {
          cidrMask: 26,
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
    });

    // VPCエンドポイント用セキュリティグループ
    const vpcEndpointSg = new ec2.SecurityGroup(this, 'VpcEndpointSg', {
      vpc,
      description: 'Security group for VPC Endpoints',
      allowAllOutbound: true,
    });

    vpcEndpointSg.addIngressRule(
      ec2.Peer.ipv4(vpc.vpcCidrBlock),
      ec2.Port.tcp(443),
      'Allow HTTPS from VPC'
    );

    // SSM用VPCエンドポイント
    vpc.addInterfaceEndpoint('SsmEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.SSM,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      securityGroups: [vpcEndpointSg],
    });

    vpc.addInterfaceEndpoint('SsmMessagesEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.SSM_MESSAGES,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      securityGroups: [vpcEndpointSg],
    });

    // S3ゲートウェイエンドポイント
    vpc.addGatewayEndpoint('S3Endpoint', {
      service: ec2.GatewayVpcEndpointAwsService.S3,
      subnets: [{ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }],
    });

    // EC2用セキュリティグループ
    const ec2Sg = new ec2.SecurityGroup(this, 'Ec2Sg', {
      vpc,
      securityGroupName: 'fsx-storage-alarm-ec2-sg',
      description: 'Security group for EC2',
      allowAllOutbound: true,
    });

    // FSx用セキュリティグループ
    const fsxSg = new ec2.SecurityGroup(this, 'FsxSg', {
      vpc,
      securityGroupName: 'fsx-storage-alarm-sg',
      description: 'Security group for FSx Storage Alarm',
      allowAllOutbound: false,
    });

    // EC2からのNFSアクセス許可
    fsxSg.addIngressRule(ec2Sg, ec2.Port.tcp(111), 'NFS RPC');
    fsxSg.addIngressRule(ec2Sg, ec2.Port.tcp(2049), 'NFS');
    fsxSg.addIngressRule(ec2Sg, ec2.Port.tcpRange(20001, 20003), 'NFS mount/status/lock');

    // FSx for OpenZFS（SINGLE_AZ_2 最小構成）
    const fileSystem = new fsx.CfnFileSystem(this, 'FsxOpenzfs', {
      fileSystemType: 'OPENZFS',
      storageCapacity: 64,
      subnetIds: [vpc.isolatedSubnets[0].subnetId],
      securityGroupIds: [fsxSg.securityGroupId],
      openZfsConfiguration: {
        deploymentType: 'SINGLE_AZ_2',
        throughputCapacity: 160,
        rootVolumeConfiguration: {
          dataCompressionType: 'LZ4',
          nfsExports: [
            {
              clientConfigurations: [
                {
                  clients: '192.168.0.0/24',
                  options: ['rw', 'async', 'crossmnt', 'no_root_squash'],
                },
              ],
            },
          ],
        },
        automaticBackupRetentionDays: 0,
      },
      tags: [
        {
          key: 'Name',
          value: 'fsx-storage-alarm',
        },
      ],
    });

    // EC2（Amazon Linux 2023 / SSM接続用）
    new ec2.Instance(this, 'Ec2', {
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),
      securityGroup: ec2Sg,
      role: new iam.Role(this, 'Ec2Role', {
        assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        ],
      }),
      blockDevices: [
        {
          deviceName: '/dev/xvda',
          volume: ec2.BlockDeviceVolume.ebs(20, {
            volumeType: ec2.EbsDeviceVolumeType.GP3,
          }),
        },
      ],
    });

    // SNSトピック（アラーム通知先 / サブスクリプション・アラーム設定はコンソールから）
    new sns.Topic(this, 'FsxStorageAlarmTopic', {
      topicName: 'fsx-storage-alarm-topic',
    });
  }
}