SSM 接続OK！踏み台 EC2 インスタンスを一括で作成してみた（CloudFormation 利用）

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFormation template to launch Bastion EC2 instance with SSM access and optional VPC endpoints'

Parameters:

  # 踏み台インスタンスを起動する VPC ID とサブネット ID
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: VPC where the Bastion instance will be launched

  SubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: Subnet where the Bastion instance will be launched

  # 踏み台インスタンスのインスタンスタイプ  
  InstanceType:
    Type: String
    Default: t3.medium
    Description: EC2 instance type
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large

  # 踏み台インスタンスの起動に使用する AMI ID が格納された SSM パラメータ名
  # ※ 下記ドキュメントのパブリックパラメータから指定することも、独自に作成した SSM パラメータを指定することも可能
  # https://docs.aws.amazon.com/ja_jp/systems-manager/latest/userguide/parameter-store-public-parameters-ami.html  
  AmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base
    Description: SSM Parameter of AMI for Bastion instance (default - Windows Server 2022)

  # 踏み台インスタンスに紐づける既存のキーペア名
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to connect Bastion instance
    Default: ""

  # VPC エンドポイントの作成有無
  # 対象サブネットにすでに SSM エンドポイントが存在する場合や、対象サブネットがパブリックの場合は No を選択する
  CreateVpcEndpoints:
    Type: String
    Default: "Yes"
    AllowedValues:
      - "Yes"
      - "No"
    Description: Create VPC Endpoints for SSM access (for private subnets)

Conditions:
  HasKeyName: !Not [!Equals [!Ref KeyName, ""]]
  ShouldCreateVpcEndpoints: !Equals [!Ref CreateVpcEndpoints, "Yes"]

Resources:
  # 踏み台インスタンスにアタッチする IAM ロール（SSM 接続に必要なポリシーのみ付与）
  EC2SSMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Path: /

  # Instance Profile for the EC2 instance
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2SSMRole

  # 踏み台インスタンスにアタッチするセキュリティグループ
  # SSM 接続するのみであればインバウンドルールの許可は不要
  BastionSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Bation instance (No inbound access)
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: bastion-server-sg

  # 踏み台 EC2 インスタンス
  BastionInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !Ref AmiId
      SubnetId: !Ref SubnetId
      SecurityGroupIds:
        - !GetAtt BastionSecurityGroup.GroupId
      IamInstanceProfile: !Ref EC2InstanceProfile
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref "AWS::NoValue"]
      Tags:
        - Key: Name
          Value: Bastion Server

  # VPC エンドポイントにアタッチするセキュリティグループ（踏み台インスタンスの SG からのみ接続を許可）
  VpcEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: ShouldCreateVpcEndpoints
    Properties:
      GroupDescription: Security group for VPC Endpoints
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - Description: HTTPS from EC2 instance security group
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !GetAtt BastionSecurityGroup.GroupId
      Tags:
        - Key: Name
          Value: vpc-endpoints-sg

  # SSM 接続に必要な VPC エンドポイント（ssm/ssmmessages）
  SSMEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: ShouldCreateVpcEndpoints
    Properties:
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ssm"
      VpcId: !Ref VpcId
      SubnetIds:
        - !Ref SubnetId
      SecurityGroupIds:
        - !Ref VpcEndpointSecurityGroup

  SSMMessagesEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: ShouldCreateVpcEndpoints
    Properties:
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ssmmessages"
      VpcId: !Ref VpcId
      SubnetIds:
        - !Ref SubnetId
      SecurityGroupIds:
        - !Ref VpcEndpointSecurityGroup

Outputs:
  InstanceId:
    Description: ID of the EC2 instance
    Value: !Ref BastionInstance

  PrivateIP:
    Description: Private IP address of the EC2 instance
    Value: !GetAtt BastionInstance.PrivateIp

  AMIId:
    Description: AMI ID used for this instance
    Value: !Ref AmiId

  SSMConnectionCommand:
    Description: Command to connect to the instance using SSM Session Manager
    Value: !Sub "aws ssm start-session --target ${BastionInstance}"

  SecurityGroupId:
    Description: Security Group ID attached to the instance
    Value: !GetAtt BastionSecurityGroup.GroupId

  KeyPairUsed:
    Description: Key pair used for this instance (if any)
    Value: !If [HasKeyName, !Ref KeyName, "No key pair specified"]

  PasswordRetrievalCommand:
    Description: Command to retrieve the Windows password (if key pair was specified)
    Value: !If 
      - HasKeyName
      - !Sub "aws ec2 get-password-data --instance-id ${BastionInstance} --priv-launch-key path/to/your/${KeyName}.pem"
      - "No key pair specified, password retrieval not available"

  VpcEndpointsCreated:
    Description: Whether VPC Endpoints were created
    Value: !If [ShouldCreateVpcEndpoints, "Yes", "No"]

  SSMEndpointId:
    Description: SSM VPC Endpoint ID (if created)
    Value: !If [ShouldCreateVpcEndpoints, !Ref SSMEndpoint, "Not created"]

  SSMMessagesEndpointId:
    Description: SSM Messages VPC Endpoint ID (if created)
    Value: !If [ShouldCreateVpcEndpoints, !Ref SSMMessagesEndpoint, "Not created"]