【Amazon EC2】Kiro CLI サーバー構築ハンズオン

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Base stack: VPC, IAM, KeyPair'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'kiro-cli'
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
  PublicSubnetCidr:
    Type: String
    Default: '10.0.1.0/24'
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: Network Configuration
        Parameters:
          - VpcCidr
          - PublicSubnetCidr
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-vpc'
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetCidr
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet'
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Security Group for SSM-only'
      VpcId: !Ref VPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: '0.0.0.0/0'
  EC2KeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair'
      KeyType: rsa
      KeyFormat: pem
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-ssm-rl'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId
  EC2AWSMCPPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-awsmcp-pl'
      Roles:
        - !Ref EC2Role
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowAWSMCPAccess
            Effect: Allow
            Action:
              - aws-mcp:InvokeMcp
              - aws-mcp:CallReadOnlyTool
              - aws-mcp:CallReadWriteTool
            Resource:
              - "*"
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile'
      Roles:
        - !Ref EC2Role
Outputs:
  PublicSubnetId:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
  SecurityGroupId:
    Value: !Ref EC2SecurityGroup
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
  EC2InstanceProfile:
    Value: !Ref EC2InstanceProfile
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
  KeyPairName:
    Value: !Ref EC2KeyPair
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EC2 instance stack'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'kiro-cli'
  InstanceIndex:
    Type: String
    Default: '01'
    Description: Instance Index
  InstanceType:
    Type: String
    Default: t3.medium
    AllowedValues: [ t3.micro, t3.small, t3.medium, t3.large ]
  ImageId:
    Type: String
    Default: ami-088b486f20fab3f0e
    AllowedPattern: "^ami-[0-9a-f]{17}$"
  EbsVolumeSize:
    Type: Number
    Default: 20
    MinValue: 8
    MaxValue: 50
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: EC2 Configuration
        Parameters:
          - InstanceIndex
          - InstanceType
          - ImageId
          - EbsVolumeSize
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ImageId
      InstanceType: !Ref InstanceType
      KeyName:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'
      IamInstanceProfile:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: 0
          GroupSet:
            - Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
          SubnetId:
            Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: !Ref EbsVolumeSize
            VolumeType: gp3
      UserData:
        Fn::Base64:
          Fn::Sub: |
              #!/bin/bash
              set -e
              exec > >(tee /var/log/user-data.log)
              exec 2>&1
              echo "UserData script started: $(date)"
              dnf update -y
              curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
              dnf install -y nodejs
              node --version
              dnf groupinstall -y "Development Tools"
              dnf install -y gcc zlib-devel bzip2-devel readline-devel sqlite sqlite-devel openssl-devel tk-devel libffi-devel xz-devel
              # Run everything as ec2-user
              sudo -u ec2-user bash << 'EOFU'
              set -e
              export HOME=/home/ec2-user
              cd ${!HOME}
              echo "Starting ec2-user setup: $(date)"
              export PATH="${!HOME}/.local/bin:${!PATH}"
              # Install pyenv
              echo "Installing pyenv..."
              curl -fsSL https://pyenv.run | bash
              echo "Configuring pyenv..."
              export PYENV_ROOT="${!HOME}/.pyenv"
              export PATH="${!PYENV_ROOT}/bin:${!PATH}"
              if [ -d "${!PYENV_ROOT}/bin" ]; then
                eval "$(pyenv init --path)"
                eval "$(pyenv init -)"
              fi
              cat << 'EOT' >> ~/.bashrc
              export PYENV_ROOT="$HOME/.pyenv"
              [[ -d $PYENV_ROOT/bin ]] && export PATH="$PYENV_ROOT/bin:$PATH"
              eval "$(pyenv init --path)"
              eval "$(pyenv init -)"
              EOT
              # Install Python 3.13 (fixed version for MCP server compatibility)
              # AWS MCP Server dependency (rpds-py -> PyO3) supports up to Python 3.14
              echo "Installing Python 3.13..."
              PYTHON_VERSION=$(pyenv install --list 2>/dev/null | grep -E '^\s*3\.13\.[0-9]+' | grep -vE 'dev|rc|alpha|beta' | tail -1 | tr -d ' ')
              echo "Installing Python ${!PYTHON_VERSION}..."
              pyenv install ${!PYTHON_VERSION}
              pyenv global ${!PYTHON_VERSION}
              echo "Python version installed:"
              python --version
              # Install Kiro CLI
              curl -fsSL https://cli.kiro.dev/install | bash
              # Install uv
              curl -LsSf https://astral.sh/uv/install.sh | sh
              uv -V
              if ! grep -q '.local/bin' ~/.bashrc; then
                echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
              fi
              source ~/.bashrc
              export PATH="${!HOME}/.local/bin:${!PATH}"
              if command -v kiro-cli &> /dev/null; then
                echo "Kiro CLI installed successfully for ec2-user"
                kiro-cli --version
              else
                echo "Warning: kiro-cli command not found after installation"
              fi
              EOFU
              echo "Kiro CLI installation completed"
              echo "UserData script completed: $(date)"
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-${InstanceIndex}'
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId

---
inclusion: always
---
# Steering: ドキュメントとKiroの回答は日本語で出力する
## 目的
Kiroが生成する文書およびユーザーとのやり取りの言語方針を明確化し、日本国内の利用者にとって理解しやすいコミュニケーションとドキュメントを一貫して提供する。
## スコープ
-  **Kiroの回答**:   ユーザーとのすべてのやり取り、説明、提案、エラーメッセージの説明
-  **プロジェクト文書**:   要件定義、基本/詳細設計、運用手順、README、API仕様、トラブルシューティング、セットアップ手順、テスト計画、ユーザーガイド、リリースノートなど
## 方針
### 1. **Kiroの回答は日本語で行う**
-  ユーザーとのやり取りはすべて日本語で行う
-  技術的な説明や提案も日本語で提供する
-  エラーメッセージの説明も日本語で行う
### 2. **ドキュメントはすべて日本語で記述する**
-  技術用語は必要に応じて適切な日本語訳を併記し、表記を統一する
-  見出しレベル、番号付き手順、強調の使い方を統一する
-  誤字脱字チェック、初心者にも理解できる説明を行う
### 3. **技術用語の扱い**
-  **英語のまま使用**:   AWSサービス名（S3、Lambda、EC2など）、技術スタック名、プログラミング言語名、フレームワーク名
-  **日本語化**:   一般的な技術概念や操作手順の説明
### 4. **コード内識別子は英語可**
-  変数名・関数名・クラス名などは可読性を優先し英語を許容する
-  コードコメントは日本語で記述する
## 禁止事項
-  文書の英語のみ記述（利用者向け最終成果物）
-  Kiroの回答を英語で行うこと
-  表現・用語の統一ルールからの逸脱
-  AWSサービス名や技術スタック名の不適切な日本語翻訳
-  CloudFormationテンプレートでは、日本語を使用しない。説明は英語にて記載すること

{
    "mcpServers": {
        "aws-mcp": {
            "command": "uvx",
            "timeout": 100000,
            "transport": "stdio",
            "args": [
            "mcp-proxy-for-aws@latest",
            "https://aws-mcp.us-east-1.api.aws/mcp",
            "--metadata",
            "AWS_REGION=us-west-2"
            ]
        },
        "Context7": {
            "type": "stdio",
            "command": "npx",
            "args": [
            "-y",
            "@upstash/context7-mcp@latest"
            ]
        },
        "sequential-thinking": {
          "command": "npx",
          "args": [
            "-y",
            "@modelcontextprotocol/server-sequential-thinking"
          ]
        },
        "drawio": {
        "command": "npx",
        "args": ["-y", "@drawio/mcp"]
        },
        "playwright": {
        "command": "npx",
        "args": ["-y", "@executeautomation/playwright-mcp-server"]
        }
    }
}