IaC: Packer、Terraform、Ansible で AWS EC2 をプロビジョニングする

aws s3 mb s3://my-good-terraform-remote-state-bucket --region ap-northeast-1

aws ssm put-parameter \
  --region "ap-northeast-1" \
  --name "/my-parameter/github/user-name" \
  --value "MY_GITHUB_USER_NAME" \
  --type "String"

aws ssm put-parameter \
  --region "ap-northeast-1" \
  --name "/my-parameter/github/access-token" \
  --value "MY_GITHUB_PERSONAL_ACCESS_TOKEN" \
  --type "SecureString"

{
  "type": "module"
}

import fs from "fs";

const logFilePath = "./my-app.log";

function addLog() {
  const now = new Date().toISOString();
  fs.appendFileSync(logFilePath, `${now}\n`, "utf8");
  console.log(`Log added: ${now}`);
}

addLog();
setInterval(addLog, 30_000);

---
- hosts: localhost
  connection: local
  become: true
  gather_facts: false

  vars:
    app_group: my-app-group
    app_user: my-app-user
    app_service_name: my-app
    exec_file_name: main.js
    exec_file_path: "{{ playbook_dir }}/{{ exec_file_name }}"

  tasks:
    - name: Create app system group
      group:
        name: "{{ app_group }}"
        system: true

    - name: Create app system user
      user:
        name: "{{ app_user }}"
        group: "{{ app_group }}"
        system: true
        shell: /usr/sbin/nologin
        create_home: true

    - name: Change ownership of app directory
      file:
        path: "{{ playbook_dir }}"
        owner: "{{ app_user }}"
        group: "{{ app_group }}"
        recurse: true

    - name: Create systemd unit for the app
      copy:
        dest: "/etc/systemd/system/{{ app_service_name }}.service"
        mode: "0644"
        content: |
          [Unit]
          Description=My App
          After=network.target

          [Service]
          ExecStart=/usr/bin/env node {{ exec_file_path }}
          WorkingDirectory={{ playbook_dir }}
          User={{ app_user }}
          Group={{ app_group }}
          Restart=always
          RestartSec=2
          StandardOutput=journal
          StandardError=journal

          [Install]
          WantedBy=multi-user.target
      notify: Reload systemd and restart my-app

    - name: Enable and start service
      systemd:
        name: "{{ app_service_name }}"
        enabled: true
        state: started

  handlers:
    - name: Reload systemd and restart my-app
      systemd:
        name: "{{ app_service_name }}"
        state: restarted
        daemon_reload: true

################################################################################
# Root configurations
################################################################################

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    region = "ap-northeast-1"
    bucket = "my-good-terraform-remote-state-bucket" # ✅ TODO: Set the actual value before running
    key    = "vpc/terraform.tfstate"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

################################################################################
# Definitions - VPC, Subnet, Security Group
################################################################################

resource "aws_vpc" "this" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
}

resource "aws_subnet" "this" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

resource "aws_route_table" "this" {
  vpc_id = aws_vpc.this.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
}

resource "aws_route_table_association" "this" {
  subnet_id      = aws_subnet.this.id
  route_table_id = aws_route_table.this.id
}

resource "aws_security_group" "this" {
  vpc_id = aws_vpc.this.id

  ###############################
  # Prohibit all inbound traffic
  ###############################
  # ingress {
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

################################################################################
# Outputs of the results
################################################################################

output "subnet_id" {
  value = aws_subnet.this.id
}

output "security_group_id" {
  value = aws_security_group.this.id
}

################################################################################
# Root configurations
################################################################################

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    region = "ap-northeast-1"
    bucket = "my-good-terraform-remote-state-bucket" # ✅ TODO: Set the actual value before running
    key    = "iam/terraform.tfstate"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

################################################################################
# Definitions - IAM
################################################################################

###################
# IAM Role for EC2
###################
data "aws_iam_policy_document" "ec2" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ec2" {
  assume_role_policy = data.aws_iam_policy_document.ec2.json
}

############################
# Instance Profile for EC2
############################
resource "aws_iam_instance_profile" "ec2" {
  role = aws_iam_role.ec2.name
}

################################################
# Attach SSM Session Manager Policy to IAM Role
################################################
resource "aws_iam_role_policy_attachment" "ssm_manager" {
  role       = aws_iam_role.ec2.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

##########################################
# Attach SSM Parameter Policy to IAM Role
##########################################
data "aws_kms_key" "ssm_parameter" {
  key_id = "alias/aws/ssm"
}

data "aws_iam_policy_document" "ssm_parameter" {
  statement {
    sid = "ReadAllParameters"
    actions = [
      "ssm:GetParameter",
      "ssm:GetParameters",
      "ssm:GetParametersByPath",
    ]
    resources = ["*"]
  }

  statement {
    sid       = "DecryptSecureStringWithDefaultAlias"
    actions   = ["kms:Decrypt"]
    resources = [data.aws_kms_key.ssm_parameter.arn]
  }
}

resource "aws_iam_policy" "ssm_parameter" {
  policy = data.aws_iam_policy_document.ssm_parameter.json
}

resource "aws_iam_role_policy_attachment" "ssm_parameter" {
  role       = aws_iam_role.ec2.name
  policy_arn = aws_iam_policy.ssm_parameter.arn
}

################################################################################
# Outputs of the results
################################################################################

output "iam_instance_profile" {
  value = aws_iam_instance_profile.ec2.name
}

################################################################################
# Root Configurations
################################################################################

packer {
  required_version = ">= 1.9.0"

  required_plugins {
    amazon = {
      source  = "github.com/hashicorp/amazon"
      version = ">= 1.3.0"
    }
    ansible = {
      source  = "github.com/hashicorp/ansible"
      version = ">= 1.1.0"
    }
  }
}

################################################################################
# Required variables
################################################################################

locals {
  subnet_id            = "subnet-059327c2ea7fc6263"             # ✅ TODO: Set the actual value before running
  security_group_id    = "sg-004a816e59eb88611"                 # ✅ TODO: Set the actual value before running
  iam_instance_profile = "terraform-20250925014517689700000003" # ✅ TODO: Set the actual value before running
}

################################################################################
# Definitions - AMI
################################################################################

source "amazon-ebs" "this" {
  source_ami    = "ami-0925d63721690c5b8" # ✅ TODO: Update if necessary
  region        = "ap-northeast-1"
  instance_type = "t3.micro"
  ssh_username  = "ec2-user"
  ami_name      = "my-ami-{{timestamp}}"

  force_deregister      =  true
  force_delete_snapshot = true

  subnet_id            = local.subnet_id
  security_group_id    = local.security_group_id
  associate_public_ip_address = true
  ssh_interface        = "session_manager"
  iam_instance_profile = local.iam_instance_profile
}

build {
  sources = ["source.amazon-ebs.this"]

  # 1. Install Ansible
  provisioner "shell" {
    execute_command = "sudo -E sh -c '{{ .Vars }} {{ .Path }}'" # Run as root
    inline = [
      "dnf -y update",
      "dnf -y install ansible-core",
      "ansible --version"
    ]
  }

  # 2. Run Ansible Playbook
  provisioner "ansible-local" {
    playbook_file = "./site.yml"
  }

  # 3. Output results to a file
  post-processor "manifest" {
    output = "manifest.json"
  }
}

- hosts: localhost
  connection: local
  become: true
  gather_facts: false

  tasks:
    - name: Install AWS CLI
      block:
        - ansible.builtin.dnf:
            name: awscli
            state: present
        - ansible.builtin.command: aws --version
          register: aws_cli_result
        - ansible.builtin.debug:
            msg: "AWS CLI version: {{ aws_cli_result.stdout }}"

    - name: Install Git
      block:
        - ansible.builtin.dnf:
            name: git
            state: present
        - ansible.builtin.command: git --version
          register: git_result
        - ansible.builtin.debug:
            msg: "Git version: {{ git_result.stdout }}"

    - name: Install Node.js
      block:
        - ansible.builtin.dnf:
            name: nodejs
            state: present
        - ansible.builtin.command: node --version
          register: node_result
        - ansible.builtin.debug:
            msg: "Node.js version: {{ node_result.stdout }}"

################################################################################
# Root configurations
################################################################################

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    region = "ap-northeast-1"
    bucket = "my-good-terraform-remote-state-bucket" # ✅ TODO: Set the actual value before running
    key    = "ec2/terraform.tfstate"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

################################################################################
# Required variables
################################################################################

locals {
  ami_id               = "ami-098e641373fce0096"                # ✅ TODO: Set the actual value before running
  subnet_id            = "subnet-059327c2ea7fc6263"             # ✅ TODO: Set the actual value before running
  security_group_id    = "sg-004a816e59eb88611"                 # ✅ TODO: Set the actual value before running
  iam_instance_profile = "terraform-20250925014517689700000003" # ✅ TODO: Set the actual value before running
}

################################################################################
# Definitions - EC2
################################################################################

resource "aws_instance" "this" {
  ami           = local.ami_id
  instance_type = "t3.micro"

  subnet_id              = local.subnet_id
  vpc_security_group_ids = [local.security_group_id]

  associate_public_ip_address = true
  iam_instance_profile        = local.iam_instance_profile

  user_data                   = file("${path.module}/cloud-init.yml")
  user_data_replace_on_change = true
}

################################################################################
# Outputs of the results
################################################################################

output "aws_instance" {
  value = aws_instance.this.id
}

#cloud-config
package_update: false
package_upgrade: false
packages: []

write_files:
  - path: /root/my-bootstrap.sh
    permissions: "0755"
    owner: root:root
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      ##########################################################################
      SSM_REGION="ap-northeast-1"
      SSM_PARAMETER_STORE_KEY_GITHUB_USER_NAME="/my-parameter/github/user-name"       # ✅ TODO: Set the actual value before running
      SSM_PARAMETER_STORE_KEY_GITHUB_ACCESS_TOKEN="/my-parameter/github/access-token" # ✅ TODO: Set the actual value before running
      GITHUB_ORGANIZATION_NAME="my-org"                                               # ✅ TODO: Set the actual value before running
      GITHUB_REPOSITORY_NAME="my-repo"                                                # ✅ TODO: Set the actual value before running
      PLAYBOOK_FILE_PATH="site.yml"                                                   # ✅ TODO: Set the actual value before running
      ##########################################################################

      # Create directory
      CHECKOUT_DIRECTORY="/opt/my-app"
      rm -rf "${CHECKOUT_DIRECTORY}"
      mkdir -p "${CHECKOUT_DIRECTORY}"

      # Fetch GitHub credentials from SSM Parameter Store
      # Use --with-decryption option for SecureString
      GITHUB_USER_NAME="$(aws ssm get-parameter --region "${SSM_REGION}" --name "${SSM_PARAMETER_STORE_KEY_GITHUB_USER_NAME}" --query 'Parameter.Value' --output text)"
      GITHUB_ACCESS_TOKEN="$(aws ssm get-parameter --region "${SSM_REGION}" --with-decryption --name "${SSM_PARAMETER_STORE_KEY_GITHUB_ACCESS_TOKEN}" --query 'Parameter.Value' --output text)"

      # Clone repository
      cd "${CHECKOUT_DIRECTORY}"
      GITHUB_REPOSITORY_URL_WITH_CREDENTIAL="https://${GITHUB_USER_NAME}:${GITHUB_ACCESS_TOKEN}@github.com/${GITHUB_ORGANIZATION_NAME}/${GITHUB_REPOSITORY_NAME}.git"
      git clone --depth=1 "${GITHUB_REPOSITORY_URL_WITH_CREDENTIAL}" .

      # Run Ansible
      cd "${CHECKOUT_DIRECTORY}"
      ansible-playbook "${PLAYBOOK_FILE_PATH}"

runcmd:
  - [bash, -lc, "/root/my-bootstrap.sh >> /var/log/my-bootstrap.log 2>&1"]