Session Managerでプライベートネットワークにセキュアにアクセスする環境を構築

### var.tf
data "aws_region" "current" {}
data "aws_caller_identity" "self" {}

locals {
  log_group_name = "/ssm/session-manager"
  s3_prefix      = "ssm/session-log"
}

### log.tf
data "aws_iam_policy_document" "log_group_policy" {
  statement {
    effect    = "Allow"
    actions   = ["kms:*"]
    resources = ["*"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.self.account_id}:root"]
    }
  }

  statement {
    effect = "Allow"
    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*"
    ]
    resources = ["*"]

    principals {
      type        = "Service"
      identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"]
    }

    condition {
      test     = "ArnEquals"
      values   = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.self.account_id}:log-group:${local.log_group_name}"]
      variable = "kms:EncryptionContext:aws:logs:arn"
    }
  }
}

resource "aws_kms_key" "log_group_encryption_key" {
  description              = "${local.log_group_name} log group encription key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  key_usage                = "ENCRYPT_DECRYPT"
  enable_key_rotation      = true
  deletion_window_in_days  = 7
  policy                   = data.aws_iam_policy_document.log_group_policy.json
}

resource "aws_kms_alias" "log_group_encryption" {
  name          = "alias/kms-ssm-log-group-encryption-key"
  target_key_id = aws_kms_key.log_group_encryption_key.key_id
}

resource "aws_cloudwatch_log_group" "ssm" {
  name       = local.log_group_name
  kms_key_id = aws_kms_key.ssm_encryption_key.arn
}

### s3.tf
resource "aws_s3_bucket" "ssm" {
  bucket = "session-manager"
  acl    = "private"

  versioning {
    enabled = true
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

resource "aws_s3_bucket_public_access_block" "ssm" {
  bucket                  = aws_s3_bucket.ssm.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

### ssm.tf
resource "aws_kms_key" "session_log" {
  description              = "Session log encription key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  key_usage                = "ENCRYPT_DECRYPT"
  enable_key_rotation      = true
  deletion_window_in_days  = 7
}

resource "aws_kms_alias" "session_log_encryption" {
  name          = "alias/kms-ssm-session-log-encryption-key"
  target_key_id = aws_kms_key.session_log.key_id
}

resource "aws_ssm_document" "session_log" {
  name = "SSM-SessionManagerRunShell"

  document_type   = "Session"
  document_format = "JSON"

  content = jsonencode({
    schemaVersion = "1.0"
    description   = "Document to hold regional settings for Session Manager"
    sessionType   = "Standard_Stream"
    inputs = {
      s3BucketName                = aws_s3_bucket.ssm.bucket
      s3KeyPrefix                 = local.s3_prefix
      s3EncryptionEnabled         = true
      cloudWatchLogGroupName      = aws_cloudwatch_log_group.ssm.name
      cloudWatchEncryptionEnabled = true
      kmsKeyId                    = aws_kms_key.session_log.arn
    }
  })
}

### vpc.tf
resource "aws_vpc" "vpc" {
  cidr_block           = "10.10.0.0/16"
  enable_dns_hostnames = true
}

resource "aws_subnet" "session_manager" {
  for_each = {
    subnet_a = { az = "ap-northeast-1a", tail_octet = "11" },
    subnet_c = { az = "ap-northeast-1c", tail_octet = "12" },
  }
  vpc_id            = aws_vpc.vpc.id
  availability_zone = each.value.az
  cidr_block        = "10.10.${each.value.tail_octet}.0/24"
  tags              = {
    "Name" = "session-manager-${each.key}"
  }
}

resource "aws_route_table" "session_manager" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_route_table_association" "session_manager" {
  for_each       = aws_subnet.session_manager
  subnet_id      = each.value.id
  route_table_id = aws_route_table.session_manager.id
}

### security.tf
resource "aws_vpc_endpoint" "session_manager_s3" {
  vpc_id            = aws_vpc.vpc.id
  service_name      = "com.amazonaws.${data.aws_region.current.name}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.session_manager.id]
}

resource "aws_security_group" "session_manager" {
  name        = "session-manager-security-group"
  description = "Allow ingress/egress for session manager"
  vpc_id      = aws_vpc.vpc.id

  # AWSの各種サービスに通信する際にHTTPSでアクセスが行われるため、アクセスを許可
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.vpc.cidr_block]
  }

  # S3のエンドポイントはGatewayなので、S3エンドポイントのCIDRへのアクセスを許可する
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = concat([aws_vpc.vpc.cidr_block], aws_vpc_endpoint.session_manager_s3.cidr_blocks)
  }

  # SSMエージェントはインスタンスメタデータを取得するため、インスタンスメタデータが配信されているIPへのアクセスを許可する
  egress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["169.254.169.254/32"]
  }

  # MySQLのアクセスを許可
  egress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = [for middleware in aws_subnet.middleware : middleware.cidr_block]
  }
}

resource "aws_security_group" "mysql_from_session_manager" {
  name        = "mysql-from-session_manager-security-group"
  description = "Allow access to mysql from session manager"
  vpc_id      = aws_vpc.vpc.id

  # Session Managerのマネージドインスタンスからのアクセスを許可
  ingress {
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.session_manager.id]
  }

  egress {
    from_port = 0
    to_port   = 0
    protocol  = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_vpc_endpoint" "session_manager_logs" {
  vpc_id              = aws_vpc.vpc.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [for subnet in aws_subnet.session_manager : subnet.id]
  security_group_ids  = [aws_security_group.session_manager.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "session_manager_ecr" {
  vpc_id              = aws_vpc.vpc.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [for subnet in aws_subnet.session_manager : subnet.id]
  security_group_ids  = [aws_security_group.session_manager.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "session_manager_ssm" {
  vpc_id              = aws_vpc.vpc.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [for subnet in aws_subnet.session_manager : subnet.id]
  security_group_ids  = [aws_security_group.session_manager.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "session_manager_ssmmessages" {
  vpc_id              = aws_vpc.vpc.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.ssmmessages"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [for subnet in aws_subnet.session_manager : subnet.id]
  security_group_ids  = [aws_security_group.session_manager.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "session_manager_kms" {
  vpc_id              = aws_vpc.vpc.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.kms"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [for subnet in aws_subnet.session_manager : subnet.id]
  security_group_ids  = [aws_security_group.session_manager.id]
  private_dns_enabled = true
}

### ecs_task_execution_role.tf
data "aws_iam_policy_document" "ecs_task_execution_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecs_task_execution" {
  name               = "ecs-task-execution"
  assume_role_policy = data.aws_iam_policy_document.ecs_task_execution_assume_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
  for_each   = {
    dummy_key_1 = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
    dummy_key_2 = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
    dummy_key_3 = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole"
    dummy_key_4 = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
  }
  role       = aws_iam_role.ecs_task_execution.name
  policy_arn = each.value
}

### ecs_task_role.tf
data "aws_iam_policy_document" "ecs_task_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecs_task_role" {
  name               = "ecs-task-role"
  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume_role.json
}

data "aws_iam_policy_document" "ecs_task_role" {
  statement {
    actions   = ["iam:PassRole"]
    # SSMエージェントが動作するロールに対してのみ制限をかけてもよい
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["ssm.amazonaws.com"]
    }
  }

  statement {
    actions = [
      "ssm:CreateActivation",
      "ssm:DeleteActivation"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ecs_task_role" {
  name   = "ecs-task-role"
  policy = data.aws_iam_policy_document.ecs_task_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_role" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  role       = aws_iam_role.ecs_task_role.name
}

### ssm_service_role.tf
data "aws_iam_policy_document" "ssm_service_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ssm.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ssm_service_role" {
  name               = "ssm-agent-role"
  assume_role_policy = data.aws_iam_policy_document.ssm_service_assume_role.json
}

data "aws_iam_policy_document" "ssm_service_role" {
  # See also: https://docs.aws.amazon.com/ja_jp/systems-manager/latest/userguide/ssm-agent-minimum-s3-permissions.html
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject"
    ]
    resources = [
      "arn:aws:s3:::aws-ssm-${data.aws_region.current.name}/*",
      "arn:aws:s3:::amazon-ssm-${data.aws_region.current.name}/*",
      "arn:aws:s3:::amazon-ssm-packages-${data.aws_region.current.name}/*",
      "arn:aws:s3:::${data.aws_region.current.name}-birdwatcher-prod/*",
      "arn:aws:s3:::patch-baseline-snapshot-${data.aws_region.current.name}/*"
    ]
  }

  # セッションログを保存できるようにする
  statement {
    effect = "Allow"
    actions = [
      "s3:PutObject"
    ]
    resources = [
      "arn:aws:s3:::${aws_s3_bucket.ssm.bucket}/${local.s3_prefix}/*"
    ]
  }

  # セッションログを暗号化して保存する際にS3バケットのデフォルト暗号化設定が必要
  statement {
    effect = "Allow"
    actions = [
      "s3:GetEncryptionConfiguration"
    ]
    resources = ["*"]
  }

  # セッションログをCloud Watch Logsに保存するために必要
  statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams"
    ]
    resources = [aws_cloudwatch_log_group.ssm.arn]
  }

  # セッションログの暗号化のためのKMSキーで復号化するために必要
  statement {
    effect = "Allow"
    actions = [
      "kms:Decrypt"
    ]
    resources = [aws_kms_key.session_log.arn]
  }

  # run.sh内でコンテナ終了時にマネージドインスタンスの登録解除するようにしているので、そのための権限を付与
  statement {
    effect = "Allow"
    actions = [
      "ssm:DeregisterManagedInstance"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "ssm_service_role" {
  name   = "ssm-service-role-policy"
  policy = data.aws_iam_policy_document.ssm_service_role.json
}

resource "aws_iam_role_policy_attachment" "ssm_service_role" {
  for_each = {
    dummy_key_1 = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
    dummy_key_2 = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
    dummy_key_3 = aws_iam_policy.ssm_service_role.arn
  }
  policy_arn = each.value
  role       = aws_iam_role.ssm_service_role.name
}

### session_manager_operator_role.tf
data "aws_iam_policy_document" "session_manager_operator_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "session_manager_operator" {
  name               = "session-manager-operator"
  assume_role_policy = data.aws_iam_policy_document.session_manager_operator_assume_role.json
}

# See also: https://docs.aws.amazon.com/ja_jp/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html
data "aws_iam_policy_document" "session_manager_operator" {
  statement {
    effect = "Allow"
    actions = [
      "ssm:StartSession"
    ]
    resources = [
      "arn:aws:ec2:*:*:instance/*",
      "arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.self.account_id}:document/${aws_ssm_document.session_log.name}"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ssm:TerminateSession",
      "ssm:ResumeSession",
      "ssm:DescribeSessions",
      "ssm:GetConnectionStatus"
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "ssm:GetDocument"
    ]
    resources = ["arn:aws:ssm:::document/${aws_ssm_document.session_log.name}"]
  }

  statement {
    effect = "Allow"
    actions = [
      "kms:GenerateDataKey"
    ]
    resources = [aws_kms_key.session_log.arn]
  }
}

resource "aws_iam_policy" "session_manager_operator" {
  name   = "session-manager-for-operator"
  policy = data.aws_iam_policy_document.session_manager_operator.json
}

resource "aws_iam_role_policy_attachment" "session_manager_operator" {
  policy_arn = aws_iam_policy_document.session_manager_operator.arn
  role       = aws_iam_role.session_manager_operator.name
}

### ecs.tf
resource "aws_ecs_cluster" "ssm_agent_ecs_cluster" {
  name = "ssm-agent-ecs-cluster"
  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

resource "aws_cloudwatch_log_group" "ssm_agent_log_group" {
  name = "/ecs/ssm_agent"
}

locals {
  container_definitions = [
    {
      name  = "ssm_agent"
      image = "xxxxxx.dkr.ecr.${data.aws_region.current.name}.amazonaws.com/YOUR_REPOSITORY_NAME:YOUR_DOCKER_IMAGE_TAG"
      environment = [
        {
          name  = "INSTANCE_NAME"
          value = "ssm-agent-from-ecs"
        },
        {
          name  = "INSTANCE_IAM_ROLE"
          value = aws_iam_role.ssm_service_role.name
        },
        {
          name  = "AWS_REGION"
          value = data.aws_region.current.name
        },
        {
          name  = "CLOUDWATCH_RECEIVER_LOG_GROUP"
          value = aws_cloudwatch_log_group.ssm_agent_log_group.name
        }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.ssm_agent_log_group.name
          "awslogs-region"        = data.aws_region.current.name
          "awslogs-stream-prefix" = "ecs"
        }
      }
      essential    = true
      startTimeout = 120
      stopTimeout  = 120
    }
  ]
}

resource "aws_ecs_task_definition" "ssm_agent" {
  family                   = "ssm-agent"
  container_definitions    = jsonencode(local.container_definitions)
  task_role_arn            = aws_iam_role.ecs_task_role.arn
  execution_role_arn       = aws_iam_role.ssm_service_role.arn
  network_mode             = "awsvpc"
  memory                   = "2048"
  cpu                      = "1024"
  requires_compatibilities = ["FARGATE"]
}