EC2でWindowsの環境構築(CFn)

概要

初めてEC2でWindowsを取り扱ったので、CloudFormationと感想をまとめておく

要件

• RDP(リモートデスクトップ)で接続・操作できる
• RDPはIPを厳しく制限する(/32) セキュリティグループで対応
• ネット接続できる
• 日本語化する(参考: 【AWS】WindowsServer2019日本語化手順(手動))
  • これはコミュニティのAMI使った方が簡単ぽい

構築してみた感想

• 基本的なところはLinuxサーバー構築とほぼ変わらない
• RDPに触れたことがなかったので新鮮だった。ただ、SSH接続と要件はほぼ変わらない認識
• GUIなので中身の自動化はめんどそう。シンプルに保ちたい。。。

CFn

AWSTemplateFormatVersion: "2010-09-09"
Description: "sample.cfn"
Parameters:
  StackName:
    Type: String
    Default: ""
  RDPIngress:
    Type: String
    Default: "xx.xx.xx.xx"
Resources:
  Vpc:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: "xx.xx.xx.xx/16"
      InstanceTenancy: "default"
      Tags: [
        { Key: "Name", Value: !Sub "${StackName}-vpc" }
      ]
  PublicSubnet1a:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: "xx.xx.xx.xx/24"
      Tags: [
        { Key: "Name", Value: !Sub "${StackName}-public-subnet-1a" }
      ]
      AvailabilityZone: !Select [ 0, Fn::GetAZs: !Ref AWS::Region ]
  IGW:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags: [
        { Key: "Name", Value: !Sub "${StackName}-igw" }
      ]
  VpcGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref IGW
  PublicRouteTable:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref Vpc
      Tags: [
        { Key: "Name", Value: !Sub "${StackName}-public-rtb" }
      ]
  PublicRoute:
    Type: "AWS::EC2::Route"
    DependsOn: VpcGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref IGW
  PublicSubnet1aRouteTableAssociation:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref PublicSubnet1a
      RouteTableId: !Ref PublicRouteTable
  Acl:
    Type: "AWS::EC2::NetworkAcl"
    Properties:
      VpcId: !Ref Vpc
      Tags: [
        { Key: "Name", Value: !Sub "${StackName}-acl" }
      ]
  AclEntryInbound:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref Acl
      RuleNumber: 100
      Protocol: "-1"
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"
  AclEntryOutbound:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref Acl
      RuleNumber: 100
      Protocol: "-1"
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"
  SgRdp:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Allow RDP access"
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - IpProtocol: "tcp"
          FromPort: 3389
          ToPort: 3389
          CidrIp: !Sub "${RDPIngress}/32"
  KeyPair:
    Type: "AWS::EC2::KeyPair"
    Properties:
      KeyName: !Sub "${StackName}-key"
  InstanceAp1:
    Type: "AWS::EC2::Instance"
    Properties:
      InstanceType: "t3.xlarge"
      ImageId: "ami-xxxxxxxx" # Windows Server 2019 Base
      KeyName: !Ref KeyPair
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: 0
          GroupSet:
            - !Ref SgRdp
          SubnetId: !Ref PublicSubnet1a
      Tags:
        - Key: "Name"
          Value: !Sub "${StackName}-ap1"