Amazon EC2 Managed Resource Visibility の設定を Lambda Managed Instances で確認してみた

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as lambda_nodejs from "aws-cdk-lib/aws-lambda-nodejs";
import { Construct } from "constructs";

export class SampleStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * VPC 作成
     *
     * MEMO: NAT Gateway 経由で Lambda から AWS サービスへのアクセスを確保する
     */
    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          name: "Public",
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          name: "PrivateWithEgress",
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        },
      ],
    });

    /**
     * セキュリティグループ作成
     *
     * MEMO: Capacity Provider 用
     */
    const securityGroup = new ec2.SecurityGroup(this, "SecurityGroup", {
      vpc,
    });

    /**
     * Capacity Provider 作成
     *
     * MEMO: LMI のコア要素。LMI のバックエンドとなる EC2 インスタンスが
     * このリソース経由でプロビジョニングされる
     */
    const capacityProvider = new lambda.CapacityProvider(
      this,
      "CapacityProvider",
      {
        subnets: vpc.selectSubnets({
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        }).subnets,
        securityGroups: [securityGroup],
      },
    );

    /**
     * LMI 用 Lambda 関数作成
     */
    const lmiFunction = new lambda_nodejs.NodejsFunction(this, "LmiFunction", {
      entry: "../server/src/lambda/handlers/sample-handler.ts",
      runtime: lambda.Runtime.NODEJS_24_X, // LMI では Node.js 22.x 以上が必須
      tracing: lambda.Tracing.ACTIVE,
    });

    /**
     * Capacity Provider に Lambda 関数を追加
     */
    capacityProvider.addFunction(lmiFunction);
  }
}

import { Context } from "aws-lambda";

export const handler = async (context: Context): Promise<void> => {
  console.log(
    JSON.stringify({
      message: "Hello from LMI!",
      requestId: context.awsRequestId,
      functionName: context.functionName,
    }),
  );
};

aws ec2 get-managed-resource-visibility --region ap-northeast-1

{
  "Visibility": {
    "DefaultVisibility": "visible"
  }
}

aws ec2 modify-managed-resource-visibility \
    --default-visibility hidden \
    --region ap-northeast-1

{
  "Visibility": {
    "DefaultVisibility": "hidden"
  }
}

aws ec2 describe-instances \
    --filters "Name=operator.managed,Values=true" \
    --query "Reservations[].Instances[].{InstanceId:InstanceId,State:State.Name,Managed:Operator.Managed,Principal:Operator.Principal}" \
    --output table \
    --region ap-northeast-1

---------------------------------------------------------------------------------------
|                               DescribeInstances                                     |
+----------------------+---------+---------+-------------------------------+----------+
|      InstanceId      | Managed |  State  |           Principal           |  State   |
+----------------------+---------+---------+-------------------------------+----------+
|  i-0b2372a2a8fc72bd1 |  True   | running |  scaler.lambda.amazonaws.com  | running  |
|  i-0a19df852fb89c1c2 |  True   | running |  scaler.lambda.amazonaws.com  | running  |
+----------------------+---------+---------+-------------------------------+----------+

aws ec2 describe-instances \
    --include-managed-resources \
    --filters "Name=operator.managed,Values=true" \
    --query "Reservations[].Instances[].{InstanceId:InstanceId,HiddenByDefault:HiddenByDefault,Managed:Operator.Managed}" \
    --output table \
    --region ap-northeast-1

-------------------------------------------------------
|                  DescribeInstances                  |
+------------------+-----------------------+----------+
|  HiddenByDefault |      InstanceId       | Managed  |
+------------------+-----------------------+----------+
|  None            |  i-0b2372a2a8fc72bd1  |  True    |
|  None            |  i-0a19df852fb89c1c2  |  True    |
+------------------+-----------------------+----------+

aws ec2 describe-instances \
    --no-include-managed-resources \
    --query "Reservations[].Instances[].InstanceId" \
    --output json \
    --region ap-northeast-1

["i-0b2372a2a8fc72bd1", "i-0a19df852fb89c1c2"]