provider "aws" {
  region = "ap-northeast-1"
}

# Amazon Linux 2023 AMI
data "aws_ami" "amazonlinux_2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023*-kernel-6.1-x86_64"]
  }
}

data "http" "ipv4_icanhazip" {
  url = "http://ipv4.icanhazip.com/"
}

locals {
  region_code  = "ap-northeast-1"
  az           = "ap-northeast-1a"
  vpc_cidr     = "10.0.0.0/16"
  subnet_cidr  = "10.0.1.0/24"
  name_prefix  = "CloudWatch-SELinux"
  current-ip   = chomp(data.http.ipv4_icanhazip.body)
  allowed-cidr = "${local.current-ip}/32"
}

# VPC - 東京
resource "aws_vpc" "main" {
  cidr_block = local.vpc_cidr

  tags = {
    Name = "${local.name_prefix}-VPC"
  }
}

# パブリックサブネット
resource "aws_subnet" "main" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = local.subnet_cidr
  availability_zone       = local.az
  map_public_ip_on_launch = true

  tags = {
    Name = "${local.name_prefix}-Public-Subnet"
  }
}

# インターネットゲートウェイ
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "${local.name_prefix}-IGW"
  }
}

# ルートテーブル
resource "aws_route_table" "main" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "${local.name_prefix}-Route-Table"
  }
}

# ルートテーブルの関連付け
resource "aws_route_table_association" "main" {
  subnet_id      = aws_subnet.main.id
  route_table_id = aws_route_table.main.id
}

# SSMとCloudWatchのためのIAMロール
resource "aws_iam_role" "main" {
  name = "SSMAndCloudWatchRoleForEC2"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = "SSMAndCloudWatchRoleForEC2"
  }
}

# SSMポリシーのアタッチ
resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.main.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# CloudWatch Agentポリシーのアタッチ
resource "aws_iam_role_policy_attachment" "cloudwatch_agent" {
  role       = aws_iam_role.main.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
}

# EC2インスタンスプロファイル
resource "aws_iam_instance_profile" "main" {
  name = "SSMAndCloudWatchInstanceProfile"
  role = aws_iam_role.main.name
}

# セキュリティグループ
resource "aws_security_group" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "${local.name_prefix}-SG"
  }
}

# セキュリティグループ 送信ルール
resource "aws_security_group_rule" "egress" {
  security_group_id = aws_security_group.main.id
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
}

# EC2インスタンス
resource "aws_instance" "main" {
  ami                    = data.aws_ami.amazonlinux_2023.id
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.main.id
  vpc_security_group_ids = [aws_security_group.main.id]
  iam_instance_profile   = aws_iam_instance_profile.main.name

  tags = {
    Name = "${local.name_prefix}-EC2"
  }
}

# インスタンス SSM接続コマンド
output "ssm_start_session" {
  value = "aws ssm start-session --target ${aws_instance.main.id}"
}

# インスタンス IPアドレス
output "instance_global_ip" {
  value = aws_instance.main.public_ip
}

{
  "agent": {
    "metrics_collection_interval": 60,
    "run_as_user": "root"
  },
  "metrics": {
    "namespace": "CustomMetrics",
    "metrics_collected": {
      "cpu": {
        "resources": [
          "*"
        ],
        "measurement": [
          "usage_idle",
          "usage_iowait",
          "usage_user",
          "usage_system"
        ],
        "totalcpu": true,
        "metrics_collection_interval": 60
      },
      "disk": {
        "resources": [
          "/",
          "/tmp"
        ],
        "measurement": [
          "used_percent",
          "inodes_free"
        ],
        "metrics_collection_interval": 60
      },
      "diskio": {
        "resources": [
          "*"
        ],
        "measurement": [
          "io_time",
          "write_bytes",
          "read_bytes",
          "writes",
          "reads"
        ],
        "metrics_collection_interval": 60
      },
      "mem": {
        "measurement": [
          "used_percent",
          "total",
          "available"
        ],
        "metrics_collection_interval": 60
      },
      "netstat": {
        "measurement": [
          "tcp_established",
          "tcp_time_wait"
        ],
        "metrics_collection_interval": 60
      },
      "swap": {
        "measurement": [
          "used_percent"
        ],
        "metrics_collection_interval": 60
      }
    },
    "append_dimensions": {
      "InstanceId": "${aws:InstanceId}"
    },
    "aggregation_dimensions": [
      ["InstanceId"]
    ]
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/cloud-init.log",
            "log_group_name": "cloud-init-logs",
            "log_stream_name": "{instance_id}-cloud-init",
            "retention_in_days": 7
          },
          {
            "file_path": "/var/log/dnf.log",
            "log_group_name": "dnf-logs",
            "log_stream_name": "{instance_id}-dnf",
            "retention_in_days": 7
          },
          {
            "file_path": "/var/log/cloud-init-output.log",
            "log_group_name": "cloud-init-output-logs",
            "log_stream_name": "{instance_id}-cloud-init-output",
            "retention_in_days": 7
          }
        ]
      }
    },
    "force_flush_interval": 15
  }
}