「きのこの山」を閉域に閉じ込めてみた

# 前回クローンしたリポジトリに cd する
cd aws-ml-jp/
# リポジトリの最新化
git pull origin main

# リポジトリをクローン
git clone https://github.com/aws-samples/aws-ml-jp
cd aws-ml-jp/

$ cd sagemaker/sagemaker-studio/IaC/case02/cdk-typescript
$ # 依存ライブラリインストール
$ npm install
$ # cdk の設定(前回実行している場合は不要)
$ # cdk bootstrap
$ # デプロイ
$ cdk deploy
(前略)
✅  ChococonesStack
✨  Deployment time: 446.38s
Outputs:
ChococonesStack.KudoEC2PasswordXXXXXXXXX = KudoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.KudoPasswordXXXXXXXXX = KudoSecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoEC2PasswordXXXXXXXX = TsugoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoPasswordXXXXXXXXX = TsugoSecretXXXXXXXX-XXXXXXXXXXXXStack ARN:
arn:aws:cloudformation:{REGION}}:{ACCOUNT}:stack/ChococonesStack/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
✨  Total time: 450.95s

$ cd sagemaker/sagemaker-studio/IaC/case02/cdk-python
$ # 依存ライブラリインストール
$ mkdir lib 
$ pip install -r requirements.txt -t /lib
$ # インストールディレクトリにパスを通す
$ export PYTHONPATH=$PWD/lib
$ # cdk の設定(前回実行している場合は不要)
$ # cdk bootstrap
$ # デプロイ
$ cdk deploy 
(前略)
✅  ChococonesStack
✨  Deployment time: 448.68s
Outputs:
ChococonesStack.KudoEC2PasswordXXXXXXXXX = KudoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.KudoPasswordXXXXXXXXX = KudoSecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoEC2PasswordXXXXXXXX = TsugoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoPasswordXXXXXXXXX = TsugoSecretXXXXXXXX-XXXXXXXXXXXXStack ARN:
arn:aws:cloudformation:{REGION}}:{ACCOUNT}:stack/ChococonesStack/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
✨  Total time: 453.82s

# 認証コマンド
aws codeartifact login --tool pip --repository chococones --domain chocones --domain-owner {ACCOUND_ID} --region {region}

// Domain 用の VPC
const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 })

// Domain 用の VPC
const vpc = new ec2.Vpc(this, 'Vpc', {
  maxAzs: 2,
  natGateways: 0,
  subnetConfiguration: [
    {
      name: 'isolated-subnet',
      subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      cidrMask: 24,
    },
  ],
})

# Domain 用の VPC
vpc = ec2.Vpc(self, "vpc", max_azs=2)

# Domain 用の VPC
vpc = ec2.Vpc(
    self,
    "vpc",
    max_azs=2,
    nat_gateways=0,
    subnet_configuration=[
        {
            "name": "isolated-subnet",
            "subnetType": ec2.SubnetType.PRIVATE_ISOLATED,
            "cidrMask": 24,
        },
    ],
)

// エンドポイントを設定
new ec2.InterfaceVpcEndpoint(this, `SsmVpcEndpoint`, {
  service: ec2.InterfaceVpcEndpointAwsService.SSM,
  privateDnsEnabled: true,
  vpc: vpc,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
})
…
(中略)
…
new ec2.InterfaceVpcEndpoint(this, 'SecretsManagerApiVpcEndpoint', {
  service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
  privateDnsEnabled: true,
  vpc: vpc,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
})
vpc.addGatewayEndpoint('S3GatewayEndpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3,
  subnets: [{ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }],
})

# エンドポイントを設定
ec2.InterfaceVpcEndpoint(
    self,
    "SsmVpcEndpoint",
    service=ec2.InterfaceVpcEndpointAwsService.SSM,
    private_dns_enabled=True,
    vpc=vpc,
    subnets={"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
)
…
(中略)
…
ec2.InterfaceVpcEndpoint(
    self,
    "SecretsManagerApiVpcEndpoint",
    service=ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
    private_dns_enabled=True,
    vpc=vpc,
    subnets={"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
)

vpc.add_gateway_endpoint(
    "S3GatewayEndpoint",
    service=ec2.GatewayVpcEndpointAwsService.S3,
    subnets=[
        {"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
    ],
)

// EC2 用のパスワードを Secrets Manager で生成
const ec2Secret = new secretsmanager.Secret(this, 'Ec2Secret')

// EC2 インスタンス
const instance = new ec2.Instance(this, 'Instance', {
  vpc: props.vpc,
  vpcSubnets: props.vpc.selectSubnets({
    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
  }),
  instanceType: ec2.InstanceType.of(
    ec2.InstanceClass.T3,
    ec2.InstanceSize.LARGE
  ),
  machineImage: new ec2.WindowsImage(
    ec2.WindowsVersion.WINDOWS_SERVER_2022_ENGLISH_FULL_BASE
  ),
  role: instanceRole,
  userData: ec2.UserData.custom(
    `
<powershell>
$password = (Get-SECSecretValue -SecretId ${ec2Secret.secretArn} -Region ${region}).SecretString
New-LocalUser -Name user-1 -Password (ConvertTo-SecureString $password -AsPlainText -Force)
Add-LocalGroupMember -Group "Remote Desktop Users" -Member user-1
Add-LocalGroupMember -Group Administrators -Member user-1
Write-Output '$url = New-SMPresignedDomainUrl -DomainId ${props.domainId} -UserProfileName ${this.userProfile.userProfileName} -Region ${region}' | Set-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
Write-Output 'start microsoft-edge:$url' | Add-Content -Encoding Default 'C:\\GetPresignedUrl.ps1' 
</powershell>
<persist>true</persist>
`
  ),
})

# EC2 へのログイン用パスワードを Secrets Manager で生成
ec2_secret = secretsmanager.Secret(self, "EC2Secret")
(中略)

# EC2 インスタンス
instance = ec2.Instance(
    self,
    "Instance",
    vpc=vpc,
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PRIVATE_ISOLATED
    ),
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.T3,
        ec2.InstanceSize.LARGE,
    ),
    machine_image=ec2.WindowsImage(
        ec2.WindowsVersion.WINDOWS_SERVER_2022_ENGLISH_FULL_BASE
    ),
    role=instance_role,
    user_data=ec2.UserData.custom(
       f"""
<powershell>
$password = (Get-SECSecretValue -SecretId {self.ec2_secret.secret_arn} -Region {region}).SecretString
New-LocalUser -Name user-1 -Password (ConvertTo-SecureString $password  -AsPlainText -Force)
Add-LocalGroupMember -Group "Remote Desktop Users" -Member user-1
Add-LocalGroupMember -Group Administrators -Member user-1
Write-Output '$url = New-SMPresignedDomainUrl -DomainId {domain.attr_domain_id} -UserProfileName {self.user_profile.user_profile_name} -Region {region}' | Set-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
Write-Output 'start microsoft-edge:$url' | Add-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
</powershell>
<persist>true</persist>
        """
    ),
)

// インスタンス用 Role
const instanceRole = new iam.Role(this, `InstanceRole`, {
  assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName(
      'AmazonSSMManagedInstanceCore'
    ),
  ],
})

const instancePolicy = new iam.ManagedPolicy(this, 'InstancePolicy')

instancePolicy.addStatements(
    new iam.PolicyStatement(
        {
          effect: iam.Effect.ALLOW,
          actions: ["sagemaker:CreatePresignedDomainUrl"],
          resources: [
            userProfile.attrUserProfileArn,
          ],
        }
    )
)

instancePolicy.addStatements(
    new iam.PolicyStatement(
        {
          effect: iam.Effect.ALLOW,
          actions: ['secretsmanager:GetSecretValue'],
          resources: [
            ec2Secret.secretArn
          ]
        }
    )
)

instanceRole.addManagedPolicy(instancePolicy)

# インスタンス用 Role
instance_role = iam.Role(
    self,
    "InstanceRole",
    assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name(
            "AmazonSSMManagedInstanceCore"
        )
    ],
)

instance_policy = iam.ManagedPolicy(self, "InstancePolicy")

instance_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=["sagemaker:CreatePresignedDomainUrl"],
        resources=[
            user_profile.attr_user_profile_arn,
        ],
    )
)

instance_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=['secretsmanager:GetSecretValue'],
        resources=[
            ec2_secret.secret_arn
        ]
    )
)

instance_role.add_managed_policy(instance_policy)

// IAM ユーザー
this.user = new iam.User(this, 'User', {
  userName: props.name,
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName('IAMUserChangePassword'),
    props.stdioCommonPolicy,
  ],
  password: secret.secretValue,
  passwordResetRequired: true,
})

// IAM ユーザーにアタッチする Fleet Manager を使うためのポリシー
const startSessionPolicyJson = {
  Version: '2012-10-17',
  Statement: [
    {
      Sid: 'EC2',
      Effect: 'Allow',
      Action: ['ec2:DescribeInstances', 'ec2:GetPasswordData'],
      Resource: '*',
    },
    {
      Sid: 'SSM',
      Effect: 'Allow',
      Action: [
        'ssm:DescribeInstanceProperties',
        'ssm:GetCommandInvocation',
        'ssm:GetInventorySchema',
      ],
      Resource: '*',
    },
    {
      Sid: 'SSMStartSession',
      Effect: 'Allow',
      Action: ['ssm:StartSession'],
      Resource: ['arn:aws:ssm:*::document/AWS-StartPortForwardingSession'],
      Condition: {
        BoolIfExists: {
          'ssm:SessionDocumentAccessCheck': 'true',
        },
      },
    },
    {
      Sid: 'AccessTaggedInstances',
      Effect: 'Allow',
      Action: ['ssm:StartSession'],
      Resource: [
        `arn:aws:ec2:*:${accountId}:instance/*`,
        `arn:aws:ssm:*:${accountId}:managed-instance/*`,
      ],
      Condition: {
        StringLike: {
          'ssm:resourceTag/Name': [nameTagValue],
        },
      },
    },
    {
      Sid: 'GuiConnect',
      Effect: 'Allow',
      Action: [
        'ssm-guiconnect:CancelConnection',
        'ssm-guiconnect:GetConnection',
        'ssm-guiconnect:StartConnection',
      ],
      Resource: '*',
    },
  ],
}

const startSessionPolicyDocument = iam.PolicyDocument.fromJson(
    startSessionPolicyJson
)
const startSessionManagedPolicy = new iam.ManagedPolicy(
    this,
    'StartSessionManagedPolicy',
    {
      document: startSessionPolicyDocument,
    }
)
startSessionManagedPolicy.attachToUser(this.user)

# IAM ユーザー
self.user = iam.User(
    self,
    "User",
    user_name=name,
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name("IAMUserChangePassword"),
    ],
    password=secret.secret_value,
    password_reset_required=True,
)
# IAM ユーザーにアタッチする Fleet Manager を使うためのポリシー
START_SESSION_POLICY_JSON = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": ["ec2:DescribeInstances", "ec2:GetPasswordData"],
            "Resource": "*",
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceProperties",
                "ssm:GetCommandInvocation",
                "ssm:GetInventorySchema",
            ],
            "Resource": "*",
        },
        {
            "Sid": "SSMStartSession",
            "Effect": "Allow",
            "Action": ["ssm:StartSession"],
            "Resource": [
                "arn:aws:ssm:*::document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true",
                }
            },
        },
        {
            "Sid": "AccessTaggedInstances",
            "Effect": "Allow",
            "Action": ["ssm:StartSession"],
            "Resource": [
                f"arn:aws:ec2:*:{account_id}:instance/*",
                f"arn:aws:ssm:*:{account_id}:managed-instance/*",
            ],
            "Condition": {
                "StringLike": {
                    "ssm:resourceTag/Name": [NAME_TAG_VALUE],
                }
            },
        },
        {
            "Sid": "GuiConnect",
            "Effect": "Allow",
            "Action": [
                "ssm-guiconnect:CancelConnection",
                "ssm-guiconnect:GetConnection",
                "ssm-guiconnect:StartConnection",
            ],
            "Resource": "*",
        },
    ],
}
start_session_policy_document = iam.PolicyDocument.from_json(
    START_SESSION_POLICY_JSON
)
start_session_managed_policy = iam.ManagedPolicy(
    self,
    "StartSessionManagedPolicy",
    document=start_session_policy_document,
)
start_session_managed_policy.attach_to_user(self.user)

const codeartifactDomain = new codeartifact.CfnDomain(
  this,
  'codeartifactDomain',
  {
    domainName: codeartifactRepositoryName,
  }
)

const codeartifactRepository = new codeartifact.CfnRepository(
  this,
  'codeartifactRepository',
  {
    domainName: codeartifactDomain.domainName,
    repositoryName: codeartifactRepositoryName,
    externalConnections: ['public:pypi'],
  }
)

codeartifactRepository.addDependency(codeartifactDomain)

code_artifact_domain = codeartifact.CfnDomain(
    self,
    "codeartifactDomain",
    domain_name=CODE_ARTIFACT_DOMAIN_NAME,
)

code_artifact_repository = codeartifact.CfnRepository(
    self,
    "codeartifactRepository",
    domain_name=code_artifact_domain.domain_name,
    repository_name=CODE_ARTIFACT_REPOSITORY_NAME,
    external_connections=["public:pypi"],
)

code_artifact_repository.add_dependency(code_artifact_domain)

// 全員の SageMaker Studio Profile につける共用 Policy
const studioCommonPolicy = new iam.ManagedPolicy(this, 'CommonPolicy')
// 共用 CodeArtifact リポジトリへのアクセス許可
studioCommonPolicy.addStatements(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: [
      'codeartifact:DescribeDomain',
      'codeartifact:DescribeRepository',
      'codeartifact:GetAuthorizationToken',
      'codeartifact:GetRepositoryEndpoint',
      'codeartifact:GetRepositoryPermissionsPolicy',
      'codeartifact:ListPackages',
      'codeartifact:ListRepositories',
      'codeartifact:ListTagsForResource',
      'codeartifact:ReadFromRepository',
    ],
    resources: [codeartifactDomain.attrArn, codeartifactRepository.attrArn],
  })
)
studioCommonPolicy.addStatements(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['sts:GetServiceBearerToken'],
    resources: ['*'],
    conditions: {
      StringEquals: {
        'sts:AWSServiceName': 'codeartifact.amazonaws.com',
      },
    },
  })
)

# 全員の SageMaker Studio Profile につける共用 Policy
studio_common_policy = iam.ManagedPolicy(self, "StudioCommonPolicy")
# 共用 CodeArtifact リポジトリへのアクセス許可
studio_common_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=[
            "codeartifact:DescribeDomain",
            "codeartifact:DescribeRepository",
            "codeartifact:GetAuthorizationToken",
            "codeartifact:GetRepositoryEndpoint",
            "codeartifact:GetRepositoryPermissionsPolicy",
            "codeartifact:ListPackages",
            "codeartifact:ListRepositories",
            "codeartifact:ListTagsForResource",
            "codeartifact:ReadFromRepository",
        ],
        resources=[
            code_artifact_domain.attr_arn,
            code_artifact_repository.attr_arn,
        ],
    )
)
studio_common_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=["sts:GetServiceBearerToken"],
        resources=["*"],
        conditions={
            "StringEquals": {"sts:AWSServiceName": "codeartifact.amazonaws.com"}
        },
    )
)