SSM Automation Runbook "AWSEC2-CloneInstanceAndUpgradeWindows" 実行前の前提条件チェックスクリプトを作ってみた

Write-Output "=== AWSEC2-CloneInstanceAndUpgradeWindows PreCheck ==="

# 1. OS Version
try {
    $os = Get-WmiObject Win32_OperatingSystem
    $caption = $os.Caption

    if ($caption -match "Windows Server 2008 R2|Windows Server 2012 R2|Windows Server 2016|Windows Server 2019") {
        Write-Output "OSVersion | OK | $caption"
    } else {
        Write-Output "OSVersion | NG | Unsupported OS: $caption"
    }
} catch {
    Write-Output "OSVersion | NG | Unable to determine OS version"
}

# 2. Domain Controller
try {
    $cs = Get-WmiObject Win32_ComputerSystem
    if ($cs.DomainRole -eq 4 -or $cs.DomainRole -eq 5) {
        Write-Output "DomainController | NG | This instance is a Domain Controller"
    } else {
        Write-Output "DomainController | OK | Not a Domain Controller"
    }
} catch {
    Write-Output "DomainController | NG | Unable to determine domain role"
}

# 3. RDS Roles
try {
    $rds = Get-WmiObject Win32_ServerFeature | Where-Object { $_.Name -match "Remote Desktop" }
    if ($rds) {
        foreach ($f in $rds) {
            Write-Output "RDSRole | NG | Installed: $($f.Name)"
        }
    } else {
        Write-Output "RDSRole | OK | No RDS roles installed"
    }
} catch {
    Write-Output "RDSRole | NG | Unable to determine RDS roles"
}

# 4. PowerShell Version
try {
    $psMajor = $PSVersionTable.PSVersion.Major
    if ($psMajor -ge 3) {
        Write-Output "PowerShell | OK | Version $psMajor"
    } else {
        Write-Output "PowerShell | NG | Version $psMajor"
    }
} catch {
    Write-Output "PowerShell | NG | Version check failed"
}

# 5. IAM Role (IMDSv2)
try {
    $token = Invoke-RestMethod -Method PUT `
        -Uri "http://169.254.169.254/latest/api/token" `
        -Headers @{ "X-aws-ec2-metadata-token-ttl-seconds" = "21600" }

    $iam = Invoke-RestMethod `
        -Uri "http://169.254.169.254/latest/meta-data/iam/info" `
        -Headers @{ "X-aws-ec2-metadata-token" = $token }

    if ($iam.InstanceProfileArn) {
        Write-Output "IAMRole | OK | $($iam.InstanceProfileArn)"
    } else {
        Write-Output "IAMRole | NG | No instance profile"
    }
} catch {
    Write-Output "IAMRole | NG | Unable to access instance metadata"
}

# 6. Time Sync
try {
    $svc = Get-WmiObject Win32_Service -Filter "Name='w32time'"
    if ($svc.State -ne "Running") {
        Write-Output "TimeSync | NG | Windows Time Service not running"
    } else {
        $w32tm = w32tm /stripchart /computer:time.aws.com /dataonly /samples:1 2>$null
        if ($w32tm -match "(-?\d+\.\d+)s") {
            $offset = [math]::Abs([double]$matches[1])
            if ($offset -le 300) {
                Write-Output "TimeSync | OK | Offset ${offset}s"
            } else {
                Write-Output "TimeSync | NG | Offset ${offset}s"
            }
        }
    }
} catch {
    Write-Output "TimeSync | NG | Check failed"
}

# 7. Internet Access
try {
    if (Test-NetConnection s3.amazonaws.com -Port 443 -InformationLevel Quiet) {
        Write-Output "InternetAccess | OK | HTTPS(443) reachable"
    } else {
        Write-Output "InternetAccess | NG | HTTPS(443) not reachable"
    }
} catch {
    Write-Output "InternetAccess | NG | Connection check failed"
}

# 8. Disk Space
try {
    $drive = Get-WmiObject Win32_LogicalDisk -Filter "DeviceID='C:'"
    $freeGB = [math]::Round($drive.FreeSpace / 1GB, 2)
    if ($freeGB -ge 20) {
        Write-Output "BootDiskFreeSpace | OK | $freeGB GB"
    } else {
        Write-Output "BootDiskFreeSpace | NG | $freeGB GB"
    }
} catch {
    Write-Output "BootDiskFreeSpace | NG | Check failed"
}

# 9. AWS Drivers (Info)
try {
    $drivers = Get-WmiObject Win32_PnPSignedDriver |
        Where-Object { $_.DeviceName -like "*AWS*" -or $_.DeviceName -like "*Amazon*" }
    foreach ($d in $drivers) {
        Write-Output "AWS-Driver | INFO | $($d.DeviceName) | Version $($d.DriverVersion)"
    }
} catch {
    Write-Output "AWS-Driver | WARN | Unable to list drivers"
}

Write-Output "=== PreCheck Finished ==="

=== AWSEC2-CloneInstanceAndUpgradeWindows PreCheck ===
OSVersion | OK | Microsoft Windows Server 2019 Datacenter
DomainController | OK | Not a Domain Controller
RDSRole | OK | No RDS roles installed
PowerShell | OK | Version 5
IAMRole | OK | arn:aws:iam::123456789012:instance-profile/AmazonSSMManagedInstanceCore
TimeSync | OK | Offset 0s
InternetAccess | OK | HTTPS(443) reachable
BootDiskFreeSpace | OK | 59.49 GB
AWS-Driver | INFO | Amazon Elastic Network Adapter | Version 2.11.0.0
AWS-Driver | INFO | AWS NVMe Elastic Block Storage Adapter | Version 1.7.0.39
=== PreCheck Finished ===

=== AWSEC2-CloneInstanceAndUpgradeWindows PreCheck ===
OSVersion | OK | Microsoft Windows Server 2016 Datacenter
DomainController | OK | Not a Domain Controller
RDSRole | OK | No RDS roles installed
PowerShell | OK | Version 5
IAMRole | OK | arn:aws:iam::123456789012:instance-profile/AmazonSSMManagedInstanceCore
TimeSync | OK | Offset 0s
InternetAccess | OK | HTTPS(443) reachable
BootDiskFreeSpace | NG | 7.25 GB
AWS-Driver | INFO | Amazon Elastic Network Adapter | Version 2.11.0.0
AWS-Driver | INFO | AWS NVMe Elastic Block Storage Adapter | Version 1.7.0.39
=== PreCheck Finished ===