CloudFormationで使い捨てEC2環境をお手軽に構築してみる

AWSTemplateFormatVersion: "2010-09-09"

Description: >-
  AWS CloudFormation Template: 
  This template make temp EC2.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Common Configuration
        Parameters:
          - AppName
          - MyIP
      -
        Label:
          default: EC2 Configuration
        Parameters:
          - KeyName
          - Ec2ImageId
          - Ec2AMIId

Parameters:
  AppName: 
    Description: Name of this application.
    Type: String
    Default: ec2-playground
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the host
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  Ec2ImageId:
    Description: Default Instans Image.
    Type: AWS::SSM::Parameter::Value<String>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  Ec2AMIId:
    Type: String
    Default: <None>
    AllowedPattern: ami-[0-91-z]{17}|^<None>$
  MyIP:
    Description: IP address allowed to connect
    Type: String

Mappings:
  SubnetConfig:
    VPC:
      CIDR: 10.10.0.0/16
    PrivateSubnet:
      CIDR: 10.10.10.0/24
    PublicSubnet:
      CIDR: 10.10.20.0/24
  EC2Config:
    EC2ForPG:
      InstanceType: t2.micro

Conditions:
  UseEc2ImageId: !Equals
    - !Ref Ec2AMIId
    - <None>

Resources:
# ==========
# VPC
# ==========
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      CidrBlock: !FindInMap [SubnetConfig, VPC, CIDR]
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC-IGW
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
         !Ref VPC
      InternetGatewayId:
         !Ref InternetGateway
# ==========
# Private Subnet
# ==========
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, !GetAZs ""]
      VpcId: !Ref VPC
      CidrBlock: !FindInMap [SubnetConfig, PrivateSubnet, CIDR]
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC-PVTSB
        - Key: Network
          Value: Private
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC-PVTRT
        - Key: Network
          Value: Private
  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable
# ==========
# Public Subnet 
# ==========
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, !GetAZs ""]
      VpcId: !Ref VPC
      CidrBlock: !FindInMap [SubnetConfig, PublicSubnet, CIDR]
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC-PUBSB
        - Key: Network
          Value: Public
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-VPC-PUBRT
        - Key: Network
          Value: Public
  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
       RouteTableId:
         !Ref PublicRouteTable
       DestinationCidrBlock: 0.0.0.0/0
       GatewayId:
         !Ref InternetGateway
  PublicSubnetRouteTableAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
# ==========
# EC2
# ==========
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2SecurityGroup
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-EC2-SG-ForPG
      SecurityGroupIngress:
        - FromPort: 22
          IpProtocol: tcp
          CidrIp: !Ref MyIP
          ToPort: 22
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !FindInMap [EC2Config, EC2ForPG, InstanceType]
      KeyName: !Ref KeyName
      ImageId: !If [UseEc2ImageId, !Ref Ec2ImageId, !Ref Ec2AMIId]
      NetworkInterfaces:
        - GroupSet:
            - !Ref EC2SecurityGroup
          AssociatePublicIpAddress: true
          DeviceIndex: '0'
          DeleteOnTermination: true
          SubnetId: !Ref PublicSubnet
      IamInstanceProfile: !Ref EC2InstanceProfile
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-EC2-ForPG
  EC2IAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-IAM-Role-ForPG
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: 
        - !Ref EC2IAMRole
      InstanceProfileName: !Sub ${AppName}-IAM-EC2InsProf-ForPG
    DependsOn: EC2IAMRole

#AppName=ec2-playground
KeyName=ec2-playground
#Ec2ImageId=/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
#Ec2AMIId=ami-xxxxxxxxxx
MyIP=xxx.xxx.xxx.xxx/xx