resource "aws_iam_user" "main" {
  name = "cloudwatch-agent-homeserver-user"
}

resource "aws_iam_access_key" "main" {
  user = aws_iam_user.main.name
}

resource "aws_iam_user_policy_attachment" "main" {
  user       = aws_iam_user.main.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
}

resource "aws_ssm_parameter" "secret" {
  name        = "AmazonCloudWatch-HomeServer-Config"
  type        = "String"
  value       = file("${path.module}/amazon-cloudwatch-agent.json")
}

output "iam_user_access_key_id" {
  value = aws_iam_access_key.main.id
  sensitive = true
}

output "iam_user_access_key_secret" {
  value = aws_iam_access_key.main.secret
  sensitive = true
}

{
	"agent": {
		"metrics_collection_interval": 60,
		"run_as_user": "root"
	},
	"logs": {
		"logs_collected": {
			"files": {
				"collect_list": [
					{
						"file_path": "/var/log/syslog",
						"log_group_name": "/var/log/syslog",
						"log_stream_name": "{hostname}"
					}
				]
			}
		}
	},
	"metrics": {
		"metrics_collected": {
			"cpu": {
				"measurement": [
					"cpu_usage_idle",
					"cpu_usage_iowait",
					"cpu_usage_steal",
					"cpu_usage_guest",
					"cpu_usage_user",
					"cpu_usage_system"
				],
				"resources": [
					"*"
				],
				"totalcpu": true
			},
			"disk": {
				"measurement": [
					"used_percent"
				],
				"resources": [
					"*"
				]
			},
			"diskio": {
				"measurement": [
					"io_time",
					"write_bytes",
					"read_bytes",
					"writes",
					"reads"
				],
				"resources": [
					"*"
				]
			},
			"mem": {
				"measurement": [
                    "mem_used",
                    "mem_cached",
                    "mem_total"
				]
			}
		}
	}
}

terraform apply;

terraform output -json;

[default]
aws_access_key_id = XXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXX

[AmazonCloudWatchAgent]
aws_access_key_id = XXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXX

---
# AWSクレデンシャル情報
aws_region: "ap-northeast-1"
iam_user_access_key_id: "XXXXXXXXXXX"  # TerraformのoutputからIAMアクセスキーIDを取得
iam_user_access_key_secret: "XXXXXXXXXXX"  # TerraformのoutputからIAMシークレットアクセスキーを取得

# サーバー接続設定
ansible_user: user  # サーバーのユーザー名
ansible_ssh_private_key_file: ~/.ssh/key_name  # SSH秘密鍵のパス
ansible_become_pass: password  # sudoパスワード

---
- name: Setup AWS credentials for CloudWatch Agent
  hosts: home_servers
  become: true

  tasks:
    - name: Create .aws directory if it doesn't exist
      ansible.builtin.file:
        path: /root/.aws
        state: directory
        mode: '0700'
        owner: root
        group: root

    - name: Check if AmazonCloudWatchAgent section already exists
      ansible.builtin.lineinfile:
        path: /root/.aws/credentials
        regexp: '^\[AmazonCloudWatchAgent\]'
        state: absent
      check_mode: true
      register: cloudwatch_section_check
      changed_when: false

    - name: Add AmazonCloudWatchAgent credentials section
      ansible.builtin.blockinfile:
        path: /root/.aws/credentials
        create: true
        mode: '0600'
        owner: root
        group: root
        marker: "# {mark} ANSIBLE MANAGED BLOCK - AmazonCloudWatchAgent"
        block: |
          [AmazonCloudWatchAgent]
          region = {{ aws_region }}
          aws_access_key_id = {{ iam_user_access_key_id }}
          aws_secret_access_key = {{ iam_user_access_key_secret }}
      when: cloudwatch_section_check.found == 0

ansible-playbook -i inventory.ini aws_credentials_setup.yml -v;

aws ssm send-command \
  --document-name "AWS-ConfigureAWSPackage" \
  --comment "Install CloudWatch Agent" \
  --targets "Key=InstanceIds,Values=$(aws ssm describe-instance-information \
    --query "join(',', InstanceInformationList[?starts_with(InstanceId, 'mi-')].InstanceId)" \
    --output text)" \
  --parameters '{"action":["Install"],"name":["AmazonCloudWatchAgent"],"version":["latest"]}' \
  --region ap-northeast-1

aws ssm list-command-invocations \
  --command-id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX \
  --output json | jq -r '.CommandInvocations[] | "\(.InstanceId)\t\(.Status)"'

aws ssm send-command \
  --document-name "AmazonCloudWatch-ManageAgent" \
  --comment "Configure CloudWatch Agent with predefined config" \
  --targets "Key=InstanceIds,Values=$(aws ssm describe-instance-information \
    --query "join(',', InstanceInformationList[?starts_with(InstanceId, 'mi-')].InstanceId)" \
    --output text)" \
  --parameters '{
    "action": ["configure"],
    "mode": ["onPremise"],
    "optionalConfigurationSource": ["ssm"],
    "optionalConfigurationLocation": ["AmazonCloudWatch-HomeServer-Config"]
  }' \
  --region ap-northeast-1

aws ssm list-command-invocations \
  --command-id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX \
  --output json | jq -r '.CommandInvocations[] | "\(.InstanceId)\t\(.Status)"'

variable "hosts" {
  default = ["server-01", "server-02", "server-03", "server-04", "server-05", "server-06"]
}

resource "aws_cloudwatch_metric_alarm" "mem_used_alarm" {
  for_each = toset(var.hosts)

  alarm_name          = "mem_used_${each.key}"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "mem_used"
  namespace           = "CWAgent"
  period              = 60
  statistic           = "Average"
  threshold           = 2e+09
  alarm_description   = "Memory usage alarm for ${each.key}"
  dimensions = {
    host = each.key
  }
  actions_enabled     = false
}

terraform apply;

python3 -c "a = bytearray(2 * 1024**3); input('Press Enter to free memory...')"

aws ssm send-command \
  --document-name "AWS-ConfigureAWSPackage" \
  --comment "Uninstall CloudWatch Agent" \
  --targets "Key=InstanceIds,Values=$(aws ssm describe-instance-information \
    --query "join(',', InstanceInformationList[?starts_with(InstanceId, 'mi-')].InstanceId)" \
    --output text)" \
  --parameters '{"action":["Uninstall"],"name":["AmazonCloudWatchAgent"],"version":["latest"]}' \
  --region ap-northeast-1

---
- name: Remove AWS credentials for CloudWatch Agent
  hosts: home_servers
  become: true

  tasks:
    - name: Remove AmazonCloudWatchAgent credentials section
      ansible.builtin.blockinfile:
        path: /root/.aws/credentials
        marker: "# {mark} ANSIBLE MANAGED BLOCK - AmazonCloudWatchAgent"
        state: absent

ansible-playbook -i inventory.ini aws_credentials_remove.yml -v;

terraform destroy;