セッションマネージャーを使用してプライベートサブネットのLinux用EC2にアクセス(NAT Gateway編)

####################
# VPC
####################
resource "aws_vpc" "vpc" {
  cidr_block           = "10.0.0.0/16"
  instance_tenancy     = "default"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "inomaso-dev-vpc"
  }
}

####################
# Subnet
####################
resource "aws_subnet" "sub_front_1a" {
  vpc_id     = aws_vpc.vpc.id
  cidr_block = "10.0.1.0/24"
  # パブリック IPv4 アドレスの自動割り当て
  map_public_ip_on_launch = true
  availability_zone       = "ap-northeast-1a"

  tags = {
    Name = "inomaso-dev-front-subnet-a"
  }
}

resource "aws_subnet" "sub_app_1a" {
  vpc_id     = aws_vpc.vpc.id
  cidr_block = "10.0.11.0/24"
  availability_zone = "ap-northeast-1a"

  tags = {
    Name = "inomaso-dev-app-subnet-a"
  }
}

####################
# Internet Gateway
####################
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "inomaso-dev-igw"
  }
}

####################
# Route Table
####################
resource "aws_route_table" "front_rt" {
  vpc_id = aws_vpc.vpc.id

  # インターネットゲートウェイ向けのルート追加
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }

  tags = {
    Name = "inomaso-dev-front-rtb"
  }
}

resource "aws_route_table" "app_rt" {
  vpc_id = aws_vpc.vpc.id

  tags = {
    Name = "inomaso-dev-app-rtb"
  }
}

####################
# Route Association
####################
resource "aws_route_table_association" "sub_front_1a_rt_assocication" {
  subnet_id      = aws_subnet.sub_front_1a.id
  route_table_id = aws_route_table.front_rt.id
}

resource "aws_route_table_association" "sub_app_1a_rt_assocication" {
  subnet_id      = aws_subnet.sub_app_1a.id
  route_table_id = aws_route_table.app_rt.id
}

####################
# NatGateway
####################
resource "aws_eip" "ngw_a" {
  vpc = true
  # EIPは暗黙的にIGWに依存している。
  depends_on = [aws_internet_gateway.igw]

  tags = {
    Name = "inomaso-dev-ngw-a-eip"
  }
}

resource "aws_nat_gateway" "sub_front_1a" {
  allocation_id = aws_eip.ngw_a.id
  subnet_id     = aws_subnet.sub_front_1a.id
  # NATゲートウェイは暗黙的にIGWに依存している。
  depends_on = [aws_internet_gateway.igw]
  tags = {
    Name = "inomaso-dev-ngw"
  }
}

resource "aws_route" "app_rt" {
  route_table_id         = aws_route_table.app_rt.id
  nat_gateway_id         = aws_nat_gateway.sub_front_1a.id
  destination_cidr_block = "0.0.0.0/0"
}

####################
# EC2
####################
resource "aws_instance" "ec2" {
  # Amazon Linux 2
  ami                         = "ami-06098fd00463352b6"
  instance_type               = "t3.micro"
  vpc_security_group_ids      = [aws_security_group.ec2.id]
  key_name  = "aws-ssh-key"
  subnet_id = aws_subnet.sub_app_1a.id

  # EBS最適化を有効
  ebs_optimized = "true"

  # IAM Role
  iam_instance_profile = "EC2RoleforSSM"

  # EBSのルートボリューム設定
  root_block_device {
    # ボリュームサイズ(GiB)
    volume_size = 8
    # ボリュームタイプ
    volume_type = "gp3"
    # GP3のIOPS
    iops = 3000
    # GP3のスループット
    throughput = 125
    # EC2終了時に削除
    delete_on_termination = true

    # EBSのNameタグ
    tags = {
      Name = "inomaso-dev-ec2"
    }
  }

  # EC2のNameタグ
  tags = {
    Name = "inomaso-dev-ec2"
  }
}

####################
# EC2 Security Group
####################
resource "aws_security_group" "ec2" {
  name        = "inomaso-dev-ec2-sg"
  description = "inomaso-dev-ec2-sg"
  vpc_id      = aws_vpc.vpc.id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "inomaso-dev-ec2-sg"
  }
}


####################
# EC2 IAM Role
####################
data "aws_iam_policy_document" "ssm_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_instance_profile" "ssm_role" {
  name = "EC2RoleforSSM"
  role = aws_iam_role.ssm_role.name
}

resource "aws_iam_role" "ssm_role" {
  name               = "EC2RoleforSSM"
  assume_role_policy = data.aws_iam_policy_document.ssm_role.json
}

resource "aws_iam_role_policy_attachment" "ssm_role" {
  role       = aws_iam_role.ssm_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

```
####################
# VPC Endpoint IAM Role
####################
data "aws_iam_policy_document" "assume_role" {
  statement {
    effect    = "Allow"
    actions   = [ "sts:AssumeRole" ]
    principals {
      type = "AWS"
      identifiers = [ "arn:aws:iam::1234567890:user/hogehoge" ]
    }
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values   = ["true"]
    }
  }
}

resource "aws_iam_role" "session_role" {
  name               = "SessionRoleforSSM"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "ssm_startsesstion" {
  statement {
    effect    = "Allow"
    actions   = [ "ssm:StartSession" ]
    resources = [ 
      "arn:aws:ec2:*:*:instance/*",
      "arn:aws:ssm:*:*:document/AWS-StartSSHSession"
    ]
  }
}

resource "aws_iam_role_policy" "session_role" {
  name = "SSMSession_policy"
  role = aws_iam_role.session_role.id
  policy = data.aws_iam_policy_document.ssm_startsesstion.json
}
```