【API Gateway】awscurl + IAM 認可を使用し、API Gateway にリクエストを送信する

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Globals:
  Function:
    Runtime: python3.11
    Timeout: 10
    MemorySize: 128
# Amazon Linux 2023 の最新AMIを参照
Parameters:
  AmiId:
    Type: AWS::SSM::Parameter::Value
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  AllowedSSHCidr1:
    Type: String
    Default: XX.XX.XX.XX/32
    Description: SSH Allow CIDR Block
Resources:
  # Lambda
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: HelloWorld-Function
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      InlineCode: |
        def handler(event, context):
            return {
                'statusCode': 200,
                'headers': {'Content-Type': 'text/plain'},
                'body': 'Hello, World'
            }
      Events:
        HelloApiEvent:
          Type: HttpApi
          Properties:
            Path: /
            Method: GET
            ApiId: !Ref HelloHttpApi
            Auth:
              Authorizer: AWS_IAM
  # APIGateway
  HelloHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Name: HelloWorld-HttpApi
      FailOnWarnings: true
      Auth:
        EnableIamAuthorizer: true
        DefaultAuthorizer: AWS_IAM
      CorsConfiguration:
        AllowMethods: ['GET', 'OPTIONS']
        AllowOrigins: ['*']
  # Lambda 権限付与
  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref HelloWorldFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HelloHttpApi}/$default/*/*'
  # Lambda 用 IAM ロール
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: HelloWorld-ambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: '/'
      Policies:
        - PolicyName: AllowLambdaLogs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
  # EC2 用 IAM ロール
  Ec2IamRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: Test-EC2Role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Path: '/'
      Policies:
        - PolicyName: AllowInvokeApi
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - execute-api:Invoke
                Resource: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*'
  Ec2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref Ec2IamRole
      Path: '/'
  # KeyPair
  MyKeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: Test-KeyPair
      KeyType: ed25519
      KeyFormat: pem
      Tags:
        - Key: Name
          Value: Test-KeyPair
  # EC2
  Ec2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.small
      ImageId: !Ref AmiId
      IamInstanceProfile: !Ref Ec2InstanceProfile
      KeyName: !Ref MyKeyPair
      SecurityGroupIds:
        - !Ref InstanceSecurityGroup
      SubnetId: !ImportValue TestPublicSubnetIdExport
      Tags:
        - Key: Name
          Value: Test-EC2
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          # システムアップデート
          dnf update -y
          # Python3-pip インストール
          dnf install -y python3-pip
          # awscurl pip3 インストール
          pip3 install awscurl
          echo 'export PATH=$PATH:~/.local/bin' >> /home/ec2-user/.bash_profile
          chown -R ec2-user:ec2-user /home/ec2-user/.local
          # 確認用
          sudo -u ec2-user bash -lc 'awscurl --version'
  Ec2EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  Ec2EIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: !GetAtt Ec2EIP.AllocationId
      InstanceId: !Ref Ec2Instance
  # インスタンス用セキュリティグループ
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SSH only from specific CIDR
      VpcId: !ImportValue TestVpcIdExport
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedSSHCidr
      Tags:
        - Key: Name
          Value: Test-EC2-SG
Outputs:
  ApiEndpoint:
    Description: 'HTTP API Endpint URL'
    Value: !Sub 'https://${HelloHttpApi}.execute-api.${AWS::Region}.amazonaws.com/'
  KeyPairParameterName:
    Description: 'KeyPiar ParameterName'
    Value: !Sub '/ec2/keypair/${MyKeyPair}'