# EC2 の料金見積もりに役立つコマンド
# インスタンスタイプの料金情報を取得（AWS Pricing API）
aws pricing get-products \
  --service-code AmazonEC2 \
  --filters \
    "Type=TERM_MATCH,Field=instanceType,Value=t3.small" \
    "Type=TERM_MATCH,Field=location,Value=Asia Pacific (Tokyo)" \
    "Type=TERM_MATCH,Field=operatingSystem,Value=Linux" \
    "Type=TERM_MATCH,Field=tenancy,Value=Shared" \
    "Type=TERM_MATCH,Field=preInstalledSw,Value=NA" \
  --region us-east-1 \
  --query 'PriceList[0]' \
  --output json | jq '.terms.OnDemand | to_entries[0].value.priceDimensions | to_entries[0].value.pricePerUnit.USD'

# Graviton インスタンスの料金比較
# Intel vs Graviton の料金差を確認
echo "=== t3.medium (Intel x86_64) ==="
aws pricing get-products \
  --service-code AmazonEC2 \
  --filters \
    "Type=TERM_MATCH,Field=instanceType,Value=t3.medium" \
    "Type=TERM_MATCH,Field=location,Value=Asia Pacific (Tokyo)" \
    "Type=TERM_MATCH,Field=operatingSystem,Value=Linux" \
  --region us-east-1 --output json 2>/dev/null | jq -r '.PriceList[0]' | jq -r '.terms.OnDemand | to_entries[0].value.priceDimensions | to_entries[0].value.pricePerUnit.USD'
 
echo "=== t4g.medium (Graviton2 ARM64) ==="
aws pricing get-products \
  --service-code AmazonEC2 \
  --filters \
    "Type=TERM_MATCH,Field=instanceType,Value=t4g.medium" \
    "Type=TERM_MATCH,Field=location,Value=Asia Pacific (Tokyo)" \
    "Type=TERM_MATCH,Field=operatingSystem,Value=Linux" \
  --region us-east-1 --output json 2>/dev/null | jq -r '.PriceList[0]' | jq -r '.terms.OnDemand | to_entries[0].value.priceDimensions | to_entries[0].value.pricePerUnit.USD'

# T3 バーストモードの確認と設定
# 現在のクレジットバランスを確認
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUCreditBalance \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time "$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --period 300 \
  --statistics Average
 
# Unlimited モードの有効化
aws ec2 modify-instance-credit-specification \
  --instance-credit-specifications '[{
    "InstanceId": "i-0123456789abcdef0",
    "CpuCredits": "unlimited"
  }]'
 
# Unlimited モードの無効化（standard に戻す）
aws ec2 modify-instance-credit-specification \
  --instance-credit-specifications '[{
    "InstanceId": "i-0123456789abcdef0",
    "CpuCredits": "standard"
  }]'

# Amazon Linux 2023 の最新 AMI を検索
aws ec2 describe-images \
  --owners amazon \
  --filters \
    "Name=name,Values=al2023-ami-2023*-x86_64" \
    "Name=state,Values=available" \
  --query 'Images | sort_by(@, &CreationDate) | [-1].[ImageId,Name]' \
  --output text
 
# Amazon Linux 2023 ARM64 (Graviton) の最新 AMI
aws ec2 describe-images \
  --owners amazon \
  --filters \
    "Name=name,Values=al2023-ami-2023*-arm64" \
    "Name=state,Values=available" \
  --query 'Images | sort_by(@, &CreationDate) | [-1].[ImageId,Name]' \
  --output text
 
# Ubuntu 22.04 の最新 AMI を検索
aws ec2 describe-images \
  --owners 099720109477 \
  --filters \
    "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*" \
    "Name=state,Values=available" \
  --query 'Images | sort_by(@, &CreationDate) | [-1].ImageId' \
  --output text
 
# Ubuntu 24.04 の最新 AMI を検索
aws ec2 describe-images \
  --owners 099720109477 \
  --filters \
    "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*" \
    "Name=state,Values=available" \
  --query 'Images | sort_by(@, &CreationDate) | [-1].ImageId' \
  --output text
 
# SSM パラメータストアから最新 AMI を取得（推奨）
aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64 \
  --query 'Parameter.Value' --output text

# 稼働中のインスタンスから AMI を作成
aws ec2 create-image \
  --instance-id i-0123456789abcdef0 \
  --name "my-app-v1.2.0-$(date +%Y%m%d)" \
  --description "My App v1.2.0 with NGINX + Node.js" \
  --no-reboot \
  --tag-specifications '[
    {
      "ResourceType": "image",
      "Tags": [
        {"Key": "Name", "Value": "my-app-v1.2.0"},
        {"Key": "Version", "Value": "1.2.0"},
        {"Key": "CreatedBy", "Value": "automation"}
      ]
    },
    {
      "ResourceType": "snapshot",
      "Tags": [
        {"Key": "Name", "Value": "my-app-v1.2.0-snapshot"}
      ]
    }
  ]'
 
# AMI 一覧（自分のアカウント）
aws ec2 describe-images --owners self \
  --query 'Images[].[ImageId,Name,CreationDate,State]' \
  --output table
 
# AMI のリージョン間コピー
aws ec2 copy-image \
  --source-region ap-northeast-1 \
  --source-image-id ami-0abcdef1234567890 \
  --name "my-app-v1.2.0-us-east-1" \
  --description "Cross-region copy of my-app-v1.2.0" \
  --region us-east-1
 
# 古い AMI の登録解除とスナップショット削除
AMI_ID="ami-0abcdef1234567890"
# スナップショット ID を取得
SNAP_IDS=$(aws ec2 describe-images --image-ids $AMI_ID \
  --query 'Images[0].BlockDeviceMappings[*].Ebs.SnapshotId' --output text)
# AMI 登録解除
aws ec2 deregister-image --image-id $AMI_ID
# スナップショット削除
for SNAP_ID in $SNAP_IDS; do
  aws ec2 delete-snapshot --snapshot-id $SNAP_ID
done

# EC2 Image Builder のパイプラインを作成する例
# まずコンポーネントを定義
aws imagebuilder create-component \
  --name "install-web-server" \
  --semantic-version "1.0.0" \
  --platform Linux \
  --data '
name: InstallWebServer
schemaVersion: 1.0
phases:
  - name: build
    steps:
      - name: InstallNginx
        action: ExecuteBash
        inputs:
          commands:
            - dnf install -y nginx
            - systemctl enable nginx
      - name: InstallNodeJS
        action: ExecuteBash
        inputs:
          commands:
            - dnf install -y nodejs npm
  - name: validate
    steps:
      - name: ValidateNginx
        action: ExecuteBash
        inputs:
          commands:
            - nginx -t
            - node --version
'

# Web サーバー用セキュリティグループを作成
SG_ID=$(aws ec2 create-security-group \
  --group-name web-server-sg \
  --description "Security group for web servers" \
  --vpc-id vpc-0123456789abcdef0 \
  --tag-specifications 'ResourceType=security-group,Tags=[{Key=Name,Value=web-server-sg}]' \
  --query 'GroupId' --output text)
 
# SSH (管理用、特定 IP のみ)
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp --port 22 \
  --cidr 203.0.113.0/32
 
# HTTP
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp --port 80 \
  --cidr 0.0.0.0/0
 
# HTTPS
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp --port 443 \
  --cidr 0.0.0.0/0
 
# IPv6 対応
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --ip-permissions '[
    {"IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "Ipv6Ranges": [{"CidrIpv6": "::/0"}]},
    {"IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "Ipv6Ranges": [{"CidrIpv6": "::/0"}]}
  ]'
 
echo "Created Security Group: $SG_ID"
 
# セキュリティグループのルール一覧
aws ec2 describe-security-group-rules \
  --filter Name=group-id,Values=$SG_ID \
  --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4,ReferencedGroupInfo.GroupId]' \
  --output table

# 多層セキュリティグループを一括作成するスクリプト
#!/bin/bash
VPC_ID="vpc-0123456789abcdef0"
OFFICE_IP="203.0.113.0/32"
 
# ALB 用 SG
ALB_SG=$(aws ec2 create-security-group \
  --group-name alb-sg --description "ALB SG" --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $ALB_SG \
  --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id $ALB_SG \
  --protocol tcp --port 443 --cidr 0.0.0.0/0
 
# Web 用 SG（ALB からのみ）
WEB_SG=$(aws ec2 create-security-group \
  --group-name web-sg --description "Web SG" --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $WEB_SG \
  --protocol tcp --port 8080 --source-group $ALB_SG
 
# App 用 SG（Web からのみ）
APP_SG=$(aws ec2 create-security-group \
  --group-name app-sg --description "App SG" --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $APP_SG \
  --protocol tcp --port 3000 --source-group $WEB_SG
 
# DB 用 SG（App からのみ）
DB_SG=$(aws ec2 create-security-group \
  --group-name db-sg --description "DB SG" --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $DB_SG \
  --protocol tcp --port 3306 --source-group $APP_SG
 
echo "ALB: $ALB_SG | Web: $WEB_SG | App: $APP_SG | DB: $DB_SG"

# キーペアを作成（Ed25519 推奨）
aws ec2 create-key-pair \
  --key-name my-key-pair \
  --key-type ed25519 \
  --query 'KeyMaterial' \
  --output text > my-key-pair.pem
 
# パーミッション設定
chmod 400 my-key-pair.pem
 
# SSH 接続
ssh -i my-key-pair.pem ec2-user@<パブリックIP>
 
# EC2 Instance Connect（キーペア不要で接続）
aws ec2-instance-connect send-ssh-public-key \
  --instance-id i-0123456789abcdef0 \
  --instance-os-user ec2-user \
  --ssh-public-key file://~/.ssh/id_ed25519.pub

# Session Manager で接続（SSH ポート不要）
aws ssm start-session --target i-0123456789abcdef0
 
# ポートフォワーディング（ローカルの 8080 → リモートの 80）
aws ssm start-session \
  --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["80"],"localPortNumber":["8080"]}'
 
# RDS へのポートフォワーディング（踏み台不要）
aws ssm start-session \
  --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{
    "host": ["my-db.xxxx.ap-northeast-1.rds.amazonaws.com"],
    "portNumber": ["3306"],
    "localPortNumber": ["3306"]
  }'

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession",
        "ssm:TerminateSession",
        "ssm:ResumeSession"
      ],
      "Resource": [
        "arn:aws:ec2:ap-northeast-1:123456789012:instance/*",
        "arn:aws:ssm:ap-northeast-1:123456789012:document/AWS-StartPortForwardingSession",
        "arn:aws:ssm:ap-northeast-1:123456789012:document/AWS-StartPortForwardingSessionToRemoteHost"
      ],
      "Condition": {
        "StringLike": {
          "ssm:resourceTag/Environment": ["production", "staging"]
        }
      }
    }
  ]
}

# EC2 用の IAM ロールを作成
aws iam create-role \
  --role-name EC2-WebServer-Role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {"Service": "ec2.amazonaws.com"},
        "Action": "sts:AssumeRole"
      }
    ]
  }'
 
# SSM 用ポリシーをアタッチ（Session Manager に必要）
aws iam attach-role-policy \
  --role-name EC2-WebServer-Role \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
 
# S3 読み取り用ポリシーをアタッチ
aws iam attach-role-policy \
  --role-name EC2-WebServer-Role \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 
# インスタンスプロファイルを作成してロールを紐付け
aws iam create-instance-profile \
  --instance-profile-name EC2-WebServer-Profile
 
aws iam add-role-to-instance-profile \
  --instance-profile-name EC2-WebServer-Profile \
  --role-name EC2-WebServer-Role
 
# 既存のインスタンスにプロファイルをアタッチ
aws ec2 associate-iam-instance-profile \
  --instance-id i-0123456789abcdef0 \
  --iam-instance-profile Name=EC2-WebServer-Profile

# gp2 ボリュームを gp3 に変更
aws ec2 modify-volume \
  --volume-id vol-0123456789abcdef0 \
  --volume-type gp3 \
  --iops 3000 \
  --throughput 125
 
# 変更状態の確認
aws ec2 describe-volumes-modifications \
  --volume-ids vol-0123456789abcdef0 \
  --query 'VolumesModifications[0].[ModificationState,TargetVolumeType,TargetIops,TargetThroughput,Progress]' \
  --output table
 
# 全 gp2 ボリュームを一覧表示（移行候補の特定）
aws ec2 describe-volumes \
  --filters "Name=volume-type,Values=gp2" \
  --query 'Volumes[].[VolumeId,Size,Iops,State,Attachments[0].InstanceId]' \
  --output table

# gp3 ボリュームを作成（100GB, 5000 IOPS）
VOL_ID=$(aws ec2 create-volume \
  --volume-type gp3 \
  --size 100 \
  --iops 5000 \
  --throughput 250 \
  --availability-zone ap-northeast-1a \
  --encrypted \
  --kms-key-id alias/ebs-key \
  --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=data-vol}]' \
  --query 'VolumeId' --output text)
 
# インスタンスにアタッチ
aws ec2 attach-volume \
  --volume-id $VOL_ID \
  --instance-id i-0123456789abcdef0 \
  --device /dev/sdf
 
# Linux でのボリュームフォーマットとマウント
# (User Data またはSSH接続後に実行)
# デバイスの確認
lsblk
# ファイルシステム作成
sudo mkfs -t xfs /dev/nvme1n1
# マウントポイント作成
sudo mkdir /data
# マウント
sudo mount /dev/nvme1n1 /data
# 永続マウント設定
UUID=$(sudo blkid -o value -s UUID /dev/nvme1n1)
echo "UUID=$UUID /data xfs defaults,nofail 0 2" | sudo tee -a /etc/fstab
 
# スナップショットの作成
aws ec2 create-snapshot \
  --volume-id $VOL_ID \
  --description "Daily backup $(date +%Y-%m-%d)" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=daily-backup},{Key=RetainDays,Value=7}]'

# Data Lifecycle Manager (DLM) でスナップショットを自動管理
aws dlm create-lifecycle-policy \
  --description "Daily EBS snapshots with 7-day retention" \
  --state ENABLED \
  --execution-role-arn arn:aws:iam::123456789012:role/AWSDataLifecycleManagerDefaultRole \
  --policy-details '{
    "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
    "ResourceTypes": ["VOLUME"],
    "TargetTags": [{"Key": "Backup", "Value": "true"}],
    "Schedules": [{
      "Name": "DailySnapshots",
      "CreateRule": {
        "Interval": 24,
        "IntervalUnit": "HOURS",
        "Times": ["03:00"]
      },
      "RetainRule": {
        "Count": 7
      },
      "CopyTags": true,
      "TagsToAdd": [{"Key": "CreatedBy", "Value": "DLM"}]
    }]
  }'

# 全要素を指定してインスタンスを起動
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.small \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings '[
    {
      "DeviceName": "/dev/xvda",
      "Ebs": {
        "VolumeSize": 30,
        "VolumeType": "gp3",
        "Iops": 3000,
        "Throughput": 125,
        "DeleteOnTermination": true,
        "Encrypted": true
      }
    }
  ]' \
  --iam-instance-profile Name=EC2-WebServer-Profile \
  --user-data file://startup.sh \
  --tag-specifications \
    'ResourceType=instance,Tags=[{Key=Name,Value=web-server-01},{Key=Environment,Value=production}]' \
    'ResourceType=volume,Tags=[{Key=Name,Value=web-server-01-root}]' \
  --metadata-options "HttpTokens=required,HttpEndpoint=enabled,HttpPutResponseHopLimit=1" \
  --count 1 \
  --monitoring Enabled=true

#!/bin/bash
# startup.sh - EC2 起動時に自動実行されるスクリプト
set -euxo pipefail
 
# ログ出力先
exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1
 
# システム更新
dnf update -y
 
# 必要なパッケージのインストール
dnf install -y nginx nodejs npm git
 
# NGINX 設定
cat > /etc/nginx/conf.d/app.conf << 'NGINX_EOF'
server {
    listen 80;
    server_name _;
 
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
 
    location /health {
        access_log off;
        return 200 'healthy';
        add_header Content-Type text/plain;
    }
}
NGINX_EOF
 
# NGINX 起動
systemctl start nginx
systemctl enable nginx
 
# CloudWatch Agent のインストール
dnf install -y amazon-cloudwatch-agent
cat > /opt/aws/amazon-cloudwatch-agent/etc/config.json << 'CW_EOF'
{
  "metrics": {
    "metrics_collected": {
      "mem": {"measurement": ["mem_used_percent"]},
      "disk": {"measurement": ["disk_used_percent"], "resources": ["/"]}
    }
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/nginx/access.log",
            "log_group_name": "/ec2/nginx/access",
            "log_stream_name": "{instance_id}"
          },
          {
            "file_path": "/var/log/nginx/error.log",
            "log_group_name": "/ec2/nginx/error",
            "log_stream_name": "{instance_id}"
          }
        ]
      }
    }
  }
}
CW_EOF
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json
 
echo "User data script completed successfully"

AWSTemplateFormatVersion: '2010-09-09'
Description: EC2 Web Server with best practices
 
Parameters:
  EnvironmentName:
    Type: String
    Default: production
    AllowedValues: [production, staging, development]
  InstanceType:
    Type: String
    Default: t3.small
    AllowedValues: [t3.micro, t3.small, t3.medium, t3.large, m6i.large]
  VpcId:
    Type: AWS::EC2::VPC::Id
  SubnetId:
    Type: AWS::EC2::Subnet::Id
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
 
Resources:
  # セキュリティグループ
  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for web server
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-web-sg
 
  # IAM ロール
  WebServerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
      Tags:
        - Key: Environment
          Value: !Ref EnvironmentName
 
  # インスタンスプロファイル
  WebServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref WebServerRole
 
  # EC2 インスタンス
  WebServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref WebServerInstanceProfile
      SubnetId: !Ref SubnetId
      SecurityGroupIds:
        - !Ref WebServerSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 30
            VolumeType: gp3
            Iops: 3000
            Throughput: 125
            Encrypted: true
            DeleteOnTermination: true
      MetadataOptions:
        HttpTokens: required
        HttpEndpoint: enabled
        HttpPutResponseHopLimit: 1
      Monitoring: true
      UserData:
        Fn::Base64: |
          #!/bin/bash
          dnf update -y
          dnf install -y nginx
          systemctl start nginx
          systemctl enable nginx
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-web-server
        - Key: Environment
          Value: !Ref EnvironmentName
 
Outputs:
  InstanceId:
    Value: !Ref WebServerInstance
  PrivateIp:
    Value: !GetAtt WebServerInstance.PrivateIp
  SecurityGroupId:
    Value: !Ref WebServerSecurityGroup

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';
 
export class Ec2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
 
    // VPC（既存の VPC を参照する場合）
    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', {
      vpcId: 'vpc-0123456789abcdef0',
    });
 
    // セキュリティグループ
    const webSg = new ec2.SecurityGroup(this, 'WebSG', {
      vpc,
      description: 'Security group for web servers',
      allowAllOutbound: true,
    });
    webSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
    webSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
 
    // IAM ロール
    const role = new iam.Role(this, 'WebServerRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
      ],
    });
 
    // EC2 インスタンス
    const instance = new ec2.Instance(this, 'WebServer', {
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.SMALL),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.X86_64,
      }),
      securityGroup: webSg,
      role,
      blockDevices: [{
        deviceName: '/dev/xvda',
        volume: ec2.BlockDeviceVolume.ebs(30, {
          volumeType: ec2.EbsDeviceVolumeType.GP3,
          iops: 3000,
          throughput: 125,
          encrypted: true,
          deleteOnTermination: true,
        }),
      }],
      requireImdsv2: true,
      detailedMonitoring: true,
    });
 
    // User Data
    instance.addUserData(
      'dnf update -y',
      'dnf install -y nginx',
      'systemctl start nginx',
      'systemctl enable nginx',
    );
 
    // 出力
    new cdk.CfnOutput(this, 'InstanceId', { value: instance.instanceId });
    new cdk.CfnOutput(this, 'PrivateIp', { value: instance.instancePrivateIp });
  }
}

# IMDSv2 でトークンを取得してメタデータにアクセス
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 
# インスタンス ID
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/instance-id
 
# インスタンスタイプ
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/instance-type
 
# パブリック IP
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/public-ipv4
 
# IAM ロールの一時的な認証情報
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/
 
# アベイラビリティゾーン
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/placement/availability-zone
 
# インスタンスのタグ（設定が必要）
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/tags/instance/Name

# 新規インスタンスで IMDSv2 を強制
aws ec2 run-instances \
  --metadata-options "HttpTokens=required,HttpEndpoint=enabled,HttpPutResponseHopLimit=1" \
  ...
 
# 既存インスタンスで IMDSv2 を強制
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled \
  --http-put-response-hop-limit 1
 
# アカウントレベルで IMDSv2 をデフォルトに設定
aws ec2 modify-instance-metadata-defaults \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled \
  --region ap-northeast-1
 
# IMDSv1 を使用しているインスタンスの検出
aws ec2 describe-instances \
  --query 'Reservations[].Instances[?MetadataOptions.HttpTokens==`optional`].[InstanceId,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# CPU 使用率の取得
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time "$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --period 300 \
  --statistics Average Maximum
 
# CPU アラームの作成
aws cloudwatch put-metric-alarm \
  --alarm-name "ec2-high-cpu" \
  --alarm-description "CPU usage exceeds 80% for 5 minutes" \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --statistic Average \
  --period 300 \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:ap-northeast-1:123456789012:alerts
 
# ステータスチェックアラーム（自動リカバリ）
aws cloudwatch put-metric-alarm \
  --alarm-name "ec2-auto-recovery" \
  --alarm-description "Auto-recover when status check fails" \
  --namespace AWS/EC2 \
  --metric-name StatusCheckFailed_System \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --statistic Maximum \
  --period 60 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 2 \
  --alarm-actions arn:aws:automate:ap-northeast-1:ec2:recover

# 悪い例 — 全世界に SSH ポートを公開
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx --protocol tcp --port 22 --cidr 0.0.0.0/0
 
# 良い例 — 管理元 IP のみ許可 + Session Manager を併用
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx --protocol tcp --port 22 --cidr 203.0.113.10/32
 
# さらに良い例 — SSH 不要、Session Manager で接続
aws ssm start-session --target i-0123456789abcdef0

# アカウントレベルで EBS デフォルト暗号化を有効化
aws ec2 enable-ebs-encryption-by-default --region ap-northeast-1
 
# 暗号化状態の確認
aws ec2 get-ebs-encryption-by-default --region ap-northeast-1
 
# デフォルト KMS キーの変更
aws ec2 modify-ebs-default-kms-key-id \
  --kms-key-id alias/ebs-custom-key \
  --region ap-northeast-1

# 悪い例 — EC2 内にアクセスキーをハードコード
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
aws s3 ls  # キー漏洩のリスク
 
# 良い例 — IAM ロール（インスタンスプロファイル）を使用
# EC2 に IAM ロールをアタッチし、一時的な認証情報を自動取得
aws s3 ls  # インスタンスプロファイルの認証情報を自動使用

# 悪い例 — User Data にパスワードをハードコード
#!/bin/bash
export DB_PASSWORD="MySecretPassword123!"
 
# 良い例 — Secrets Manager から取得
#!/bin/bash
DB_PASSWORD=$(aws secretsmanager get-secret-value \
  --secret-id my-db-password \
  --query 'SecretString' --output text)
export DB_PASSWORD

# AWS Compute Optimizer で推奨インスタンスタイプを確認
aws compute-optimizer get-ec2-instance-recommendations \
  --instance-arns arn:aws:ec2:ap-northeast-1:123456789012:instance/i-0123456789abcdef0 \
  --query 'instanceRecommendations[].[instanceArn,currentInstanceType,recommendationOptions[0].instanceType,finding]' \
  --output table

# タグ付けポリシーの適用
aws ec2 create-tags \
  --resources i-0123456789abcdef0 \
  --tags \
    Key=Name,Value=web-server-01 \
    Key=Environment,Value=production \
    Key=Team,Value=backend \
    Key=CostCenter,Value=CC-12345 \
    Key=Application,Value=my-web-app \
    Key=ManagedBy,Value=terraform \
    Key=Backup,Value=true

# SSM Patch Manager でパッチ適用を自動化
aws ssm create-patch-baseline \
  --name "AmazonLinux2023-Custom" \
  --operating-system AMAZON_LINUX_2023 \
  --approval-rules '{
    "PatchRules": [{
      "PatchFilterGroup": {
        "PatchFilters": [
          {"Key": "SEVERITY", "Values": ["Critical", "Important"]},
          {"Key": "CLASSIFICATION", "Values": ["Security", "Bugfix"]}
        ]
      },
      "ApproveAfterDays": 3,
      "ComplianceLevel": "CRITICAL"
    }]
  }'
 
# パッチ適用のメンテナンスウィンドウを作成
aws ssm create-maintenance-window \
  --name "WeeklyPatching" \
  --schedule "cron(0 2 ? * SUN *)" \
  --duration 3 \
  --cutoff 1 \
  --allow-unassociated-targets