[アップデート] Amazon Bedrock AgentCore Gatewayがプライベート認証局（CA）の証明書に対応したので、VPC内のMCPサーバーに接続してみた

#!/usr/bin/env bash
# 検証用の証明書を certs/ に作る（OpenSSL 3.x）
set -euo pipefail
HOST=mcp.internal.example.com
mkdir -p certs && cd certs

# プライベートCA：basicConstraintsをCA:TRUEにして自己署名する
openssl genrsa -out ca.key 2048
openssl req -x509 -new -key ca.key -sha256 -days 3650 \
  -subj "/CN=Demo Private CA" \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign" \
  -out ca.pem

# サーバー証明書：SANに接続先ホスト名を入れ、CAで署名する
openssl genrsa -out server.key 2048
openssl req -new -key server.key -subj "/CN=$HOST" -out server.csr
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
  -days 365 -sha256 \
  -extfile <(printf "subjectAltName=DNS:%s\nbasicConstraints=CA:FALSE\nextendedKeyUsage=serverAuth\n" "$HOST") \
  -out server.pem

# ---- おまけ：プライベートAPI Gatewayのカスタムドメイン用 ----
API_HOST=api.internal.example.com
openssl genrsa -out api.key 2048
openssl req -new -key api.key -subj "/CN=$API_HOST" -out api.csr
openssl x509 -req -in api.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
  -days 365 -sha256 \
  -extfile <(printf "subjectAltName=DNS:%s\nbasicConstraints=CA:FALSE\nextendedKeyUsage=serverAuth\nkeyUsage=critical,digitalSignature,keyEncipherment\n" "$API_HOST") \
  -out api.pem

# /// script
# requires-python = ">=3.14,<3.15"
# dependencies = ["mcp==1.30.0"]
# ///
import os
import socket

import uvicorn
from mcp.server.fastmcp import FastMCP

# 0.0.0.0 を指定すると、Hostヘッダーの制限（DNSリバインディング対策）が自動では有効にならない
mcp = FastMCP("private-tls-demo", host="0.0.0.0", stateless_http=True, json_response=True)

@mcp.tool()
def whoami() -> str:
    """このMCPサーバーが動いているホスト名を返す"""
    return f"hello from {socket.gethostname()}"

if __name__ == "__main__":
    uvicorn.run(
        mcp.streamable_http_app(),
        host="0.0.0.0",
        port=int(os.environ.get("PORT", "443")),
        ssl_certfile=os.environ.get("CERT", "server.pem"),
        ssl_keyfile=os.environ.get("KEY", "server.key"),
    )

import * as fs from 'fs';
import * as path from 'path';
import * as cdk from 'aws-cdk-lib/core';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as route53 from 'aws-cdk-lib/aws-route53';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import { Construct } from 'constructs';

const CERTS = path.join(__dirname, '../../certs');
const read = (name: string) => fs.readFileSync(path.join(CERTS, name), 'utf8');

export class Ec2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // パブリックサブネット（NAT用）と、MCPサーバーを置くプライベートサブネット
    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        { name: 'public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
        { name: 'private', subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
      ],
    });

    // Gateway（VPC Lattice）が作るENIに付けるSG
    const latticeSg = new ec2.SecurityGroup(this, 'LatticeSg', { vpc, allowAllOutbound: true });

    // MCPサーバーは、リソースゲートウェイのENIからの443だけを受け付ける
    const serverSg = new ec2.SecurityGroup(this, 'ServerSg', { vpc, allowAllOutbound: true });
    serverSg.addIngressRule(latticeSg, ec2.Port.tcp(443));

    // サーバー証明書・MCPサーバーのコードと、Gatewayが参照するCA証明書のPEM
    const bucket = new s3.Bucket(this, 'Bucket', {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });
    const serverFiles = new s3deploy.BucketDeployment(this, 'ServerFiles', {
      destinationBucket: bucket,
      destinationKeyPrefix: 'server',
      sources: [
        s3deploy.Source.data('server.pem', read('server.pem')),
        s3deploy.Source.data('server.key', read('server.key')),
        s3deploy.Source.asset(path.join(__dirname, '../..'), { exclude: ['*', '!server.py'] }),
      ],
    });
    // Gatewayが参照するCA証明書のPEM
    new s3deploy.BucketDeployment(this, 'CaFiles', {
      destinationBucket: bucket,
      destinationKeyPrefix: 'ca',
      sources: [s3deploy.Source.data('private-ca.pem', read('ca.pem'))],
    });

    // MCPサーバー（起動時にS3から証明書とコードを取得し、systemdで起動する）
    const role = new iam.Role(this, 'ServerRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')],
    });
    bucket.grantRead(role, 'server/*');
    const userData = ec2.UserData.forLinux();
    userData.addCommands(
      'set -euxo pipefail',
      'mkdir -p /opt/mcp && cd /opt/mcp',
      `aws s3 cp s3://${bucket.bucketName}/server/ . --recursive`,
      'chmod 600 server.key',
      'export HOME=/root',
      'curl -LsSf https://astral.sh/uv/0.9.26/install.sh | sh',
      `cat > /etc/systemd/system/mcp.service <<'UNIT'
[Unit]
Description=Private MCP server
After=network-online.target
[Service]
WorkingDirectory=/opt/mcp
Environment=HOME=/root
ExecStart=/root/.local/bin/uv run server.py
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
UNIT`,
      'systemctl daemon-reload',
      'systemctl enable --now mcp',
    );
    const server = new ec2.Instance(this, 'Server', {
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, availabilityZones: [vpc.availabilityZones[0]] },
      instanceType: new ec2.InstanceType('t4g.small'),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({ cpuType: ec2.AmazonLinuxCpuType.ARM_64 }),
      securityGroup: serverSg,
      role,
      userData,
    });
    server.node.addDependency(serverFiles);

    // VPC内だけで名前解決できるドメイン
    const zone = new route53.PrivateHostedZone(this, 'Zone', { zoneName: 'internal.example.com', vpc });
    new route53.ARecord(this, 'McpRecord', {
      zone,
      recordName: 'mcp',
      target: route53.RecordTarget.fromIpAddresses(server.instancePrivateIp),
      ttl: cdk.Duration.seconds(60),
    });

    // Gatewayのサービスロール（CA証明書の読み取り）
    const gatewayRole = new iam.Role(this, 'GatewayRole', {
      assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com', {
        conditions: {
          StringEquals: { 'aws:SourceAccount': this.account },
          ArnLike: { 'aws:SourceArn': `arn:aws:bedrock-agentcore:${this.region}:${this.account}:gateway/*` },
        },
      }),
    });
    bucket.grantRead(gatewayRole, 'ca/*');
    gatewayRole.addToPolicy(
      new iam.PolicyStatement({
        actions: ['secretsmanager:GetSecretValue'],
        resources: [`arn:aws:secretsmanager:${this.region}:${this.account}:secret:gw-tls-demo-ca-*`],
      }),
    );

    // IAM認証のMCPゲートウェイ（ターゲットはCLIで登録する）
    const gateway = new agentcore.CfnGateway(this, 'Gateway', {
      name: 'private-tls-demo',
      protocolType: 'MCP',
      authorizerType: 'AWS_IAM',
      roleArn: gatewayRole.roleArn,
    });

    // ターゲット登録時に --private-endpoint へそのまま渡すJSON
    const privateEndpoint = {
      managedVpcResource: {
        vpcIdentifier: vpc.vpcId,
        subnetIds: vpc.privateSubnets.map((s) => s.subnetId),
        endpointIpAddressType: 'IPV4',
        securityGroupIds: [latticeSg.securityGroupId],
      },
    };

    new cdk.CfnOutput(this, 'GatewayId', { value: gateway.attrGatewayIdentifier });
    new cdk.CfnOutput(this, 'GatewayUrl', { value: gateway.attrGatewayUrl });
    new cdk.CfnOutput(this, 'PrivateEndpoint', { value: this.toJsonString(privateEndpoint) });
    new cdk.CfnOutput(this, 'BucketName', { value: bucket.bucketName });
    new cdk.CfnOutput(this, 'ServerInstanceId', { value: server.instanceId });
  }
}

#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib/core';
import { Ec2Stack } from '../lib/ec2-stack';
import { ApigwStack } from '../lib/apigw-stack';

const app = new cdk.App();
const env = { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'ap-northeast-1' };

// 本編：プライベートCAの証明書を使うMCPサーバー（EC2）
new Ec2Stack(app, 'GwTlsEc2', { env });

// おまけ：プライベートCAの証明書を付けたプライベートAPI Gateway
// ACMにインポートした証明書のARNを渡したときだけ作る（cdk deploy GwTlsApigw -c certificateArn=...）
const certificateArn = app.node.tryGetContext('certificateArn');
if (certificateArn) {
  new ApigwStack(app, 'GwTlsApigw', { env, certificateArn });
}

import * as path from 'path';
import * as cdk from 'aws-cdk-lib/core';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as apigw from 'aws-cdk-lib/aws-apigateway';
import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as route53 from 'aws-cdk-lib/aws-route53';
import * as targets from 'aws-cdk-lib/aws-route53-targets';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import { Construct } from 'constructs';

export interface ApigwStackProps extends cdk.StackProps {
  certificateArn: string;
}

const DOMAIN = 'api.internal.example.com';

export class ApigwStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: ApigwStackProps) {
    super(scope, id, props);

    // NATなしのプライベートサブネットだけのVPC
    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.1.0.0/16'),
      maxAzs: 2,
      natGateways: 0,
      subnetConfiguration: [{ name: 'private', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }],
    });

    // Gateway（VPC Lattice）が作るENIに付けるSG
    const latticeSg = new ec2.SecurityGroup(this, 'LatticeSg', { vpc, allowAllOutbound: true });

    // execute-apiのVPCエンドポイントは、リソースゲートウェイのENIからの443だけを受け付ける
    const vpceSg = new ec2.SecurityGroup(this, 'VpceSg', { vpc, allowAllOutbound: false });
    vpceSg.addIngressRule(latticeSg, ec2.Port.tcp(443));
    const vpce = vpc.addInterfaceEndpoint('ExecuteApi', {
      service: ec2.InterfaceVpcEndpointAwsService.APIGATEWAY,
      privateDnsEnabled: false,
      securityGroups: [vpceSg],
      open: false,
    });

    // VPCエンドポイント経由の呼び出しだけを許可するポリシー
    const fromVpce = new iam.PolicyDocument({
      statements: [
        new iam.PolicyStatement({
          principals: [new iam.AnyPrincipal()],
          actions: ['execute-api:Invoke'],
          resources: ['execute-api:/*'],
          conditions: { StringEquals: { 'aws:SourceVpce': vpce.vpcEndpointId } },
        }),
      ],
    });

    // Mock統合でJSONを返すだけのプライベートAPI
    const api = new apigw.RestApi(this, 'Api', {
      restApiName: 'gw-tls-private-api',
      endpointTypes: [apigw.EndpointType.PRIVATE],
      policy: fromVpce,
      deployOptions: { stageName: 'prod' },
    });
    api.root.addResource('hello').addMethod(
      'GET',
      new apigw.MockIntegration({
        requestTemplates: { 'application/json': '{"statusCode": 200}' },
        integrationResponses: [
          {
            statusCode: '200',
            responseTemplates: { 'application/json': '{"message": "hello from private API Gateway"}' },
          },
        ],
      }),
      { methodResponses: [{ statusCode: '200' }] },
    );

    // プライベートCAで署名した証明書を付けたプライベートなカスタムドメイン
    const domain = new apigw.CfnDomainNameV2(this, 'PrivateDomain', {
      domainName: DOMAIN,
      certificateArn: props.certificateArn,
      endpointConfiguration: { types: ['PRIVATE'] },
      securityPolicy: 'TLS_1_2',
      policy: fromVpce.toJSON(),
    });
    new apigw.CfnBasePathMappingV2(this, 'Mapping', {
      domainNameArn: domain.attrDomainNameArn,
      restApiId: api.restApiId,
      stage: api.deploymentStage.stageName,
    });
    new apigw.CfnDomainNameAccessAssociation(this, 'AccessAssociation', {
      domainNameArn: domain.attrDomainNameArn,
      accessAssociationSource: vpce.vpcEndpointId,
      accessAssociationSourceType: 'VPCE',
    });

    // VPC内だけで名前解決できるドメインを、VPCエンドポイントに向ける
    const zone = new route53.PrivateHostedZone(this, 'Zone', { zoneName: 'internal.example.com', vpc });
    new route53.ARecord(this, 'ApiRecord', {
      zone,
      recordName: DOMAIN,
      target: route53.RecordTarget.fromAlias(new targets.InterfaceVpcEndpointTarget(vpce)),
    });

    // Gatewayが参照するCA証明書のPEM
    const bucket = new s3.Bucket(this, 'CaBucket', {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });
    new s3deploy.BucketDeployment(this, 'CaPem', {
      destinationBucket: bucket,
      destinationKeyPrefix: 'ca',
      sources: [s3deploy.Source.asset(path.join(__dirname, '../../certs'), { exclude: ['*', '!ca.pem'] })],
    });
    // OpenAPIターゲットに渡すAPIの定義（serversにカスタムドメインを書く）
    new s3deploy.BucketDeployment(this, 'OpenApi', {
      destinationBucket: bucket,
      destinationKeyPrefix: 'openapi',
      sources: [s3deploy.Source.asset(path.join(__dirname, '../../openapi'))],
    });

    // Gatewayのサービスロール（CA証明書とOpenAPI定義の読み取り）
    const gatewayRole = new iam.Role(this, 'GatewayRole', {
      assumedBy: new iam.ServicePrincipal('bedrock-agentcore.amazonaws.com', {
        conditions: {
          StringEquals: { 'aws:SourceAccount': this.account },
          ArnLike: { 'aws:SourceArn': `arn:aws:bedrock-agentcore:${this.region}:${this.account}:gateway/*` },
        },
      }),
    });
    bucket.grantRead(gatewayRole, 'ca/*');
    bucket.grantRead(gatewayRole, 'openapi/*');

    // IAM認証のMCPゲートウェイ（ターゲットはCLIで登録する）
    const gateway = new agentcore.CfnGateway(this, 'Gateway', {
      name: 'private-tls-apigw',
      protocolType: 'MCP',
      authorizerType: 'AWS_IAM',
      roleArn: gatewayRole.roleArn,
    });

    // ターゲット登録時に --private-endpoint へそのまま渡すJSON
    const privateEndpoint = {
      managedVpcResource: {
        vpcIdentifier: vpc.vpcId,
        subnetIds: vpc.isolatedSubnets.map((s) => s.subnetId),
        endpointIpAddressType: 'IPV4',
        securityGroupIds: [latticeSg.securityGroupId],
      },
    };

    new cdk.CfnOutput(this, 'GatewayId', { value: gateway.attrGatewayIdentifier });
    new cdk.CfnOutput(this, 'GatewayUrl', { value: gateway.attrGatewayUrl });
    new cdk.CfnOutput(this, 'PrivateEndpoint', { value: this.toJsonString(privateEndpoint) });
    new cdk.CfnOutput(this, 'BucketName', { value: bucket.bucketName });
  }
}