【AWS CDK】EC2 Instance Connect Endpoint 経由で EC2 インスタンスの Windows Server に RDP 接続してみた

% sw_vers
ProductName:		macOS
ProductVersion:		14.6.1
BuildVersion:		23G93

% aws --version
aws-cli/2.22.7 Python/3.12.6 Darwin/23.6.0 exe/x86_64

% cdk --version
2.177.0 (build b396961)

// EIC Endpoint
const endpointSecurityGroup = new ec2.SecurityGroup(
  this,
  'Ec2InstanceConnectEndpointSecurityGroup',
  {
    vpc,
    securityGroupName: `${projectName}-instance-connect-endpoint-security-group`,
    allowAllOutbound: false,
  }
);

// EIC Endpoint → EC2 インスタンスの RDP アクセスを許可（送信側）
endpointSecurityGroup.addEgressRule(
  instanceSecurityGroup,
  ec2.Port.tcp(3389)
);

// EIC Endpoint → EC2 インスタンスの RDP アクセスを許可（受信側）
instanceSecurityGroup.addIngressRule(
  endpointSecurityGroup,
  ec2.Port.tcp(3389)
);

new ec2.CfnInstanceConnectEndpoint(this, 'Ec2InstanceConnectEndpoint', {
  subnetId: vpc.selectSubnets({ subnetGroupName: 'private' }).subnetIds[0],
  securityGroupIds: [endpointSecurityGroup.securityGroupId],
});

const machineImage = new ec2.LookupMachineImage({
  name: `${ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE}-*`,
  filters: {
    'image-type': ['machine'],
    state: ['available'],
  },
  owners: ['amazon'],
  windows: true,
});
// こちらだと AMI のバージョンが更新されるたびに EC2 インスタンスが再作成されてしまう
// const machineImage = new ec2.WindowsImage(
//   ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE
// );

{
  ...
  "ami:account=xxxxxxxxxxxx:filters.image-type.0=machine:filters.name.0=Windows_Server-2019-Japanese-Full-Base-*:filters.platform.0=windows:filters.state.0=available:owners.0=amazon:region=ap-northeast-1": "ami-028a21172be6f0723"
  ...
}

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';

type Ec2StackProps = cdk.StackProps & {
  projectName: string;
};

export class Ec2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: Ec2StackProps) {
    super(scope, id, props);

    const { projectName } = props;

    // VPC
    const vpcName = `${projectName}-vpc`;
    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', {
      vpcName,
    });

    // https://docs.aws.amazon.com/ja_jp/prescriptive-guidance/latest/optimize-costs-microsoft-workloads/right-size-selection.html#right-size-selection-next-steps
    const instanceType = ec2.InstanceType.of(
      ec2.InstanceClass.T3,
      ec2.InstanceSize.MEDIUM
    );

    const machineImage = new ec2.LookupMachineImage({
      name: `${ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE}-*`,
      filters: {
        'image-type': ['machine'],
        state: ['available'],
      },
      owners: ['amazon'],
      windows: true,
    });
    // こちらだと AMI のバージョンが更新されるたびに EC2 インスタンスが再作成されてしまう
    // const machineImage = new ec2.WindowsImage(
    //   ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE
    // );

    const instanceSecurityGroup = new ec2.SecurityGroup(
      this,
      'Ec2InstanceSecurityGroup',
      {
        vpc: vpc,
        securityGroupName: `${projectName}-instance-security-group`,
      }
    );

    const instanceRole = new iam.Role(this, 'EC2InstanceRole', {
      roleName: `${projectName}-instance-role`,
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
    });

    const keyPairName = `${projectName}-ec2-key`;
    const keyPair = new ec2.KeyPair(this, 'EC2KeyPair', {
      keyPairName,
    });

    const volumeSize = 100;
    const vpcSubnets = vpc.selectSubnets({ subnetGroupName: 'private' });
    const blockDevices = [
      {
        // ルートボリューム上書き
        deviceName: '/dev/sda1',
        volume: ec2.BlockDeviceVolume.ebs(volumeSize, {
          volumeType: ec2.EbsDeviceVolumeType.GP3,
        }),
      },
    ];

    new ec2.Instance(this, 'EC2Instance', {
      vpc,
      vpcSubnets,
      instanceName: `${projectName}-instance`,
      instanceType,
      machineImage,
      securityGroup: instanceSecurityGroup,
      role: instanceRole,
      keyPair,
      blockDevices,
      ebsOptimized: true,
      requireImdsv2: true,
    });

    // EIC Endpoint
    const endpointSecurityGroup = new ec2.SecurityGroup(
      this,
      'Ec2InstanceConnectEndpointSecurityGroup',
      {
        vpc,
        securityGroupName: `${projectName}-instance-connect-endpoint-security-group`,
        allowAllOutbound: false,
      }
    );

    // EIC Endpoint → EC2 インスタンスの RDP アクセスを許可（送信側）
    endpointSecurityGroup.addEgressRule(
      instanceSecurityGroup,
      ec2.Port.tcp(3389)
    );

    // EIC Endpoint → EC2 インスタンスの RDP アクセスを許可（受信側）
    instanceSecurityGroup.addIngressRule(
      endpointSecurityGroup,
      ec2.Port.tcp(3389)
    );

    new ec2.CfnInstanceConnectEndpoint(this, 'Ec2InstanceConnectEndpoint', {
      subnetId: vpc.selectSubnets({ subnetGroupName: 'private' }).subnetIds[0],
      securityGroupIds: [endpointSecurityGroup.securityGroupId],
    });
  }
}

% aws ec2-instance-connect open-tunnel \
  --instance-id <対象の EC2 インスタンス ID> \
  --remote-port 3389 \
  --local-port 13389