AWS Systems Manager のパラメータストアスループット制限の上限引き上げ (Higher throughput 有効化) の設定を AWS CDK で実装する

			
			import * as cdk from "aws-cdk-lib";
import * as cr from "aws-cdk-lib/custom-resources";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

export class ParameterStoreConstruct extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Parameter Store のスループット設定の ARN
     */
    const highThroughputEnabledArn = cdk.Stack.of(this).formatArn({
      service: "ssm",
      resource: "servicesetting",
      resourceName: "ssm/parameter-store/high-throughput-enabled",
    });

    /**
     * カスタムリソース用の IAM ロール
     * - Lambda の実行ロール
     * - SSM のサービス設定を更新する権限
     */
    const customResourceRole = new iam.Role(this, "HighThroughputEnabledRole", {
      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "service-role/AWSLambdaBasicExecutionRole"
        ),
      ],
      inlinePolicies: {
        ParameterStoreServiceSettingPolicy: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              effect: iam.Effect.ALLOW,
              actions: ["ssm:UpdateServiceSetting", "ssm:ResetServiceSetting"],
              resources: [highThroughputEnabledArn],
            }),
          ],
        }),
      },
    });

    /**
     * Parameter Store のスループットを設定するカスタムリソース
     * - 作成時に Higher throughput を有効化
     * - 削除時に Higher throughput を無効化（デフォルトにリセット）
     */
    new cr.AwsCustomResource(this, "ThroughputSetting", {
      onCreate: {
        service: "SSM",
        action: "updateServiceSetting",
        parameters: {
          SettingId: highThroughputEnabledArn,
          SettingValue: "true",
        },
        physicalResourceId: cr.PhysicalResourceId.of(
          "parameter-store-throughput-setting"
        ),
      },
      onDelete: {
        service: "SSM",
        action: "resetServiceSetting",
        parameters: {
          SettingId: highThroughputEnabledArn,
        },
        physicalResourceId: cr.PhysicalResourceId.of(
          "parameter-store-throughput-setting"
        ),
      },
      role: customResourceRole, // IAM ロールを明示的に定義することにより、Lambda の実行ロールの権限を必要最低限に抑える
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });
  }
}