Day 21：VPC Lambda の真実（ENI / コールドスタート / 最速化）

aws lambda put-provisioned-concurrency-config \
  --function-name MyFunc \
  --qualifier PROD \
  --provisioned-concurrent-executions 5

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Minimal VPC Lambda + VPC Endpoints (S3 Gateway, SecretsManager Interface)

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  PrivateSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Lambda を配置する Private Subnet（2AZ 以上推奨）
  PrivateRouteTableIds:
    Type: List<AWS::EC2::RouteTable::Id>
    Description: Private Subnet に紐づく Route Table（S3 Gateway Endpoint 用）

Globals:
  Function:
    Runtime: python3.12
    Timeout: 30
    MemorySize: 512
    Tracing: Active

Resources:
  # 1) Lambda 側の Security Group（最小例）
  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Lambda in VPC
      VpcId: !Ref VpcId
      # egress は最小化したい場合だけ明示（デフォルトは全許可）
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          DestinationSecurityGroupId: !Ref EndpointSecurityGroup

  # 2) Interface Endpoint 側の Security Group（Lambda からの 443 を許可）
  EndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Interface VPC Endpoints
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref LambdaSecurityGroup

  # 3) Lambda 関数：VpcConfig の最小例
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: my-vpc-lambda
      Handler: app.lambda_handler
      CodeUri: src/
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSecurityGroup
        SubnetIds: !Ref PrivateSubnetIds
      Policies:
        # Secrets Manager を使う例（必要に応じて絞る）
        - Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource: "*"
        # S3 へアクセスする例（必要に応じて絞る）
        - S3ReadPolicy:
            BucketName: my-bucket

  # 4) S3 Gateway Endpoint（RouteTableIds に紐づく）
  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Gateway
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      RouteTableIds: !Ref PrivateRouteTableIds
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: "s3:*"
            Resource: "*"

  # 5) Secrets Manager Interface Endpoint（Subnets + SG に紐づく）
  SecretsManagerInterfaceEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.secretsmanager"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds:
        - !Ref EndpointSecurityGroup
      PrivateDnsEnabled: true

Outputs:
  FunctionName:
    Value: !Ref MyFunction
  S3GatewayEndpointId:
    Value: !Ref S3GatewayEndpoint
  SecretsManagerEndpointId:
    Value: !Ref SecretsManagerInterfaceEndpoint

Resources:
  # Lambda 側 SG（例）
  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Lambda in VPC
      VpcId: !Ref VpcId
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          DestinationSecurityGroupId: !Ref EndpointSecurityGroup

  # Interface Endpoint 側 SG（Lambda からの 443 を許可）
  EndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Interface VPC Endpoints
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref LambdaSecurityGroup

  # --- Gateway Endpoint: S3（ECR イメージレイヤ取得にも効く）---
  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Gateway
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      RouteTableIds: !Ref PrivateRouteTableIds

  # --- Interface Endpoints: CloudWatch Logs / KMS / STS / ECR ---
  CloudWatchLogsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.logs"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds: [!Ref EndpointSecurityGroup]
      PrivateDnsEnabled: true

  KmsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.kms"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds: [!Ref EndpointSecurityGroup]
      PrivateDnsEnabled: true

  StsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.sts"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds: [!Ref EndpointSecurityGroup]
      PrivateDnsEnabled: true

  EcrApiEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ecr.api"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds: [!Ref EndpointSecurityGroup]
      PrivateDnsEnabled: true

  EcrDkrEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      VpcEndpointType: Interface
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ecr.dkr"
      SubnetIds: !Ref PrivateSubnetIds
      SecurityGroupIds: [!Ref EndpointSecurityGroup]
      PrivateDnsEnabled: true

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  InternalZoneName:
    Type: String
    Default: corp.internal
  AlbDnsName:
    Type: String
    Description: internal ALB の DNS 名（例: internal-xxx.ap-northeast-1.elb.amazonaws.com）
  AlbHostedZoneId:
    Type: String
    Description: ALB の CanonicalHostedZoneId

Resources:
  PrivateHostedZone:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: !Ref InternalZoneName
      VPCs:
        - VPCId: !Ref VpcId
          VPCRegion: !Ref AWS::Region

  InternalApiRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref PrivateHostedZone
      Name: !Sub "api.${InternalZoneName}"
      Type: A
      AliasTarget:
        DNSName: !Ref AlbDnsName
        HostedZoneId: !Ref AlbHostedZoneId

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  ResolverSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Resolver Endpoint 用サブネット（2AZ 推奨）
  OnPremDnsIp1:
    Type: String
  OnPremDnsIp2:
    Type: String
  OnPremDomain:
    Type: String
    Default: onprem.local

Resources:
  ResolverSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Route53 Resolver Endpoints
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: udp
          FromPort: 53
          ToPort: 53
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 53
          ToPort: 53
          CidrIp: 0.0.0.0/0

  ResolverInboundEndpoint:
    Type: AWS::Route53Resolver::ResolverEndpoint
    Properties:
      Direction: INBOUND
      IpAddresses:
        - SubnetId: !Select [0, !Ref ResolverSubnetIds]
        - SubnetId: !Select [1, !Ref ResolverSubnetIds]
      SecurityGroupIds: [!Ref ResolverSecurityGroup]

  ResolverOutboundEndpoint:
    Type: AWS::Route53Resolver::ResolverEndpoint
    Properties:
      Direction: OUTBOUND
      IpAddresses:
        - SubnetId: !Select [0, !Ref ResolverSubnetIds]
        - SubnetId: !Select [1, !Ref ResolverSubnetIds]
      SecurityGroupIds: [!Ref ResolverSecurityGroup]

  ForwardToOnPremRule:
    Type: AWS::Route53Resolver::ResolverRule
    Properties:
      DomainName: !Ref OnPremDomain
      RuleType: FORWARD
      ResolverEndpointId: !Ref ResolverOutboundEndpoint
      TargetIps:
        - Ip: !Ref OnPremDnsIp1
          Port: 53
        - Ip: !Ref OnPremDnsIp2
          Port: 53

  ForwardRuleAssociation:
    Type: AWS::Route53Resolver::ResolverRuleAssociation
    Properties:
      ResolverRuleId: !Ref ForwardToOnPremRule
      VPCId: !Ref VpcId