# VPC の作成
VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=prod-vpc}]' \
  --query 'Vpc.VpcId' --output text)
 
# DNS 有効化
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-support
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames
 
# パブリックサブネット（AZ-1a, AZ-1c）
PUB_1A=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 --availability-zone ap-northeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=pub-1a}]' \
  --query 'Subnet.SubnetId' --output text)
 
PUB_1C=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 --availability-zone ap-northeast-1c \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=pub-1c}]' \
  --query 'Subnet.SubnetId' --output text)
 
# プライベートサブネット（App層 / DB層）
PRIV_APP_1A=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.11.0/24 --availability-zone ap-northeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=priv-app-1a}]' \
  --query 'Subnet.SubnetId' --output text)
 
PRIV_APP_1C=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.12.0/24 --availability-zone ap-northeast-1c \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=priv-app-1c}]' \
  --query 'Subnet.SubnetId' --output text)
 
PRIV_DB_1A=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.21.0/24 --availability-zone ap-northeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=priv-db-1a}]' \
  --query 'Subnet.SubnetId' --output text)
 
PRIV_DB_1C=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.22.0/24 --availability-zone ap-northeast-1c \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=priv-db-1c}]' \
  --query 'Subnet.SubnetId' --output text)
 
# パブリックサブネットの自動パブリック IP 割り当て有効化
aws ec2 modify-subnet-attribute \
  --subnet-id $PUB_1A \
  --map-public-ip-on-launch
 
aws ec2 modify-subnet-attribute \
  --subnet-id $PUB_1C \
  --map-public-ip-on-launch

# VPC に Secondary CIDR ブロックを追加
aws ec2 associate-vpc-cidr-block \
  --vpc-id $VPC_ID \
  --cidr-block 100.64.0.0/16
 
# 追加した CIDR でサブネットを作成
aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 100.64.1.0/24 \
  --availability-zone ap-northeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=eks-pods-1a}]'
 
# 利用シーン:
# - EKS Pod のカスタムネットワーキング（Pod に VPC IP を割当）
# - IP アドレス空間が不足した場合の拡張
# - RFC 6598 (100.64.0.0/10) は CGN 用だが VPC 内では利用可能

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.5.0"
 
  name = "prod-vpc"
  cidr = "10.0.0.0/16"
 
  azs              = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
  public_subnets   = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets  = ["10.0.16.0/20", "10.0.32.0/20", "10.0.48.0/20"]
  database_subnets = ["10.0.64.0/24", "10.0.65.0/24", "10.0.66.0/24"]
 
  enable_nat_gateway     = true
  single_nat_gateway     = false  # 本番: AZ ごとに NAT GW
  one_nat_gateway_per_az = true
 
  enable_dns_hostnames = true
  enable_dns_support   = true
 
  create_database_subnet_group       = true
  create_database_subnet_route_table = true
 
  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_iam_role             = true
 
  # パブリックサブネットのタグ（EKS ALB Ingress Controller 用）
  public_subnet_tags = {
    "kubernetes.io/role/elb" = "1"
  }
 
  # プライベートサブネットのタグ（EKS 内部 LB 用）
  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = "1"
  }
 
  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}
 
# VPC のアウトプット
output "vpc_id" {
  value = module.vpc.vpc_id
}
 
output "private_subnet_ids" {
  value = module.vpc.private_subnets
}
 
output "public_subnet_ids" {
  value = module.vpc.public_subnets
}
 
output "database_subnet_group_name" {
  value = module.vpc.database_subnet_group_name
}

AWSTemplateFormatVersion: '2010-09-09'
Description: Production VPC with 3-tier subnet architecture
 
Parameters:
  EnvironmentName:
    Type: String
    Default: prod
  VpcCIDR:
    Type: String
    Default: 10.0.0.0/16
 
Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-vpc
 
  # Internet Gateway
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-igw
 
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
 
  # Public Subnets
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-pub-1a
 
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-pub-1c
 
  # Private App Subnets
  PrivateAppSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.11.0/24
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-app-1a
 
  PrivateAppSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.12.0/24
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-app-1c
 
  # Private DB Subnets
  PrivateDBSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.21.0/24
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-db-1a
 
  PrivateDBSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.22.0/24
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-db-1c
 
  # NAT Gateway (AZ-1a)
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
 
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-1a
 
  # NAT Gateway (AZ-1c)
  NatGateway2EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
 
  NatGateway2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-1c
 
  # Public Route Table
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-pub-rt
 
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
 
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1
 
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2
 
  # Private Route Tables (AZ ごと)
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-rt-1a
 
  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
 
  PrivateAppSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateAppSubnet1
 
  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-priv-rt-1c
 
  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2
 
  PrivateAppSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateAppSubnet2
 
Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub ${EnvironmentName}-VpcId
 
  PublicSubnets:
    Value: !Join [',', [!Ref PublicSubnet1, !Ref PublicSubnet2]]
    Export:
      Name: !Sub ${EnvironmentName}-PublicSubnets
 
  PrivateAppSubnets:
    Value: !Join [',', [!Ref PrivateAppSubnet1, !Ref PrivateAppSubnet2]]
    Export:
      Name: !Sub ${EnvironmentName}-PrivateAppSubnets
 
  PrivateDBSubnets:
    Value: !Join [',', [!Ref PrivateDBSubnet1, !Ref PrivateDBSubnet2]]
    Export:
      Name: !Sub ${EnvironmentName}-PrivateDBSubnets

# Internet Gateway
IGW_ID=$(aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=prod-igw}]' \
  --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID
 
# Elastic IP + NAT Gateway (AZ-1a)
EIP_1A=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
NAT_1A=$(aws ec2 create-nat-gateway \
  --subnet-id $PUB_1A --allocation-id $EIP_1A \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-1a}]' \
  --query 'NatGateway.NatGatewayId' --output text)
 
# NAT Gateway の作成完了を待機
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_1A
 
# Elastic IP + NAT Gateway (AZ-1c)
EIP_1C=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
NAT_1C=$(aws ec2 create-nat-gateway \
  --subnet-id $PUB_1C --allocation-id $EIP_1C \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=nat-1c}]' \
  --query 'NatGateway.NatGatewayId' --output text)
 
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_1C
 
# Public ルートテーブル
PUB_RT=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=pub-rt}]' \
  --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PUB_RT \
  --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB_1A
aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB_1C
 
# Private ルートテーブル AZ-1a（NAT GW 経由）
PRIV_RT_1A=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=priv-rt-1a}]' \
  --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_1A
aws ec2 associate-route-table --route-table-id $PRIV_RT_1A --subnet-id $PRIV_APP_1A
aws ec2 associate-route-table --route-table-id $PRIV_RT_1A --subnet-id $PRIV_DB_1A
 
# Private ルートテーブル AZ-1c（NAT GW 経由）
PRIV_RT_1C=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=priv-rt-1c}]' \
  --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PRIV_RT_1C \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_1C
aws ec2 associate-route-table --route-table-id $PRIV_RT_1C --subnet-id $PRIV_APP_1C
aws ec2 associate-route-table --route-table-id $PRIV_RT_1C --subnet-id $PRIV_DB_1C

# NAT Instance の作成（Amazon Linux 2023 AMI）
NAT_INSTANCE=$(aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t4g.nano \
  --subnet-id $PUB_1A \
  --security-group-ids $NAT_SG \
  --key-name my-key \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nat-instance}]' \
  --query 'Instances[0].InstanceId' --output text)
 
# Source/Destination Check を無効化（NAT に必須）
aws ec2 modify-instance-attribute \
  --instance-id $NAT_INSTANCE \
  --no-source-dest-check
 
# NAT Instance 用のセキュリティグループ
NAT_SG=$(aws ec2 create-security-group \
  --group-name nat-sg --description "NAT Instance SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
 
# プライベートサブネットからの全トラフィックを許可
aws ec2 authorize-security-group-ingress --group-id $NAT_SG \
  --protocol -1 --cidr 10.0.0.0/16
 
# プライベートルートテーブルのデフォルトルートを NAT Instance に設定
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-cidr-block 0.0.0.0/0 \
  --instance-id $NAT_INSTANCE

# ALB 用 SG
ALB_SG=$(aws ec2 create-security-group \
  --group-name alb-sg --description "ALB SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $ALB_SG \
  --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id $ALB_SG \
  --protocol tcp --port 80 --cidr 0.0.0.0/0
 
# App 用 SG（ALB からのみ受信）
APP_SG=$(aws ec2 create-security-group \
  --group-name app-sg --description "App SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $APP_SG \
  --protocol tcp --port 8080 --source-group $ALB_SG
 
# DB 用 SG（App からのみ受信）
DB_SG=$(aws ec2 create-security-group \
  --group-name db-sg --description "DB SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $DB_SG \
  --protocol tcp --port 3306 --source-group $APP_SG
aws ec2 authorize-security-group-ingress --group-id $DB_SG \
  --protocol tcp --port 6379 --source-group $APP_SG
 
# Bastion 用 SG（特定 IP からのみ SSH）
BASTION_SG=$(aws ec2 create-security-group \
  --group-name bastion-sg --description "Bastion SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $BASTION_SG \
  --protocol tcp --port 22 --cidr 203.0.113.0/32
 
# App SG に Bastion からの SSH を追加
aws ec2 authorize-security-group-ingress --group-id $APP_SG \
  --protocol tcp --port 22 --source-group $BASTION_SG
 
# VPC Endpoint 用 SG
ENDPOINT_SG=$(aws ec2 create-security-group \
  --group-name endpoint-sg --description "VPC Endpoint SG" \
  --vpc-id $VPC_ID --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $ENDPOINT_SG \
  --protocol tcp --port 443 --cidr 10.0.0.0/16

# DB サブネット用 NACL
DB_NACL=$(aws ec2 create-network-acl --vpc-id $VPC_ID \
  --tag-specifications 'ResourceType=network-acl,Tags=[{Key=Name,Value=db-nacl}]' \
  --query 'NetworkAcl.NetworkAclId' --output text)
 
# インバウンド: App サブネットからの MySQL/Redis のみ許可
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 100 --protocol tcp --port-range From=3306,To=3306 \
  --cidr-block 10.0.11.0/24 --rule-action allow --ingress
 
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 110 --protocol tcp --port-range From=3306,To=3306 \
  --cidr-block 10.0.12.0/24 --rule-action allow --ingress
 
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 120 --protocol tcp --port-range From=6379,To=6379 \
  --cidr-block 10.0.11.0/24 --rule-action allow --ingress
 
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 130 --protocol tcp --port-range From=6379,To=6379 \
  --cidr-block 10.0.12.0/24 --rule-action allow --ingress
 
# アウトバウンド: エフェメラルポート（戻りトラフィック）のみ許可
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 100 --protocol tcp --port-range From=1024,To=65535 \
  --cidr-block 10.0.11.0/24 --rule-action allow --egress
 
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 110 --protocol tcp --port-range From=1024,To=65535 \
  --cidr-block 10.0.12.0/24 --rule-action allow --egress
 
# 全拒否ルール（デフォルトルールだが明示的に記載）
aws ec2 create-network-acl-entry --network-acl-id $DB_NACL \
  --rule-number 32767 --protocol -1 --cidr-block 0.0.0.0/0 \
  --rule-action deny --ingress
 
# NACL をサブネットに関連付け
aws ec2 replace-network-acl-association \
  --association-id aclassoc-xxxxx \
  --network-acl-id $DB_NACL

# Gateway エンドポイント（S3）- 無料
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.s3 \
  --route-table-ids $PRIV_RT_1A $PRIV_RT_1C \
  --vpc-endpoint-type Gateway \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=s3-endpoint}]'
 
# Gateway エンドポイント（DynamoDB）- 無料
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.dynamodb \
  --route-table-ids $PRIV_RT_1A $PRIV_RT_1C \
  --vpc-endpoint-type Gateway \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=dynamodb-endpoint}]'
 
# Interface エンドポイント（Secrets Manager）- 有料
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.secretsmanager \
  --vpc-endpoint-type Interface \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --security-group-ids $ENDPOINT_SG \
  --private-dns-enabled \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=secretsmanager-endpoint}]'
 
# Interface エンドポイント（ECR - Docker Pull 用）
# ECR は 2 つのエンドポイントが必要
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.ecr.dkr \
  --vpc-endpoint-type Interface \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --security-group-ids $ENDPOINT_SG \
  --private-dns-enabled \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=ecr-dkr-endpoint}]'
 
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.ecr.api \
  --vpc-endpoint-type Interface \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --security-group-ids $ENDPOINT_SG \
  --private-dns-enabled \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=ecr-api-endpoint}]'
 
# Interface エンドポイント（CloudWatch Logs）
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.logs \
  --vpc-endpoint-type Interface \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --security-group-ids $ENDPOINT_SG \
  --private-dns-enabled \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=logs-endpoint}]'
 
# Interface エンドポイント（STS - IAM ロール引き受け用）
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.ap-northeast-1.sts \
  --vpc-endpoint-type Interface \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --security-group-ids $ENDPOINT_SG \
  --private-dns-enabled \
  --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=sts-endpoint}]'

# S3 エンドポイントへのポリシー設定（特定バケットのみ許可）
aws ec2 modify-vpc-endpoint \
  --vpc-endpoint-id vpce-xxxxx \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowSpecificBuckets",
        "Effect": "Allow",
        "Principal": "*",
        "Action": [
          "s3:GetObject",
          "s3:PutObject",
          "s3:ListBucket"
        ],
        "Resource": [
          "arn:aws:s3:::my-app-bucket",
          "arn:aws:s3:::my-app-bucket/*",
          "arn:aws:s3:::prod-*"
        ]
      },
      {
        "Sid": "AllowECRBucket",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::prod-ap-northeast-1-starport-layer-bucket/*"
      }
    ]
  }'

# VPC Peering 接続の作成
PEERING_ID=$(aws ec2 create-vpc-peering-connection \
  --vpc-id $VPC_ID --peer-vpc-id vpc-0abc123 \
  --tag-specifications 'ResourceType=vpc-peering-connection,Tags=[{Key=Name,Value=prod-to-shared}]' \
  --query 'VpcPeeringConnection.VpcPeeringConnectionId' --output text)
 
# 承認（相手側アカウントで実行、またはクロスアカウントの場合）
aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id $PEERING_ID
 
# 双方のルートテーブルに Peering ルート追加
# VPC-A 側
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id $PEERING_ID
 
# VPC-B 側
aws ec2 create-route --route-table-id rtb-shared-xxx \
  --destination-cidr-block 10.0.0.0/16 \
  --vpc-peering-connection-id $PEERING_ID
 
# DNS 解決の有効化（Peering 先の プライベート DNS を解決）
aws ec2 modify-vpc-peering-connection-options \
  --vpc-peering-connection-id $PEERING_ID \
  --requester-peering-connection-options AllowDnsResolutionFromRemoteVpc=true \
  --accepter-peering-connection-options AllowDnsResolutionFromRemoteVpc=true

# Transit Gateway の作成
TGW_ID=$(aws ec2 create-transit-gateway \
  --description "Central hub for all VPCs" \
  --options '{
    "AmazonSideAsn": 64512,
    "AutoAcceptSharedAttachments": "enable",
    "DefaultRouteTableAssociation": "enable",
    "DefaultRouteTablePropagation": "enable",
    "DnsSupport": "enable",
    "VpnEcmpSupport": "enable"
  }' \
  --tag-specifications 'ResourceType=transit-gateway,Tags=[{Key=Name,Value=central-tgw}]' \
  --query 'TransitGateway.TransitGatewayId' --output text)
 
# VPC アタッチメントの作成
aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id $TGW_ID \
  --vpc-id $VPC_ID \
  --subnet-ids $PRIV_APP_1A $PRIV_APP_1C \
  --tag-specifications 'ResourceType=transit-gateway-attachment,Tags=[{Key=Name,Value=prod-vpc-attach}]'
 
# VPC のルートテーブルに TGW 経由のルート追加
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-cidr-block 10.1.0.0/16 \
  --transit-gateway-id $TGW_ID
 
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-cidr-block 10.2.0.0/16 \
  --transit-gateway-id $TGW_ID
 
# TGW ルートテーブルの確認
aws ec2 search-transit-gateway-routes \
  --transit-gateway-route-table-id tgw-rtb-xxxxx \
  --filters "Name=type,Values=propagated"

# CloudWatch Logs への Flow Log 設定
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids $VPC_ID \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /vpc/flow-logs/prod \
  --deliver-logs-permission-arn arn:aws:iam::123456789012:role/flowlogs-role \
  --max-aggregation-interval 60 \
  --tag-specifications 'ResourceType=vpc-flow-log,Tags=[{Key=Name,Value=prod-flow-log}]'
 
# S3 への Flow Log 設定（推奨: 長期保存・Athena 分析向き）
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids $VPC_ID \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::my-flowlogs-bucket/prod/ \
  --log-format '${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}' \
  --max-aggregation-interval 60
 
# Flow Logs 用の IAM ロール
cat > flowlogs-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "vpc-flow-logs.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
 
aws iam create-role \
  --role-name flowlogs-role \
  --assume-role-policy-document file://flowlogs-trust-policy.json
 
aws iam put-role-policy \
  --role-name flowlogs-role \
  --policy-name flowlogs-policy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogGroups",
          "logs:DescribeLogStreams"
        ],
        "Effect": "Allow",
        "Resource": "*"
      }
    ]
  }'

-- Athena テーブルの作成（S3 に保存した Flow Logs 用）
CREATE EXTERNAL TABLE IF NOT EXISTS vpc_flow_logs (
  version int,
  account_id string,
  interface_id string,
  srcaddr string,
  dstaddr string,
  srcport int,
  dstport int,
  protocol bigint,
  packets bigint,
  bytes bigint,
  start bigint,
  `end` bigint,
  action string,
  log_status string,
  vpc_id string,
  subnet_id string,
  az_id string,
  sublocation_type string,
  sublocation_id string,
  pkt_srcaddr string,
  pkt_dstaddr string,
  region string,
  pkt_src_aws_service string,
  pkt_dst_aws_service string,
  flow_direction string,
  traffic_path int
)
PARTITIONED BY (dt string)
ROW FORMAT DELIMITED
FIELDS TERMINATED BY ' '
LOCATION 's3://my-flowlogs-bucket/prod/AWSLogs/123456789012/vpcflowlogs/ap-northeast-1/'
TBLPROPERTIES ("skip.header.line.count"="1");
 
-- 拒否されたトラフィックの分析
SELECT srcaddr, dstaddr, dstport, protocol, action, SUM(packets) as total_packets
FROM vpc_flow_logs
WHERE action = 'REJECT'
  AND dt = '2026/02/15'
GROUP BY srcaddr, dstaddr, dstport, protocol, action
ORDER BY total_packets DESC
LIMIT 20;
 
-- 特定 IP からのトラフィック量分析
SELECT dstport, protocol, SUM(bytes) as total_bytes, COUNT(*) as flow_count
FROM vpc_flow_logs
WHERE srcaddr = '10.0.11.15'
  AND dt >= '2026/02/01'
GROUP BY dstport, protocol
ORDER BY total_bytes DESC;
 
-- NAT Gateway 経由のトラフィック量（コスト分析用）
SELECT pkt_dstaddr, dstport, SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE interface_id IN (
  SELECT network_interface_id FROM nat_gw_enis
)
AND flow_direction = 'egress'
GROUP BY pkt_dstaddr, dstport
ORDER BY total_bytes DESC
LIMIT 50;

// lib/vpc-stack.ts
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';
 
export class VpcStack extends cdk.Stack {
  public readonly vpc: ec2.Vpc;
 
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
 
    // VPC の作成（3層サブネット）
    this.vpc = new ec2.Vpc(this, 'ProdVpc', {
      vpcName: 'prod-vpc',
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      maxAzs: 3,
      natGateways: 3,  // AZ ごとに 1 つ
 
      subnetConfiguration: [
        {
          subnetType: ec2.SubnetType.PUBLIC,
          name: 'Public',
          cidrMask: 24,
        },
        {
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
          name: 'PrivateApp',
          cidrMask: 20,
        },
        {
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
          name: 'PrivateDB',
          cidrMask: 24,
        },
      ],
 
      // Flow Logs
      flowLogs: {
        's3': {
          destination: ec2.FlowLogDestination.toS3(),
          trafficType: ec2.FlowLogTrafficType.ALL,
        },
      },
    });
 
    // S3 Gateway Endpoint（無料）
    this.vpc.addGatewayEndpoint('S3Endpoint', {
      service: ec2.GatewayVpcEndpointAwsService.S3,
    });
 
    // DynamoDB Gateway Endpoint（無料）
    this.vpc.addGatewayEndpoint('DynamoDBEndpoint', {
      service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
    });
 
    // ECR Interface Endpoints
    this.vpc.addInterfaceEndpoint('EcrDockerEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,
    });
 
    this.vpc.addInterfaceEndpoint('EcrApiEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.ECR,
    });
 
    // CloudWatch Logs Interface Endpoint
    this.vpc.addInterfaceEndpoint('CloudWatchLogsEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS,
    });
 
    // セキュリティグループ: ALB
    const albSg = new ec2.SecurityGroup(this, 'AlbSg', {
      vpc: this.vpc,
      description: 'Security group for ALB',
      allowAllOutbound: true,
    });
    albSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'HTTPS');
    albSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'HTTP redirect');
 
    // セキュリティグループ: App
    const appSg = new ec2.SecurityGroup(this, 'AppSg', {
      vpc: this.vpc,
      description: 'Security group for App tier',
      allowAllOutbound: true,
    });
    appSg.addIngressRule(albSg, ec2.Port.tcp(8080), 'From ALB');
 
    // セキュリティグループ: DB
    const dbSg = new ec2.SecurityGroup(this, 'DbSg', {
      vpc: this.vpc,
      description: 'Security group for DB tier',
      allowAllOutbound: false,
    });
    dbSg.addIngressRule(appSg, ec2.Port.tcp(3306), 'MySQL from App');
    dbSg.addIngressRule(appSg, ec2.Port.tcp(6379), 'Redis from App');
 
    // アウトプット
    new cdk.CfnOutput(this, 'VpcId', { value: this.vpc.vpcId });
    new cdk.CfnOutput(this, 'PublicSubnets', {
      value: this.vpc.publicSubnets.map(s => s.subnetId).join(','),
    });
    new cdk.CfnOutput(this, 'PrivateSubnets', {
      value: this.vpc.privateSubnets.map(s => s.subnetId).join(','),
    });
    new cdk.CfnOutput(this, 'IsolatedSubnets', {
      value: this.vpc.isolatedSubnets.map(s => s.subnetId).join(','),
    });
  }
}

# VPC に IPv6 CIDR を関連付け
aws ec2 associate-vpc-cidr-block \
  --vpc-id $VPC_ID \
  --amazon-provided-ipv6-cidr-block
 
# サブネットに IPv6 CIDR を割当
aws ec2 associate-subnet-cidr-block \
  --subnet-id $PUB_1A \
  --ipv6-cidr-block 2600:1f18:xxxx:0100::/64
 
# Egress-only Internet Gateway の作成
EIGW_ID=$(aws ec2 create-egress-only-internet-gateway \
  --vpc-id $VPC_ID \
  --query 'EgressOnlyInternetGateway.EgressOnlyInternetGatewayId' --output text)
 
# プライベートサブネットの IPv6 ルート（アウトバウンドのみ）
aws ec2 create-route --route-table-id $PRIV_RT_1A \
  --destination-ipv6-cidr-block ::/0 \
  --egress-only-internet-gateway-id $EIGW_ID
 
# パブリックサブネットの IPv6 ルート（双方向）
aws ec2 create-route --route-table-id $PUB_RT \
  --destination-ipv6-cidr-block ::/0 \
  --gateway-id $IGW_ID