社員の誰でも、使いたい分だけ使える個人専用環境、AWS オンデマンド設計の裏側

Parameters:
  InstanceType:
    Description: Instance type of the obtained Jupyter Lab environment.
    Type: String
    AllowedValues:
      - # 複数のインスタンスタイプを記載
      -
      -
    Default: # デフォルトも設定

  VolumeSize:
    Description: EBS (SSD) disk volume size (GiB). Allowed Range is 30 to 16,384.
    Type: Number # Allowed Range: 1-16,384
    MinValue: 30
    MaxValue: 16384
    Default: 100

  Iops:
    Description: EBS IOPS. Allowed Range is 3,000 to 16,000.
    Type: Number # Allowed Range: 3,000-16,000
    MinValue: 3000
    MaxValue: 16000
    Default: 3000

  Throughput:
    Description: EBS Throughput (MiB/s). Allowed Range is 125 to 1,000.
    Type: Number # Allowed Range: 125-1,000
    MinValue: 125
    MaxValue: 1000
    Default: 125

  JupyterPassword:
    Description: Enter password (8 to 16 length alphanumeric characters) to login to the obtained Jupyter Lab environment.
    Type: String
    AllowedPattern: ^[0-9a-zA-Z]+$
    MinLength: 8
    MaxLength: 16
    NoEcho: True

  # コスト情報の入力欄
  XXXX:
    Description: XXXX
    Type: String
    AllowedPattern: '(^[A-Z0-9]+$|^SI-\d{4}$)'

  YYYY:
    Description: YYYYY
    Type: String
    Default: ''
    AllowedPattern: '^[A-Z0-9]*$'

  ZZZZ:
    Description: ZZZZ
    Type: String
    AllowedPattern: '^[A-Z0-9]+$'
    MinLength: 7
    MaxLength: 7

Resources:
  Ec2Instance:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !FindInMap [EnvMapping, !Ref "AWS::AccountId", SubnetId]
      IamInstanceProfile: !Ref IAMInstanceProfileForLaunchedEC2Instance
      PropagateTagsToVolumeOnCreation: true
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: 1

      # Parameters で入力された情報をタグとして付与する
      Tags:
        # 注: Name タグは Lamda 関数に作らせるので、ここでは作らない
        - Key: xxx
          Value: xxx

      UserData:
        Fn::Base64:
          !Sub
            - |
              Content-Type: multipart/mixed; boundary="//"
              MIME-Version: 1.0

              --//
              Content-Type: text/cloud-config; charset="us-ascii"
              MIME-Version: 1.0
              Content-Transfer-Encoding: 7bit
              Content-Disposition: attachment; filename="cloud-config.txt"

              #cloud-config
              cloud_final_modules:
                - [scripts-user, always]

              --//
              Content-Type: text/x-shellscript; charset="us-ascii"
              MIME-Version: 1.0
              Content-Transfer-Encoding: 7bit
              Content-Disposition: attachment; filename="userdata.txt"

              #!/bin/bash

              # Docker image name for run into variable
              image_name_jupyter=${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ContainerRepositoryNameForJupyter}

              # This "if" statement is for the first time of the booting of EC2 instance,
              # i.e., for the case of docker image is not yet exist on this instance
              if [ -z "$(docker image ls -q $image_name_jupyter)" ]; then
                # Create workspace directry for user work
                mkdir /workdir

                # Yum updates and Docker installing
                yum update -y
                yum install -y docker
                systemctl enable docker
                service docker start

                # Create docker network for jupyter and mlflow
                docker network create jupyter-mlflow-network

                # Pulling docker image from Amazon ECR repository
                aws ecr get-login-password --region ${AWS::Region} | docker login -u AWS --password-stdin https://${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com
                docker pull $image_name_jupyter
                docker logout

              # This "else" statement is for other than the first time of the booting of EC2
              # i.e., for the case of docker image for run already existing on this instance
              else
                docker container rm -f "$(docker ps -q -a)"
              fi

              # Running docker container which gives JupyterLab server functionality
              docker run ...

Outputs:
  JupyterURL:
    Description: Jupyter URL
    Value: !Join [ "", [ "http://", {IP}, ":8888" ] ]

LambdaFunctionToAutoAttachSGAndTagsToCloud9:
  Type: AWS::Lambda::Function
  Properties:
    Description: A Lambda function attached EventBridge that automatically attach tags to ebs from service catalog.
    FunctionName: XXX
    Handler: index.lambda_handler
    Role: XXX
    Runtime: python3.9
    Timeout: 6
    Code:
      ZipFile: |
        # modified from: https://aws.amazon.com/jp/blogs/desktop-and-application-streaming/automatically-attach-additional-security-groups-to-amazon-appstream-2-0-and-amazon-workspaces/
        import json
        import logging
        import boto3
        import re
        import os

        def lambda_handler(event, context):
            ec2 = boto3.resource('ec2')

            instance_id = event["detail"]["responseElements"]["instancesSet"]["items"][0]["instanceId"]
            instance = ec2.Instance(instance_id)

            tags = dict(
                [
                    (
                        tag['Key'],
                        tag['Value']
                    ) for tag in instance.tags
                ]
            )

            for tag in list(tags):
                if re.match('aws:', tag):
                    tags.pop(tag)

            volume_id = instance.block_device_mappings[0]['Ebs']['VolumeId']
            volume = ec2.Volume(volume_id)

            for key, value in tags.items():
                volume.create_tags(
                    Tags=[
                        {
                            'Key': key,
                            'Value': value
                        },
                    ]
                )

EventBridgeRule:
  Type: AWS::Events::Rule
  Properties:
    Description: This is an EventBridge trigger to automatically add user tag to ec2 instance and ebs from Service Catalog.
    EventBusName: default
    EventPattern:
      source:
        - aws.ec2
      detail:
        awsRegion:
          - !Ref AWS::Region
        eventSource:
          - ec2.amazonaws.com
        eventName:
          - RunInstances
        responseElements:
          instancesSet:
            items:
              tagSet:
                items:
                  key:
                    - requestedBy
                  value:
                    - AWSServiceCatalog

# Create Launch Constraings to each products in portfoilos.
LaunchConstraintsForJupyterLabCpuProduct:
  Type: AWS::ServiceCatalog::LaunchRoleConstraint
  Properties:
    AcceptLanguage: 'jp'
    Description: !Join
      - ''
      -
        - '次のように起動'
        - !GetAtt IAMRoleForLaunchConstraints.Arn
    LocalRoleName: # 事前に定義した IAM ロール
    PortfolioId: !Ref JupyetrLabServiceCatalog
    ProductId: !Ref JupyterLabCpuProduct

IAMRoleForLaunchConstraints:
  Type: AWS::IAM::Role
  Properties:
    Description: "IAM Role to attach Service Catalog as Launch Constraints"
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        -
          Sid: "ServiceCatalogTrustPolicy"
          Effect: Allow
          Principal:
            Service:
              - servicecatalog.amazonaws.com
          Action:
            - 'sts:AssumeRole'
    ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
    Policies:
      -
        PolicyName: XXX
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Effect: Allow
              Action:
                - 'ec2:*'
                - 'iam:PassRole'
                - 'iam:PassRole'
                - 'iam:CreateRole'
                - 'iam:GetRole'
                - 'iam:TagRole'
                - 'iam:DeleteRole'
                - 'iam:GetRolePolicy'
                - 'iam:PutRolePolicy'
                - 'iam:AttachRolePolicy'
                - 'iam:DetachRolePolicy'
                - 'iam:DeleteRolePolicy'
                - 'iam:GetInstanceProfile'
                - 'iam:CreateInstanceProfile'
                - 'iam:AddRoleToInstanceProfile'
                - 'iam:RemoveRoleFromInstanceProfile'
                - 'iam:DeleteInstanceProfile'
                - 'cloudwatch:PutMetricAlarm'
                - 'cloudwatch:DeleteAlarms'
                - 'ssm:StartSession'
                - 'iam:CreateServiceLinkedRole'
                - 's3:CreateBucket'
                - 's3:DeleteBucket'
                - 's3:PutBucketTagging'
                - 's3:DeleteBucketTagging'
                - 's3:SetBucketEncryption'
                - 's3:DeleteBucketEncryption'
                - 's3:PutEncryptionConfiguration'
                - 's3:PutLifecycleConfiguration'
                - 's3:DeleteLifecycleConfiguration'
                - 's3:PutBucketVersioning'
                - 's3:PutBucketPolicy'
                - 's3:DeleteBucketPolicy'
              Resource: '*'

            # below statement from:
            # https://docs.aws.amazon.com/ja_jp/servicecatalog/latest/adminguide/constraints-launch.html
            -
              Effect: Allow
              Action: 's3:GetObject'
              Resource: '*'
              Condition:
                StringEquals:
                  s3:ExistingObjectTag/servicecatalog:provisioning: true
    RoleName: XXX