【AWS CDK】Session Manager 経由で EC2 インスタンスの Windows Server に RDP 接続してみた

% sw_vers
ProductName:		macOS
ProductVersion:		14.6.1
BuildVersion:		23G93

% aws --version
aws-cli/2.26.2 Python/3.13.2 Darwin/23.6.0 exe/x86_64

% cdk --version
2.177.0 (build b396961)

const instanceRole = new iam.Role(this, 'EC2InstanceRole', {
  roleName: `${projectName}-instance-role`,
  assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName(
      'AmazonSSMManagedInstanceCore'
    ),
  ],
});

const subnets = vpc.selectSubnets({
  subnetGroupName: 'private',
});
vpc.addInterfaceEndpoint('SSMEndpoint', {
  subnets,
  service: ec2.InterfaceVpcEndpointAwsService.SSM,
});
vpc.addInterfaceEndpoint('SSMMessagesEndpoint', {
  subnets,
  service: ec2.InterfaceVpcEndpointAwsService.SSM_MESSAGES,
});
vpc.addInterfaceEndpoint('EC2MessagesEndpoint', {
  subnets,
  service: ec2.InterfaceVpcEndpointAwsService.EC2_MESSAGES,
});

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';

type VpcStackProps = cdk.StackProps & {
  projectName: string;
};

export class VpcStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: VpcStackProps) {
    super(scope, id, props);

    const { projectName } = props;

    const cidr = '10.100.0.0/16';
    const cidrMask = 24;
    const maxAzs = 2;
    const natGateways = 0;

    // VPC
    const vpc = new ec2.Vpc(this, 'Vpc', {
      vpcName: `${projectName}-vpc`,
      ipAddresses: ec2.IpAddresses.cidr(cidr),
      subnetConfiguration: [
        {
          cidrMask,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
          mapPublicIpOnLaunch: false,
        },
        {
          cidrMask,
          name: 'private',
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
      maxAzs,
      natGateways,
    });

    const subnets = vpc.selectSubnets({
      subnetGroupName: 'private',
    });
    vpc.addInterfaceEndpoint('SSMEndpoint', {
      subnets,
      service: ec2.InterfaceVpcEndpointAwsService.SSM,
    });
    vpc.addInterfaceEndpoint('SSMMessagesEndpoint', {
      subnets,
      service: ec2.InterfaceVpcEndpointAwsService.SSM_MESSAGES,
    });
    vpc.addInterfaceEndpoint('EC2MessagesEndpoint', {
      subnets,
      service: ec2.InterfaceVpcEndpointAwsService.EC2_MESSAGES,
    });
  }
}

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';

type Ec2StackProps = cdk.StackProps & {
  projectName: string;
};

export class Ec2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: Ec2StackProps) {
    super(scope, id, props);

    const { projectName } = props;

    // VPC
    const vpcName = `${projectName}-vpc`;
    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', {
      vpcName,
    });

    // https://docs.aws.amazon.com/ja_jp/prescriptive-guidance/latest/optimize-costs-microsoft-workloads/right-size-selection.html#right-size-selection-next-steps
    const instanceType = ec2.InstanceType.of(
      ec2.InstanceClass.T3,
      ec2.InstanceSize.MEDIUM
    );

    // https://zenn.dev/hiren/scraps/4f768929fcfe25
    const machineImage = new ec2.LookupMachineImage({
      name: `${ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE}-*`,
      filters: {
        'image-type': ['machine'],
        state: ['available'],
      },
      owners: ['amazon'],
      windows: true,
    });
    // こちらだと AMI のバージョンが更新されるたびに EC2 インスタンスが再作成されてしまう
    // const machineImage = new ec2.WindowsImage(
    //   ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE
    // );

    const instanceSecurityGroup = new ec2.SecurityGroup(
      this,
      'Ec2InstanceSecurityGroup',
      {
        vpc: vpc,
        securityGroupName: `${projectName}-instance-security-group`,
      }
    );

    const instanceRole = new iam.Role(this, 'EC2InstanceRole', {
      roleName: `${projectName}-instance-role`,
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          'AmazonSSMManagedInstanceCore'
        ),
      ],
    });

    const keyPairName = `${projectName}-ec2-key`;
    const keyPair = new ec2.KeyPair(this, 'EC2KeyPair', {
      keyPairName,
    });

    const volumeSize = 100;
    const vpcSubnets = vpc.selectSubnets({ subnetGroupName: 'private' });
    const blockDevices = [
      {
        // ルートボリューム上書き
        deviceName: '/dev/sda1',
        volume: ec2.BlockDeviceVolume.ebs(volumeSize, {
          volumeType: ec2.EbsDeviceVolumeType.GP3,
        }),
      },
    ];

    new ec2.Instance(this, 'EC2Instance', {
      vpc,
      vpcSubnets,
      instanceName: `${projectName}-instance`,
      instanceType,
      machineImage,
      securityGroup: instanceSecurityGroup,
      role: instanceRole,
      keyPair,
      blockDevices,
      ebsOptimized: true,
      requireImdsv2: true,
    });
  }
}

% curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/mac_arm64/sessionmanager-bundle.zip" -o "sessionmanager-bundle.zip"
% unzip sessionmanager-bundle.zip
% sudo ./sessionmanager-bundle/install -i /usr/local/sessionmanagerplugin -b /usr/local/bin/session-manager-plugin

% aws ssm start-session \
--target <EC2 インスタンス ID> \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["3389"], "localPortNumber":["13389"]}'

Starting session with SessionId: xxxx
Port 13389 opened for sessionId xxxx
Waiting for connections...