【Amazon EC2】Kiro IDE サーバー構築ハンズオン

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Base stack: VPC, IAM, KeyPair'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'kiro-ide'
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
  PublicSubnetCidr:
    Type: String
    Default: '10.0.1.0/24'
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: Network Configuration
        Parameters:
          - VpcCidr
          - PublicSubnetCidr
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-vpc'
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetCidr
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet'
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Security Group for SSM-only'
      VpcId: !Ref VPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: '0.0.0.0/0'
          Description: 'Allow HTTPS outbound for SSM and AWS services'
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: '0.0.0.0/0'
          Description: 'Allow HTTP outbound for package downloads'
        - IpProtocol: tcp
          FromPort: 53
          ToPort: 53
          CidrIp: '0.0.0.0/0'
          Description: 'Allow DNS TCP queries'
        - IpProtocol: udp
          FromPort: 53
          ToPort: 53
          CidrIp: '0.0.0.0/0'
          Description: 'Allow DNS UDP queries'
        - IpProtocol: tcp
          FromPort: 123
          ToPort: 123
          CidrIp: '0.0.0.0/0'
          Description: 'Allow NTP for time synchronization'
        - IpProtocol: udp
          FromPort: 123
          ToPort: 123
          CidrIp: '0.0.0.0/0'
          Description: 'Allow NTP UDP for time synchronization'
  EC2KeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair'
      KeyType: rsa
      KeyFormat: pem
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-ssm-rl'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId
  EC2AWSMCPPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-awsmcp-pl'
      Roles:
        - !Ref EC2Role
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowAWSMCPAccess
            Effect: Allow
            Action:
              - aws-mcp:InvokeMcp
              - aws-mcp:CallReadOnlyTool
              - aws-mcp:CallReadWriteTool
            Resource:
              - "*"
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile'
      Roles:
        - !Ref EC2Role
Outputs:
  PublicSubnetId:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
  SecurityGroupId:
    Value: !Ref EC2SecurityGroup
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
  EC2InstanceProfile:
    Value: !Ref EC2InstanceProfile
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
  KeyPairName:
    Value: !Ref EC2KeyPair
    Export:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EC2 instance stack'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: 'kiro-ide'
  InstanceIndex:
    Type: String
    Default: '01'
    Description: Instance Index
  InstanceType:
    Type: String
    Default: t3.medium
    AllowedValues: [ t3.micro, t3.small, t3.medium, t3.large ]
  ImageId:
    Type: String
    AllowedPattern: "^ami-[0-9a-f]{17}$"
    Description: Windows Server 2025 AMI ID
  EbsVolumeSize:
    Type: Number
    Default: 40
    MinValue: 30
    MaxValue: 100
  RdpUserPassword:
    Type: String
    NoEcho: true
    Description: Password for rdpuser (generated by deploy script)
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      -
        Label:
          default: EC2 Configuration
        Parameters:
          - InstanceIndex
          - InstanceType
          - ImageId
          - EbsVolumeSize
      -
        Label:
          default: OS Configuration
        Parameters:
          - RdpUserPassword
Resources:
  RdpUserPasswordParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub '/${Environment}/${ProjectId}/${ProjectInfix}/${InstanceIndex}/windows-server/rdpuser-password'
      Type: String
      Value: !Ref RdpUserPassword
      Description: 'RDP user password for Windows Server'
      Tags:
        Environment: !Ref Environment
        ProjectId: !Ref ProjectId
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ImageId
      InstanceType: !Ref InstanceType
      KeyName:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-keypair-name'
      IamInstanceProfile:
        Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-instance-profile-name'
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: 0
          GroupSet:
            - Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-ec2-sg-id'
          SubnetId:
            Fn::ImportValue: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-public-subnet-id'
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: !Ref EbsVolumeSize
            VolumeType: gp3
            DeleteOnTermination: true
            Encrypted: true
      UserData:
        Fn::Base64: !Sub |
          <powershell>
          # ============================================================
          # UserData Bootstrap Script for Windows Server 2025
          # ============================================================
          # This script runs once at first boot under the SYSTEM account.
          # It performs the following tasks:
          #   1. Set timezone to JST (Tokyo Standard Time)
          #   2. Create an RDP user with administrator privileges
          #   3. Enable and configure Remote Desktop connections
          #   4. Install Chocolatey package manager and development tools
          #   5. Install Japanese language pack and configure locale
          #   6. Register a RunOnce script for per-user locale finalization
          #      and Windows Update enablement
          #   7. Reboot to apply language settings
          #
          # Log file: C:\Windows\Temp\UserData.log
          # ============================================================
          Start-Transcript -Path "C:\Windows\Temp\UserData.log" -Append
          Write-Output "UserData script started: $(Get-Date)"
          # ----------------------------------------------------------
          # Execution Policy
          # ----------------------------------------------------------
          # Allow all scripts to run in this session without restriction.
          # This is required because the default policy on Windows Server
          # may block unsigned scripts downloaded from the internet.
          Set-ExecutionPolicy Bypass -Scope Process -Force
          # ----------------------------------------------------------
          # Timezone Configuration
          # ----------------------------------------------------------
          # Set the system timezone to Japan Standard Time (UTC+09:00).
          Write-Output "Setting timezone to Tokyo Standard Time..."
          Set-TimeZone -Id "Tokyo Standard Time"
          Write-Output "Timezone set to: $(Get-TimeZone)"
          # ----------------------------------------------------------
          # RDP User Creation
          # ----------------------------------------------------------
          # Create a dedicated local user "rdpuser" for Remote Desktop access.
          # The password is passed from the CloudFormation parameter and also
          # stored in SSM Parameter Store for later retrieval.
          # The user is added to Administrators, Remote Desktop Users, and
          # Users groups to allow full RDP access with admin privileges.
          $RdpUserPasswordPlain = "${RdpUserPassword}"
          Write-Output "Using passwords from CloudFormation parameters"
          $RdpUserPasswordSecure = ConvertTo-SecureString $RdpUserPasswordPlain -AsPlainText -Force
          try {
              $existingRdpUser = Get-LocalUser -Name "rdpuser" -ErrorAction SilentlyContinue
              if ($existingRdpUser) {
                  Write-Output "RDP user already exists, updating password..."
                  Set-LocalUser -Name "rdpuser" -Password $RdpUserPasswordSecure
              } else {
                  Write-Output "Creating new RDP user..."
                  New-LocalUser -Name "rdpuser" -Password $RdpUserPasswordSecure -FullName "RDP User" -Description "RDP Access User with Administrator privileges" -PasswordNeverExpires
              }
              Add-LocalGroupMember -Group "Remote Desktop Users" -Member "rdpuser" -ErrorAction SilentlyContinue
              Add-LocalGroupMember -Group "Users" -Member "rdpuser" -ErrorAction SilentlyContinue
              Add-LocalGroupMember -Group "Administrators" -Member "rdpuser" -ErrorAction SilentlyContinue
              Write-Output "RDP user configured successfully with administrator privileges and RDP access"
          } catch {
              Write-Output "RDP user creation/update failed: $_"
          }
          # ----------------------------------------------------------
          # Remote Desktop Protocol (RDP) Configuration
          # ----------------------------------------------------------
          # Enable RDP connections by setting fDenyTSConnections to 0,
          # open the Windows Firewall rules for RDP (port 3389), and
          # explicitly set the RDP listening port.
          # Firewall rules are matched by Name pattern instead of
          # DisplayGroup to avoid dependency on the OS display language.
          Write-Output "Configuring RDP settings..."
          Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
          Get-NetFirewallRule -Name "RemoteDesktop-*" | Enable-NetFirewallRule
          # Set RDP listening port to the default 3389
          Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "PortNumber" -Value 3389
          # Disable automatic logon for security hardening
          Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name "AutoAdminLogon" -Value "0"
          # ----------------------------------------------------------
          # Windows Update
          # ----------------------------------------------------------
          # AWS AMI has Windows Update disabled by default.
          # It will be enabled via RunOnce after first RDP login.
          Write-Output "RDP and security configuration completed"
          # ----------------------------------------------------------
          # Chocolatey Package Manager Installation
          # ----------------------------------------------------------
          # Install Chocolatey, a Windows package manager, to automate
          # the installation of development tools. TLS 1.2 is enforced
          # for secure download of the installer script.
          Write-Output "Installing Chocolatey package manager..."
          [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
          try {
              Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
              Write-Output "Chocolatey installed successfully"
          } catch {
              Write-Output "Chocolatey installation failed: $_"
          }
          # Reload system PATH after Chocolatey installation so that
          # the 'choco' command is available in the current session.
          $machinePath = [System.Environment]::GetEnvironmentVariable("Path","Machine")
          $userPath = [System.Environment]::GetEnvironmentVariable("Path","User")
          $env:Path = $machinePath + ";" + $userPath
          # ----------------------------------------------------------
          # Development Tools Installation (via Chocolatey)
          # ----------------------------------------------------------
          # Each package is installed individually inside its own
          # try-catch block so that a single package failure does not
          # prevent the remaining packages from being installed.
          Write-Output "Installing development tools..."
          $chocoPackages = @(
              @{ Name = "python3"; Args = "--version=3.13 -y --no-progress" },
              @{ Name = "nodejs-lts"; Args = "-y --no-progress" },
              @{ Name = "git"; Args = "-y --no-progress" },
              @{ Name = "awscli"; Args = "-y --no-progress" },
              @{ Name = "vscode"; Args = "-y --no-progress" },
              @{ Name = "googlechrome"; Args = "-y --no-progress --ignore-checksums" },
              @{ Name = "uv"; Args = "-y --no-progress" }
          )
          foreach ($pkg in $chocoPackages) {
              try {
                  Write-Output "Installing $($pkg.Name)..."
                  $expression = "choco install $($pkg.Name) $($pkg.Args)"
                  Invoke-Expression $expression
                  Write-Output "$($pkg.Name) installed successfully"
              } catch {
                  Write-Output "$($pkg.Name) installation failed: $_"
              }
          }
          # ----------------------------------------------------------
          # Japanese Localization (Phase 1: System-wide defaults)
          # ----------------------------------------------------------
          # Install the Japanese language pack with -CopyToSettings to
          # apply display language, regional format, and locale settings
          # system-wide in a single step. Additional cmdlets configure
          # the preferred UI language, system locale, home location,
          # input method, and copy settings to the welcome screen and
          # new user profile template.
          # Note: This runs under the SYSTEM account. Per-user settings
          # for rdpuser are handled by the RunOnce script in Phase 2.
          Write-Output "Installing Japanese language pack with CopyToSettings..."
          $maxRetry = 3
          $langInstalled = $false
          for ($retry = 1; $retry -le $maxRetry; $retry++) {
              try {
                  Write-Output "Install-Language attempt $retry of $maxRetry..."
                  Install-Language -Language "ja-JP" -CopyToSettings -ErrorAction Stop
                  $langInstalled = $true
                  Write-Output "Japanese language pack installed successfully on attempt $retry"
                  break
              } catch {
                  Write-Output "Install-Language attempt $retry failed: $_"
                  if ($retry -lt $maxRetry) {
                      Write-Output "Waiting 30 seconds before retry..."
                      Start-Sleep -Seconds 30
                  }
              }
          }
          Write-Output "Installed language packs:"
          Get-InstalledLanguage | Out-String | Write-Output
          Write-Output "Configuring system-wide Japanese locale settings..."
          if ($langInstalled) {
              Set-SystemPreferredUILanguage -Language "ja-JP"
          } else {
              Write-Output "WARNING: Language pack not fully installed. Skipping Set-SystemPreferredUILanguage."
          }
          Set-WinSystemLocale -SystemLocale "ja-JP"
          Set-WinHomeLocation -GeoId 0x7A
          Set-WinUILanguageOverride -Language "ja-JP"
          Set-WinUserLanguageList -LanguageList ja-JP,en-US -Force
          Set-WinDefaultInputMethodOverride -InputTip "0411:00000411"
          Copy-UserInternationalSettingsToSystem -WelcomeScreen $true -NewUser $true
          Write-Output "System-wide Japanese locale settings configured"
          # ----------------------------------------------------------
          # Japanese Localization (Phase 2: Per-user RunOnce script)
          # ----------------------------------------------------------
          # Since UserData runs under the SYSTEM account, per-user
          # locale settings (language list, culture, input method) may
          # not apply to interactive logon users such as rdpuser.
          # This RunOnce script acts as a safety net: it runs once at
          # the first interactive logon and applies Japanese locale
          # settings in the context of the logged-in user.
          # Log file: C:\Windows\Temp\RunOnce-JapaneseLocale.log
          $RunOnceScriptPath = "C:\Windows\Temp\ApplyJapaneseLocale.ps1"
          @'
          Start-Transcript -Path "C:\Windows\Temp\RunOnce-JapaneseLocale.log" -Append
          Write-Output "RunOnce Japanese locale configuration started: $(Get-Date)"
          Set-WinUserLanguageList -LanguageList ja-JP,en-US -Force
          Set-WinHomeLocation -GeoId 0x7A
          Set-Culture ja-JP
          Set-WinUILanguageOverride -Language "ja-JP"
          Set-WinDefaultInputMethodOverride -InputTip "0411:00000411"
          Copy-UserInternationalSettingsToSystem -WelcomeScreen $true -NewUser $true
          # Enable Windows Update service (disabled by default in AWS AMI)
          Write-Output "Enabling Windows Update service..."
          Set-Service -Name wuauserv -StartupType Automatic
          Start-Service -Name wuauserv
          Write-Output "RunOnce Japanese locale configuration completed: $(Get-Date)"
          Stop-Transcript
          '@ | Out-File -Encoding UTF8 $RunOnceScriptPath
          # Register the RunOnce script in HKLM so it executes for
          # the first user who logs on interactively after reboot.
          Write-Output "Registering RunOnce for Japanese locale finalize..."
          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v ApplyJapaneseLocale /t REG_SZ /d "powershell -ExecutionPolicy Bypass -File $RunOnceScriptPath" /f
          Write-Output "RunOnce registered successfully"
          # ----------------------------------------------------------
          # Reboot
          # ----------------------------------------------------------
          # A reboot is required for the Japanese language pack and
          # locale changes to take full effect. After reboot, the
          # RunOnce script will finalize per-user settings on first logon.
          Write-Output "UserData script completed: $(Get-Date)"
          Write-Output "System will reboot to apply Japanese language settings..."
          Stop-Transcript
          Restart-Computer -Force
          </powershell>
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-${InstanceIndex}'
        - Key: Environment
          Value: !Ref Environment
        - Key: ProjectId
          Value: !Ref ProjectId

@echo off
REM Keep window open: re-launch with cmd /k when double-clicked
if not defined DEPLOY_RUNNING (
    set DEPLOY_RUNNING=1
    cmd /k "%~f0" %*
    exit /b
)
setlocal enabledelayedexpansion
echo Kiro AWS Development Environment Deployment Script
echo ================================================
echo.
echo Note: This deployment uses SSM port forwarding for RDP connections.
echo Direct RDP port (3389) is not exposed to the internet.
echo Note: This script uses the default AWS CLI profile.
echo.
set ENVIRONMENT=dev
set PROJECT_ID=001
set PROJECT_INFIX=kiro-ide
set INSTANCE_INDEX=01
set REGION=ap-northeast-1
set AMI_ID=ami-0ffac53afaf6a405e
REM Stack names
set BASE_STACK_NAME=%ENVIRONMENT%-%PROJECT_ID%-%PROJECT_INFIX%-base
set INSTANCE_STACK_NAME=%ENVIRONMENT%-%PROJECT_ID%-%PROJECT_INFIX%-instance-%INSTANCE_INDEX%
REM Template files
set BASE_TEMPLATE=ec2-kiro-base-stack.yaml
set INSTANCE_TEMPLATE=ec2-kiro-ide-instance-stack.yaml
echo Configuration:
echo - Environment: %ENVIRONMENT%
echo - Project ID: %PROJECT_ID%
echo - Project Infix: %PROJECT_INFIX%
echo - Region: %REGION%
echo - Instance Index: %INSTANCE_INDEX%
echo - AMI ID: %AMI_ID%
echo - Base Stack: %BASE_STACK_NAME%
echo - Instance Stack: %INSTANCE_STACK_NAME%
echo.
pause
echo Testing AWS CLI connection...
aws sts get-caller-identity --region %REGION% >nul 2>&1
if !errorlevel! neq 0 echo AWS CLI connection failed. Please check your credentials. & echo Run: aws sts get-caller-identity --region %REGION% & pause & goto end
echo AWS CLI connection successful
echo.
echo ================================================
echo Starting Staged Deployment
echo ================================================
echo.
REM ================================================
REM Stage 1: Base Stack (VPC, IAM, KeyPair)
REM ================================================
echo Checking Base stack status...
for /f "delims=" %%i in ('aws cloudformation describe-stacks --stack-name %BASE_STACK_NAME% --region %REGION% --query "Stacks[0].StackStatus" --output text 2^>nul') do set BASE_STATUS=%%i
if defined BASE_STATUS (
    echo Base stack found. Status: !BASE_STATUS!
    if "!BASE_STATUS!"=="CREATE_COMPLETE" (
        echo Base stack is ready. Proceeding to Instance deployment...
        goto check_instance
    )
    if "!BASE_STATUS!"=="UPDATE_COMPLETE" (
        echo Base stack is ready. Proceeding to Instance deployment...
        goto check_instance
    )
    echo Base stack status: !BASE_STATUS!
    echo Please wait for Base stack to complete or check for errors.
    pause
    goto check_instance
) else (
    echo Base stack not found. Starting Base deployment...
    goto deploy_base
)
:deploy_base
echo.
echo ================================================
echo Stage 1: Deploying Base Infrastructure
echo ================================================
echo.
echo Ready to deploy Base infrastructure stack.
echo This will create VPC, subnets, security groups, IAM roles, and KeyPair.
echo Press Enter to continue with Base stack deployment...
pause >nul
echo Deploying Base stack...
aws cloudformation create-stack ^
    --stack-name %BASE_STACK_NAME% ^
    --template-body file://%BASE_TEMPLATE% ^
    --parameters ParameterKey=Environment,ParameterValue=%ENVIRONMENT% ParameterKey=ProjectId,ParameterValue=%PROJECT_ID% ParameterKey=ProjectInfix,ParameterValue=%PROJECT_INFIX% ^
    --capabilities CAPABILITY_NAMED_IAM ^
    --region %REGION%
if !errorlevel! neq 0 echo Base stack deployment failed. Please check the error above. & pause & goto end
echo Waiting for Base stack creation to complete...
aws cloudformation wait stack-create-complete ^
    --stack-name %BASE_STACK_NAME% ^
    --region %REGION%
if !errorlevel! neq 0 echo Base stack creation failed or timed out. Check CloudFormation console. & pause & goto end
echo Base stack deployment completed successfully.
echo.
REM ================================================
REM Stage 2: Instance Stack (EC2)
REM ================================================
:check_instance
echo Checking Instance stack status...
for /f "delims=" %%i in ('aws cloudformation describe-stacks --stack-name %INSTANCE_STACK_NAME% --region %REGION% --query "Stacks[0].StackStatus" --output text 2^>nul') do set INSTANCE_STATUS=%%i
if defined INSTANCE_STATUS (
    echo Instance stack found. Status: !INSTANCE_STATUS!
    if "!INSTANCE_STATUS!"=="CREATE_COMPLETE" (
        echo Instance is ready. Proceeding to final checks...
        goto final_checks
    )
    if "!INSTANCE_STATUS!"=="UPDATE_COMPLETE" (
        echo Instance is ready. Proceeding to final checks...
        goto final_checks
    )
    echo Instance stack status: !INSTANCE_STATUS!
    echo Please wait for Instance stack to complete or check for errors.
    pause
    goto final_checks
) else (
    echo Instance stack not found. Starting Instance deployment...
    goto deploy_instance
)
:deploy_instance
echo.
echo ================================================
echo Stage 2: Deploying EC2 Instance
echo ================================================
echo.
echo Generating random password for RDP user...
for /f "delims=" %%i in ('powershell -Command "$chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789'; $symbols = '!@#%%^*-_=+'; $password = ''; for($i=0; $i -lt 12; $i++) { $password += $chars[(Get-Random -Maximum $chars.Length)] }; for($i=0; $i -lt 4; $i++) { $password += $symbols[(Get-Random -Maximum $symbols.Length)] }; $charArray = $password.ToCharArray(); [System.Random]$rng = New-Object System.Random; for($i=$charArray.Length-1; $i -gt 0; $i--) { $j=$rng.Next($i+1); $tmp=$charArray[$i]; $charArray[$i]=$charArray[$j]; $charArray[$j]=$tmp }; Write-Output (-join $charArray)"') do set RDP_PASSWORD=%%i
echo Password generated successfully.
echo.
echo Password will be stored in SSM Parameter Store:
echo - /%ENVIRONMENT%/%PROJECT_ID%/%PROJECT_INFIX%/%INSTANCE_INDEX%/windows-server/rdpuser-password
echo.
echo Ready to deploy EC2 Instance stack.
echo Press Enter to continue with Instance stack deployment...
pause >nul
echo Deploying Instance stack...
aws cloudformation create-stack ^
    --stack-name %INSTANCE_STACK_NAME% ^
    --template-body file://%INSTANCE_TEMPLATE% ^
    --parameters ParameterKey=Environment,ParameterValue=%ENVIRONMENT% ParameterKey=ProjectId,ParameterValue=%PROJECT_ID% ParameterKey=ProjectInfix,ParameterValue=%PROJECT_INFIX% ParameterKey=InstanceIndex,ParameterValue=%INSTANCE_INDEX% ParameterKey=RdpUserPassword,ParameterValue=%RDP_PASSWORD% ParameterKey=ImageId,ParameterValue=%AMI_ID% ^
    --region %REGION%
if !errorlevel! neq 0 echo Instance stack deployment failed. Please check the error above. & pause & goto end
echo Waiting for Instance stack creation to complete...
aws cloudformation wait stack-create-complete ^
    --stack-name %INSTANCE_STACK_NAME% ^
    --region %REGION%
if !errorlevel! neq 0 echo Instance stack creation failed or timed out. Check CloudFormation console. & pause & goto end
echo Instance stack deployment completed successfully.
echo.
REM ================================================
REM Final Checks and Connection Info
REM ================================================
:final_checks
echo.
echo ================================================
echo Final Deployment Checks
echo ================================================
echo.
echo Getting EC2 instance information...
for /f "delims=" %%i in ('aws cloudformation describe-stack-resources --stack-name %INSTANCE_STACK_NAME% --logical-resource-id EC2Instance --query "StackResources[0].PhysicalResourceId" --output text --region %REGION% 2^>nul') do set INSTANCE_ID=%%i
if not defined INSTANCE_ID (
    echo ERROR: Could not retrieve instance ID.
    echo Please check if the Instance stack was created successfully.
    pause
    goto end
)
echo Instance ID: !INSTANCE_ID!
echo.
echo Getting instance details...
aws ec2 describe-instances --instance-ids !INSTANCE_ID! --region %REGION% --query "Reservations[0].Instances[0].[State.Name,PublicIpAddress,PrivateIpAddress]" --output table
echo.
echo ========================================
echo Waiting for SSM Agent to come online
echo ========================================
echo.
set ATTEMPT=0
set MAX_ATTEMPTS=200
set WAIT_SECONDS=30
echo Checking SSM Agent status (max 200 attempts, 30s interval)...
:CHECK_SSM_LOOP
set /a ATTEMPT+=1
if !ATTEMPT! geq !MAX_ATTEMPTS! echo WARNING: SSM Agent did not come online after !MAX_ATTEMPTS! attempts. & goto SHOW_INFO
for /f "tokens=*" %%i in ('aws ssm describe-instance-information --filters "Key=InstanceIds,Values=!INSTANCE_ID!" --query "InstanceInformationList[0].PingStatus" --output text --region %REGION% 2^>nul') do set PING_STATUS=%%i
if "!PING_STATUS!"=="Online" echo SSM Agent is online. & goto SSM_ONLINE
echo Attempt !ATTEMPT!/!MAX_ATTEMPTS! - Status: !PING_STATUS! - Waiting !WAIT_SECONDS!s...
timeout /t !WAIT_SECONDS! /nobreak >nul
goto CHECK_SSM_LOOP
:SSM_ONLINE
echo.
echo ========================================
echo Deployment completed successfully
echo ========================================
echo.
:SHOW_INFO
echo.
echo ========================================
echo Connection Commands
echo ========================================
echo.
echo Step 1: Retrieve RDP password
echo aws ssm get-parameter --name "/%ENVIRONMENT%/%PROJECT_ID%/%PROJECT_INFIX%/%INSTANCE_INDEX%/windows-server/rdpuser-password" --with-decryption --query "Parameter.Value" --output text --region %REGION%
echo.
echo Step 2: RDP via SSM port forwarding
echo.
echo   [PowerShell]
echo   $INSTANCE_ID = "!INSTANCE_ID!"
echo   aws ssm start-session --target $INSTANCE_ID --document-name AWS-StartPortForwardingSession --parameters "portNumber=3389,localPortNumber=13389" --region %REGION%
echo.
echo   [Cmd]
echo   set INSTANCE_ID=!INSTANCE_ID!
echo   aws ssm start-session --target %%INSTANCE_ID%% --document-name AWS-StartPortForwardingSession --parameters "portNumber=3389,localPortNumber=13389" --region %REGION%
echo.
echo Step 3: Connect with Remote Desktop
echo ----------------------------------------
echo RDP endpoint: localhost:13389
echo Username: rdpuser
echo Password: (retrieved in Step 1)
echo ----------------------------------------
echo.
echo ========================================
echo Next Steps
echo ========================================
echo.
echo 1. Wait for Windows to fully complete initialization (first boot may take 10-15 minutes)
echo 2. Use the SSM commands above to connect to the instance
echo 3. After first RDP login, Japanese locale and Windows Defender/Update will be re-enabled automatically
echo.
:end
echo.
echo Press any key to exit...
pause >nul

Title: Security Scanner(入力する)
Description: ファイル保存時にAPIキーや秘密情報が含まれていないかチェックし、環境変数への移行を提案します(入力する)
Event: File Saved(選択する)
File path(s) to watch： */* (入力後、Enterキーを押下)
Action: Ask Kiro(選択する)
Instructions for Kiro agent:(入力する)
ファイルを精査して、以下のような機密情報を検出：
1. ハードコードされた認証情報
  - APIキー（AWS、Google、OpenAIなど）
  - パスワード
  - 秘密鍵
  - データベース接続文字列
2. 見つかった場合の対処
  - 該当行をハイライト
  - 環境変数への移行方法を提案
  - .envファイルへの追加例を表示
  - .gitignoreに.envが含まれているか確認
3. プライベートなURL
  - 内部APIのエンドポイント
  - 開発環境のURL
  - これらも環境変数化を提案
4. コミット前の最終チェック
  - git diffで機密情報が含まれていないか確認
  - 問題があればコミットを中断するよう警告

---
inclusion: always
---
# Steering: ドキュメントとKiroの回答は日本語で出力する
## 目的
Kiroが生成する文書およびユーザーとのやり取りの言語方針を明確化し、日本国内の利用者にとって理解しやすいコミュニケーションとドキュメントを一貫して提供する。
## スコープ
-  **Kiroの回答**:   ユーザーとのすべてのやり取り、説明、提案、エラーメッセージの説明
-  **プロジェクト文書**:   要件定義、基本/詳細設計、運用手順、README、API仕様、トラブルシューティング、セットアップ手順、テスト計画、ユーザーガイド、リリースノートなど
## 方針
### 1. **Kiroの回答は日本語で行う**
-  ユーザーとのやり取りはすべて日本語で行う
-  技術的な説明や提案も日本語で提供する
-  エラーメッセージの説明も日本語で行う
### 2. **ドキュメントはすべて日本語で記述する**
-  技術用語は必要に応じて適切な日本語訳を併記し、表記を統一する
-  見出しレベル、番号付き手順、強調の使い方を統一する
-  誤字脱字チェック、初心者にも理解できる説明を行う
### 3. **技術用語の扱い**
-  **英語のまま使用**:   AWSサービス名（S3、Lambda、EC2など）、技術スタック名、プログラミング言語名、フレームワーク名
-  **日本語化**:   一般的な技術概念や操作手順の説明
### 4. **コード内識別子は英語可**
-  変数名・関数名・クラス名などは可読性を優先し英語を許容する
-  コードコメントは英語で記述する
## 禁止事項
-  文書の英語のみ記述（利用者向け最終成果物）
-  Kiroの回答を英語で行うこと
-  表現・用語の統一ルールからの逸脱
-  AWSサービス名や技術スタック名の不適切な日本語翻訳
-  CloudFormationテンプレートでは、日本語を使用しない。説明は英語にて記載すること

---
inclusion: always
---
# Kiro Steering
## 前提条件
- 本Steeringは **Windows環境での利用を前提**とする
## 目的
Kiroが生成するすべての回答およびドキュメントを日本語で統一し、
Windows環境で作業する日本国内利用者にとって
理解しやすく一貫性のある出力を提供する。
## 適用範囲
本Steeringは以下すべてに自動的に適用される。
- Kiroによるユーザーへの回答
- 技術的な説明、設計提案、レビュー
- エラーメッセージおよびトラブルシューティングの説明
- プロジェクト内のすべてのドキュメント
## 出力言語ルール
### 1. Kiroの回答
- すべて **日本語で出力**する
- 技術的内容も日本語で説明する
- ユーザー入力が英語であっても、日本語で回答する
### 2. ドキュメント
- すべて日本語で記述する
- 見出し構造、手順、表現を統一する
- 初心者にも理解できる説明を心がける
### 3. 技術用語の扱い
- 以下は英語表記のまま使用する
  - AWSサービス名（S3、Lambda、EC2 など）
  - プログラミング言語名
  - フレームワーク名
  - OSS・ライブラリ名
- 一般的な技術概念や操作説明は日本語で行う
### 4. コード記述ルール
- 変数名・関数名・クラス名は英語を使用してよい
- コードコメントは英語で記述する

{
    "mcpServers": {
        "aws-mcp": {
            "command": "uvx",
            "timeout": 100000,
            "transport": "stdio",
            "args": [
            "mcp-proxy-for-aws@latest",
            "https://aws-mcp.us-east-1.api.aws/mcp",
            "--metadata",
            "AWS_REGION=us-west-2"
            ]
        },
        "Context7": {
            "type": "stdio",
            "command": "npx",
            "args": [
            "-y",
            "@upstash/context7-mcp@latest"
            ]
        },
        "sequential-thinking": {
          "command": "npx",
          "args": [
            "-y",
            "@modelcontextprotocol/server-sequential-thinking"
          ]
        },
        "drawio": {
        "command": "npx",
        "args": ["-y", "@drawio/mcp"]
        },
        "playwright": {
        "command": "npx",
        "args": ["-y", "@executeautomation/playwright-mcp-server"]
        }
    }
}