cd aws-ml-jp/
# リポジトリの最新化
git pull origin main

git clone https://github.com/aws-samples/aws-ml-jp
cd aws-ml-jp/

$ cd sagemaker/sagemaker-studio/IaC/case02/cdk-typescript
$ # 依存ライブラリインストール
$ npm install
$ # cdk の設定(前回実行している場合は不要)
$ # cdk bootstrap
$ # デプロイ
$ cdk deploy
(前略)
✅  ChococonesStack
✨  Deployment time: 446.38s
Outputs:
ChococonesStack.KudoEC2PasswordXXXXXXXXX = KudoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.KudoPasswordXXXXXXXXX = KudoSecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoEC2PasswordXXXXXXXX = TsugoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoPasswordXXXXXXXXX = TsugoSecretXXXXXXXX-XXXXXXXXXXXXStack ARN:
arn:aws:cloudformation:{REGION}}:{ACCOUNT}:stack/ChococonesStack/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
✨  Total time: 450.95s

$ cd sagemaker/sagemaker-studio/IaC/case02/cdk-python
$ # 依存ライブラリインストール
$ mkdir lib 
$ pip install -r requirements.txt -t /lib
$ # インストールディレクトリにパスを通す
$ export PYTHONPATH=$PWD/lib
$ # cdk の設定(前回実行している場合は不要)
$ # cdk bootstrap
$ # デプロイ
$ cdk deploy 
(前略)
✅  ChococonesStack
✨  Deployment time: 448.68s
Outputs:
ChococonesStack.KudoEC2PasswordXXXXXXXXX = KudoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.KudoPasswordXXXXXXXXX = KudoSecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoEC2PasswordXXXXXXXX = TsugoEC2SecretXXXXXXXX-XXXXXXXXXXXX
ChococonesStack.TsugoPasswordXXXXXXXXX = TsugoSecretXXXXXXXX-XXXXXXXXXXXXStack ARN:
arn:aws:cloudformation:{REGION}}:{ACCOUNT}:stack/ChococonesStack/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
✨  Total time: 453.82s

$ cd sagemaker/sagemaker-studio/IaC/case02/terraform
$ # 鍵保管用のディレクトリ作成
$ mkdir ./cert
$ # 鍵生成
$ gpg --gen-key
(名前を問われるので terraform,メールアドレスは任意のアドレスを入力する)
$ # 鍵のエクスポート
$ gpg -o ./cert/terraform.public.gpg  --export terraform
$ gpg -o ./cert/terraform.private.gpg --export-secret-key terraform
$ 
$ # Lambda 関数のアセットを zip 圧縮
$ cd examples
$ zip rotate.py.zip rotate.py
$ 
$ # Terraform 実行準備 
$ terraform init
$ # Terraform 実行
$ # project name は世界でユニークなものを設定してください。筆者が使っているのでおそらく使えません。
$ terraform apply -var='project_name=chococones' -auto-approve
(前略)
Plan: 114 to add, 0 to change, 0 to destroy.
(後略)

// Domain 用の VPC
const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 })

// Domain 用の VPC
const vpc = new ec2.Vpc(this, 'Vpc', {
  maxAzs: 2,
  natGateways: 0,
  subnetConfiguration: [
    {
      name: 'isolated-subnet',
      subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      cidrMask: 24,
    },
  ],
})

# Domain 用の VPC
vpc = ec2.Vpc(self, "vpc", max_azs=2)

# Domain 用の VPC
vpc = ec2.Vpc(
    self,
    "vpc",
    max_azs=2,
    nat_gateways=0,
    subnet_configuration=[
        {
            "name": "isolated-subnet",
            "subnetType": ec2.SubnetType.PRIVATE_ISOLATED,
            "cidrMask": 24,
        },
    ],
)

# VPC
module "vpc_for_sagemaker" {
  source = "terraform-aws-modules/vpc/aws"

  name            = "${var.project_name}-${var.environment}-vpc-sagemaker"
  cidr            = "10.0.0.0/16"
  azs             = ["us-east-1a", "us-east-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false
  one_nat_gateway_per_az = false
  enable_dns_support     = true
  enable_dns_hostnames   = true

  tags = {
    Name = "vpc_for_sagemaker"
  }
}

# VPC
module "vpc_for_sagemaker" {
  source = "terraform-aws-modules/vpc/aws"

  name            = "${var.project_name}-${var.environment}-vpc"
  cidr            = "10.0.0.0/16"
  azs             = ["${var.aws_region}a", "${var.aws_region}c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]

  enable_nat_gateway     = false
  single_nat_gateway     = false
  one_nat_gateway_per_az = false
  enable_dns_support     = true
  enable_dns_hostnames   = true

  tags = {
    Name = "${var.project_name}-${var.environment}-vpc"
  }
}

// エンドポイントを設定
new ec2.InterfaceVpcEndpoint(this, `SsmVpcEndpoint`, {
  service: ec2.InterfaceVpcEndpointAwsService.SSM,
  privateDnsEnabled: true,
  vpc: vpc,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
})
…
(中略)
…
new ec2.InterfaceVpcEndpoint(this, 'SecretsManagerApiVpcEndpoint', {
  service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
  privateDnsEnabled: true,
  vpc: vpc,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
})
vpc.addGatewayEndpoint('S3GatewayEndpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3,
  subnets: [{ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }],
})

# エンドポイントを設定
ec2.InterfaceVpcEndpoint(
    self,
    "SsmVpcEndpoint",
    service=ec2.InterfaceVpcEndpointAwsService.SSM,
    private_dns_enabled=True,
    vpc=vpc,
    subnets={"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
)
…
(中略)
…
ec2.InterfaceVpcEndpoint(
    self,
    "SecretsManagerApiVpcEndpoint",
    service=ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
    private_dns_enabled=True,
    vpc=vpc,
    subnets={"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
)

vpc.add_gateway_endpoint(
    "S3GatewayEndpoint",
    service=ec2.GatewayVpcEndpointAwsService.S3,
    subnets=[
        {"subnet_type": ec2.SubnetType.PRIVATE_ISOLATED},
    ],
)

# Security Group for VPC endpoint
resource "aws_security_group" "allow_local_https" {
  name        = "allow_local_https"
  description = "Allow HTTPS inbound traffic"
  vpc_id      = module.vpc_for_sagemaker.vpc_id

  ingress {
    description = "TLS from VPC"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [module.vpc_for_sagemaker.vpc_cidr_block]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "allow_local_https"
  }
}

resource "aws_vpc_endpoint" "s3_endpoint" {
  vpc_id            = module.vpc_for_sagemaker.vpc_id
  service_name      = "com.amazonaws.${data.aws_region.current.name}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = module.vpc_for_sagemaker.private_route_table_ids
  policy            = <<POLICY
    {
        "Statement": [
            {
                "Action": "*",
                "Effect": "Allow",
                "Resource": "*",
                "Principal": "*"
            }
        ]
    }
    POLICY
}

# VPCエンドポイント
module "endpoints" {
  source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

  vpc_id             = module.vpc_for_sagemaker.vpc_id
  security_group_ids = [aws_security_group.allow_local_https.id]

  endpoints = {

    ssm = {
      service             = "ssm"
      private_dns_enabled = true
      subnet_ids          = module.vpc_for_sagemaker.private_subnets
      security_group_ids  = [aws_security_group.allow_local_https.id]
    },
    …
    (中略)
    …
    secretsmanager = {
      service             = "secretsmanager"
      private_dns_enabled = true
      subnet_ids          = module.vpc_for_sagemaker.private_subnets
  } }
}

// EC2 用のパスワードを Secrets Manager で生成
const ec2Secret = new secretsmanager.Secret(this, 'Ec2Secret')

// EC2 インスタンス
const instance = new ec2.Instance(this, 'Instance', {
  vpc: props.vpc,
  vpcSubnets: props.vpc.selectSubnets({
    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
  }),
  instanceType: ec2.InstanceType.of(
    ec2.InstanceClass.T3,
    ec2.InstanceSize.LARGE
  ),
  machineImage: new ec2.WindowsImage(
    ec2.WindowsVersion.WINDOWS_SERVER_2022_ENGLISH_FULL_BASE
  ),
  role: instanceRole,
  userData: ec2.UserData.custom(
    `
<powershell>
$password = (Get-SECSecretValue -SecretId ${ec2Secret.secretArn} -Region ${region}).SecretString
New-LocalUser -Name user-1 -Password (ConvertTo-SecureString $password -AsPlainText -Force)
Add-LocalGroupMember -Group "Remote Desktop Users" -Member user-1
Add-LocalGroupMember -Group Administrators -Member user-1
Write-Output '$url = New-SMPresignedDomainUrl -DomainId ${props.domainId} -UserProfileName ${this.userProfile.userProfileName} -Region ${region}' | Set-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
Write-Output 'start microsoft-edge:$url' | Add-Content -Encoding Default 'C:\\GetPresignedUrl.ps1' 
</powershell>
<persist>true</persist>
`
  ),
})

# EC2 へのログイン用パスワードを Secrets Manager で生成
ec2_secret = secretsmanager.Secret(self, "EC2Secret")
(中略)

# EC2 インスタンス
instance = ec2.Instance(
    self,
    "Instance",
    vpc=vpc,
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PRIVATE_ISOLATED
    ),
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.T3,
        ec2.InstanceSize.LARGE,
    ),
    machine_image=ec2.WindowsImage(
        ec2.WindowsVersion.WINDOWS_SERVER_2022_ENGLISH_FULL_BASE
    ),
    role=instance_role,
    user_data=ec2.UserData.custom(
       f"""
<powershell>
$password = (Get-SECSecretValue -SecretId {self.ec2_secret.secret_arn} -Region {region}).SecretString
New-LocalUser -Name user-1 -Password (ConvertTo-SecureString $password  -AsPlainText -Force)
Add-LocalGroupMember -Group "Remote Desktop Users" -Member user-1
Add-LocalGroupMember -Group Administrators -Member user-1
Write-Output '$url = New-SMPresignedDomainUrl -DomainId {domain.attr_domain_id} -UserProfileName {self.user_profile.user_profile_name} -Region {region}' | Set-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
Write-Output 'start microsoft-edge:$url' | Add-Content -Encoding Default 'C:\\GetPresignedUrl.ps1'
</powershell>
<persist>true</persist>
        """
    ),
)

# Secret
resource "aws_secretsmanager_secret" "ec2_login_password" {
  for_each = toset(var.user_list)
  name     = "${var.project_name}-ec2-login-password-${each.value}"
}

resource "aws_secretsmanager_secret_version" "secret_version" {
  for_each      = toset(var.user_list)
  secret_id     = "${var.project_name}-ec2-login-password-${each.value}"
  secret_string = jsonencode("dummypassword")

  lifecycle {
    ignore_changes = [
      secret_string
    ]
  }
  depends_on = [
    aws_secretsmanager_secret.ec2_login_password
  ]
}

# EC2
resource "aws_instance" "ec2-indivisual" {
  for_each               = toset(var.user_list)
  ami                    = data.aws_ssm_parameter.windows_latest_ami.value
  instance_type          = "m5.xlarge"
  iam_instance_profile   = "ec2-instanceprofile-${each.value}"
  subnet_id              = module.vpc_for_sagemaker.private_subnets[0]
  vpc_security_group_ids = [aws_security_group.private_ec2.id]
  user_data              = <<EOF
<powershell>
$password = (Get-SECSecretValue -SecretId ${var.project_name}-ec2-login-password-${each.value}).SecretString
New-LocalUser -Name user-1 -Password (ConvertTo-SecureString $password -AsPlainText -Force)
Add-LocalGroupMember -Group "Remote Desktop Users" -Member user-1
Add-LocalGroupMember -Group Administrators -Member user-1
Write-Output '$url = New-SMPresignedDomainUrl -DomainId ${aws_sagemaker_domain.domain.id} -UserProfileName sagemaker-user-${each.value} -Region us-east-1' | Set-Content -Encoding Default 'C:\GetPresignedUrl.ps1'
Write-Output 'start microsoft-edge:$url' | Add-Content -Encoding Default 'C:\GetPresignedUrl.ps1' 
</powershell>
<persist>true</persist>
EOF
  tags = {
    Name = "ec2-indivisual-${each.value}"
  }
  depends_on = [
    aws_secretsmanager_secret.ec2_login_password,
    aws_secretsmanager_secret_rotation.ec2_login_password_secret_rotation,
    aws_iam_policy_attachment.ec2_get_secret,
    aws_secretsmanager_secret_rotation.ec2_login_password_secret_rotation
  ]

}

// インスタンス用 Role
const instanceRole = new iam.Role(this, `InstanceRole`, {
  assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName(
      'AmazonSSMManagedInstanceCore'
    ),
  ],
})

const instancePolicy = new iam.ManagedPolicy(this, 'InstancePolicy')

instancePolicy.addStatements(
    new iam.PolicyStatement(
        {
          effect: iam.Effect.ALLOW,
          actions: ["sagemaker:CreatePresignedDomainUrl"],
          resources: [
            userProfile.attrUserProfileArn,
          ],
        }
    )
)

instancePolicy.addStatements(
    new iam.PolicyStatement(
        {
          effect: iam.Effect.ALLOW,
          actions: ['secretsmanager:GetSecretValue'],
          resources: [
            ec2Secret.secretArn
          ]
        }
    )
)

instanceRole.addManagedPolicy(instancePolicy)

# インスタンス用 Role
instance_role = iam.Role(
    self,
    "InstanceRole",
    assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name(
            "AmazonSSMManagedInstanceCore"
        )
    ],
)

instance_policy = iam.ManagedPolicy(self, "InstancePolicy")

instance_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=["sagemaker:CreatePresignedDomainUrl"],
        resources=[
            user_profile.attr_user_profile_arn,
        ],
    )
)

instance_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=['secretsmanager:GetSecretValue'],
        resources=[
            ec2_secret.secret_arn
        ]
    )
)

instance_role.add_managed_policy(instance_policy)

# IAM role - 個人EC2用
resource "aws_iam_role" "ec2_role_indivisual" {
  for_each           = toset(var.user_list)
  name               = "ec2-role-${each.value}"
  assume_role_policy = data.aws_iam_policy_document.ec2_assume_role.json
}

data "aws_iam_policy_document" "ec2_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

# IAM policy - SecretsManagerの値を取得
resource "aws_iam_policy" "ec2_get_secret" {
  for_each = toset(var.user_list)
  name     = "allow-get-${var.project_name}-ec2-login-password-${each.value}"
  policy   = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:${var.project_name}-ec2-login-password-${each.value}-??????"]
    }
  ]
}
EOF
}

resource "aws_iam_instance_profile" "ec2_isntanceprofile_indivisual" {
  for_each = toset(var.user_list)
  name     = "ec2-instanceprofile-${each.value}"
  role     = "ec2-role-${each.value}"
}

// IAM ユーザー
this.user = new iam.User(this, 'User', {
  userName: props.name,
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName('IAMUserChangePassword'),
    props.stdioCommonPolicy,
  ],
  password: secret.secretValue,
  passwordResetRequired: true,
})

// IAM ユーザーにアタッチする Fleet Manager を使うためのポリシー
const startSessionPolicyJson = {
  Version: '2012-10-17',
  Statement: [
    {
      Sid: 'EC2',
      Effect: 'Allow',
      Action: ['ec2:DescribeInstances', 'ec2:GetPasswordData'],
      Resource: '*',
    },
    {
      Sid: 'SSM',
      Effect: 'Allow',
      Action: [
        'ssm:DescribeInstanceProperties',
        'ssm:GetCommandInvocation',
        'ssm:GetInventorySchema',
      ],
      Resource: '*',
    },
    {
      Sid: 'SSMStartSession',
      Effect: 'Allow',
      Action: ['ssm:StartSession'],
      Resource: ['arn:aws:ssm:*::document/AWS-StartPortForwardingSession'],
      Condition: {
        BoolIfExists: {
          'ssm:SessionDocumentAccessCheck': 'true',
        },
      },
    },
    {
      Sid: 'AccessTaggedInstances',
      Effect: 'Allow',
      Action: ['ssm:StartSession'],
      Resource: [
        `arn:aws:ec2:*:${accountId}:instance/*`,
        `arn:aws:ssm:*:${accountId}:managed-instance/*`,
      ],
      Condition: {
        StringLike: {
          'ssm:resourceTag/Name': [nameTagValue],
        },
      },
    },
    {
      Sid: 'GuiConnect',
      Effect: 'Allow',
      Action: [
        'ssm-guiconnect:CancelConnection',
        'ssm-guiconnect:GetConnection',
        'ssm-guiconnect:StartConnection',
      ],
      Resource: '*',
    },
  ],
}

const startSessionPolicyDocument = iam.PolicyDocument.fromJson(
    startSessionPolicyJson
)
const startSessionManagedPolicy = new iam.ManagedPolicy(
    this,
    'StartSessionManagedPolicy',
    {
      document: startSessionPolicyDocument,
    }
)
startSessionManagedPolicy.attachToUser(this.user)

# IAM ユーザー
self.user = iam.User(
    self,
    "User",
    user_name=name,
    managed_policies=[
        iam.ManagedPolicy.from_aws_managed_policy_name("IAMUserChangePassword"),
    ],
    password=secret.secret_value,
    password_reset_required=True,
)
# IAM ユーザーにアタッチする Fleet Manager を使うためのポリシー
START_SESSION_POLICY_JSON = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": ["ec2:DescribeInstances", "ec2:GetPasswordData"],
            "Resource": "*",
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceProperties",
                "ssm:GetCommandInvocation",
                "ssm:GetInventorySchema",
            ],
            "Resource": "*",
        },
        {
            "Sid": "SSMStartSession",
            "Effect": "Allow",
            "Action": ["ssm:StartSession"],
            "Resource": [
                "arn:aws:ssm:*::document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true",
                }
            },
        },
        {
            "Sid": "AccessTaggedInstances",
            "Effect": "Allow",
            "Action": ["ssm:StartSession"],
            "Resource": [
                f"arn:aws:ec2:*:{account_id}:instance/*",
                f"arn:aws:ssm:*:{account_id}:managed-instance/*",
            ],
            "Condition": {
                "StringLike": {
                    "ssm:resourceTag/Name": [NAME_TAG_VALUE],
                }
            },
        },
        {
            "Sid": "GuiConnect",
            "Effect": "Allow",
            "Action": [
                "ssm-guiconnect:CancelConnection",
                "ssm-guiconnect:GetConnection",
                "ssm-guiconnect:StartConnection",
            ],
            "Resource": "*",
        },
    ],
}
start_session_policy_document = iam.PolicyDocument.from_json(
    START_SESSION_POLICY_JSON
)
start_session_managed_policy = iam.ManagedPolicy(
    self,
    "StartSessionManagedPolicy",
    document=start_session_policy_document,
)
start_session_managed_policy.attach_to_user(self.user)

const codeartifactDomain = new codeartifact.CfnDomain(
  this,
  'codeartifactDomain',
  {
    domainName: codeartifactRepositoryName,
  }
)

const codeartifactRepository = new codeartifact.CfnRepository(
  this,
  'codeartifactRepository',
  {
    domainName: codeartifactDomain.domainName,
    repositoryName: codeartifactRepositoryName,
    externalConnections: ['public:pypi'],
  }
)

codeartifactRepository.addDependency(codeartifactDomain)

code_artifact_domain = codeartifact.CfnDomain(
    self,
    "codeartifactDomain",
    domain_name=CODE_ARTIFACT_DOMAIN_NAME,
)

code_artifact_repository = codeartifact.CfnRepository(
    self,
    "codeartifactRepository",
    domain_name=code_artifact_domain.domain_name,
    repository_name=CODE_ARTIFACT_REPOSITORY_NAME,
    external_connections=["public:pypi"],
)

code_artifact_repository.add_dependency(code_artifact_domain)

# CodeArtifact
resource "aws_codeartifact_domain" "codeartifact_domain" {
  domain = var.project_name
}

resource "aws_codeartifact_repository" "codeartifact_repository" {
  repository = var.project_name
  domain     = aws_codeartifact_domain.codeartifact_domain.domain
  external_connections {
    external_connection_name = "public:pypi"
  }
}

// 全員の SageMaker Studio Profile につける共用 Policy
const studioCommonPolicy = new iam.ManagedPolicy(this, 'CommonPolicy')
// 共用 CodeArtifact リポジトリへのアクセス許可
studioCommonPolicy.addStatements(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: [
      'codeartifact:DescribeDomain',
      'codeartifact:DescribeRepository',
      'codeartifact:GetAuthorizationToken',
      'codeartifact:GetRepositoryEndpoint',
      'codeartifact:GetRepositoryPermissionsPolicy',
      'codeartifact:ListPackages',
      'codeartifact:ListRepositories',
      'codeartifact:ListTagsForResource',
      'codeartifact:ReadFromRepository',
    ],
    resources: [codeartifactDomain.attrArn, codeartifactRepository.attrArn],
  })
)
studioCommonPolicy.addStatements(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['sts:GetServiceBearerToken'],
    resources: ['*'],
    conditions: {
      StringEquals: {
        'sts:AWSServiceName': 'codeartifact.amazonaws.com',
      },
    },
  })
)

# 全員の SageMaker Studio Profile につける共用 Policy
studio_common_policy = iam.ManagedPolicy(self, "StudioCommonPolicy")
# 共用 CodeArtifact リポジトリへのアクセス許可
studio_common_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=[
            "codeartifact:DescribeDomain",
            "codeartifact:DescribeRepository",
            "codeartifact:GetAuthorizationToken",
            "codeartifact:GetRepositoryEndpoint",
            "codeartifact:GetRepositoryPermissionsPolicy",
            "codeartifact:ListPackages",
            "codeartifact:ListRepositories",
            "codeartifact:ListTagsForResource",
            "codeartifact:ReadFromRepository",
        ],
        resources=[
            code_artifact_domain.attr_arn,
            code_artifact_repository.attr_arn,
        ],
    )
)
studio_common_policy.add_statements(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        actions=["sts:GetServiceBearerToken"],
        resources=["*"],
        conditions={
            "StringEquals": {"sts:AWSServiceName": "codeartifact.amazonaws.com"}
        },
    )
)

# IAM policy document for access shared CodeArtifact
data "aws_iam_policy_document" "codecartifact_access" {
  statement {
    actions=[
        "codeartifact:DescribeDomain",
        "codeartifact:DescribeRepository",
        "codeartifact:GetAuthorizationToken",
        "codeartifact:GetRepositoryEndpoint",
        "codeartifact:GetRepositoryPermissionsPolicy",
        "codeartifact:ListPackages",
        "codeartifact:ListRepositories",
        "codeartifact:ListTagsForResource",
        "codeartifact:ReadFromRepository",
    ]
    resources = [aws_codeartifact_domain.codeartifact_domain.arn, aws_codeartifact_repository.codeartifact_repository.arn]
    effect    = "Allow"
  }
  statement {
    actions   = ["sts:GetServiceBearerToken"]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "sts:AWSServiceName"
      values   = ["codeartifact.amazonaws.com"]
    }
    effect = "Allow"
  }
}

# IAM policy for access shared CodeArtifact
resource "aws_iam_policy" "allow_codeartifact_access" {
  name   = "allow-access-codeartifact-repository"
  policy = data.aws_iam_policy_document.codecartifact_access.json
}