【CloudFormation】SSM ステートマネージャーを使ってCloudWatch Agentのインストールとログ出力設定を自動化してみる

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  LogGroupPrefix:
    Type: "String"
    Default: "oslog-linux-syslog"
    AllowedValues: ["oslog-linux-syslog"]
  LogGroupPrefixWindows:
    Type: "String"
    Default: "oslog-windows-syslog"
    AllowedValues: ["oslog-windows-syslog"]
  RetentionDays:
    Description: The number of days to retain the log events in the specified log group.
    Type: Number
    Default: 30
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365]

Resources:
  # 取得する syslog を定義する SSM Parameter
  ## Linux
  SSMParameterLinuxLogs:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: !Sub "AmazonCloudWatch-Linux-syslog"
      Description: "SSM Parameter for Linux to export syslog."
      DataType: "text"
      Tier: "Standard"
      Type: "String"
      Value: !Sub |-
        {
          "agent": {
            "run_as_user": "root"
          },
          "logs":
            {
              "logs_collected":
                {
                  "files":
                    {
                      "collect_list":
                        [
                          {
                            "file_path": "/var/log/messages",
                            "log_group_name": "${LogGroupPrefix}-${AWS::Region}/var/log/messages",
                            "log_stream_name": "{instance_id}",
                            "retention_in_days": ${RetentionDays}
                          }                        
                        ]
                    }
                }
            }
        }
  ## Windows
  SSMParameterWindowsLogs:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: !Sub "AmazonCloudWatch-Windows-syslog"
      Description: "SSM Parameter for Windows to export syslog."
      DataType: "text"
      Tier: "Standard"
      Type: "String"
      Value: !Sub |-
        {
          "agent": {
            "run_as_user": "root"
          },
          "logs":
            {
              "logs_collected":
                {
                  "windows_events":
                    {
                      "collect_list":
                        [
                          {
                            "event_format": "xml",
                            "event_levels": [
                              "WARNING",
                              "ERROR",
                              "CRITICAL"
                            ],
                            "event_name": "System",
                            "log_group_name": "${LogGroupPrefixWindows}-${AWS::Region}/System",
                            "log_stream_name": "{instance_id}",
                            "retention_in_days": ${RetentionDays}
                          }
                        ]
                    }
                }
            }
        }

  InstallAndManageCloudWatchDocument:
    Type: "AWS::SSM::Document"
    Properties:
      DocumentType: Command
      Name: InstallAndManageCloudWatchDocument
      UpdateMethod: NewVersion
      Content:
        schemaVersion: "2.2"
        description: "The AWS-InstallAndManageCloudWatch command document installs the Amazon CloudWatch agent and manages the configuration of the agent for Amazon EC2 instances."
        mainSteps:
          - name: installCWAgent
            action: "aws:runDocument"
            inputs:
              documentType: SSMDocument
              documentPath: AWS-ConfigureAWSPackage
              documentParameters:
                action: Install
                name: AmazonCloudWatchAgent
          # Amazon Linux 2023では rsyslog が未インストール
          - name: installRsyslogLinux
            action: "aws:runDocument"
            precondition:
              StringEquals:
                - platformType
                - Linux
            inputs:
              documentType: SSMDocument
              documentPath: AWS-RunShellScript
              documentParameters:
                commands:
                  - yum install rsyslog -y
                  - sudo systemctl enable rsyslog
                  - sudo systemctl restart rsyslog
          - name: manageCWAgentLinux
            action: "aws:runDocument"
            precondition:
              StringEquals:
                - platformType
                - Linux
            inputs:
              documentType: SSMDocument
              documentPath: AmazonCloudWatch-ManageAgent
              documentParameters:
                action: configure
                mode: ec2
                optionalConfigurationSource: ssm
                optionalConfigurationLocation: !Ref SSMParameterLinuxLogs
                optionalRestart: "yes"
          - name: manageCWAgentWindows
            action: "aws:runDocument"
            precondition:
              StringEquals:
                - platformType
                - Windows
            inputs:
              documentType: SSMDocument
              documentPath: AmazonCloudWatch-ManageAgent
              documentParameters:
                action: configure
                mode: ec2
                optionalConfigurationSource: ssm
                optionalConfigurationLocation: !Ref SSMParameterWindowsLogs
                optionalRestart: "yes"

  SystemAssociationForInstallAndConfigureCloudWatchAgent:
    Type: "AWS::SSM::Association"
    Properties:
      Name:
        Ref: InstallAndManageCloudWatchDocument
      AssociationName: ManageCloudWatchAgent
      ScheduleExpression:
        Ref: "AWS::NoValue"
      Targets:
        - Key: InstanceIds
          Values:
            - "*"