AWSTemplateFormatVersion: '2010-09-09'
Description: 'Web アプリケーション基盤テンプレート'
 
Parameters:
  EnvironmentName:
    Type: String
    Default: dev
    AllowedValues: [dev, stg, prod]
    Description: デプロイ先環境名
 
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]
    Description: EC2 インスタンスタイプ
 
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
    AllowedPattern: '(\d{1,3}\.){3}\d{1,3}/\d{1,2}'
    Description: VPC の CIDR ブロック
 
Mappings:
  RegionAMI:
    ap-northeast-1:
      HVM64: ami-0abcdef1234567890
    us-east-1:
      HVM64: ami-0fedcba9876543210
 
Conditions:
  IsProduction: !Equals [!Ref EnvironmentName, prod]
  CreateReadReplica: !Equals [!Ref EnvironmentName, prod]
 
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-vpc'
 
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 4, 8]]
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-public-1'
 
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !If [IsProduction, t3.medium, !Ref InstanceType]
      ImageId: !FindInMap [RegionAMI, !Ref 'AWS::Region', HVM64]
      SubnetId: !Ref PublicSubnet1
      SecurityGroupIds:
        - !Ref WebSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-web-server'
 
  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web server security group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
 
Outputs:
  VpcId:
    Description: VPC ID
    Value: !Ref VPC
    Export:
      Name: !Sub '${EnvironmentName}-VpcId'
 
  WebServerPublicIP:
    Description: Web サーバーのパブリック IP
    Value: !GetAtt WebServer.PublicIp

# !Sub の高度な使い方
BucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref MyBucket
    PolicyDocument:
      Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:role/${RoleName}'
          Action: 's3:GetObject'
          Resource: !Sub 'arn:aws:s3:::${MyBucket}/*'
 
# !Cidr による自動サブネット計算
Subnets:
  # 10.0.0.0/16 から 4つの /24 サブネットを自動計算
  # → 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24
  - !Select [0, !Cidr [!Ref VpcCidr, 4, 8]]
  - !Select [1, !Cidr [!Ref VpcCidr, 4, 8]]
  - !Select [2, !Cidr [!Ref VpcCidr, 4, 8]]
  - !Select [3, !Cidr [!Ref VpcCidr, 4, 8]]

Parameters:
  # SSM Parameter Store からの動的参照
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
    Description: 最新の Amazon Linux 2 AMI ID
 
  # 正規表現によるバリデーション
  ProjectName:
    Type: String
    MinLength: 3
    MaxLength: 20
    AllowedPattern: '[a-z][a-z0-9-]*'
    ConstraintDescription: 小文字英数字とハイフンのみ。先頭は英字。
 
  # 複数選択可能なパラメータ
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: デプロイ先サブネット
 
  # NoEcho でパスワードを隠す
  DatabasePassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 128
    AllowedPattern: '[a-zA-Z0-9!@#$%^&*()_+-=]*'
    Description: RDS マスターパスワード
 
  # Secrets Manager からの動的参照
  DatabaseCredentials:
    Type: String
    Default: '{{resolve:secretsmanager:prod/db/credentials:SecretString:password}}'

Rules:
  # 本番環境では t3.micro を使用禁止
  ProdInstanceTypeRule:
    RuleCondition: !Equals [!Ref EnvironmentName, prod]
    Assertions:
      - Assert: !Not [!Equals [!Ref InstanceType, t3.micro]]
        AssertDescription: 本番環境では t3.micro は使用できません
 
  # マルチ AZ は本番環境でのみ必須
  MultiAZRule:
    RuleCondition: !Equals [!Ref EnvironmentName, prod]
    Assertions:
      - Assert: !Equals [!Ref MultiAZDatabase, true]
        AssertDescription: 本番環境ではマルチ AZ を有効にしてください

Metadata:
  # コンソールでのパラメータグループ化
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: ネットワーク設定
        Parameters:
          - VpcCidr
          - SubnetIds
      - Label:
          default: コンピューティング設定
        Parameters:
          - InstanceType
          - KeyPairName
      - Label:
          default: データベース設定
        Parameters:
          - DatabasePassword
          - MultiAZDatabase
    ParameterLabels:
      VpcCidr:
        default: VPC CIDR ブロック
      InstanceType:
        default: EC2 インスタンスタイプ

# スタックの作成
aws cloudformation create-stack \
  --stack-name my-web-stack \
  --template-body file://template.yaml \
  --parameters \
    ParameterKey=EnvironmentName,ParameterValue=prod \
    ParameterKey=InstanceType,ParameterValue=t3.small \
  --capabilities CAPABILITY_NAMED_IAM \
  --tags Key=Project,Value=MyApp
 
# 変更セットの作成 (更新前にプレビュー)
aws cloudformation create-change-set \
  --stack-name my-web-stack \
  --change-set-name update-instance-type \
  --template-body file://template-v2.yaml \
  --parameters \
    ParameterKey=InstanceType,ParameterValue=t3.medium
 
# 変更セットの確認
aws cloudformation describe-change-set \
  --stack-name my-web-stack \
  --change-set-name update-instance-type
 
# 変更セットの実行
aws cloudformation execute-change-set \
  --stack-name my-web-stack \
  --change-set-name update-instance-type
 
# スタックの削除
aws cloudformation delete-stack \
  --stack-name my-web-stack
 
# スタック作成完了まで待機
aws cloudformation wait stack-create-complete \
  --stack-name my-web-stack
 
# スタックイベントの確認
aws cloudformation describe-stack-events \
  --stack-name my-web-stack \
  --query 'StackEvents[0:10].{Time:Timestamp,Status:ResourceStatus,Type:ResourceType,Reason:ResourceStatusReason}' \
  --output table

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "Update:*",
      "Principal": "*",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "Update:Replace",
      "Principal": "*",
      "Resource": "LogicalResourceId/Database",
      "Condition": {
        "StringEquals": {
          "ResourceType": ["AWS::RDS::DBInstance"]
        }
      }
    }
  ]
}

# スタックポリシーの設定
aws cloudformation set-stack-policy \
  --stack-name my-web-stack \
  --stack-policy-body file://stack-policy.json
 
# スタックポリシーの確認
aws cloudformation get-stack-policy \
  --stack-name my-web-stack

# ロールバック設定付きでスタック作成
aws cloudformation create-stack \
  --stack-name my-web-stack \
  --template-body file://template.yaml \
  --rollback-configuration \
    RollbackTriggers='[{Arn=arn:aws:cloudwatch:ap-northeast-1:123456789012:alarm:HighErrorRate,Type=AWS::CloudWatch::Alarm}]',\
    MonitoringTimeInMinutes=10
 
# ロールバック無効化 (デバッグ時)
aws cloudformation update-stack \
  --stack-name my-web-stack \
  --template-body file://template-v2.yaml \
  --disable-rollback

# 既存リソースをスタックにインポート
# 1. インポートテンプレートを準備 (DeletionPolicy: Retain 必須)
# 2. 変更セットを作成
aws cloudformation create-change-set \
  --stack-name my-web-stack \
  --change-set-name import-existing-resources \
  --change-set-type IMPORT \
  --template-body file://import-template.yaml \
  --resources-to-import '[
    {
      "ResourceType": "AWS::EC2::SecurityGroup",
      "LogicalResourceId": "WebSecurityGroup",
      "ResourceIdentifier": {"GroupId": "sg-12345678"}
    }
  ]'
 
# 変更セットの確認と実行
aws cloudformation describe-change-set \
  --stack-name my-web-stack \
  --change-set-name import-existing-resources
 
aws cloudformation execute-change-set \
  --stack-name my-web-stack \
  --change-set-name import-existing-resources

# インポート用テンプレート (DeletionPolicy: Retain が必須)
Resources:
  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DeletionPolicy: Retain
    Properties:
      GroupDescription: Imported security group
      VpcId: vpc-12345678

# network-stack.yaml (エクスポート側)
Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub '${EnvironmentName}-VpcId'
 
  PublicSubnetIds:
    Value: !Join [',', [!Ref PublicSubnet1, !Ref PublicSubnet2]]
    Export:
      Name: !Sub '${EnvironmentName}-PublicSubnetIds'
 
# app-stack.yaml (インポート側)
Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !Select
        - 0
        - !Split [',', !ImportValue 'prod-PublicSubnetIds']
      SecurityGroupIds:
        - !ImportValue 'prod-WebSG'

# parent-stack.yaml
Resources:
  NetworkStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/network.yaml
      Parameters:
        EnvironmentName: !Ref EnvironmentName
        VpcCidr: !Ref VpcCidr
 
  DatabaseStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: NetworkStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/database.yaml
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds
 
  ApplicationStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: [NetworkStack, DatabaseStack]
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/application.yaml
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        DatabaseEndpoint: !GetAtt DatabaseStack.Outputs.Endpoint

# ドリフト検出の開始
aws cloudformation detect-stack-drift \
  --stack-name my-web-stack
 
# ドリフト検出結果の確認
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id <detection-id>
 
# リソースごとのドリフト詳細
aws cloudformation describe-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED DELETED
 
# 特定リソースのドリフト検出
aws cloudformation detect-stack-resource-drift \
  --stack-name my-web-stack \
  --logical-resource-id WebSecurityGroup

# EventBridge + Lambda でドリフトを定期チェック
Resources:
  DriftCheckSchedule:
    Type: AWS::Events::Rule
    Properties:
      Description: 日次ドリフト検出
      ScheduleExpression: 'cron(0 9 * * ? *)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt DriftCheckFunction.Arn
          Id: DriftCheckTarget
 
  DriftCheckFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.12
      Handler: index.handler
      Role: !GetAtt DriftCheckRole.Arn
      Code:
        ZipFile: |
          import boto3
          import json
 
          cfn = boto3.client('cloudformation')
          sns = boto3.client('sns')
 
          def handler(event, context):
              # 全スタックのドリフト検出
              stacks = cfn.list_stacks(
                  StackStatusFilter=['CREATE_COMPLETE', 'UPDATE_COMPLETE']
              )
 
              results = []
              for stack in stacks['StackSummaries']:
                  stack_name = stack['StackName']
                  try:
                      response = cfn.detect_stack_drift(
                          StackName=stack_name
                      )
                      results.append({
                          'stack': stack_name,
                          'detection_id': response['StackDriftDetectionId']
                      })
                  except Exception as e:
                      print(f"Error checking {stack_name}: {e}")
 
              return {'statusCode': 200, 'results': results}

# カスタムリソースの定義
Resources:
  # Lambda 関数
  CustomResourceFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${AWS::StackName}-custom-resource'
      Runtime: python3.12
      Handler: index.handler
      Timeout: 300
      Role: !GetAtt CustomResourceRole.Arn
      Code:
        ZipFile: |
          import json
          import urllib.request
          import boto3
 
          def handler(event, context):
              response_data = {}
              physical_resource_id = event.get('PhysicalResourceId', 'custom-resource')
 
              try:
                  if event['RequestType'] == 'Create':
                      # リソース作成ロジック
                      # 例: S3 バケットにデフォルトファイルをアップロード
                      s3 = boto3.client('s3')
                      bucket_name = event['ResourceProperties']['BucketName']
                      s3.put_object(
                          Bucket=bucket_name,
                          Key='config/default.json',
                          Body=json.dumps({'version': '1.0'})
                      )
                      physical_resource_id = f"{bucket_name}-init"
                      response_data['Message'] = 'Created successfully'
 
                  elif event['RequestType'] == 'Update':
                      # リソース更新ロジック
                      response_data['Message'] = 'Updated successfully'
 
                  elif event['RequestType'] == 'Delete':
                      # リソース削除ロジック (クリーンアップ)
                      s3 = boto3.client('s3')
                      bucket_name = event['ResourceProperties']['BucketName']
                      # バケット内のオブジェクトを削除
                      objects = s3.list_objects_v2(Bucket=bucket_name)
                      if 'Contents' in objects:
                          delete_objects = [{'Key': obj['Key']} for obj in objects['Contents']]
                          s3.delete_objects(
                              Bucket=bucket_name,
                              Delete={'Objects': delete_objects}
                          )
                      response_data['Message'] = 'Deleted successfully'
 
                  send_response(event, context, 'SUCCESS', response_data, physical_resource_id)
 
              except Exception as e:
                  print(f"Error: {e}")
                  send_response(event, context, 'FAILED', {'Error': str(e)}, physical_resource_id)
 
          def send_response(event, context, status, data, physical_resource_id):
              response_body = json.dumps({
                  'Status': status,
                  'Reason': f"See CloudWatch Log Stream: {context.log_stream_name}",
                  'PhysicalResourceId': physical_resource_id,
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId'],
                  'Data': data
              })
 
              req = urllib.request.Request(
                  event['ResponseURL'],
                  data=response_body.encode('utf-8'),
                  headers={'Content-Type': 'application/json'},
                  method='PUT'
              )
              urllib.request.urlopen(req)
 
  # カスタムリソースの呼び出し
  BucketInitializer:
    Type: Custom::BucketInit
    DependsOn: MyBucket
    Properties:
      ServiceToken: !GetAtt CustomResourceFunction.Arn
      BucketName: !Ref MyBucket
 
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::StackName}-data-bucket'

# cfn-response を使ったシンプルなカスタムリソース
CustomResourceFunction:
  Type: AWS::Lambda::Function
  Properties:
    Runtime: python3.12
    Handler: index.handler
    Role: !GetAtt CustomResourceRole.Arn
    Code:
      ZipFile: |
        import cfnresponse
        import boto3
 
        def handler(event, context):
            try:
                if event['RequestType'] == 'Create':
                    # 処理
                    response_data = {'Result': 'Success'}
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
                elif event['RequestType'] == 'Delete':
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                else:
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
            except Exception as e:
                cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)})

# AWS::Include マクロの使用例
Resources:
  MyResource:
    Fn::Transform:
      Name: AWS::Include
      Parameters:
        Location: s3://my-bucket/resource-snippet.yaml
 
# SAM テンプレート (AWS::Serverless マクロ)
Transform: AWS::Serverless-2016-10-31
 
Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.12
      Handler: app.handler
      Events:
        Api:
          Type: Api
          Properties:
            Path: /hello
            Method: get

# マクロ登録テンプレート
Resources:
  MacroFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: EnvVarInjector
      Runtime: python3.12
      Handler: index.handler
      Role: !GetAtt MacroRole.Arn
      Code:
        ZipFile: |
          import copy
 
          def handler(event, context):
              """全 Lambda 関数に共通環境変数を自動注入するマクロ"""
              fragment = event['fragment']
              common_env = event['templateParameterValues'].get('CommonEnvVars', {})
 
              for resource_name, resource in fragment.get('Resources', {}).items():
                  if resource['Type'] == 'AWS::Lambda::Function':
                      props = resource.get('Properties', {})
                      env = props.get('Environment', {})
                      variables = env.get('Variables', {})
                      variables.update({
                          'ENVIRONMENT': fragment.get('Parameters', {}).get('EnvironmentName', {}).get('Default', 'dev'),
                          'REGION': {'Ref': 'AWS::Region'},
                          'STACK_NAME': {'Ref': 'AWS::StackName'}
                      })
                      env['Variables'] = variables
                      props['Environment'] = env
                      resource['Properties'] = props
 
              return {
                  'requestId': event['requestId'],
                  'status': 'success',
                  'fragment': fragment
              }
 
  EnvVarInjectorMacro:
    Type: AWS::CloudFormation::Macro
    Properties:
      Name: EnvVarInjector
      FunctionName: !GetAtt MacroFunction.Arn

# マクロの使用
Transform: EnvVarInjector
 
Resources:
  MyFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.12
      Handler: index.handler
      # Environment は自動で注入される

# スタックセットの作成 (Service-managed)
aws cloudformation create-stack-set \
  --stack-set-name security-baseline \
  --template-body file://security-baseline.yaml \
  --permission-model SERVICE_MANAGED \
  --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false \
  --capabilities CAPABILITY_NAMED_IAM
 
# スタックインスタンスのデプロイ (OU 指定)
aws cloudformation create-stack-instances \
  --stack-set-name security-baseline \
  --deployment-targets OrganizationalUnitIds='["ou-xxxx-yyyyyyy"]' \
  --regions ap-northeast-1 us-east-1 \
  --operation-preferences \
    FailureTolerancePercentage=10,\
    MaxConcurrentPercentage=25,\
    RegionConcurrencyType=PARALLEL
 
# スタックセットの更新
aws cloudformation update-stack-set \
  --stack-set-name security-baseline \
  --template-body file://security-baseline-v2.yaml
 
# スタックインスタンスの状態確認
aws cloudformation list-stack-instances \
  --stack-set-name security-baseline \
  --query 'Summaries[].{Account:Account,Region:Region,Status:Status}' \
  --output table

AWSTemplateFormatVersion: '2010-09-09'
Description: 'セキュリティベースライン (全アカウント共通)'
 
Resources:
  # CloudTrail 有効化
  CloudTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: organization-trail
      IsLogging: true
      IsMultiRegionTrail: true
      EnableLogFileValidation: true
      S3BucketName: !Sub 'cloudtrail-${AWS::AccountId}'
 
  # GuardDuty 有効化
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      DataSources:
        S3Logs:
          Enable: true
        Kubernetes:
          AuditLogs:
            Enable: true
 
  # Config 有効化
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: default
      RoleARN: !GetAtt ConfigRole.Arn
      RecordingGroup:
        AllSupported: true
        IncludeGlobalResourceTypes: true
 
  # デフォルト VPC の削除を防止する Config ルール
  RestrictedSSH:
    Type: AWS::Config::ConfigRule
    DependsOn: ConfigRecorder
    Properties:
      ConfigRuleName: restricted-ssh
      Source:
        Owner: AWS
        SourceIdentifier: INCOMING_SSH_DISABLED
 
  # パスワードポリシー
  PasswordPolicy:
    Type: Custom::PasswordPolicy
    Properties:
      ServiceToken: !GetAtt PasswordPolicyFunction.Arn
      MinimumPasswordLength: 14
      RequireSymbols: true
      RequireNumbers: true
      RequireUppercaseCharacters: true
      RequireLowercaseCharacters: true
      MaxPasswordAge: 90
      PasswordReusePrevention: 12
 
  # S3 パブリックアクセスブロック (アカウントレベル)
  S3PublicAccessBlock:
    Type: AWS::S3::AccountPublicAccessBlock
    Properties:
      BlockPublicAcls: true
      BlockPublicPolicy: true
      IgnorePublicAcls: true
      RestrictPublicBuckets: true

# CI/CD パイプラインテンプレート
Resources:
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: infra-pipeline
      RoleArn: !GetAtt PipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        # ソースステージ
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeStarSourceConnection
                Version: "1"
              Configuration:
                ConnectionArn: !Ref CodeStarConnection
                FullRepositoryId: my-org/infra-repo
                BranchName: main
              OutputArtifacts:
                - Name: SourceOutput
 
        # テストステージ
        - Name: Test
          Actions:
            - Name: CFnLint
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref LintProject
              InputArtifacts:
                - Name: SourceOutput
 
        # ステージング環境
        - Name: Staging
          Actions:
            - Name: CreateChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                StackName: staging-stack
                ChangeSetName: staging-changeset
                TemplatePath: SourceOutput::template.yaml
                TemplateConfiguration: SourceOutput::config/staging.json
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
              InputArtifacts:
                - Name: SourceOutput
              RunOrder: 1
 
            - Name: ExecuteChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                StackName: staging-stack
                ChangeSetName: staging-changeset
              RunOrder: 2
 
        # 承認ステージ
        - Name: Approval
          Actions:
            - Name: ManualApproval
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: "1"
              Configuration:
                NotificationArn: !Ref ApprovalTopic
                CustomData: "本番環境へのデプロイを承認してください"
 
        # 本番環境
        - Name: Production
          Actions:
            - Name: CreateChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                StackName: production-stack
                ChangeSetName: production-changeset
                TemplatePath: SourceOutput::template.yaml
                TemplateConfiguration: SourceOutput::config/production.json
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
              InputArtifacts:
                - Name: SourceOutput
              RunOrder: 1
 
            - Name: ExecuteChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                StackName: production-stack
                ChangeSetName: production-changeset
              RunOrder: 2

# .github/workflows/deploy.yml
name: Deploy Infrastructure
 
on:
  push:
    branches: [main]
    paths:
      - 'cloudformation/**'
  pull_request:
    branches: [main]
    paths:
      - 'cloudformation/**'
 
permissions:
  id-token: write
  contents: read
  pull-requests: write
 
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: cfn-lint
        uses: scottbrenner/cfn-lint-action@v2
        with:
          command: cfn-lint cloudformation/**/*.yaml
 
      - name: cfn-nag
        uses: stelligent/cfn_nag@master
        with:
          input_path: cloudformation/
 
  deploy-staging:
    needs: lint
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
 
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: ap-northeast-1
 
      - name: Deploy to Staging
        run: |
          aws cloudformation deploy \
            --template-file cloudformation/template.yaml \
            --stack-name staging-stack \
            --parameter-overrides \
              EnvironmentName=stg \
              InstanceType=t3.small \
            --capabilities CAPABILITY_NAMED_IAM \
            --no-fail-on-empty-changeset
 
  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
 
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: ap-northeast-1
 
      - name: Create Change Set
        run: |
          aws cloudformation create-change-set \
            --stack-name production-stack \
            --change-set-name "deploy-${GITHUB_SHA}" \
            --template-body file://cloudformation/template.yaml \
            --parameters \
              ParameterKey=EnvironmentName,ParameterValue=prod \
            --capabilities CAPABILITY_NAMED_IAM
 
          aws cloudformation wait change-set-create-complete \
            --stack-name production-stack \
            --change-set-name "deploy-${GITHUB_SHA}"
 
      - name: Describe Change Set
        run: |
          aws cloudformation describe-change-set \
            --stack-name production-stack \
            --change-set-name "deploy-${GITHUB_SHA}" \
            --output json
 
      - name: Execute Change Set
        run: |
          aws cloudformation execute-change-set \
            --stack-name production-stack \
            --change-set-name "deploy-${GITHUB_SHA}"
 
          aws cloudformation wait stack-update-complete \
            --stack-name production-stack

# cfn-lint (構文チェック)
pip install cfn-lint
cfn-lint template.yaml
 
# cfn-nag (セキュリティチェック)
gem install cfn-nag
cfn_nag_scan --input-path template.yaml
 
# TaskCat (マルチリージョンテスト)
pip install taskcat
taskcat test run
 
# Rain (CloudFormation の便利ツール)
# テンプレートのフォーマット
rain fmt template.yaml
 
# テンプレートのデプロイ (対話的)
rain deploy template.yaml my-stack
 
# スタック情報の表示
rain ls
rain watch my-stack

# taskcat の設定ファイル (.taskcat.yml)
project:
  name: my-infra
  regions:
    - ap-northeast-1
    - us-east-1
tests:
  default:
    template: template.yaml
    parameters:
      EnvironmentName: test
      InstanceType: t3.micro

# 1. 失敗したリソースの特定
aws cloudformation describe-stack-events \
  --stack-name my-stack \
  --query 'StackEvents[?ResourceStatus==`UPDATE_FAILED`].{Resource:LogicalResourceId,Reason:ResourceStatusReason}' \
  --output table
 
# 2. 問題のあるリソースをスキップしてロールバック続行
aws cloudformation continue-update-rollback \
  --stack-name my-stack \
  --resources-to-skip MyLambdaFunction MySecurityGroup
 
# 3. ロールバック完了を待機
aws cloudformation wait stack-rollback-complete \
  --stack-name my-stack

# 削除保護の解除
aws cloudformation update-termination-protection \
  --no-enable-termination-protection \
  --stack-name my-stack
 
# 依存関係の確認
aws cloudformation list-imports \
  --export-name 'my-stack-VpcId'
 
# S3 バケットが空でない場合の対処
aws s3 rm s3://my-bucket --recursive
aws cloudformation delete-stack --stack-name my-stack
 
# 強制削除 (一部リソースを残す)
aws cloudformation delete-stack \
  --stack-name my-stack \
  --retain-resources SecurityGroup VPCEndpoint

# cfn-init と cfn-signal を使った EC2 初期化とシグナル
 
Resources:
  WebServer:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT15M  # 15分でタイムアウト
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          full_install:
            - install_packages
            - configure_app
        install_packages:
          packages:
            yum:
              httpd: []
              php: []
          services:
            sysvinit:
              httpd:
                enabled: true
                ensureRunning: true
        configure_app:
          files:
            /var/www/html/index.html:
              content: |
                <html><body>Hello from CloudFormation!</body></html>
              mode: '000644'
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum update -y
          yum install -y aws-cfn-bootstrap
 
          # cfn-init の実行
          /opt/aws/bin/cfn-init -v \
            --stack ${AWS::StackName} \
            --resource WebServer \
            --configsets full_install \
            --region ${AWS::Region}
 
          # 結果を cfn-signal で報告
          /opt/aws/bin/cfn-signal -e $? \
            --stack ${AWS::StackName} \
            --resource WebServer \
            --region ${AWS::Region}

Resources:
  # スナップショット取得後に削除
  Database:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties:
      DBInstanceClass: db.t3.medium
      Engine: mysql
      MasterUsername: admin
      MasterUserPassword: !Ref DatabasePassword
 
  # 削除しない (スタック削除時もリソースを残す)
  ImportantBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub '${AWS::StackName}-important-data'
 
  # 通常削除 (デフォルト)
  TempBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub '${AWS::StackName}-temp'

Resources:
  # 明示的な依存関係
  ApplicationServer:
    Type: AWS::EC2::Instance
    DependsOn:
      - Database
      - CacheCluster
    Properties:
      # ...
 
  # WaitCondition (外部プロセスからのシグナル待ち)
  WaitHandle:
    Type: AWS::CloudFormation::WaitConditionHandle
 
  WaitCondition:
    Type: AWS::CloudFormation::WaitCondition
    DependsOn: ApplicationServer
    Properties:
      Handle: !Ref WaitHandle
      Timeout: '600'
      Count: 1

Conditions:
  IsProduction: !Equals [!Ref EnvironmentName, prod]
  IsNotProduction: !Not [!Equals [!Ref EnvironmentName, prod]]
  CreateReplica: !And
    - !Equals [!Ref EnvironmentName, prod]
    - !Equals [!Ref EnableReadReplica, true]
  UseCustomDomain: !Not [!Equals [!Ref DomainName, '']]
 
Resources:
  # 条件付きリソース作成
  ReadReplica:
    Type: AWS::RDS::DBInstance
    Condition: CreateReplica
    Properties:
      SourceDBInstanceIdentifier: !Ref Database
      DBInstanceClass: db.t3.medium
 
  # 条件付きプロパティ
  ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: !If [IsProduction, internet-facing, internal]
      Subnets: !If
        - IsProduction
        - [!Ref PublicSubnet1, !Ref PublicSubnet2, !Ref PublicSubnet3]
        - [!Ref PublicSubnet1, !Ref PublicSubnet2]
 
  # 条件付き出力
  Outputs:
    ReplicaEndpoint:
      Condition: CreateReplica
      Value: !GetAtt ReadReplica.Endpoint.Address

Resources:
  Database:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t3.medium
      Engine: mysql
      # SSM Parameter Store からの参照
      MasterUsername: '{{resolve:ssm:/prod/db/username}}'
      # Secrets Manager からの参照
      MasterUserPassword: '{{resolve:secretsmanager:prod/db/credentials:SecretString:password}}'
 
  # SSM SecureString からの参照
  ApiServer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: app
          Environment:
            - Name: API_KEY
              Value: '{{resolve:ssm-secure:/prod/api/key}}'

AWSTemplateFormatVersion: '2010-09-09'
Description: '3層 Web アプリケーション基盤'
 
Parameters:
  EnvironmentName:
    Type: String
    Default: prod
    AllowedValues: [dev, stg, prod]
 
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
 
  DatabasePassword:
    Type: String
    NoEcho: true
    MinLength: 8
 
Conditions:
  IsProduction: !Equals [!Ref EnvironmentName, prod]
 
Resources:
  # ============ VPC ============
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-vpc'
 
  InternetGateway:
    Type: AWS::EC2::InternetGateway
 
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
 
  # パブリックサブネット
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 6, 8]]
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-public-1'
 
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [1, !Cidr [!Ref VpcCidr, 6, 8]]
      AvailabilityZone: !Select [1, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-public-2'
 
  # プライベートサブネット
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [2, !Cidr [!Ref VpcCidr, 6, 8]]
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-private-1'
 
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [3, !Cidr [!Ref VpcCidr, 6, 8]]
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-private-2'
 
  # NAT Gateway
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
 
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
 
  # ルートテーブル
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
 
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
 
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable
 
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable
 
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
 
  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
 
  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable
 
  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable
 
  # ============ ALB ============
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ALB Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
 
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub '${EnvironmentName}-alb'
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      SecurityGroups:
        - !Ref ALBSecurityGroup
      Tags:
        - Key: Environment
          Value: !Ref EnvironmentName
 
  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub '${EnvironmentName}-tg'
      Port: 80
      Protocol: HTTP
      VpcId: !Ref VPC
      TargetType: ip
      HealthCheckPath: /healthz
      HealthCheckIntervalSeconds: 30
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 3
 
  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ALBTargetGroup
 
  # ============ RDS ============
  DatabaseSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Database Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref AppSecurityGroup
 
  DatabaseSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Database subnet group
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
 
  Database:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties:
      DBInstanceIdentifier: !Sub '${EnvironmentName}-db'
      DBInstanceClass: !If [IsProduction, db.r6g.large, db.t3.medium]
      Engine: mysql
      EngineVersion: '8.0'
      MasterUsername: admin
      MasterUserPassword: !Ref DatabasePassword
      AllocatedStorage: 100
      StorageType: gp3
      MultiAZ: !If [IsProduction, true, false]
      DBSubnetGroupName: !Ref DatabaseSubnetGroup
      VPCSecurityGroups:
        - !Ref DatabaseSecurityGroup
      BackupRetentionPeriod: !If [IsProduction, 30, 7]
      StorageEncrypted: true
      DeletionProtection: !If [IsProduction, true, false]
 
  # ============ ECS ============
  AppSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          SourceSecurityGroupId: !Ref ALBSecurityGroup
 
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Sub '${EnvironmentName}-cluster'
      ClusterSettings:
        - Name: containerInsights
          Value: enabled
 
  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
 
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub '${EnvironmentName}-app'
      NetworkMode: awsvpc
      RequiresCompatibilities: [FARGATE]
      Cpu: '512'
      Memory: '1024'
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      ContainerDefinitions:
        - Name: app
          Image: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/my-app:latest'
          PortMappings:
            - ContainerPort: 8080
          Environment:
            - Name: DB_HOST
              Value: !GetAtt Database.Endpoint.Address
            - Name: ENVIRONMENT
              Value: !Ref EnvironmentName
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref LogGroup
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: app
 
  Service:
    Type: AWS::ECS::Service
    DependsOn: ALBListener
    Properties:
      ServiceName: !Sub '${EnvironmentName}-app-svc'
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: !If [IsProduction, 3, 1]
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets:
            - !Ref PrivateSubnet1
            - !Ref PrivateSubnet2
          SecurityGroups:
            - !Ref AppSecurityGroup
      LoadBalancers:
        - ContainerName: app
          ContainerPort: 8080
          TargetGroupArn: !Ref ALBTargetGroup
 
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/ecs/${EnvironmentName}-app'
      RetentionInDays: !If [IsProduction, 90, 14]
 
Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub '${EnvironmentName}-VpcId'
 
  ALBDnsName:
    Value: !GetAtt ApplicationLoadBalancer.DNSName
 
  DatabaseEndpoint:
    Value: !GetAtt Database.Endpoint.Address
 
  ECSClusterName:
    Value: !Ref ECSCluster
    Export:
      Name: !Sub '${EnvironmentName}-ECSCluster'

Database:
  Type: AWS::RDS::DBInstance
  DeletionPolicy: Snapshot
  UpdateReplacePolicy: Snapshot
  Properties:
    # ...

# [悪い例]
Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890  # ハードコード
      SubnetId: subnet-12345678       # ハードコード
      SecurityGroupIds:
        - sg-87654321                 # ハードコード
 
# [良い例]
Parameters:
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
 
Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      SubnetId: !ImportValue 'network-PublicSubnet1Id'
      SecurityGroupIds:
        - !ImportValue 'security-WebSGId'

# 本番スタックには必ず削除保護を有効化
aws cloudformation update-termination-protection \
  --enable-termination-protection \
  --stack-name production-stack