プライベートサブネットのEC2にSession Managerで接続する構成をTerraformで作る

$ terraform providers -version
Terraform v1.11.0
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.94.1

$ tree
.
├── ec2.tf
├── iam.tf
├── provider.tf
├── security_group.tf
├── variable.tf
└── vpc.tf

terraform {
  required_version = ">= 1.0.0, < 2.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region  = "ap-northeast-1"
}

locals {
  region       = "ap-northeast-1"
  https_port   = 443
  any_protocol = -1
  tcp_protocol = "tcp"
}

variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  default     = "10.0.0.0/16"
}

variable "subnet" {
  description = "CIDR block and region for subnet"
  type = object({
    az   = string
    cidr = string
  })

  default = {
    az   = "ap-northeast-1a"
    cidr = "10.0.1.0/24"
  }
}

variable "vpc_endpoint" {
  description = "List of VPC endpoint name"
  type        = list(string)
  default     = ["ssm", "ssmmessages"]
}

# VPCの作成
resource "aws_vpc" "test_vpc" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "test_vpc"
  }
}

# プライベートサブネットの作成
resource "aws_subnet" "test_private_subnet" {
  vpc_id            = aws_vpc.test_vpc.id
  cidr_block        = var.subnet.cidr
  availability_zone = var.subnet.az

  tags = {
    Name = "test_private_subnet"
  }
}

# 空のルートテーブルを作成
resource "aws_route_table" "test_private_route_table" {
  vpc_id = aws_vpc.test_vpc.id

  route = []

  tags = {
    Name = "test_private_route_table"
  }
}

# ルートテーブルをプライベートサブネットへアタッチ
resource "aws_route_table_association" "test_private_route_table_association" {
  subnet_id      = aws_subnet.test_private_subnet.id
  route_table_id = aws_route_table.test_private_route_table.id
}

# VPCエンドポイントの作成
resource "aws_vpc_endpoint" "test_vpc_endpoint" {
  for_each = toset(var.vpc_endpoint)

  vpc_id              = aws_vpc.test_vpc.id
  subnet_ids          = [aws_subnet.test_private_subnet.id]
  service_name        = "com.amazonaws.${local.region}.${each.value}"
  vpc_endpoint_type   = "Interface"
  security_group_ids  = [aws_security_group.vpc_endpoint_sg.id]
  private_dns_enabled = true
}

# 信頼されたエンティティを定義
data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

# IAMロールの作成
resource "aws_iam_role" "test_iam_role" {
  name               = "test_role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

# IAMインスタンスプロファイルの作成
resource "aws_iam_instance_profile" "test_profile" {
  name = "test_profile"
  role = aws_iam_role.test_iam_role.name
}

# AmazonSSMManagedInstanceCoreのARNをフェッチ
data "aws_iam_policy" "ssm_access" {
  arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# IAMロールにAmazonSSMManagedInstanceCoreをアタッチ
resource "aws_iam_role_policy_attachment" "test_attachment" {
  role       = aws_iam_role.test_iam_role.name
  policy_arn = data.aws_iam_policy.ssm_access.arn
}

# 最新のAmazon Linux 2023 x86_64版のAMI IDを取得
data "aws_ami" "amzn_linux_2023_ami" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

resource "aws_instance" "test_ec2" {
  ami                    = data.aws_ami.amzn_linux_2023_ami.id
  instance_type          = "t2.micro"
  subnet_id              = aws_subnet.test_private_subnet.id
  iam_instance_profile   = aws_iam_instance_profile.test_profile.name
  vpc_security_group_ids = [aws_security_group.ec2_sg.id]

  tags = {
    Name = "test_ec2"
  }

}

# EC2用セキュリティグループの作成
resource "aws_security_group" "ec2_sg" {
  name   = "ec2_sg"
  vpc_id = aws_vpc.test_vpc.id

  tags = {
    Name = "ec2_sg"
  }
}

# VPCエンドポイント用セキュリティグループの作成
resource "aws_security_group" "vpc_endpoint_sg" {
  name   = "vpc_endpoint_sg"
  vpc_id = aws_vpc.test_vpc.id

  tags = {
    Name = "vpc_endpoint_sg"
  }
}

# HTTPSのインバウンド許可設定を作成し、VPCエンドポイント用セキュリティグループへアタッチ
resource "aws_vpc_security_group_ingress_rule" "allow_https_ingress" {
  security_group_id = aws_security_group.vpc_endpoint_sg.id
  cidr_ipv4         = var.subnet.cidr
  from_port         = local.https_port
  ip_protocol       = local.tcp_protocol
  to_port           = local.https_port
}

# HTTPSのアウトバウンド許可設定を作成し、EC2用セキュリティグループへアタッチ
resource "aws_vpc_security_group_egress_rule" "allow_https_egress" {
  security_group_id = aws_security_group.ec2_sg.id
  cidr_ipv4         = var.subnet.cidr
  from_port         = local.https_port
  ip_protocol       = local.tcp_protocol
  to_port           = local.https_port
}

$ terraform init
$ terraform apply

$ aws ssm start-session --target インスタンスID --region リージョン名 --profile プロファイル名（プロファイルを使用していれば）

Starting session with SessionId: botocore-session-xxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxx
sh-5.2$ uname -n
ip-10-0-1-172.ap-northeast-1.compute.internal
sh-5.2$