CSA Data UploaderをAmazon Linux 2023で起動するためのCloudFormationを作成しました

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Data Uploader EC2 Instance Template'

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: VPC ID where the EC2 instance will be launched

  SubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: Subnet ID where the EC2 instance will be launched

  AllowedIpAddress:
    Type: String
    Description: IP address allowed to access the EC2 instance (e.g., 192.168.1.1/32)
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x

  DuS3Bucket:
    Type: String
    Description: S3 bucket name containing the Data Uploader binary
    AllowedPattern: '^[a-zA-Z0-9.-]+$'
    ConstraintDescription: Must be a valid S3 bucket name

  DuS3Key:
    Type: String
    Description: S3 key (path) to the Data Uploader binary (e.g., du/csa_du-latest-linux_x64.tar.gz)
    AllowedPattern: '^.*\.tar\.gz$'
    ConstraintDescription: Must be a valid S3 key ending with .tar.gz

  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
    Description: Latest Amazon Linux 2023 AMI ID

Resources:
  # Security Group for VPC Endpoints
  VpcEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub '${AWS::StackName}-vpc-endpoint-sg'
      GroupDescription: Security group for VPC endpoints
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref DataUploaderSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0

  # Security Group for EC2 instance
  DataUploaderSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub '${AWS::StackName}-data-uploader-sg'
      GroupDescription: Security group for Data Uploader EC2 instance
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref AllowedIpAddress
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedIpAddress

  # VPC Endpoint for SSM
  SSMVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ssm'
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref SubnetId
      SecurityGroupIds:
        - !Ref VpcEndpointSecurityGroup
      PrivateDnsEnabled: true

  # VPC Endpoint for SSM Messages
  SSMMessagesVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ssmmessages'
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref SubnetId
      SecurityGroupIds:
        - !Ref VpcEndpointSecurityGroup
      PrivateDnsEnabled: true

  # VPC Endpoint for EC2 Messages
  EC2MessagesVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ec2messages'
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref SubnetId
      SecurityGroupIds:
        - !Ref VpcEndpointSecurityGroup
      PrivateDnsEnabled: true

  # IAM Role for EC2 instance to access S3 and Session Manager
  DataUploaderInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: S3AccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource: !Sub 'arn:aws:s3:::${DuS3Bucket}/${DuS3Key}'
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource: !Sub 'arn:aws:s3:::${DuS3Bucket}/${DuS3Key}/*'

  # IAM Instance Profile
  DataUploaderInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref DataUploaderInstanceRole

  # EC2 Instance
  DataUploaderInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      SubnetId: !Ref SubnetId
      SecurityGroupIds:
        - !Ref DataUploaderSecurityGroup
      IamInstanceProfile: !Ref DataUploaderInstanceProfile
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum update -y
          yum install -y aws-cli tar
          yum install -y unixODBC-devel
          aws s3 cp s3://${DuS3Bucket}/${DuS3Key} /tmp/du-binary.tar.gz
          tar -axvf /tmp/du-binary.tar.gz -C /usr/local
          echo 'export PATH=$PATH:/usr/local/csa_du/bin' >> ~/.bash_profile
          source ~/.bash_profile
          which csa_du
          setcap 'cap_net_bind_service=+ep' /usr/local/csa_du/bin/csa_du
          /usr/local/csa_du/bin/csa_du webserver --service install
          sed -i '/^EnvironmentFile=-\/etc\/sysconfig\/csa_data_uploader$/a Environment=HOME=/root' /etc/systemd/system/csa_data_uploader.service
          systemctl daemon-reload
          /usr/local/csa_du/bin/csa_du webserver --service start
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-data-uploader'

Outputs:
  InstanceId:
    Description: ID of the Data Uploader EC2 instance
    Value: !Ref DataUploaderInstance
    Export:
      Name: !Sub '${AWS::StackName}-InstanceId'

  PublicIpAddress:
    Description: Public IP address of the Data Uploader EC2 instance
    Value: !GetAtt DataUploaderInstance.PublicIp
    Export:
      Name: !Sub '${AWS::StackName}-PublicIp'

  SecurityGroupId:
    Description: ID of the security group
    Value: !Ref DataUploaderSecurityGroup
    Export:
      Name: !Sub '${AWS::StackName}-SecurityGroupId'

  SSMVpcEndpointId:
    Description: ID of the SSM VPC Endpoint
    Value: !Ref SSMVpcEndpoint
    Export:
      Name: !Sub '${AWS::StackName}-SSMVpcEndpointId'