Packer、Terraform、Ansible で AWS EC2 をプロビジョニングする

aws s3 mb s3://my-sample-bucket --region ap-northeast-1

aws ssm put-parameter \
  --region "ap-northeast-1" \
  --name "/my-sample-parameter/github/user-name" \
  --value "MY_GITHUB_USER_NAME" \
  --type "String"

aws ssm put-parameter \
  --region "ap-northeast-1" \
  --name "/my-sample-parameter/github/access-token" \
  --value "MY_GITHUB_PERSONAL_ACCESS_TOKEN" \
  --type "SecureString"

################################################################################
# Root configurations
################################################################################

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    region = "ap-northeast-1"
    bucket = "my-super-great-awesome-remote-state-bucket" # ✅ TODO: Set the actual value before running
    key    = "vpc-iam/terraform.tfstate"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

################################################################################
# Definitions - VPC, Subnet, Security Group
################################################################################

resource "aws_vpc" "this" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
}

resource "aws_subnet" "this" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true
}

resource "aws_route_table" "this" {
  vpc_id = aws_vpc.this.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
}

resource "aws_route_table_association" "this" {
  subnet_id      = aws_subnet.this.id
  route_table_id = aws_route_table.this.id
}

resource "aws_security_group" "this" {
  vpc_id = aws_vpc.this.id

  ################################
  # Prohibit all inbound traffic
  ################################
  # ingress {
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

################################################################################
# Definitions - IAM
################################################################################

data "aws_iam_policy_document" "this" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "this" {
  assume_role_policy = data.aws_iam_policy_document.this.json
}

resource "aws_iam_role_policy_attachment" "this" {
  role       = aws_iam_role.this.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "this" {
  role = aws_iam_role.this.name
}

################################################################################
# Outputs of the results
################################################################################

output "subnet_id" {
  value = aws_subnet.this.id
}

output "security_group_id" {
  value = aws_security_group.this.id
}

output "iam_instance_profile" {
  value = aws_iam_instance_profile.this.name
}

{
  "iam_instance_profile": {
    "value": "terraform-20250924021127296400000003"
  },
  "security_group_id": {
    "value": "sg-0771f216351be7bc2"
  },
  "subnet_id": {
    "value": "subnet-0285eefb82ce847ed"
  }
}

################################################################################
# Root Configurations
################################################################################

packer {
  required_version = ">= 1.9.0"

  required_plugins {
    amazon = {
      source  = "github.com/hashicorp/amazon"
      version = ">= 1.3.0"
    }
    ansible = {
      source  = "github.com/hashicorp/ansible"
      version = ">= 1.1.0"
    }
  }
}

################################################################################
# Required variables
################################################################################

locals {
  subnet_id            = "subnet-0285eefb82ce847ed"             # ✅ TODO: Set the actual value before running
  security_group_id    = "sg-0771f216351be7bc2"                 # ✅ TODO: Set the actual value before running
  iam_instance_profile = "terraform-20250924021127296400000003" # ✅ TODO: Set the actual value before running
}

################################################################################
# Definitions - AMI
################################################################################

source "amazon-ebs" "this" {
  source_ami    = "ami-0925d63721690c5b8" # ✅ TODO: Update if necessary
  region        = "ap-northeast-1"
  instance_type = "t3.micro"
  ssh_username  = "ec2-user"
  ami_name      = "my-ami-{{timestamp}}"

  force_deregister      =  true
  force_delete_snapshot = true

  subnet_id            = local.subnet_id
  security_group_id    = local.security_group_id
  associate_public_ip_address = true
  ssh_interface        = "session_manager"
  iam_instance_profile = local.iam_instance_profile
}

build {
  sources = ["source.amazon-ebs.this"]

  # 1. Install Ansible
  provisioner "shell" {
    execute_command = "sudo -E sh -c '{{ .Vars }} {{ .Path }}'" # Run as root
    inline = [
      "dnf -y update",
      "dnf -y install ansible-core",
      "ansible --version"
    ]
  }

  # 2. Run Ansible Playbook
  provisioner "ansible-local" {
    playbook_file = "./site.yml"
  }

  # 3. Output results to a file
  post-processor "manifest" {
    output = "manifest.json"
  }
}

- hosts: localhost
  connection: local
  become: true
  gather_facts: false

  tasks:
    - name: Install AWS CLI
      block:
        - ansible.builtin.dnf:
            name: awscli
            state: present
        - ansible.builtin.command: aws --version
          register: aws_result
        - ansible.builtin.debug:
            msg: "AWS CLI version: {{ aws_result.stdout }}"

    - name: Install Git
      block:
        - ansible.builtin.dnf:
            name: git
            state: present
        - ansible.builtin.command: git --version
          register: git_result
        - ansible.builtin.debug:
            msg: "Git version: {{ git_result.stdout }}"

    - name: Install Node.js
      block:
        - ansible.builtin.dnf:
            name: nodejs
            state: present
        - ansible.builtin.command: node --version
          register: node_result
        - ansible.builtin.debug:
            msg: "Node.js version: {{ node_result.stdout }}"

################################################################################
# Root configurations
################################################################################

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    region = "ap-northeast-1"
    bucket = "my-super-great-awesome-remote-state-bucket" # ✅ TODO: Set the actual value before running
    key    = "ec2/terraform.tfstate"
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

################################################################################
# Required variables
################################################################################

locals {
  ami_id               = "ami-098e641373fce0096"                # ✅ TODO: Set the actual value before running
  subnet_id            = "subnet-0285eefb82ce847ed"             # ✅ TODO: Set the actual value before running
  security_group_id    = "sg-0771f216351be7bc2"                 # ✅ TODO: Set the actual value before running
  iam_instance_profile = "terraform-20250924021127296400000003" # ✅ TODO: Set the actual value before running
}

################################################################################
# Definitions - EC2
################################################################################

resource "aws_instance" "this" {
  ami           = local.ami_id
  instance_type = "t3.micro"

  subnet_id              = local.subnet_id
  vpc_security_group_ids = [local.security_group_id]

  associate_public_ip_address = true
  iam_instance_profile        = local.iam_instance_profile

  user_data                   = file("${path.module}/cloud-init.yml")
  user_data_replace_on_change = true
}

################################################################################
# Outputs of the results
################################################################################

output "aws_instance" {
  value = aws_instance.this.id
}

#cloud-config
package_update: false
package_upgrade: false
packages: []

write_files:
  - path: /root/my-bootstrap.sh
    permissions: "0755"
    owner: root:root
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      ##########################################################################
      SSM_REGION="ap-northeast-1"
      SSM_PARAMETER_STORE_KEY_GITHUB_USER_NAME="/my-parameter/github/user-name"       # ✅ TODO: Set the actual value before running
      SSM_PARAMETER_STORE_KEY_GITHUB_ACCESS_TOKEN="/my-parameter/github/access-token" # ✅ TODO: Set the actual value before running
      GITHUB_ORGANIZATION_NAME="my-org"                                               # ✅ TODO: Set the actual value before running
      GITHUB_REPOSITORY_NAME="my-repo"                                                # ✅ TODO: Set the actual value before running
      APP_EXEC_FILE_PATH="app/main.js"                                                # ✅ TODO: Set the actual value before running
      PLAYBOOK_FILE_PATH="terraform/site.yml"                                         # ✅ TODO: Set the actual value before running
      ##########################################################################

      # Create directory
      CHECKOUT_DIRECTORY="/opt/my-app"
      rm -rf "${CHECKOUT_DIRECTORY}"
      mkdir -p "${CHECKOUT_DIRECTORY}"

      # Fetch GitHub credentials from SSM Parameter Store
      # Use --with-decryption option for SecureString
      GITHUB_USER_NAME="$(aws ssm get-parameter --region "${SSM_REGION}" --name "${SSM_PARAMETER_STORE_KEY_GITHUB_USER_NAME}" --query 'Parameter.Value' --output text)"
      GITHUB_ACCESS_TOKEN="$(aws ssm get-parameter --region "${SSM_REGION}" --with-decryption --name "${SSM_PARAMETER_STORE_KEY_GITHUB_ACCESS_TOKEN}" --query 'Parameter.Value' --output text)"

      # Clone repository
      cd "${CHECKOUT_DIRECTORY}"
      GITHUB_REPOSITORY_URL_WITH_CREDENTIAL="https://${GITHUB_USER_NAME}:${GITHUB_ACCESS_TOKEN}@github.com/${GITHUB_ORGANIZATION_NAME}/${GITHUB_REPOSITORY_NAME}.git"
      git clone --depth=1 "${GITHUB_REPOSITORY_URL_WITH_CREDENTIAL}" .

      # Run Ansible
      cd "${CHECKOUT_DIRECTORY}"
      EXEC_FILE_PATH="${CHECKOUT_DIRECTORY}/${APP_EXEC_FILE_PATH}"
      ansible-playbook \
        -e "my_exec_file_path=${EXEC_FILE_PATH}" \
        "${PLAYBOOK_FILE_PATH}"

runcmd:
  - [bash, -lc, "/root/my-bootstrap.sh >> /var/log/my-bootstrap.log 2>&1"]

aws_instance = "i-08712b45d86e03d6b"

terraform destroy

terraform destroy