AWS Client VPN（相互認証）のハンズオンを試してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: "Prerequisites for AWS Client VPN Hands-on (Mutual Authentication)"

Parameters:
  Prefix:
    Type: String
    Default: "clientvpn-handson"

  VpcCidr:
    Type: String
    Default: "10.0.0.0/16"

  PrivateSubnetCidr:
    Type: String
    Default: "10.0.0.0/24"

  VpnClientCidr:
    Type: String
    Default: "10.10.0.0/22"
    Description: "CIDR block assigned to VPN clients. Must not overlap with VpcCidr."

  EC2InstanceAMI:
    Type: AWS::EC2::Image::Id
    Default: "ami-0b6e7ccaa7b93e898"
  EC2InstanceType:
    Type: String
    Default: "t3.nano"
  EC2InstanceVolumeType:
    Type: String
    Default: "gp3"
  EC2InstanceVolumeSize:
    Type: String
    Default: "8"

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-vpc

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PrivateSubnetCidr
      VpcId: !Ref Vpc
      AvailabilityZone:
        Fn::Select:
          - "0"
          - Fn::GetAZs: ""
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-private-subnet

  Ec2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${Prefix}-ec2-sg
      GroupDescription: !Sub ${Prefix}-ec2-sg
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - IpProtocol: icmp
          FromPort: -1
          ToPort: -1
          CidrIp: !Ref VpcCidr
          Description: "Allow ICMP from VPC CIDR (Client VPN uses source NAT, so source IP is VPN gateway ENI in VPC subnet)"
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-ec2-sg

  SsmVpcEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${Prefix}-ssm-endpoint-sg
      GroupDescription: !Sub ${Prefix}-ssm-endpoint-sg
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref Ec2SecurityGroup
          Description: "Allow HTTPS from EC2"
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-ssm-endpoint-sg

  SsmVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
      VpcId: !Ref Vpc
      SubnetIds:
        - !Ref PrivateSubnet
      SecurityGroupIds:
        - !Ref SsmVpcEndpointSecurityGroup

  SsmMessagesVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
      VpcId: !Ref Vpc
      SubnetIds:
        - !Ref PrivateSubnet
      SecurityGroupIds:
        - !Ref SsmVpcEndpointSecurityGroup

  Ec2MessagesVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ec2messages
      VpcId: !Ref Vpc
      SubnetIds:
        - !Ref PrivateSubnet
      SecurityGroupIds:
        - !Ref SsmVpcEndpointSecurityGroup

  Ec2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${Prefix}-ec2-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

  Ec2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub ${Prefix}-ec2-instance-profile
      Roles:
        - !Ref Ec2Role

  Ec2Instance:
    Type: AWS::EC2::Instance
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-ec2
      ImageId: !Ref EC2InstanceAMI
      InstanceType: !Ref EC2InstanceType
      IamInstanceProfile: !Ref Ec2InstanceProfile
      DisableApiTermination: false
      EbsOptimized: false
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: true
            VolumeType: !Ref EC2InstanceVolumeType
            VolumeSize: !Ref EC2InstanceVolumeSize
      SecurityGroupIds:
        - !Ref Ec2SecurityGroup
      SubnetId: !Ref PrivateSubnet
      UserData: !Base64 |
        #!/bin/bash
        yum update -y

  VpnLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/clientvpn/${Prefix}
      RetentionInDays: 30

Outputs:
  VpcId:
    Description: "VPC ID"
    Value: !Ref Vpc

  PrivateSubnetId:
    Description: "Private Subnet ID (use for Client VPN target network association)"
    Value: !Ref PrivateSubnet

  VpcCidr:
    Description: "VPC CIDR (use for Client VPN authorization rule)"
    Value: !Ref VpcCidr

  Ec2InstanceId:
    Description: "EC2 Instance ID (ping target after VPN connection)"
    Value: !Ref Ec2Instance

  Ec2InstancePrivateIp:
    Description: "EC2 Private IP (ping target after VPN connection)"
    Value: !GetAtt Ec2Instance.PrivateIp

  VpnLogGroupName:
    Description: "CloudWatch Logs log group name (use for Client VPN connection logging)"
    Value: !Ref VpnLogGroup