EC2 NAT 实例选型与部署实践

aws ec2 describe-instance-types \
    --filters "Name=current-generation,Values=true" \
    --query "InstanceTypes[].[InstanceType, VCpuInfo.DefaultVCpus, NetworkInfo.NetworkPerformance, NetworkInfo.NetworkCards[0].PeakBandwidthInGbps, NetworkInfo.NetworkCards[0].BaselineBandwidthInGbps]" \
    --output json

aws pricing get-products \
    --service-code AmazonEC2 \
    --filters \
        'Type=TERM_MATCH,Field=location,Value=China (Ningxia)' \
        'Type=TERM_MATCH,Field=operatingSystem,Value=Linux' \
        'Type=TERM_MATCH,Field=tenancy,Value=Shared' \
        'Type=TERM_MATCH,Field=capacitystatus,Value=Used' \
        'Type=TERM_MATCH,Field=preInstalledSw,Value=NA' \
    --output json

# 安装 iptables
sudo yum install iptables-services -y
sudo systemctl enable iptables
sudo systemctl start iptables
# 启用 IP 转发
sudo tee /etc/sysctl.d/custom-ip-forwarding.conf << EOF
net.ipv4.ip_forward=1
EOF
sudo sysctl -p /etc/sysctl.d/custom-ip-forwarding.conf
# 获取默认路由网卡，配置 MASQUERADE
IFACE=$(ip route show default | awk '{print $5}' | head -1)
sudo /sbin/iptables -t nat -A POSTROUTING -o "$IFACE" -j MASQUERADE
sudo /sbin/iptables -F FORWARD
sudo service iptables save

# 获取 IMDSv2 Token
TOKEN=$(curl -s -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" -X PUT "http://169.254.169.254/latest/api/token")
# 通过 Token 获取当前实例 ID
INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)

# 接管 EIP，--allow-reassociation 允许从旧实例接管
aws ec2 associate-address --allocation-id ${NatEip.AllocationId} --instance-id $INSTANCE_ID --allow-reassociation

# 禁用源/目标检查，允许转发非自身流量
aws ec2 modify-instance-attribute --no-source-dest-check --instance-id $INSTANCE_ID

for SUBNET in ${PrivateSubnets}; do
  # 查找子网显式关联的路由表
  RT=$(aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=$SUBNET" --query 'RouteTables[0].RouteTableId' --output text)

  # 未找到则说明子网使用主路由表，通过 VPC ID 查找
  if [ "$RT" = "None" ] || [ -z "$RT" ]; then
    VPC_ID=$(aws ec2 describe-subnets --subnet-ids $SUBNET --query 'Subnets[0].VpcId' --output text)
    RT=$(aws ec2 describe-route-tables --filters "Name=vpc-id,Values=$VPC_ID" "Name=association.main,Values=true" --query 'RouteTables[0].RouteTableId' --output text)
  fi
  # 替换已有路由，若不存在则创建
  aws ec2 replace-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --instance-id $INSTANCE_ID || \
  aws ec2 create-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --instance-id $INSTANCE_ID
done

AWSTemplateFormatVersion: "2010-09-09"
Description: NAT Instance
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Instance Configuration
        Parameters:
          - InstanceType
          - KeyPairName
          - PublicSubnetId
      - Label:
          default: Network Configuration
        Parameters:
          - PrivateSubnetIds
    ParameterLabels:
      InstanceType:
        default: Instance Type
      KeyPairName:
        default: Key Pair
      PublicSubnetId:
        default: Public Subnet
      PrivateSubnetIds:
        default: Private Subnets
Parameters:
  InstanceType:
    Type: String
    Default: t4g.nano
    AllowedValues:
      - t4g.nano
      - t4g.micro
      - t4g.small
      - t4g.medium
      - c8g.medium
      - c8g.large
      - c8gn.medium
      - c8gn.large
      - c8g.8xlarge
      - c8g.12xlarge
      - c8gn.8xlarge
      - c8gn.12xlarge
      - c8gn.16xlarge
      - c8gn.24xlarge
    Description: Select a recommended NAT instance type in cn-northwest-1
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Select a key pair for SSH access
  PublicSubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: Select a public subnet to deploy the NAT instance
  PrivateSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Select private subnets that need NAT
Resources:
  GetVpcIdRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: DescribeVpcSubnets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeSubnets
                Resource: "*"
  GetVpcIdFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.14
      Handler: index.handler
      Role: !GetAtt GetVpcIdRole.Arn
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import json
          def handler(event, context):
              try:
                  # Skip processing on stack deletion
                  if event['RequestType'] == 'Delete':
                      cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                      return

                  ec2 = boto3.client('ec2')
                  public_subnet_id = event['ResourceProperties']['PublicSubnetId']

                  # Get VPC ID from subnet
                  response = ec2.describe_subnets(SubnetIds=[public_subnet_id])
                  vpc_id = response['Subnets'][0]['VpcId']

                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {
                      'VpcId': vpc_id
                  })
              except Exception as e:
                  print(f"Error: {str(e)}")
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})
  GetVpcId:
    Type: Custom::GetVpcId
    Properties:
      ServiceToken: !GetAtt GetVpcIdFunction.Arn
      PublicSubnetId: !Ref PublicSubnetId
  NatSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for NAT instance
      VpcId: !GetAtt GetVpcId.VpcId
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: Allow HTTP to internet
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: Allow HTTPS to internet
  AddSecurityGroupRulesRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: SecurityGroupOperations
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeSubnets
                  - ec2:AuthorizeSecurityGroupIngress
                Resource: "*"
  AddSecurityGroupRulesFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.14
      Handler: index.handler
      Role: !GetAtt AddSecurityGroupRulesRole.Arn
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          def handler(event, context):
              try:
                  ec2 = boto3.client('ec2')

                  # Skip processing on stack deletion
                  if event['RequestType'] == 'Delete':
                      cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                      return

                  sg_id = event['ResourceProperties']['SecurityGroupId']
                  private_subnet_ids = event['ResourceProperties']['PrivateSubnetIds']

                  # Get CIDR blocks for all private subnets
                  response = ec2.describe_subnets(SubnetIds=private_subnet_ids)

                  # Add ingress rules for each private subnet CIDR
                  for subnet in response['Subnets']:
                      cidr = subnet['CidrBlock']

                      ec2.authorize_security_group_ingress(
                          GroupId=sg_id,
                          IpPermissions=[
                              {
                                  'IpProtocol': 'tcp',
                                  'FromPort': 80,
                                  'ToPort': 80,
                                  'IpRanges': [{'CidrIp': cidr, 'Description': f'HTTP from {cidr}'}]
                              },
                              {
                                  'IpProtocol': 'tcp',
                                  'FromPort': 443,
                                  'ToPort': 443,
                                  'IpRanges': [{'CidrIp': cidr, 'Description': f'HTTPS from {cidr}'}]
                              }
                          ]
                      )

                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
              except Exception as e:
                  print(f"Error: {str(e)}")
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})
  AddNatSecurityGroupRules:
    Type: Custom::SecurityGroupRules
    Properties:
      ServiceToken: !GetAtt AddSecurityGroupRulesFunction.Arn
      SecurityGroupId: !Ref NatSecurityGroup
      PrivateSubnetIds: !Ref PrivateSubnetIds
  NatInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: NatInstancePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:ModifyInstanceCreditSpecification
                  - ec2:AssociateAddress
                  - ec2:ModifyInstanceAttribute
                  - ec2:DescribeRouteTables
                  - ec2:DescribeSubnets
                  - ec2:ReplaceRoute
                  - ec2:CreateRoute
                Resource: "*"
  NatInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref NatInstanceRole
  NatLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64}}"
        InstanceType: !Ref InstanceType
        KeyName: !Ref KeyPairName
        NetworkInterfaces:
          - DeviceIndex: "0"
            AssociatePublicIpAddress: true
            Groups:
              - !Ref NatSecurityGroup
        IamInstanceProfile:
          Arn: !GetAtt NatInstanceProfile.Arn
        UserData:
          Fn::Base64: !Sub
            - |
              #!/bin/bash
              set -ex
              # Install and enable iptables
              sudo yum install iptables-services -y
              sudo systemctl enable iptables
              sudo systemctl start iptables
              # Enable IP forwarding
              sudo tee /etc/sysctl.d/custom-ip-forwarding.conf << EOF
              net.ipv4.ip_forward=1
              EOF
              sudo sysctl -p /etc/sysctl.d/custom-ip-forwarding.conf
              # Configure NAT masquerade on default interface
              IFACE=$(ip route show default | awk '{print $5}' | head -1)
              sudo /sbin/iptables -t nat -A POSTROUTING -o "$IFACE" -j MASQUERADE
              sudo /sbin/iptables -F FORWARD
              sudo service iptables save
              # Get instance ID using IMDSv2
              TOKEN=$(curl -s -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" -X PUT "http://169.254.169.254/latest/api/token")
              INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
              # Set CPU credit specification to standard
              aws ec2 modify-instance-credit-specification --instance-credit-specifications InstanceId=$INSTANCE_ID,CpuCredits=standard
              # Associate EIP with this instance
              aws ec2 associate-address --allocation-id ${NatEip.AllocationId} --instance-id $INSTANCE_ID --allow-reassociation
              # Disable source/destination check for NAT
              aws ec2 modify-instance-attribute --no-source-dest-check --instance-id $INSTANCE_ID
              # Update route tables for private subnets
              for SUBNET in ${PrivateSubnets}; do
                # Find route table explicitly associated with subnet
                RT=$(aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=$SUBNET" --query 'RouteTables[0].RouteTableId' --output text)

                # If not found, use main route table
                if [ "$RT" = "None" ] || [ -z "$RT" ]; then
                  VPC_ID=$(aws ec2 describe-subnets --subnet-ids $SUBNET --query 'Subnets[0].VpcId' --output text)
                  RT=$(aws ec2 describe-route-tables --filters "Name=vpc-id,Values=$VPC_ID" "Name=association.main,Values=true" --query 'RouteTables[0].RouteTableId' --output text)
                fi
                # Replace or create default route pointing to this instance
                aws ec2 replace-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --instance-id $INSTANCE_ID || \
                aws ec2 create-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --instance-id $INSTANCE_ID
              done
            - PrivateSubnets: !Join [ " ", !Ref PrivateSubnetIds ]
  NatAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref NatLaunchTemplate
        Version: !GetAtt NatLaunchTemplate.LatestVersionNumber
      VPCZoneIdentifier:
        - !Ref PublicSubnetId
      DesiredCapacity: "1"
      MinSize: "1"
      MaxSize: "1"
  NatEip:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc