【小ネタ】TerraformでSSMセッションマネージャー接続エラー、原因はAMI選択ミス

################################################################################
# Data Sources                                                                 #
################################################################################
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

################################################################################
# VPC                                                                          #
################################################################################
module "vpc" {
  source     = "../../modules/vpc"
  name       = "${var.project_name}-${var.env}-vpc"
  cidr_block = var.vpc_cidr_block

  igw_name = "${var.project_name}-${var.env}-igw"

  subnets = {
    "public_a" = {
      name              = "${var.project_name}-${var.env}-subnet-publ-a"
      cidr_block        = var.public_subnets.a.cidr_block
      availability_zone = "ap-northeast-1a"

      route_tables = ["public"]
      network_acl  = "public"
    },
    "protected_a" = {
      name              = "${var.project_name}-${var.env}-subnet-prot-a"
      cidr_block        = var.protected_subnets.a.cidr_block
      availability_zone = "ap-northeast-1a"

      route_tables = ["protected_a"]
      network_acl  = "protected"
    }
  }

  route_tables = {
    "public" = {
      name                 = "${var.project_name}-${var.env}-rtb-publ",
      use_internet_gateway = true,
    },
    "protected_a" = {
      name        = "${var.project_name}-${var.env}-rtb-prot-a",
      nat_gateway = "ngw_a"
    }
  }

  nat_gateways = {
    "ngw_a" = {
      name      = "${var.project_name}-${var.env}-ngw-a"
      subnet_id = "public_a"
    }
  }

  network_acls = {
    "public" = {
      name = "${var.project_name}-${var.env}-nacl-publ"
      ingress = [
        {
          rule_no    = 100
          protocol   = "-1"
          action     = "allow"
          cidr_block = "0.0.0.0/0"
          from_port  = 0
          to_port    = 0
        }
      ]
      egress = [
        {
          rule_no    = 100
          protocol   = "-1"
          action     = "allow"
          cidr_block = "0.0.0.0/0"
          from_port  = 0
          to_port    = 0
        }
      ]
    },
    "protected" = {
      name = "${var.project_name}-${var.env}-nacl-prot"
      ingress = [
        {
          rule_no    = 100
          protocol   = "-1"
          action     = "allow"
          cidr_block = "0.0.0.0/0"
          from_port  = 0
          to_port    = 0
        }
      ]
      egress = [
        {
          rule_no    = 100
          protocol   = "-1"
          action     = "allow"
          cidr_block = "0.0.0.0/0"
          from_port  = 0
          to_port    = 0
        }
      ]
    }
  }

  security_groups = {
    "sg_ec2" = {
      name        = "${var.project_name}-${var.env}-sg-ec2"
      description = "Security group for EC2"

      egress = [
        {
          description = "All outbound traffic"
          from_port   = 0
          to_port     = 0
          protocol    = "-1"
          cidr_blocks = ["0.0.0.0/0"]
        }
      ]
    }
  }
}

################################################################################
# EC2                                                                          #
################################################################################

data "aws_ami" "amazon_linux_2023" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# EC2用のIAMロール（モジュール使用）
module "ec2_iam_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role"
  version = "~> 6.4"

  name            = "${var.project_name}-${var.env}-role-ec2"
  use_name_prefix = false

  create_instance_profile = true

  # Trust policy（EC2が引き受けるロール）
  trust_policy_permissions = {
    EC2AssumeRole = {
      actions = ["sts:AssumeRole"]
      principals = [
        {
          type        = "Service"
          identifiers = ["ec2.amazonaws.com"]
        }
      ]
    }
  }

  # マネージドポリシー（SSM接続用）
  policies = {
    AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  }

  tags = {
    Name = "${var.project_name}-${var.env}-role-ec2"
  }
}

# EC2インスタンス
module "ec2" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "~> 6.2"

  name = "${var.project_name}-${var.env}-ec2"

  ami                    = data.aws_ami.amazon_linux_2023.id
  instance_type          = "t3.micro"
  subnet_id              = module.vpc.subnets["protected_a"].id
  vpc_security_group_ids = [module.vpc.security_groups["sg_ec2"].id]
  create_security_group  = false

  iam_instance_profile = module.ec2_iam_role.instance_profile_name

  # EBSボリューム設定
  root_block_device = {
    volume_type = "gp3"
    volume_size = 8
    encrypted   = true
  }

  tags = {
    Name = "${var.project_name}-${var.env}-ec2"
  }
}