[CDK] 内部 ALB に AWS Certificate Manager でサーバ証明書を発行してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import {
  aws_route53 as route53,
  aws_route53_targets as route53targets,
  aws_certificatemanager as acm, aws_ec2 as ec2,
  aws_elasticloadbalancingv2 as elbv2,
  aws_ecs as ecs,
  aws_ecs_patterns as ecsPatterns
} from 'aws-cdk-lib';

export interface InternalAlbCertificateStackProps extends cdk.StackProps {
  readonly domainName: string;
}

export class InternalAlbCertificateStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: InternalAlbCertificateStackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        },
      ]    
    });

    const publicHostedZone = route53.HostedZone.fromLookup(this, 'PublicHostedZone', {
      domainName: props.domainName,
      privateZone: false,
    });
    const privateHostedZone = new route53.PrivateHostedZone(this, 'PrivateHostedZone', {
      vpc,
      zoneName: `private.${props.domainName}`,
    });

    const certificate = new acm.Certificate(this, 'Certificate', {
      domainName: `api.${privateHostedZone.zoneName}`,
      validation: acm.CertificateValidation.fromDns(publicHostedZone),
    });

    const service = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'SampleService', {
      vpc: vpc,
      cpu: 256,
      memoryLimitMiB: 512,
      desiredCount: 1,
      taskImageOptions: {
        image: ecs.ContainerImage.fromRegistry('public.ecr.aws/nginx/nginx:1.27'),
        containerPort: 80,
      },
      publicLoadBalancer: false,
      protocol: elbv2.ApplicationProtocol.HTTPS,
      certificate: certificate,
      loadBalancerName: 'SampleLoadBalancer',
      // ↓ 以下でもエイリアスレコードを登録可能
      // domainName: `api.${privateHostedZone.zoneName}`,
      // domainZone: privateHostedZone,
    });

    new route53.ARecord(this, 'AliasRecord', {
      zone: privateHostedZone,
      recordName: `api.${privateHostedZone.zoneName}`,
      target: route53.RecordTarget.fromAlias(new route53targets.LoadBalancerTarget(service.loadBalancer)),
    });

    const bastion = new ec2.BastionHostLinux(this, 'BastionHost', {
      vpc,
      instanceName: 'BastionHost',
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.SMALL),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64,
      }),
      subnetSelection: {
        subnetType: ec2.SubnetType.PUBLIC,
      },
      requireImdsv2: true,
    });
    service.service.connections.allowFrom(bastion, ec2.Port.HTTPS, 'Allow HTTP traffic from Bastion Host');
  }
}