Terraformの実行環境を、CFnでゼロから構築してみた！

AWSTemplateFormatVersion: "2010-09-09"
Description: Terraform execution environment on EC2 (Session Manager access, tfstate on S3). For verification use only.

Parameters:
  ProjectName:
    Type: String
    Default: tf-lab
    AllowedPattern: "^[a-z0-9][a-z0-9-]{1,18}[a-z0-9]$"
    Description: Lowercase letters, digits and hyphens (3-20 chars). Used for resource names and the S3 bucket names.
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  InstanceType:
    Type: String
    Default: t3.small
    AllowedValues: [t3.micro, t3.small, t3.medium]
    Description: The AWS provider needs memory, so t3.small (2GiB) or larger is recommended.
  TerraformVersion:
    Type: String
    Default: latest
    Description: "latest, or an exact version available in the HashiCorp repo (e.g. 1.16.5)."

Conditions:
  UseLatestTerraform: !Equals [!Ref TerraformVersion, latest]

Resources:
  # ---------------- Network (one public subnet, no NAT, no inbound) ----------------
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-vpc" }

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-igw" }

  IgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.0.0.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: true
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-public-subnet" }

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-public-rt" }

  PublicDefaultRoute:
    Type: AWS::EC2::Route
    DependsOn: IgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Terraform server (no inbound; access via Session Manager only)
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-sg" }

  # ---------------- tfstate bucket (managed by CloudFormation, not by Terraform) ----------------
  StateBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName: !Sub "${ProjectName}-tfstate-${AWS::AccountId}-${AWS::Region}"
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # ---------------- IAM ----------------
  TerraformRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: { Service: ec2.amazonaws.com }
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: terraform-state-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:ListBucket
                Resource: !GetAtt StateBucket.Arn
              # State file and the lock file (use_lockfile = true creates <key>.tflock)
              - Effect: Allow
                Action: [s3:GetObject, s3:PutObject, s3:DeleteObject]
                Resource: !Sub "${StateBucket.Arn}/*"
        - PolicyName: terraform-sample-s3-only
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Verification only: Terraform may manage buckets named <ProjectName>-sample-* and nothing else
              - Effect: Allow
                Action: s3:*
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${ProjectName}-sample-*"
                  - !Sub "arn:${AWS::Partition}:s3:::${ProjectName}-sample-*/*"
              - Effect: Allow
                Action: [s3:ListAllMyBuckets, s3:GetBucketLocation]
                Resource: "*"

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles: [!Ref TerraformRole]

  # ---------------- EC2 ----------------
  TerraformInstance:
    Type: AWS::EC2::Instance
    DependsOn: PublicDefaultRoute
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT15M
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      MetadataOptions:
        HttpTokens: required
        HttpEndpoint: enabled
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp3
            VolumeSize: 20
            Encrypted: true
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: true
          SubnetId: !Ref PublicSubnet
          GroupSet: [!Ref InstanceSecurityGroup]
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-terraform-server" }
      UserData:
        Fn::Base64:
          !Sub
            - |
              #!/bin/bash
              set -Eeuxo pipefail
              signal() { /opt/aws/bin/cfn-signal -e $1 --stack ${AWS::StackName} --resource TerraformInstance --region ${AWS::Region}; }
              trap 'signal 1' ERR

              # ---- 1. Install Terraform from the HashiCorp repository ----
              dnf install -y yum-utils git
              yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo
              dnf install -y ${TfPackage}

              # ---- 2. Working directory for the ssm-user (Session Manager login user) ----
              id ssm-user || useradd -m ssm-user
              WORKDIR=/home/ssm-user/tf-lab
              mkdir -p $WORKDIR

              cat > $WORKDIR/backend.tf <<'TFEOF'
              terraform {
                backend "s3" {
                  bucket       = "${StateBucket}"
                  key          = "sample/terraform.tfstate"
                  region       = "${AWS::Region}"
                  encrypt      = true
                  use_lockfile = true
                }
              }
              TFEOF

              cat > $WORKDIR/main.tf <<'TFEOF'
              terraform {
                required_providers {
                  aws = {
                    source  = "hashicorp/aws"
                    version = "~> 6.0"
                  }
                }
              }

              provider "aws" {
                region = "${AWS::Region}"
              }

              data "aws_caller_identity" "current" {}

              # A sample resource: one private S3 bucket (name must start with <ProjectName>-sample- to match the IAM policy)
              resource "aws_s3_bucket" "sample" {
                bucket = format("${ProjectName}-sample-%s", data.aws_caller_identity.current.account_id)

                tags = {
                  ManagedBy = "terraform"
                }
              }

              resource "aws_s3_bucket_public_access_block" "sample" {
                bucket                  = aws_s3_bucket.sample.id
                block_public_acls       = true
                block_public_policy     = true
                ignore_public_acls      = true
                restrict_public_buckets = true
              }

              output "sample_bucket_name" {
                value = aws_s3_bucket.sample.bucket
              }
              TFEOF

              chown -R ssm-user:ssm-user /home/ssm-user/tf-lab
              terraform version
              signal 0
            - TfPackage: !If [UseLatestTerraform, terraform, !Sub "terraform-${TerraformVersion}"]

Outputs:
  InstanceId:
    Description: Terraform server (connect with Session Manager)
    Value: !Ref TerraformInstance
  InstanceConsoleUrl:
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2/home?region=${AWS::Region}#InstanceDetails:instanceId=${TerraformInstance}"
  StateBucketName:
    Description: S3 bucket that stores the tfstate (managed by this stack)
    Value: !Ref StateBucket
  SampleBucketName:
    Description: Name of the sample bucket Terraform will create
    Value: !Sub "${ProjectName}-sample-${AWS::AccountId}"