AWS Management Console Private Accessの閉域アクセスを検証し、DNS設定でPublic/Privateを使い分ける方法を確認してみた

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.51"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}

data "aws_caller_identity" "current" {}
data "aws_availability_zones" "available" { state = "available" }

locals {
  azs = slice(data.aws_availability_zones.available.names, 0, 2)
}

#########################
# 東京リージョン: VPC
#########################

resource "aws_vpc" "main" {
  cidr_block           = "172.16.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet("172.16.0.0/16", 8, count.index + 1)
  availability_zone = local.azs[count.index]
}

resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet("172.16.0.0/16", 8, 100)
  availability_zone = local.azs[0]
}

#########################
# Internet Gateway + NAT Gateway
#########################

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route" "public_internet" {
  route_table_id         = aws_route_table.public.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.main.id
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_eip" "nat" {
  domain = "vpc"
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public.id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route" "private_nat" {
  route_table_id         = aws_route_table.private.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.main.id
}

resource "aws_route_table_association" "private" {
  count          = 2
  subnet_id      = aws_subnet.private[count.index].id
  route_table_id = aws_route_table.private.id
}

#########################
# Security Groups
#########################

resource "aws_security_group" "vpce" {
  name_prefix = "console-private-access-vpce-"
  description = "Allow TLS from VPC for VPC Endpoints"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["172.16.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "ec2" {
  name_prefix = "console-private-access-ec2-"
  description = "EC2 instance SG"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "RDP from VPC"
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["172.16.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

#########################
# VPC Endpoints - Console Private Access
#########################

resource "aws_vpc_endpoint" "console" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.console"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "*"
      Resource  = "*"
    }]
  })
}

resource "aws_vpc_endpoint" "signin" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.signin"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "signin:*"
      Resource  = "*"
    }]
  })
}

resource "aws_vpc_endpoint" "console_static" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.console-static"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

#########################
# VPC Endpoints - SSM (Fleet Manager RDP接続用)
#########################

resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.ssm"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

resource "aws_vpc_endpoint" "ssmmessages" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.ssmmessages"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

resource "aws_vpc_endpoint" "ec2messages" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.ec2messages"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

#########################
# VPC Endpoints - S3 (Gateway + Interface)
#########################

resource "aws_vpc_endpoint" "s3_gateway" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.ap-northeast-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

resource "aws_vpc_endpoint" "s3_interface" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.s3"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  dns_options {
    private_dns_only_for_inbound_resolver_endpoint = true
  }
}

#########################
# VPC Endpoints - その他サービス
#########################

resource "aws_vpc_endpoint" "kms" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.kms"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

resource "aws_vpc_endpoint" "ec2" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.ec2"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

resource "aws_vpc_endpoint" "monitoring" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.monitoring"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.ap-northeast-1.logs"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
}

#########################
# EC2 Instance (Windows Server - Fleet Manager RDP)
#########################

data "aws_ssm_parameter" "windows_ami" {
  name = "/aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base"
}

resource "aws_iam_role" "ec2" {
  name = "console-private-access-ec2-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.ec2.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "ec2" {
  name = "console-private-access-ec2-profile"
  role = aws_iam_role.ec2.name
}

resource "aws_instance" "windows" {
  ami                    = data.aws_ssm_parameter.windows_ami.value
  instance_type          = "m5.large"
  subnet_id              = aws_subnet.private[0].id
  iam_instance_profile   = aws_iam_instance_profile.ec2.name
  vpc_security_group_ids = [aws_security_group.ec2.id]

  metadata_options {
    http_tokens = "required"
  }

  root_block_device {
    volume_size = 50
    encrypted   = true
  }
}

#########################
# us-east-1: VPC + VPCエンドポイント
#########################

data "aws_availability_zones" "us_east_1" {
  provider = aws.us_east_1
  state    = "available"
}

resource "aws_vpc" "us_east_1" {
  provider             = aws.us_east_1
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_subnet" "us_east_1_private" {
  count             = 2
  provider          = aws.us_east_1
  vpc_id            = aws_vpc.us_east_1.id
  cidr_block        = cidrsubnet("10.0.0.0/16", 8, count.index + 1)
  availability_zone = data.aws_availability_zones.us_east_1.names[count.index]
}

resource "aws_route_table" "us_east_1_private" {
  provider = aws.us_east_1
  vpc_id   = aws_vpc.us_east_1.id
}

resource "aws_route_table_association" "us_east_1_private" {
  count          = 2
  provider       = aws.us_east_1
  subnet_id      = aws_subnet.us_east_1_private[count.index].id
  route_table_id = aws_route_table.us_east_1_private.id
}

resource "aws_security_group" "us_east_1_vpce" {
  provider    = aws.us_east_1
  name_prefix = "console-private-access-us-east-1-vpce-"
  description = "Allow TLS from peered VPCs"
  vpc_id      = aws_vpc.us_east_1.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16", "172.16.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_vpc_endpoint" "us_east_1_console" {
  provider            = aws.us_east_1
  vpc_id              = aws_vpc.us_east_1.id
  service_name        = "com.amazonaws.us-east-1.console"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.us_east_1_private[*].id
  security_group_ids  = [aws_security_group.us_east_1_vpce.id]
}

resource "aws_vpc_endpoint" "us_east_1_signin" {
  provider            = aws.us_east_1
  vpc_id              = aws_vpc.us_east_1.id
  service_name        = "com.amazonaws.us-east-1.signin"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.us_east_1_private[*].id
  security_group_ids  = [aws_security_group.us_east_1_vpce.id]
}

resource "aws_vpc_endpoint" "us_east_1_console_static" {
  provider            = aws.us_east_1
  vpc_id              = aws_vpc.us_east_1.id
  service_name        = "com.amazonaws.us-east-1.console-static"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.us_east_1_private[*].id
  security_group_ids  = [aws_security_group.us_east_1_vpce.id]
}

resource "aws_vpc_endpoint" "us_east_1_s3_gateway" {
  provider          = aws.us_east_1
  vpc_id            = aws_vpc.us_east_1.id
  service_name      = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.us_east_1_private.id]
}

resource "aws_vpc_endpoint" "us_east_1_s3" {
  depends_on          = [aws_vpc_endpoint.us_east_1_s3_gateway]
  provider            = aws.us_east_1
  vpc_id              = aws_vpc.us_east_1.id
  service_name        = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
  subnet_ids          = aws_subnet.us_east_1_private[*].id
  security_group_ids  = [aws_security_group.us_east_1_vpce.id]
}

#########################
# VPCピアリング（東京 ↔ us-east-1）
#########################

resource "aws_vpc_peering_connection" "tokyo_to_us_east_1" {
  vpc_id      = aws_vpc.main.id
  peer_vpc_id = aws_vpc.us_east_1.id
  peer_region = "us-east-1"
  auto_accept = false
}

resource "aws_vpc_peering_connection_accepter" "us_east_1" {
  provider                  = aws.us_east_1
  vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_to_us_east_1.id
  auto_accept               = true
}

resource "aws_route" "tokyo_to_us_east_1" {
  route_table_id            = aws_route_table.private.id
  destination_cidr_block    = "10.0.0.0/16"
  vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_to_us_east_1.id
  depends_on                = [aws_vpc_peering_connection_accepter.us_east_1]
}

resource "aws_route" "us_east_1_to_tokyo" {
  provider                  = aws.us_east_1
  route_table_id            = aws_route_table.us_east_1_private.id
  destination_cidr_block    = "172.16.0.0/16"
  vpc_peering_connection_id = aws_vpc_peering_connection.tokyo_to_us_east_1.id
  depends_on                = [aws_vpc_peering_connection_accepter.us_east_1]
}

#########################
# Route 53 Private Hosted Zone
#########################

resource "aws_route53_zone" "s3_us_east_1" {
  name = "s3.us-east-1.amazonaws.com"

  vpc {
    vpc_id     = aws_vpc.main.id
    vpc_region = "ap-northeast-1"
  }
}

resource "aws_route53_record" "s3_us_east_1" {
  zone_id = aws_route53_zone.s3_us_east_1.zone_id
  name    = "s3.us-east-1.amazonaws.com"
  type    = "A"

  alias {
    name                   = aws_vpc_endpoint.us_east_1_s3.dns_entry[0].dns_name
    zone_id                = aws_vpc_endpoint.us_east_1_s3.dns_entry[0].hosted_zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_zone" "account_us_east_1" {
  name = "account.us-east-1.api.aws"

  vpc {
    vpc_id     = aws_vpc.main.id
    vpc_region = "ap-northeast-1"
  }
}

resource "aws_route53_zone" "freetier_us_east_1" {
  name = "freetier.us-east-1.api.aws"

  vpc {
    vpc_id     = aws_vpc.main.id
    vpc_region = "ap-northeast-1"
  }
}