NLB と Auto Scaling グループで Fivetran SSH トンネルの自動復旧を試してみた

#!/bin/bash

# ログファイルの設定
LOGFILE="/var/log/fivetran-setup.log"
echo "Starting Fivetran setup process at $(date)" > ${LOGFILE}

# グループを作成
echo "Creating fivetran group..." >> ${LOGFILE}
groupadd fivetran

# ユーザーを作成
echo "Creating fivetran user..." >> ${LOGFILE}
useradd -m -g fivetran fivetran

# .ssh ディレクトリを作成
echo "Setting up SSH directory..." >> ${LOGFILE}
mkdir -p /home/fivetran/.ssh
chmod 700 /home/fivetran/.ssh

# パラメータストアから公開鍵を取得
echo "Retrieving SSH public key from Parameter Store..." >> ${LOGFILE}
SSH_PUBLIC_KEY=$(aws ssm get-parameter --name "/ssh/fivetran/public-key" --query "Parameter.Value" --output text)

# 公開鍵を authorized_keys に追加
echo "${SSH_PUBLIC_KEY}" > /home/fivetran/.ssh/authorized_keys
chmod 600 /home/fivetran/.ssh/authorized_keys
chown -R fivetran:fivetran /home/fivetran/.ssh
echo "SSH public key installed for fivetran user" >> ${LOGFILE}

# パラメータストアからAPI認証情報を取得
echo "Retrieving Fivetran API credentials from Parameter Store..." >> ${LOGFILE}
API_KEY=$(aws ssm get-parameter --name "/fivetran/api_key" --with-decryption --query "Parameter.Value" --output text)
API_SECRET_KEY=$(aws ssm get-parameter --name "/fivetran/api_secret" --with-decryption --query "Parameter.Value" --output text)
CONNECTION_ID=$(aws ssm get-parameter --name "/fivetran/connection_id" --query "Parameter.Value" --output text)

# APIキーとシークレットを結合してBase64エンコード
AUTH_HEADER=$(echo -n "${API_KEY}:${API_SECRET_KEY}" | base64)
echo "API credentials retrieved and encoded" >> ${LOGFILE}

# フィンガープリントハッシュを取得
echo "Generating SSH fingerprint hash..." >> ${LOGFILE}
HASH=$(ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' | sed 's/SHA256://g')
echo "Fingerprint hash: ${HASH}" >> ${LOGFILE}

# ホスト公開鍵を取得
HOST_PUBLIC_KEY=$(cat /etc/ssh/ssh_host_ecdsa_key.pub)
echo "Host public key retrieved" >> ${LOGFILE}

# API リクエストを送信
echo "Sending API request to Fivetran..." >> ${LOGFILE}
RESPONSE=$(curl -s --request POST \
  --url "https://api.fivetran.com/v1/connections/${CONNECTION_ID}/fingerprints" \
  --header "Accept: application/json" \
  --header "Authorization: Basic ${AUTH_HEADER}" \
  --header "Content-Type: application/json" \
  --data "{
  \"hash\": \"${HASH}\",
  \"public_key\": \"${HOST_PUBLIC_KEY}\"
}")

# レスポンスをログに記録
echo "API Response: ${RESPONSE}" >> ${LOGFILE}

# 成功したかどうかを確認
if echo "${RESPONSE}" | grep -q "Success"; then
  echo "SSH fingerprint successfully approved at $(date)" >> ${LOGFILE}
  echo "Fivetran setup completed successfully" >> ${LOGFILE}
else
  echo "ERROR: Failed to approve SSH fingerprint at $(date)" >> ${LOGFILE}
  echo "Please check the API response for details" >> ${LOGFILE}
fi

$ sudo cat /var/log/fivetran-setup.log
Starting Fivetran setup process at Wed Jun 18 08:25:09 UTC 2025
Creating fivetran group...
Creating fivetran user...
Setting up SSH directory...
Retrieving SSH public key from Parameter Store...
SSH public key installed for fivetran user
Retrieving Fivetran API credentials from Parameter Store...
API credentials retrieved and encoded
Generating SSH fingerprint hash...
Fingerprint hash: xxxxx
Host public key retrieved
Sending API request to Fivetran...
API Response: {"code":"Success","message":"The fingerprint has been approved.","data":{"id":"xxxxx","hash":xxxxx","public_key":"ecdsa-sha2-nistp256 xxxxx xxxxx.ec2.internal","validated_date":"2025-06-18T08:25:14.986000Z","validated_by":"xxxxx"}}
SSH fingerprint successfully approved at Wed Jun 18 08:25:14 UTC 2025
Fivetran setup completed successfully

AUTH_HEADER=$(echo -n "$API_KEY:$API_SECRET_KEY" | base64)
CONNECTION_ID="xxxxx"  # connectionIdを設定

# フィンガープリントハッシュを取得
HASH=$(sudo ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' | sed 's/SHA256://g')

curl --request POST \
  --url "https://api.fivetran.com/v1/connections/${CONNECTION_ID}/fingerprints" \
  --header "Accept: application/json" \
  --header "Authorization: Basic ${AUTH_HEADER}" \
  --header "Content-Type: application/json" \
  --data "{
  \"hash\": \"${HASH}\",
  \"public_key\": \"${PUBLIC_KEY}\"
}"