aws ec2 describe-vpc-endpoint-services \
  --filters Name=service-type,Values=Interface Name=owner,Values=amazon \
  --region ap-northeast-1 \
  --service-region us-east-1 \
  --query ServiceNames

[
    "com.amazonaws.iam",
    "com.amazonaws.route53",
    "com.amazonaws.us-east-1.ecr.api",
    "com.amazonaws.us-east-1.ecr.dkr",
    "com.amazonaws.us-east-1.ecs",
    "com.amazonaws.us-east-1.ecs-fips",
    "com.amazonaws.us-east-1.kinesis-firehose",
    "com.amazonaws.us-east-1.kinesisanalytics",
    "com.amazonaws.us-east-1.kinesisanalytics-fips",
    "com.amazonaws.us-east-1.kms",
    "com.amazonaws.us-east-1.kms-fips",
    "com.amazonaws.us-east-1.lambda",
    "com.amazonaws.us-east-1.s3"
]

# ==========================================
# Terraform設定
# ==========================================
terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

# ==========================================
# 変数定義
# ==========================================
variable "vpc_cidr" {
  description = "VPCのCIDRブロック"
  type        = string
  default     = "10.0.0.0/16"
}

variable "project_name" {
  description = "プロジェクト名(リソースのタグに使用)"
  type        = string
  default     = "privatelink-cross-region-test"
}

locals {
  # プライベートサブネット定義
  private_subnets = {
    private_1 = {
      cidr_index = 1
      az_index   = 0
    }
    private_2 = {
      cidr_index = 2
      az_index   = 1
    }
  }

  # VPCエンドポイント定義
  vpc_endpoints = {
    ssm         = "com.amazonaws.ap-northeast-1.ssm"
    ssmmessages = "com.amazonaws.ap-northeast-1.ssmmessages"
  }

  # セキュリティグループ定義
  security_groups = {
    vpc_endpoint = {
      description = "Security group for VPC endpoints"
      ingress = [{
        description = "HTTPS from VPC"
        from_port   = 443
        to_port     = 443
        protocol    = "tcp"
        cidr_blocks = [var.vpc_cidr]
      }]
    }
    ec2 = {
      description = "Security group for test EC2 instance"
      ingress     = []
    }
  }
}

# ==========================================
# データソース
# ==========================================
data "aws_ami" "amazon_linux_2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

data "aws_availability_zones" "available" {
  state = "available"
}

# ==========================================
# VPC
# ==========================================
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name    = "${var.project_name}-vpc"
    Project = var.project_name
  }
}

# ==========================================
# プライベートサブネット
# ==========================================
resource "aws_subnet" "private" {
  for_each = local.private_subnets

  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, each.value.cidr_index)
  availability_zone = data.aws_availability_zones.available.names[each.value.az_index]

  tags = {
    Name    = "${var.project_name}-${each.key}-subnet"
    Project = var.project_name
  }
}

# プライベートサブネット用のルートテーブル
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name    = "${var.project_name}-private-rt"
    Project = var.project_name
  }
}

# プライベートサブネットとルートテーブルの関連付け
resource "aws_route_table_association" "private" {
  for_each = local.private_subnets

  subnet_id      = aws_subnet.private[each.key].id
  route_table_id = aws_route_table.private.id
}

# ==========================================
# セキュリティグループ
# ==========================================
resource "aws_security_group" "main" {
  for_each = local.security_groups

  name        = "${var.project_name}-${each.key}-sg"
  description = each.value.description
  vpc_id      = aws_vpc.main.id

  # すべてのアウトバウンド通信を許可
  egress {
    description = "Allow all outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name    = "${var.project_name}-${each.key}-sg"
    Project = var.project_name
  }
}

# セキュリティグループのIngressルール
resource "aws_security_group_rule" "ingress" {
  for_each = {
    for item in flatten([
      for sg_key, sg in local.security_groups : [
        for idx, rule in sg.ingress : {
          key         = "${sg_key}-${idx}"
          sg_key      = sg_key
          description = rule.description
          from_port   = rule.from_port
          to_port     = rule.to_port
          protocol    = rule.protocol
          cidr_blocks = rule.cidr_blocks
        }
      ]
    ]) : item.key => item
  }

  type              = "ingress"
  security_group_id = aws_security_group.main[each.value.sg_key].id
  description       = each.value.description
  from_port         = each.value.from_port
  to_port           = each.value.to_port
  protocol          = each.value.protocol
  cidr_blocks       = each.value.cidr_blocks
}

# ==========================================
# クロスリージョンVPCエンドポイント
# ==========================================
resource "aws_vpc_endpoint" "s3_cross_region" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type   = "Interface"
  service_region      = "us-east-1"
  subnet_ids          = values(aws_subnet.private)[*].id
  security_group_ids  = [aws_security_group.main["vpc_endpoint"].id]
  private_dns_enabled = true

  timeouts {
    create = "20m"
  }

  tags = {
    Name    = "${var.project_name}-s3-cross-region-endpoint"
    Project = var.project_name
  }
}

# ==========================================
# SSM Session Manager用のVPCエンドポイント
# ==========================================
resource "aws_vpc_endpoint" "interface" {
  for_each = local.vpc_endpoints

  vpc_id              = aws_vpc.main.id
  service_name        = each.value
  vpc_endpoint_type   = "Interface"
  subnet_ids          = values(aws_subnet.private)[*].id
  security_group_ids  = [aws_security_group.main["vpc_endpoint"].id]
  private_dns_enabled = true

  tags = {
    Name    = "${var.project_name}-${each.key}-endpoint"
    Project = var.project_name
  }
}

# ==========================================
# 検証用EC2インスタンスのIAM設定
# ==========================================
resource "aws_iam_role" "ec2_role" {
  name = "ec2-privatelink-test-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "cross_region_policy" {
  name = "cross-region-access-policy"
  role = aws_iam_role.ec2_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "vpce:AllowMultiRegion"
        Resource = "*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ssm_policy" {
  role       = aws_iam_role.ec2_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "ec2_profile" {
  name = "ec2-privatelink-test-profile"
  role = aws_iam_role.ec2_role.name
}

# ==========================================
# 検証用EC2インスタンス
# ==========================================
resource "aws_instance" "test_instance" {
  ami                         = data.aws_ami.amazon_linux_2023.id
  instance_type               = "t3.micro"
  subnet_id                   = aws_subnet.private["private_1"].id
  iam_instance_profile        = aws_iam_instance_profile.ec2_profile.name
  vpc_security_group_ids      = [aws_security_group.main["ec2"].id]
  associate_public_ip_address = false

  tags = {
    Name    = "${var.project_name}-test-instance"
    Project = var.project_name
  }
}

# ==========================================
# 出力
# ==========================================
output "s3_cross_region_endpoint_id" {
  description = "クロスリージョンS3 VPCエンドポイントのID"
  value       = aws_vpc_endpoint.s3_cross_region.id
}

output "s3_cross_region_endpoint_dns" {
  description = "S3 VPCエンドポイントのDNSエントリ"
  value       = aws_vpc_endpoint.s3_cross_region.dns_entry
}

output "test_instance_id" {
  description = "検証用EC2インスタンスのID"
  value       = aws_instance.test_instance.id
}

╷
│ Error: waiting for EC2 VPC Endpoint (com.amazonaws.us-east-1.s3) create: timeout while waiting for state to become 'available, pendingacceptance' (last state: 'pending', timeout: 10m0s)
│ 
│   with aws_vpc_endpoint.s3_cross_region,
│   on main.tf line 197, in resource "aws_vpc_endpoint" "s3_cross_region":
│  197: resource "aws_vpc_endpoint" "s3_cross_region" {
│ 
╵
╷
│ Error: Missing Resource Identity After Create: The Terraform provider unexpectedly returned no resource identity after having no errors in the resource create. This is always a problem with the provider and should be reported to the provider developer
│ 
│   with aws_vpc_endpoint.s3_cross_region,
│   on main.tf line 197, in resource "aws_vpc_endpoint" "s3_cross_region":
│  197: resource "aws_vpc_endpoint" "s3_cross_region" {
│ 
╵

# AWS CLIでSession Managerを使用して接続
aws ssm start-session --target i-xxxxxxxxx --region ap-northeast-1

# インターネット接続の確認(失敗するはず)
ping -c 3 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2113ms

# S3バケットの一覧を取得(us-east-1リージョン)
$ aws s3 ls --region us-east-1

2025-11-05 09:52:13 xxx-s3
2025-02-12 04:42:27 yyy-s3
2025-02-12 04:42:19 zzz-s3

$ aws s3 ls --region ap-northeast-1

2025-11-20 11:53:05,982 - MainThread - botocore.httpsession - DEBUG - Certificate path: /etc/pki/tls/certs/ca-bundle.crt
2025-11-20 11:53:05,982 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): s3.ap-northeast-1.amazonaws.com:443

$ nslookup s3.us-east-1.amazonaws.com
Server:         10.0.0.2
Address:        10.0.0.2#53

Non-authoritative answer:
Name:   s3.us-east-1.amazonaws.com
Address: 10.0.2.8
Name:   s3.us-east-1.amazonaws.com
Address: 10.0.1.246