Amazon Timestream for InfluxDB 3 CoreとInfluxDB 3 ExplorerをCloudFormationで構築してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates a private single-node Timestream for InfluxDB 3 Core cluster and
  hosts InfluxDB 3 Explorer on a private EC2 instance. Administrators access
  Explorer through an SSM port-forwarding session.

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: VPC containing the private subnet and Timestream for InfluxDB 3.

  PrivateSubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: >
      First private subnet for the InfluxDB 3 cluster and the Explorer EC2
      instance. It must have access to Systems Manager and to the
      container/package repositories.

  PrivateSubnetId2:
    Type: AWS::EC2::Subnet::Id
    Description: >
      Second private subnet for the InfluxDB 3 cluster. It must be in a
      different Availability Zone from PrivateSubnetId.

  ExplorerInstanceType:
    Type: String
    Default: t3.small
    Description: EC2 instance type used to run InfluxDB 3 Explorer.
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large

  InfluxDbClusterName:
    Type: String
    Default: influxdb3-poc
    Description: Name of the Timestream for InfluxDB 3 Core cluster.
    MinLength: 3
    MaxLength: 40
    AllowedPattern: ^[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$

  InfluxDbInstanceType:
    Type: String
    Default: db.influx.large
    Description: Instance class for the single-node InfluxDB 3 Core cluster.
    AllowedValues:
      - db.influx.medium
      - db.influx.large
      - db.influx.xlarge
      - db.influx.2xlarge
      - db.influx.4xlarge
      - db.influx.8xlarge
      - db.influx.12xlarge
      - db.influx.16xlarge
      - db.influx.24xlarge

  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
    Description: SSM public parameter for the Amazon Linux 2023 AMI.

  ExplorerImage:
    Type: String
    Default: influxdata/influxdb3-ui:1.9.0
    Description: InfluxDB 3 Explorer container image.

  ExplorerMode:
    Type: String
    Default: admin
    AllowedValues:
      - admin
      - query
    Description: >
      Explorer operation mode. Use query with a read-only token when
      administrative functions are unnecessary.

Resources:
  ExplorerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Allows the Explorer EC2 instance to connect to Systems Manager.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Name
          Value: influxdb3-explorer-poc

  ExplorerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - Ref: ExplorerInstanceRole

  ExplorerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "InfluxDB 3 Explorer accessed through SSM Session Manager"
      VpcId:
        Ref: VpcId
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
          Description: PoC outbound access
      Tags:
        - Key: Name
          Value: influxdb3-explorer-poc

  InfluxDbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Private InfluxDB 3 cluster allowing Explorer on TCP 8086"
      VpcId:
        Ref: VpcId
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
          Description: PoC outbound access
      Tags:
        - Key: Name
          Value: influxdb3-poc

  InfluxDbIngressFromExplorer:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow InfluxDB 3 Explorer to connect over TLS.
      GroupId:
        Ref: InfluxDbSecurityGroup
      IpProtocol: tcp
      FromPort: 8086
      ToPort: 8086
      SourceSecurityGroupId:
        Ref: ExplorerSecurityGroup

  InfluxDbCluster:
    Type: AWS::Timestream::InfluxDBCluster
    DependsOn:
      - InfluxDbIngressFromExplorer
    Properties:
      Name:
        Ref: InfluxDbClusterName
      DbInstanceType:
        Ref: InfluxDbInstanceType
      DbParameterGroupIdentifier: InfluxDBV3Core
      NetworkType: IPV4
      Port: 8086
      PubliclyAccessible: false
      VpcSecurityGroupIds:
        - Ref: InfluxDbSecurityGroup
      VpcSubnetIds:
        - Ref: PrivateSubnetId
        - Ref: PrivateSubnetId2
      Tags:
        - Key: Name
          Value:
            Ref: InfluxDbClusterName
        - Key: Purpose
          Value: InfluxDB3PoC

  ExplorerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Ref: LatestAmiId
      InstanceType:
        Ref: ExplorerInstanceType
      IamInstanceProfile:
        Ref: ExplorerInstanceProfile
      MetadataOptions:
        HttpEndpoint: enabled
        HttpTokens: required
        HttpPutResponseHopLimit: 1
      NetworkInterfaces:
        - AssociatePublicIpAddress: false
          DeleteOnTermination: true
          DeviceIndex: "0"
          GroupSet:
            - Ref: ExplorerSecurityGroup
          SubnetId:
            Ref: PrivateSubnetId
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: true
            Encrypted: true
            VolumeSize: 20
            VolumeType: gp3
      UserData:
        Fn::Base64:
          Fn::Sub: |
            #!/bin/bash
            set -euxo pipefail
            exec > >(tee /var/log/influxdb3-explorer-user-data.log | logger -t user-data -s 2>/dev/console) 2>&1

            dnf install -y docker openssl
            systemctl enable --now docker

            install -d -m 0700 -o 1500 -g 1500 /opt/influxdb3-explorer/db
            install -d -m 0700 /etc/influxdb3-explorer

            SESSION_SECRET_KEY=$(openssl rand -hex 32)
            printf 'SESSION_SECRET_KEY=%s\n' "$SESSION_SECRET_KEY" \
              > /etc/influxdb3-explorer/explorer.env
            chmod 0600 /etc/influxdb3-explorer/explorer.env

            docker pull "${ExplorerImage}"
            docker run --detach \
              --name influxdb3-explorer \
              --publish 127.0.0.1:8888:8080 \
              --volume /opt/influxdb3-explorer/db:/db:rw \
              --env-file /etc/influxdb3-explorer/explorer.env \
              --restart unless-stopped \
              "${ExplorerImage}" \
              --mode="${ExplorerMode}"
      Tags:
        - Key: Name
          Value: influxdb3-explorer-poc
        - Key: Purpose
          Value: InfluxDB3Explorer

Outputs:
  ExplorerInstanceId:
    Description: Target instance ID for the SSM port-forwarding session.
    Value:
      Ref: ExplorerInstance

  ExplorerSecurityGroupId:
    Description: Security group attached to the Explorer EC2 instance.
    Value:
      Ref: ExplorerSecurityGroup

  InfluxDbClusterId:
    Description: Service-generated identifier of the InfluxDB 3 cluster.
    Value:
      Fn::GetAtt:
        - InfluxDbCluster
        - Id

  InfluxDbClusterArn:
    Description: ARN of the InfluxDB 3 cluster.
    Value:
      Fn::GetAtt:
        - InfluxDbCluster
        - Arn

  InfluxDbSecurityGroupId:
    Description: Security group attached to the InfluxDB 3 cluster.
    Value:
      Ref: InfluxDbSecurityGroup

  InfluxDbEndpoint:
    Description: Private endpoint of the InfluxDB 3 cluster.
    Value:
      Fn::GetAtt:
        - InfluxDbCluster
        - Endpoint

  InfluxDbServerUrl:
    Description: URL to register under Explorer Configure > Servers.
    Value:
      Fn::Sub:
        - https://${Endpoint}:8086
        - Endpoint:
            Fn::GetAtt:
              - InfluxDbCluster
              - Endpoint

  InfluxAuthParametersSecretArn:
    Description: >
      Secrets Manager ARN containing the initial InfluxDB authorization
      parameters generated by the service.
    Value:
      Fn::GetAtt:
        - InfluxDbCluster
        - InfluxAuthParametersSecretArn

  StartPortForwardingCommand:
    Description: Run this command locally, and then open http://localhost:8888.
    Value:
      Fn::Sub: >-
        aws ssm start-session
        --target ${ExplorerInstance}
        --document-name AWS-StartPortForwardingSession
        --parameters '{"portNumber":["8888"],"localPortNumber":["8888"]}'

  ExplorerUrl:
    Description: Local URL available while the SSM session is running.
    Value: http://localhost:8888