VPCの中にEventBridge Connectionで入ってみた — Step FunctionsからVPC内ALBをLambdaなしでリクエスト

AWSTemplateFormatVersion: "2010-09-09"
Description: "Stack 1: Internal ALB + EventBridge Connection (Private) + API Gateway REST API"

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Default: vpc-0example1234567890
  SubnetIds:
    Type: CommaDelimitedList
    Default: "subnet-0example1a,subnet-0example1c,subnet-0example1d"
  CertificateArn:
    Type: String
    Default: arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  AlbDomainName:
    Type: String
    Default: eb-demo.example.com

Resources:
  # ============================================================
  # 共通: Internal ALB
  # ============================================================
  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP/HTTPS from VPC CIDR
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 192.168.0.0/18
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 192.168.0.0/18

  ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internal
      Subnets: !Ref SubnetIds
      SecurityGroups:
        - !Ref AlbSecurityGroup

  HttpListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ALB
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "200"
            ContentType: application/json
            MessageBody: '{"status":"ok","source":"internal-alb"}'

  HttpsListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ALB
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: !Ref CertificateArn
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "200"
            ContentType: application/json
            MessageBody: '{"status":"ok","source":"internal-alb"}'

  # ============================================================
  # パターン A: EventBridge Connection (Private) via VPC Lattice
  # ============================================================
  ResourceGatewaySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for VPC Lattice Resource Gateway
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIpv6: "::/0"

  ResourceGateway:
    Type: AWS::VpcLattice::ResourceGateway
    Properties:
      Name: eb-demo-resource-gw-v2
      IpAddressType: IPV4
      ResourceConfigDnsResolution: IN_VPC
      VpcIdentifier: !Ref VpcId
      SubnetIds: !Ref SubnetIds
      SecurityGroupIds:
        - !Ref ResourceGatewaySecurityGroup

  ResourceConfiguration:
    Type: AWS::VpcLattice::ResourceConfiguration
    Properties:
      Name: eb-demo-resource-cfg-v3
      ResourceGatewayId: !GetAtt ResourceGateway.Id
      ResourceConfigurationType: SINGLE
      ResourceConfigurationAuthType: AWS_IAM
      ProtocolType: TCP
      PortRanges:
        - "443"
      AllowAssociationToSharableServiceNetwork: true
      ResourceConfigurationDefinition:
        DnsResource:
          DomainName: !Ref AlbDomainName
          IpAddressType: IPV4

  PrivateConnection:
    Type: AWS::Events::Connection
    Properties:
      Name: eb-demo-private-connection
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: x-dummy-key
          ApiKeyValue: dummy
      InvocationConnectivityParameters:
        ResourceParameters:
          ResourceConfigurationArn: !GetAtt ResourceConfiguration.Arn

  # ============================================================
  # パターン B: API Gateway REST API + VPC Link v2
  # ============================================================
  VpcLinkSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for API Gateway VPC Link
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 192.168.0.0/18

  VpcLink:
    Type: AWS::ApiGatewayV2::VpcLink
    Properties:
      Name: eb-demo-vpc-link
      SubnetIds: !Ref SubnetIds
      SecurityGroupIds:
        - !Ref VpcLinkSecurityGroup

  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: eb-demo-rest-api
      EndpointConfiguration:
        Types:
          - REGIONAL

  RestApiMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApi
      ResourceId: !GetAtt RestApi.RootResourceId
      HttpMethod: GET
      AuthorizationType: AWS_IAM
      Integration:
        Type: HTTP_PROXY
        IntegrationHttpMethod: GET
        ConnectionType: VPC_LINK
        ConnectionId: !Ref VpcLink
        IntegrationTarget: !Ref HttpListener
        Uri: !Sub "http://${ALB.DNSName}/"

  RestApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: RestApiMethod
    Properties:
      RestApiId: !Ref RestApi

  RestApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref RestApi
      DeploymentId: !Ref RestApiDeployment
      StageName: prod

  PublicConnection:
    Type: AWS::Events::Connection
    Properties:
      Name: eb-demo-public-connection
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: x-dummy-key
          ApiKeyValue: dummy

Outputs:
  AlbDnsName:
    Value: !GetAtt ALB.DNSName
  AlbHttpsListenerArn:
    Value: !Ref HttpsListener
  PrivateConnectionArn:
    Value: !GetAtt PrivateConnection.Arn
  PublicConnectionArn:
    Value: !GetAtt PublicConnection.Arn
  RestApiEndpoint:
    Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/prod"
  RestApiId:
    Value: !Ref RestApi

AWSTemplateFormatVersion: "2010-09-09"
Description: "Stack 2: Step Functions state machines (Pattern A: Private Connection, Pattern B: REST API)"

Parameters:
  InfraStackName:
    Type: String
    Default: eb-connection-infra

Resources:
  # ============================================================
  # IAM Role - Pattern A (Private Connection)
  # ============================================================
  PatternARole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: HttpInvokePrivate
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: states:InvokeHTTPEndpoint
                Resource: "*"
              - Effect: Allow
                Action: events:RetrieveConnectionCredentials
                Resource:
                  Fn::GetStackOutput:
                    StackName: !Ref InfraStackName
                    OutputName: PrivateConnectionArn
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                  - secretsmanager:DescribeSecret
                Resource:
                  Fn::Join:
                    - ""
                    - - "arn:aws:secretsmanager:"
                      - !Ref AWS::Region
                      - ":"
                      - !Ref AWS::AccountId
                      - ":secret:events!connection/eb-demo-private-connection/*"
              - Effect: Allow
                Action: vpc-lattice-svcs:Invoke
                Resource: "*"

  # ============================================================
  # IAM Role - Pattern B (REST API direct integration)
  # ============================================================
  PatternBRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: HttpInvokeRestApi
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: execute-api:Invoke
                Resource:
                  Fn::Join:
                    - ""
                    - - "arn:aws:execute-api:"
                      - !Ref AWS::Region
                      - ":"
                      - !Ref AWS::AccountId
                      - ":"
                      - Fn::GetStackOutput:
                          StackName: !Ref InfraStackName
                          OutputName: RestApiId
                      - "/prod/GET/"

  # ============================================================
  # ステートマシン A: EventBridge Connection (Private) 経由
  # ============================================================
  StateMachineA:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: eb-demo-pattern-a-private
      RoleArn: !GetAtt PatternARole.Arn
      DefinitionString:
        Fn::Join:
          - ""
          - - '{"StartAt":"CallPrivateApi","States":{"CallPrivateApi":{"Type":"Task","Resource":"arn:aws:states:::http:invoke","TimeoutSeconds":60,"Parameters":{"ApiEndpoint":"https://eb-demo.example.com/","Method":"GET","Authentication":{"ConnectionArn":"'
            - Fn::GetStackOutput:
                StackName: !Ref InfraStackName
                OutputName: PrivateConnectionArn
            - '"}},"End":true}}}'

  # ============================================================
  # ステートマシン B: API Gateway REST API 経由 (Optimized Integration)
  # ============================================================
  StateMachineB:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: eb-demo-pattern-b-apigw
      RoleArn: !GetAtt PatternBRole.Arn
      DefinitionString:
        Fn::Join:
          - ""
          - - '{"StartAt":"CallRestApi","States":{"CallRestApi":{"Type":"Task","Resource":"arn:aws:states:::apigateway:invoke","Parameters":{"ApiEndpoint":"'
            - Fn::GetStackOutput:
                StackName: !Ref InfraStackName
                OutputName: RestApiId
            - '.execute-api.ap-northeast-1.amazonaws.com","Method":"GET","Stage":"prod","AuthType":"IAM_ROLE"},"End":true}}}'

Outputs:
  StateMachineArnPatternA:
    Value: !GetAtt StateMachineA.Arn
  StateMachineArnPatternB:
    Value: !GetAtt StateMachineB.Arn