CDKで作る！プライベートEC2インスタンス + EC2 Instance Connect Endpoint

import * as cdk from "aws-cdk-lib";
import { RemovalPolicy } from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

interface TestEc2StackProps extends cdk.StackProps {
  vpcConfig: {
    cidr: string;
  };
}

export class TestEc2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: TestEc2StackProps) {
    super(scope, id, props);

    const keyPair = new ec2.KeyPair(this, `KeyPair`, {
      keyPairName: `test-key-pair`,
    });
    keyPair.applyRemovalPolicy(RemovalPolicy.DESTROY);

    const ec2Role = new iam.Role(this, `TestEC2Role`, {
      roleName: `TestEc2Role`,
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      description: "IAM role for EC2 for testing",
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "AmazonSSMManagedInstanceCore"
        ),
      ],
    });

    // Create a VPC with a single private subnet
    const vpc = new ec2.Vpc(this, "Vpc", {
      ipAddresses: ec2.IpAddresses.cidr(props.vpcConfig.cidr),
      maxAzs: 1,
      subnetConfiguration: [
        {
          cidrMask: 28,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
    });

    // Get the private subnet
    const privateSubnetList = vpc.selectSubnets().subnets;

    const sgEic = new ec2.SecurityGroup(this, `EicSecurityGroup`, {
      vpc: vpc,
      description: "Security group for EC2 instance connect endpoint",
      allowAllOutbound: true,
    });

    const eic = new ec2.CfnInstanceConnectEndpoint(this, `Eic`, {
      subnetId: privateSubnetList[0].subnetId,
      clientToken: sgEic.securityGroupId,
      preserveClientIp: false,
      securityGroupIds: [sgEic.securityGroupId],
      tags: [
        {
          key: "Name",
          value: `test-eic-${vpc.vpcId}`,
        },
      ],
    });

    const sgTestEc2 = new ec2.SecurityGroup(this, `SgTestEc2`, {
      vpc: vpc,
      description: "Allow ICMP and SSH",
      allowAllOutbound: true,
      securityGroupName: `test-sg-ec2`,
    });

    sgTestEc2.addIngressRule(
      ec2.Peer.ipv4(vpc.vpcCidrBlock),
      ec2.Port.icmpPing(),
      "Allow ICMP from VPC"
    );

    sgTestEc2.addIngressRule(
      ec2.Peer.securityGroupId(sgEic.securityGroupId),
      ec2.Port.tcp(22),
      "Allow SSH from EIC Security Group"
    );

    const instanceName = `ec2-test`;
    const instance = new ec2.Instance(this, `Ec2Test`, {
      instanceType: ec2.InstanceType.of(
        ec2.InstanceClass.T2,
        ec2.InstanceSize.MICRO
      ),
      machineImage: new ec2.AmazonLinuxImage({
        generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2023,
      }),
      vpc: vpc,
      vpcSubnets: { subnets: privateSubnetList },
      securityGroup: sgTestEc2,
      keyPair: keyPair,
      instanceName: instanceName,
      role: ec2Role,
      blockDevices: [
        {
          deviceName: "/dev/xvda",
          volume: ec2.BlockDeviceVolume.ebs(8, {
            volumeType: ec2.EbsDeviceVolumeType.GP3,
            encrypted: true,
          }),
        },
      ],
    });
    instance.node.addDependency(eic);
  }
}