terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 6.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
  default_tags {
    tags = {
      app = var.app_name
    }
  }
}

# Variables
variable "app_name" {
  default = "rocky-test"
}

variable "aws_region" {
  description = "AWS region"
  default     = "ap-northeast-1"
  type        = string
}

variable "vpc_cidr" {
  description = "CIDR block for VPC"
  default     = "172.16.0.0/16"
  type        = string
}

variable "public_subnets" {
  description = "Public subnet configurations"
  type = map(object({
    cidr_block        = string
    availability_zone = string
  }))
  default = {
    public-subnet-1a = {
      cidr_block        = "172.16.0.0/24"
      availability_zone = "ap-northeast-1a"
    }
  }
}

# VPC
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "${var.app_name}-vpc"
  }
}

# Subnet
resource "aws_subnet" "public" {
  for_each                = var.public_subnets
  vpc_id                  = aws_vpc.main.id
  cidr_block              = each.value.cidr_block
  map_public_ip_on_launch = true
  availability_zone       = each.value.availability_zone
  tags = {
    Name = "${var.app_name}-${each.key}"
  }
}

# IGW
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "${var.app_name}-igw"
  }
}

# Route Table
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  tags = {
    Name = "${var.app_name}-public-rtb"
  }
}

resource "aws_route_table_association" "public" {
  for_each       = var.public_subnets
  subnet_id      = aws_subnet.public[each.key].id
  route_table_id = aws_route_table.public.id
}

# NACLs
resource "aws_network_acl" "public" {
  vpc_id     = aws_vpc.main.id
  subnet_ids = [for s in aws_subnet.public : s.id]

  ingress {
    protocol   = "-1"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }

  egress {
    protocol   = "-1"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }

  tags = {
    Name = "${var.app_name}-public-nacl"
  }
}

# SG
resource "aws_security_group" "main" {
  name        = "${var.app_name}-ec2-sg"
  description = "Security group for EC2"
  vpc_id      = aws_vpc.main.id

  tags = {
    Name = "${var.app_name}-ec2-sg"
  }
}

resource "aws_security_group_rule" "main" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.main.id
}

# Rocky Linux 9 AMI
data "aws_ami" "rocky9" {
  most_recent = true
  owners      = ["679593333241"] # Rocky Linux official

  filter {
    name   = "name"
    values = ["Rocky-9-EC2-Base-*"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

resource "aws_instance" "main" {
  ami                    = data.aws_ami.rocky9.id
  instance_type          = "t3.small"
  subnet_id              = aws_subnet.public["public-subnet-1a"].id
  vpc_security_group_ids = [aws_security_group.main.id]
  iam_instance_profile   = aws_iam_instance_profile.main.name

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 20
    iops                  = 3000
    throughput            = 125
    encrypted             = true
    delete_on_termination = true
    tags = {
      Name = "${var.app_name}-ebs"
    }
  }

  metadata_options {
    http_endpoint = "enabled"
    http_tokens   = "required"
  }

  user_data = base64encode(templatefile("${path.module}/conf/user_data.sh", {}))

  tags = {
    Name             = "${var.app_name}-ec2"
    cm-opswitchStart = "true"
    cm-opswitchStop  = "true"
  }

  depends_on = [aws_ssm_parameter.cloudwatch_config]
}

output "ssm_start_session" {
  value = "aws ssm start-session --target ${aws_instance.main.id}"
}

# CloudWatch Logs Group
resource "aws_cloudwatch_log_group" "main" {
  name              = "/aws/ec2/${var.app_name}-ec2/var-log"
  retention_in_days = 180

  tags = {
    Name = "/aws/ec2/${var.app_name}-ec2/var-log"
  }
}

# CloudWatch Agent configuration in SSM Parameter Store
resource "aws_ssm_parameter" "cloudwatch_config" {
  name  = "AmazonCloudWatch-Parameter-EC2"
  type  = "String"
  value = <<-EOT
  {
    "logs": {
      "logs_collected": {
        "files": {
          "collect_list": [
            {
              "file_path": "/var/log/messages",
              "log_group_name": "${aws_cloudwatch_log_group.main.name}",
              "log_stream_name": "{instance_id}",
              "timestamp_format": "%Y-%m-%d %H:%M:%S.%f"
            }
          ]
        }
      }
    },
    "metrics": {
      "aggregation_dimensions": [
        ["InstanceId"]
      ],
      "append_dimensions": {
        "AutoScalingGroupName": "$${aws:AutoScalingGroupName}",
        "ImageId": "$${aws:ImageId}",
        "InstanceId": "$${aws:InstanceId}",
        "InstanceType": "$${aws:InstanceType}"
      },
      "metrics_collected": {
        "disk": {
          "measurement": [
            "used_percent"
          ],
          "metrics_collection_interval": 60,
          "resources": [
            "/"
          ]
        },
        "mem": {
          "measurement": [
            "used_percent"
          ],
          "metrics_collection_interval": 60
        }
      }
    }
  }
  EOT

  tags = {
    Name = "AmazonCloudWatch-Parameter-EC2"
  }
}

# ec2用IAMロール
resource "aws_iam_role" "main" {
  name = "${var.app_name}-ec2-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = "${var.app_name}-ec2-role"
  }
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.main.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_role_policy_attachment" "cloudwatch_agent" {
  role       = aws_iam_role.main.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
}

resource "aws_iam_instance_profile" "main" {
  name = "${var.app_name}-instance-profile"
  role = aws_iam_role.main.name
}

#!/bin/bash
set -eux

# Update Package
sudo dnf -y upgrade

# Change Timezone To JST
timedatectl set-timezone Asia/Tokyo

# Set Hostname
sudo hostnamectl set-hostname rocky-test-ec2

# Install SSM Agent
sudo dnf install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
sudo systemctl enable amazon-ssm-agent

# Install CloudWatch Agent
sudo dnf install -y https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm
sudo systemctl enable amazon-cloudwatch-agent

# Configure CloudWatch Agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config \
  -m ec2 \
  -c ssm:AmazonCloudWatch-Parameter-EC2 \
  -s

# Setting SELinux
sudo sed -i 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config

sudo reboot