Lambda MicroVMs で作る、ブラウザだけで開ける使い捨て VS Code 環境

mkdir -p ~/handson-microvm && cd ~/handson-microvm

export BUCKET="<アーティファクト用 S3 バケット名>"
export BUILD_ROLE="<ビルドロール名>"
export EXEC_ROLE="<実行ロール名>"
export EDGE_ROLE_ARN="<Lambda@Edge 用ロールの ARN>"

# ▼ 以下はそのままでよい
export REGION="us-east-1"
export ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"
export IMAGE_NAME="handson-codeserver"
export TABLE="handson-sessions"
export AWS_PAGER=""   # get-* の結果がページャ(less)で開くのを防ぐ

# アーティファクト用 S3 バケット
aws s3 mb "s3://${BUCKET}" --region "${REGION}"

# セッション管理用 DynamoDB テーブル (パーティションキー sessionId、オンデマンド)
aws dynamodb create-table --table-name "${TABLE}" \
  --attribute-definitions AttributeName=sessionId,AttributeType=S \
  --key-schema AttributeName=sessionId,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST --region "${REGION}"
aws dynamodb wait table-exists --table-name "${TABLE}" --region "${REGION}"

cat > Dockerfile <<'EOF'
FROM public.ecr.aws/lambda/microvms:al2023-minimal

ARG CODE_VERSION=4.139.1
# 研修で使うツールと code-server の展開に必要なもの
RUN dnf install -y tar gzip git which shadow-utils procps-ng && dnf clean all
# code-server（Arm64）を導入
RUN curl -fsSL "https://github.com/coder/code-server/releases/download/v${CODE_VERSION}/code-server-${CODE_VERSION}-linux-arm64.tar.gz" \
      -o /tmp/cs.tar.gz \
 && mkdir -p /usr/lib/code-server \
 && tar -C /usr/lib/code-server --strip-components=1 -xzf /tmp/cs.tar.gz \
 && ln -sf /usr/lib/code-server/bin/code-server /usr/bin/code-server \
 && rm -f /tmp/cs.tar.gz
# 作業ユーザー（root では動かさない）
RUN useradd -m -s /bin/bash builder
COPY start.sh /app/start.sh
RUN chmod +x /app/start.sh
EXPOSE 8080
CMD ["/app/start.sh"]
EOF

cat > start.sh <<'EOF'
#!/bin/bash
export HOME=/home/builder
# 8080 を即座に開く（ビルド時のスナップショット取得をブロックしない）
exec runuser -u builder -- /usr/bin/code-server \
  --auth none --bind-addr 0.0.0.0:8080 \
  --disable-telemetry --disable-update-check \
  /home/builder
EOF

zip -r app.zip Dockerfile start.sh
aws s3 cp app.zip "s3://${BUCKET}/handson/app.zip" --region "${REGION}"

aws lambda-microvms create-microvm-image \
  --name "${IMAGE_NAME}" \
  --code-artifact "{\"uri\":\"s3://${BUCKET}/handson/app.zip\"}" \
  --base-image-arn "arn:aws:lambda:${REGION}:aws:microvm-image:al2023-1" \
  --base-image-version 0 \
  --build-role-arn "arn:aws:iam::${ACCOUNT_ID}:role/${BUILD_ROLE}" \
  --additional-os-capabilities '["ALL"]' \
  --region "${REGION}"
# state が CREATED になるまで get-microvm-image でポーリング
aws lambda-microvms get-microvm-image \
  --image-identifier "arn:aws:lambda:${REGION}:${ACCOUNT_ID}:microvm-image:${IMAGE_NAME}" \
  --region "${REGION}" --query state --output text

PARTICIPANTS=10
IMAGE_ARN="arn:aws:lambda:${REGION}:${ACCOUNT_ID}:microvm-image:${IMAGE_NAME}"
EXECUTION_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${EXEC_ROLE}"

for i in $(seq 1 $PARTICIPANTS); do
  # スナップショットから複製起動（実測 数秒 / 台）
  RESP=$(aws lambda-microvms run-microvm \
    --image-identifier "$IMAGE_ARN" --image-version "1.0" \
    --execution-role-arn "$EXECUTION_ROLE_ARN" \
    --idle-policy '{"maxIdleDurationSeconds":1800,"suspendedDurationSeconds":3600,"autoResumeEnabled":true}' \
    --region "${REGION}")
  MICROVM_ID=$(echo "$RESP" | jq -r '.microvmId')
  ENDPOINT=$(echo "$RESP" | jq -r '.endpoint')   # VM ごとに固有のエンドポイント
  # VM ごとの認証トークン（最大 60 分。後述のコラムも参照）
  TOKEN=$(aws lambda-microvms create-microvm-auth-token \
    --microvm-identifier "$MICROVM_ID" --expiration-in-minutes 60 \
    --allowed-ports '[{"port":8080}]' \
    --query 'authToken."X-aws-proxy-auth"' --output text \
    --region "${REGION}")
  # プールへ登録（state=free が「空き」の印）
  aws dynamodb put-item --table-name "${TABLE}" --region "${REGION}" --item "{
    \"sessionId\": {\"S\": \"p$(openssl rand -hex 4)\"},
    \"microvmId\": {\"S\": \"$MICROVM_ID\"},
    \"endpoint\":  {\"S\": \"$ENDPOINT\"},
    \"token\":     {\"S\": \"$TOKEN\"},
    \"state\":     {\"S\": \"free\"}}"
done

cat > index.js <<'EOF'
// Lambda@Edge (origin-request):
//   /        : プールから空きを確保して /s/<ID>/ へ 302（空きゼロなら満席ページ）
//   /s/<ID>/*: セッションを引いてオリジン差し替え + トークン注入
const { DynamoDBClient, GetItemCommand, ScanCommand, UpdateItemCommand }
  = require("@aws-sdk/client-dynamodb");
const ddb = new DynamoDBClient({ region: "us-east-1" });
const TABLE = "handson-sessions";
const cache = new Map();  // sessionId -> { value, expires } の 60 秒キャッシュ

async function lookup(sessionId) {
  const hit = cache.get(sessionId);
  if (hit && hit.expires > Date.now()) return hit.value;
  const out = await ddb.send(new GetItemCommand({
    TableName: TABLE, Key: { sessionId: { S: sessionId } } }));
  if (!out.Item) return null;
  const value = { endpoint: out.Item.endpoint.S, token: out.Item.token.S };
  cache.set(sessionId, { value, expires: Date.now() + 60000 });
  return value;
}

// 空きセッションを 1 つ確保。条件付き更新なので同時アクセスでも二重配布されない
async function claimFreeSession() {
  const scan = await ddb.send(new ScanCommand({
    TableName: TABLE,
    FilterExpression: "#st = :free",
    ExpressionAttributeNames: { "#st": "state" },
    ExpressionAttributeValues: { ":free": { S: "free" } },
    ProjectionExpression: "sessionId" }));
  for (const item of scan.Items || []) {
    try {
      await ddb.send(new UpdateItemCommand({
        TableName: TABLE, Key: { sessionId: item.sessionId },
        UpdateExpression: "SET #st = :assigned",
        ConditionExpression: "#st = :free",   // free のときだけ成功 = 定員管理
        ExpressionAttributeNames: { "#st": "state" },
        ExpressionAttributeValues: {
          ":assigned": { S: "assigned" }, ":free": { S: "free" } } }));
      return item.sessionId.S;
    } catch (e) {
      if (e.name === "ConditionalCheckFailedException") continue;  // 競り負け→次へ
      throw e;
    }
  }
  return null;  // 満席
}

exports.handler = async (event) => {
  const request = event.Records[0].cf.request;

  // 受付: 共通 URL
  if (request.uri === "/" || request.uri === "") {
    const sessionId = await claimFreeSession();
    if (!sessionId) {
      return { status: "503", statusDescription: "Service Unavailable",
               headers: { "content-type": [{ key: "Content-Type",
                 value: "text/html; charset=utf-8" }] },
               body: "<h1>ただいま満席です</h1>" };
    }
    return { status: "302", statusDescription: "Found",
             headers: { location:
               [{ key: "Location", value: `/s/${sessionId}/` }] } };
  }

  // ルーティング: /s/<ID>/*
  const m = request.uri.match(/^\/s\/([^/]+)(\/.*)?$/);
  const session = m && await lookup(m[1]);
  if (!session) return { status: "404", statusDescription: "Not Found" };

  request.origin = { custom: {
    domainName: session.endpoint, port: 443, protocol: "https", path: "",
    sslProtocols: ["TLSv1.2"], readTimeout: 60, keepaliveTimeout: 60,
    customHeaders: {} } };
  request.headers["host"] = [{ key: "Host", value: session.endpoint }];
  request.headers["x-aws-proxy-auth"] =
    [{ key: "X-aws-proxy-auth", value: session.token }];   // トークン注入
  request.headers["x-aws-proxy-port"] =
    [{ key: "X-aws-proxy-port", value: "8080" }];
  // ★ code-server は WebSocket の Origin==Host を検証する。
  //   Host を VM に書き換えるので、Origin も VM に合わせないと 1006 で切れる。
  if (request.headers["origin"]) {
    request.headers["origin"] =
      [{ key: "Origin", value: `https://${session.endpoint}` }];
  }
  request.uri = m[2] || "/";  // /s/<ID> プレフィックスを除去
  return request;
};
EOF

zip edge.zip index.js
# Lambda@Edge は us-east-1 に作成する必要があります（REGION とは独立）
aws lambda create-function \
  --function-name handson-edge-router \
  --runtime nodejs24.x --handler index.handler \
  --role "${EDGE_ROLE_ARN}" \
  --zip-file fileb://edge.zip \
  --timeout 10 --memory-size 128 --region us-east-1
aws lambda wait function-active --function-name handson-edge-router --region us-east-1

# CloudFront に関連付けるためのバージョンを発行し、環境変数に保持
export EDGE_ARN=$(aws lambda publish-version \
  --function-name handson-edge-router --region us-east-1 \
  --query 'FunctionArn' --output text)
echo $EDGE_ARN   # 例: arn:aws:lambda:us-east-1:...:function:handson-edge-router:1

cat > dist-config.json <<EOF
{
  "CallerReference": "handson-codeserver-$(date +%s)",
  "Comment": "browser handson code-server environment",
  "Enabled": true,
  "Origins": { "Quantity": 1, "Items": [{
    "Id": "placeholder", "DomainName": "example.com",
    "CustomOriginConfig": {
      "HTTPPort": 80, "HTTPSPort": 443,
      "OriginProtocolPolicy": "https-only",
      "OriginSslProtocols": { "Quantity": 1, "Items": ["TLSv1.2"] },
      "OriginReadTimeout": 60, "OriginKeepaliveTimeout": 60 } }] },
  "DefaultCacheBehavior": {
    "TargetOriginId": "placeholder",
    "ViewerProtocolPolicy": "redirect-to-https",
    "AllowedMethods": {
      "Quantity": 7,
      "Items": ["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],
      "CachedMethods": { "Quantity": 2, "Items": ["GET","HEAD"] } },
    "Compress": false,
    "CachePolicyId": "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
    "OriginRequestPolicyId": "216adef6-5c7f-47e4-b989-5492eafa07d3",
    "LambdaFunctionAssociations": { "Quantity": 1, "Items": [{
      "LambdaFunctionARN": "${EDGE_ARN}",
      "EventType": "origin-request",
      "IncludeBody": false }] } }
}
EOF

aws cloudfront create-distribution --distribution-config file://dist-config.json \
  --query 'Distribution.DomainName' --output text
# デプロイ完了まで数分待つ

# 稼働中・サスペンド中の MicroVM をすべて terminate
for MID in $(aws lambda-microvms list-microvms --region "${REGION}" \
    --query "items[?state!='TERMINATED'].microvmId" --output text); do
  aws lambda-microvms terminate-microvm --microvm-identifier "$MID" --region "${REGION}"
done

# MicroVM イメージ・DynamoDB テーブル・S3 バケットを削除
aws lambda-microvms delete-microvm-image \
  --image-identifier "arn:aws:lambda:${REGION}:${ACCOUNT_ID}:microvm-image:${IMAGE_NAME}" \
  --region "${REGION}"
aws dynamodb delete-table --table-name "${TABLE}" --region "${REGION}"
aws s3 rb "s3://${BUCKET}" --force

DIST_ID=<作成した CloudFront ディストリビューション ID>

# 1) 無効化: 現在の config を取得し Enabled=false にして更新
ETAG=$(aws cloudfront get-distribution-config --id "$DIST_ID" --query ETag --output text)
aws cloudfront get-distribution-config --id "$DIST_ID" \
  --query DistributionConfig --output json > dist-current.json
# dist-current.json の "Enabled" を false に変更して保存してから:
aws cloudfront update-distribution --id "$DIST_ID" \
  --distribution-config file://dist-current.json --if-match "$ETAG"

# 2) Status が Deployed に戻るまで待ってから削除
aws cloudfront wait distribution-deployed --id "$DIST_ID"
ETAG=$(aws cloudfront get-distribution --id "$DIST_ID" --query ETag --output text)
aws cloudfront delete-distribution --id "$DIST_ID" --if-match "$ETAG"

# 3) Lambda@Edge 関数の削除（レプリカが消えるまで時間がかかる。失敗したら時間を置いて再実行）
aws lambda delete-function --function-name handson-edge-router --region us-east-1