【Amazon EC2】Claude Code on AWS構築ハンズオン

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Base stack: VPC, IAM, KeyPair, Bedrock Application Inference Profiles'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'claude'
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
  PublicSubnetCidr:
    Type: String
    Default: '10.0.1.0/24'
  HaikuInferenceProfileId:
    Type: String
    Default: 'jp.anthropic.claude-haiku-4-5-20251001-v1:0'
    Description: 'Haiku inference profile ID'
  SonnetInferenceProfileId:
    Type: String
    Default: 'jp.anthropic.claude-sonnet-4-5-20250929-v1:0'
    Description: 'Sonnet inference profile ID'
  OpusInferenceProfileId:
    Type: String
    Default: 'global.anthropic.claude-opus-4-5-20251101-v1:0'
    Description: 'Opus inference profile ID'
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: Network Configuration
        Parameters:
          - VpcCidr
          - PublicSubnetCidr
      -
        Label:
          default: Bedrock Configuration
        Parameters:
          - HaikuInferenceProfileId
          - SonnetInferenceProfileId
          - OpusInferenceProfileId
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-vpc'
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetCidr
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet'
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Security Group for SSM-only'
      VpcId: !Ref VPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: '0.0.0.0/0'
  EC2KeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair'
      KeyType: rsa
      KeyFormat: pem
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-ssm-bedrock-rl'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId
  EC2BedrockPolicy:
    Type: AWS::IAM::Policy
    DependsOn:
      - EC2SonnetProfile
      - EC2OpusProfile
      - EC2HaikuProfile
    Properties:
      PolicyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-bedrock-pl'
      Roles:
        - !Ref EC2Role
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowModelInvocation
            Effect: Allow
            Action:
              - bedrock:InvokeModel
              - bedrock:InvokeModelWithResponseStream
              - bedrock:ListInferenceProfiles
            Resource:
              - !GetAtt EC2SonnetProfile.InferenceProfileArn
              - !GetAtt EC2OpusProfile.InferenceProfileArn
              - !GetAtt EC2HaikuProfile.InferenceProfileArn
              - arn:aws:bedrock:*:*:foundation-model/*
              - arn:aws:bedrock:*:*:inference-profile/*
  EC2AWSMCPPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-awsmcp-pl'
      Roles:
        - !Ref EC2Role
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowAWSMCPAccess
            Effect: Allow
            Action:
              - aws-mcp:InvokeMcp
              - aws-mcp:CallReadOnlyTool
              - aws-mcp:CallReadWriteTool
            Resource:
              - "*"
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile'
      Roles:
        - !Ref EC2Role
  EC2HaikuProfile:
    Type: AWS::Bedrock::ApplicationInferenceProfile
    Properties:
      InferenceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-haiku'
      Description: !Sub 'inferenceProfileId: ${HaikuInferenceProfileId}'
      ModelSource:
        CopyFrom: !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/${HaikuInferenceProfileId}'
      Tags:
        - Key: Application
          Value: !Sub '${Environment}-${ProjectId}'
        - Key: Category1
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-haiku'
        - Key: Category2
          Value: !Sub '${HaikuInferenceProfileId}'
  EC2SonnetProfile:
    Type: AWS::Bedrock::ApplicationInferenceProfile
    Properties:
      InferenceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-sonnet'
      Description: !Sub 'inferenceProfileId: ${SonnetInferenceProfileId}'
      ModelSource:
        CopyFrom: !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/${SonnetInferenceProfileId}'
      Tags:
        - Key: Application
          Value: !Sub '${Environment}-${ProjectId}'
        - Key: Category1
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-sonnet'
        - Key: Category2
          Value: !Sub '${SonnetInferenceProfileId}'
  EC2OpusProfile:
    Type: AWS::Bedrock::ApplicationInferenceProfile
    Properties:
      InferenceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-opus'
      Description: !Sub 'inferenceProfileId: ${OpusInferenceProfileId}'
      ModelSource:
        CopyFrom: !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/${OpusInferenceProfileId}'
      Tags:
        - Key: Application
          Value: !Sub '${Environment}-${ProjectId}'
        - Key: Category1
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-opus'
        - Key: Category2
          Value: !Sub '${OpusInferenceProfileId}'
Outputs:
  PublicSubnetId:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
  SecurityGroupId:
    Value: !Ref EC2SecurityGroup
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
  EC2InstanceProfile:
    Value: !Ref EC2InstanceProfile
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
  KeyPairName:
    Value: !Ref EC2KeyPair
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'
  EC2HaikuProfile:
    Value: !GetAtt EC2HaikuProfile.InferenceProfileArn
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-haiku-profile-arn'
  EC2SonnetProfile:
    Value: !GetAtt EC2SonnetProfile.InferenceProfileArn
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sonnet-profile-arn'
  EC2OpusProfile:
    Value: !GetAtt EC2OpusProfile.InferenceProfileArn
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-opus-profile-arn'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EC2 instance stack'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'claude'
  InstanceIndex:
    Type: String
    Default: '01'
    Description: Instance Index
  InstanceType:
    Type: String
    Default: t3.medium
    AllowedValues: [ t3.micro, t3.small, t3.medium, t3.large ]
  ImageId:
    Type: String
    Default: ami-03d1820163e6b9f5d
    AllowedPattern: "^ami-[0-9a-f]{17}$"
  EbsVolumeSize:
    Type: Number
    Default: 20
    MinValue: 8
    MaxValue: 50
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: EC2 Configuration
        Parameters:
          - InstanceIndex
          - InstanceType
          - ImageId
          - EbsVolumeSize
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ImageId
      InstanceType: !Ref InstanceType
      KeyName:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'
      IamInstanceProfile:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: 0
          GroupSet:
            - Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
          SubnetId:
            Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: !Ref EbsVolumeSize
            VolumeType: gp3
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash
              set -e
              exec > >(tee /var/log/user-data.log)
              exec 2>&1
              echo "UserData script started: $(date)"
              sudo dnf update -y
              # Install Node.js 22
              curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
              sudo dnf install -y nodejs
              node --version
              # Install development tools for pyenv
              sudo dnf groupinstall -y "Development Tools"
              sudo dnf install -y gcc zlib-devel bzip2-devel readline-devel sqlite sqlite-devel openssl-devel tk-devel libffi-devel xz-devel
              # Run everything as ec2-user
              sudo -u ec2-user bash << 'EOFU'
              set -e
              export HOME=/home/ec2-user
              cd $HOME
              echo "Starting ec2-user setup: $(date)"
              # Set PATH first
              export PATH="$HOME/.local/bin:$PATH"
              # Install pyenv
              echo "Installing pyenv..."
              curl -fsSL https://pyenv.run | bash
              # Set pyenv environment variables immediately
              echo "Configuring pyenv..."
              export PYENV_ROOT="$HOME/.pyenv"
              export PATH="$PYENV_ROOT/bin:$PATH"
              # Initialize pyenv for non-interactive shell
              if [ -d "$PYENV_ROOT/bin" ]; then
                eval "$(pyenv init --path)"
                eval "$(pyenv init -)"
              fi
              # Configure pyenv in bashrc for future sessions
              cat << 'EOT' >> ~/.bashrc
              export PYENV_ROOT="$HOME/.pyenv"
              [[ -d $PYENV_ROOT/bin ]] && export PATH="$PYENV_ROOT/bin:$PATH"
              eval "$(pyenv init --path)"
              eval "$(pyenv init -)"
              EOT
              # Install latest stable Python version
              echo "Installing latest Python version..."
              LATEST_PYTHON=$(pyenv install --list 2>/dev/null | grep -E '^\s*[0-9]+\.[0-9]+\.[0-9]+$' | tail -1 | tr -d ' ')
              echo "Installing Python $LATEST_PYTHON..."
              pyenv install $LATEST_PYTHON
              pyenv global $LATEST_PYTHON
              echo "Python version installed:"
              python --version
              # Install Claude Code
              curl -fsSL https://claude.ai/install.sh | bash -s stable
              # Install uv
              curl -LsSf https://astral.sh/uv/install.sh | sh
              uv -V
              # Environment variables
              cat << EOT >> ~/.bashrc
              # AWS Configuration
              export CLAUDE_CODE_USE_BEDROCK=1
              export AWS_REGION=${AWS::Region}
              export AWS_DEFAULT_REGION=${AWS::Region}
              # Configure Bedrock Application Inference Profiles for Claude Code
              export ANTHROPIC_DEFAULT_SONNET_MODEL="${EC2SonnetProfileArn}"
              export ANTHROPIC_DEFAULT_OPUS_MODEL="${EC2OpusProfileArn}"
              export ANTHROPIC_DEFAULT_HAIKU_MODEL="${EC2HaikuProfileArn}"
              export CLAUDE_CODE_SUBAGENT_MODEL="${EC2HaikuProfileArn}"
              # Claude Code Configuration
              export CLAUDE_CODE_MAX_OUTPUT_TOKENS=4096
              export MAX_THINKING_TOKENS=1024
              export PATH="\$HOME/.local/bin:\$PATH"
              EOT
              source ~/.bashrc
              # Claude Code settings
              mkdir -p ~/.claude
              cat << 'EOT' > ~/.claude/settings.json
              {
                "provider": "bedrock",
                "awsRegion": "${AWS::Region}",
                "autoUpdates": true,
                "autoUpdatesChannel": "stable",
                "model": "haiku",
                "language": "japanese",
                "statusLine": {
                  "type": "command",
                  "command": "npx -y ccstatusline@latest",
                  "padding": 0
                },
                "permissions": {
                  "allow": [
                    "Bash(ls:*)",
                    "Bash(cat:*)",
                    "Bash(npm run dev)",
                    "Bash(npm run build)",
                    "Bash(npm test)"
                  ],
                  "deny": [
                    "Bash(rm -rf:*)",
                    "Bash(sudo:*)",
                    "Read(.env)"
                  ]
                }
              }
              EOT
              # Verify Claude Code
              if command -v claude &> /dev/null; then
                  echo "Claude Code installed successfully for ec2-user"
                  claude --version
              else
                  echo "Warning: claude command not found after installation"
              fi
              EOFU
              echo "Claude Code installation completed"
              echo "UserData script completed: $(date)"
            - EC2HaikuProfileArn:
                Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-haiku-profile-arn'
              EC2SonnetProfileArn:
                Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sonnet-profile-arn'
              EC2OpusProfileArn:
                Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-opus-profile-arn'
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-${InstanceIndex}'
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId

# AWS Configuration
export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=ap-northeast-1
export AWS_DEFAULT_REGION=ap-northeast-1
# Configure Bedrock Application Inference Profiles for Claude Code
export ANTHROPIC_DEFAULT_SONNET_MODEL="arn:aws:bedrock:{AWS Region}:{AWS Account ID}:application-inference-profile/xxxxxx"
export ANTHROPIC_DEFAULT_OPUS_MODEL="arn:aws:bedrock:{AWS Region}:{AWS Account ID}:application-inference-profile/xxxxxx"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="arn:aws:bedrock:{AWS Region}:{AWS Account ID}:application-inference-profile/xxxxxx"
export CLAUDE_CODE_SUBAGENT_MODEL="arn:aws:bedrock:{AWS Region}:{AWS Account ID}:application-inference-profile/xxxxxx"
# Claude Code Configuration
export CLAUDE_CODE_MAX_OUTPUT_TOKENS=4096
export MAX_THINKING_TOKENS=1024
export PATH="$HOME/.local/bin:$PATH"

{
  "permissions": {
    "allow": [
      "Bash(ls:*)",
      "Bash(cat:*)",
      "Bash(npm run dev)",
      "Bash(npm run build)",
      "Bash(npm test)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(sudo:*)",
      "Read(.env)"
    ]
  },
  "model": "haiku",
  "statusLine": {
    "type": "command",
    "command": "npx -y ccstatusline@latest",
    "padding": 0
  },
  "language": "japanese",
  "autoUpdatesChannel": "stable",
  "provider": "bedrock",
  "awsRegion": "ap-northeast-1",
  "autoUpdates": true
}

{
    "mcpServers": {
        "aws-mcp": {
            "command": "uvx",
            "timeout": 100000,
            "transport": "stdio",
            "args": [
            "mcp-proxy-for-aws@latest",
            "https://aws-mcp.us-east-1.api.aws/mcp",
            "--metadata",
            "AWS_REGION=us-west-2"
            ]
        },
        "Context7": {
            "type": "stdio",
            "command": "npx",
            "args": [
            "-y",
            "@upstash/context7-mcp@latest"
            ]
        },
        "sequential-thinking": {
          "command": "npx",
          "args": [
            "-y",
            "@modelcontextprotocol/server-sequential-thinking"
          ]
        },
        "drawio": {
        "command": "npx",
        "args": ["-y", "@drawio/mcp"]
        }
    }
}