AWSCLIでWebサイト用VPC構築

##AWS CLIを使ってみよう
**AWSCLIはバージョンで若干異なるようなので気を付けてください。
なお、私は下記の環境で実行しました。

```
aws --version
aws-cli/1.16.102 Python/2.7.16 Linux/4.14.121-85.96.amzn1.x86_64 botocore/1.12.92
```
最近はだいぶん、マネージメントコンソールでの操作に慣れてきたので、infrastructure as a code の一歩目として
CloudFormationの前にCLIでのVPC内操作をスクリプト化してみました。
最終的には下記の様なインフラが構築できます。

jq コマンド必須です

```
curl -o /usr/bin/jq -L https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64
chmod a+x /usr/bin/jq
```

![Untitled Diagram-Copy of 課題準備工程用1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/347413/645eecf8-f44b-ebc5-a0b4-da4bbd67940f.png)


```networking.sh
#!/bin/bash

#setregion
az=$(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone)
regiona=${az:0:${#az} - 1}
regionb=${az:0:${#az} - 1}
regiona+="a"
regionb+="b"

set -eu

echo "What is the Name tag?"
read Nametag
echo "What is the Owner tag?"
read Ownertag
echo "What is the Use tag?"
read Usetag

#Creates a VPC with the specified IPv4 CIDR block
MyVPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/22 | jq .Vpc.VpcId -r)
echo "MyVPC = $MyVPC"
aws ec2 create-tags --resources $MyVPC --tags Key=Name,Value=WebVPC Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag


#To modify the enableDnsHostnames attribute
aws ec2 modify-vpc-attribute --vpc-id $MyVPC --enable-dns-hostnames "{\"Value\":true}"

#CreateInternetgateway
MyIGW=$(aws ec2 create-internet-gateway | jq .InternetGateway.InternetGatewayId -r)
echo "MyIGW = $MyIGW"
aws ec2 create-tags --resources $MyIGW --tags Key=Name,Value=WebIGW Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

aws ec2 attach-internet-gateway --vpc-id $MyVPC --internet-gateway-id $MyIGW 
echo "          Attach IGW"

#CreateSubnet
PublicSubnet1=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.0.0/28 --availability-zone $regiona | jq .Subnet.SubnetId -r)
echo "PublicSubnet1 = $PublicSubnet1"
aws ec2 create-tags --resources $PublicSubnet1 --tags Key=Name,Value=PublicSubnet1 Key=Owner,Value=$Ownertag Key=Usetag,Value=$Usetag

PublicSubnet2=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.0.16/28 --availability-zone $regionb | jq .Subnet.SubnetId -r)
echo "PublicSubnet2 = $PublicSubnet2"
aws ec2 create-tags --resources $PublicSubnet2 --tags Key=Name,Value=PublicSubnet2  Key=Owner,Value=$Ownertag Key=Usetag,Value=$Usetag

ProtectSubnet1=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.1.0/26 --availability-zone $regiona | jq .Subnet.SubnetId -r)
echo "ProtectSubnet1 = $ProtectSubnet1"
aws ec2 create-tags --resources $ProtectSubnet1 --tags Key=Name,Value=ProtectSubnet1 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

ProtectSubnet2=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.1.64/26 --availability-zone $regionb | jq .Subnet.SubnetId -r)
echo "ProtectSubnet2 = $ProtectSubnet2"
aws ec2 create-tags --resources $ProtectSubnet2 --tags Key=Name,Value=ProtectSubnet2 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

PrivateSubnet1=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.2.0/28 --availability-zone $regiona | jq .Subnet.SubnetId -r)
echo "PrivateSubnet1 = $PrivateSubnet1"
aws ec2 create-tags --resources $PrivateSubnet1 --tags Key=Name,Value=PrivateSubnet1 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

PrivateSubnet2=$(aws ec2 create-subnet --vpc-id $MyVPC  --cidr-block 10.0.2.16/28 --availability-zone $regionb | jq .Subnet.SubnetId -r)
echo "PrivateSubnet2 = $PrivateSubnet2"
aws ec2 create-tags --resources $PrivateSubnet2 --tags Key=Name,Value=PrivateSubnet2 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag


#Allocate-ElasticIP
ElasticIP1=$(aws ec2 allocate-address | jq .AllocationId -r)
echo "ElasticIP1 = $ElasticIP1"
aws ec2 create-tags --resources $ElasticIP1 --tags Key=Name,Value=WebEIP1 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag
ElasticIP2=$(aws ec2 allocate-address | jq .AllocationId -r)
echo "ElasticIP2 = $ElasticIP2"
aws ec2 create-tags --resources $ElasticIP2 --tags Key=Name,Value=WebEIP2 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag


#CleateNAT
NatGateway1=$(aws ec2 create-nat-gateway --subnet-id $PublicSubnet1 --allocation-id $ElasticIP1 | jq .NatGateway.NatGatewayId -r)
echo "NatGateway1 = $NatGateway1"
aws ec2 create-tags --resources $NatGateway1 --tags Key=Name,Value=PublicTable1Nat Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

NatGateway2=$(aws ec2 create-nat-gateway --subnet-id $PublicSubnet2 --allocation-id $ElasticIP2 | jq .NatGateway.NatGatewayId -r)
echo "NatGateway2 = $NatGateway2"
aws ec2 create-tags --resources $NatGateway2 --tags Key=Name,Value=PublicTable2Nat Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag


#CreateRouteTable
PublicTable=$(aws ec2 create-route-table --vpc-id $MyVPC | jq .RouteTable.RouteTableId -r)
echo "PublicTable = $PublicTable"
aws ec2 create-tags --resources $PublicTable --tags Key=Name,Value=PublicTable Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

ProtectedTable1=$(aws ec2 create-route-table --vpc-id $MyVPC | jq .RouteTable.RouteTableId -r)
echo "ProtectedTable1 = $ProtectedTable1"
aws ec2 create-tags --resources $ProtectedTable1 --tags Key=Name,Value=ProtectedTable1 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

ProtectedTable2=$(aws ec2 create-route-table --vpc-id $MyVPC | jq .RouteTable.RouteTableId -r)
echo "ProtectedTable2 = $ProtectedTable2"
aws ec2 create-tags --resources $ProtectedTable2 --tags Key=Name,Value=ProtectedTable2 Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

PrivateTable=$(aws ec2 create-route-table --vpc-id $MyVPC | jq .RouteTable.RouteTableId -r)
echo "PrivateTable = $PrivateTable"
aws ec2 create-tags --resources $PrivateTable --tags Key=Name,Value=PrivateTable Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag


#Create-Route
aws ec2 create-route --route-table-id $PublicTable --destination-cidr-block 0.0.0.0/0 --gateway-id $MyIGW > /dev/null
sleep 1
aws ec2 create-route --route-table-id $ProtectedTable1 --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NatGateway1 > /dev/null
sleep 1
aws ec2 create-route --route-table-id $ProtectedTable2 --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NatGateway2 > /dev/null
sleep 1
echo "          Create Route"

#Associate-Route-table
aws ec2 associate-route-table  --subnet-id $PublicSubnet1 --route-table-id $PublicTable > /dev/null
aws ec2 associate-route-table  --subnet-id $PublicSubnet2 --route-table-id $PublicTable > /dev/null
aws ec2 associate-route-table  --subnet-id $ProtectSubnet1 --route-table-id $ProtectedTable1 > /dev/null
aws ec2 associate-route-table  --subnet-id $ProtectSubnet2 --route-table-id $ProtectedTable2 > /dev/null
aws ec2 associate-route-table  --subnet-id $PrivateSubnet1 --route-table-id $PrivateTable > /dev/null
aws ec2 associate-route-table  --subnet-id $PrivateSubnet2 --route-table-id $PrivateTable > /dev/null
echo "          Associate-Routetable-Subnet"

#CreateSecurityGroup
ALBSG=$(aws ec2 create-security-group --group-name ALBSG --description "OnlyHTTPfromALL"  --vpc-id $MyVPC | jq .GroupId -r)
echo "ALBSG = $ALBSG"
aws ec2 create-tags --resources $ALBSG --tags Key=Name,Value=ALBSG Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

WEBSG=$(aws ec2 create-security-group --group-name WEBSG --description "OnlyHTTPfromALBSG"  --vpc-id $MyVPC | jq .GroupId -r)
echo "WEBSG = $WEBSG"
aws ec2 create-tags --resources $WEBSG --tags Key=Name,Value=WEBSG Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

BastionSG=$(aws ec2 create-security-group --group-name BastionSG --description "OnlySSHfromMyIP"  --vpc-id $MyVPC | jq .GroupId -r)
echo "BastionSG = $BastionSG"
aws ec2 create-tags --resources $BastionSG --tags Key=Name,Value=BastionSG Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

DBSG=$(aws ec2 create-security-group --group-name DBSG --description "OnlyDBfromWEBSG,BastionSG"  --vpc-id $MyVPC | jq .GroupId -r)
echo "DBSG = $DBSG"
aws ec2 create-tags --resources $DBSG --tags Key=Name,Value=DBSG Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag

EFSSG=$(aws ec2 create-security-group --group-name EFSSG --description "OnlyNFSfromWEBSG,BastionSG"  --vpc-id $MyVPC | jq .GroupId -r)
echo "EFSSG = $EFSSG"
aws ec2 create-tags --resources $EFSSG --tags Key=Name,Value=EFSSG Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag



#Allowtraffic
aws ec2 authorize-security-group-ingress --group-id $ALBSG --protocol tcp --port 80 --cidr 0.0.0.0/0 > /dev/null
aws ec2 authorize-security-group-ingress --group-id $WEBSG --protocol tcp --port 80 --source-group $ALBSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $WEBSG --protocol tcp --port 22 --source-group $ALBSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $WEBSG --protocol tcp --port 80 --source-group $BastionSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $DBSG --protocol tcp --port 3306 --source-group $WEBSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $DBSG --protocol tcp --port 3306 --source-group $BastionSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $DBSG --protocol tcp --port 5432 --source-group $WEBSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $DBSG --protocol tcp --port 5432 --source-group $BastionSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $EFSSG --protocol tcp --port 2049 --source-group $WEBSG > /dev/null
aws ec2 authorize-security-group-ingress --group-id $EFSSG --protocol tcp --port 2049 --source-group $BastionSG > /dev/null
echo "          Allowtraffic"


#Createloadbalancer
ALB_arn=$(aws elbv2 create-load-balancer --name WebELB --subnets $PublicSubnet1 $PublicSubnet2 --security-groups $ALBSG | jq .LoadBalancers[].LoadBalancerArn -r)
echo "ALB_arn = $ALB_arn"
aws elbv2 add-tags --resource-arns $ALB_arn --tags Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag
ALB_dns=$(aws elbv2 describe-load-balancers --load-balancer-arn $ALB_arn | jq .LoadBalancers[].DNSName -r)
echo "ALB_dns = $ALB_dns"

TG_arn=$(aws elbv2 create-target-group --name WebTG --protocol HTTP --port 80 --vpc-id $MyVPC \
--health-check-path /healthcheck --health-check-interval-seconds 60 --health-check-timeout-seconds 25 --healthy-threshold-count 2 \
--unhealthy-threshold-count 5 | jq .TargetGroups[].TargetGroupArn -r)
echo "TG_arn = $TG_arn"

aws elbv2 add-tags --resource-arns $TG_arn --tags Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag > /dev/null
aws elbv2 modify-target-group-attributes --target-group-arn $TG_arn --attributes Key=deregistration_delay.timeout_seconds,Value=30 > /dev/null
aws elbv2 create-listener --load-balancer-arn $ALB_arn --protocol HTTP --port 80 --default-actions Type=forward,TargetGroupArn=$TG_arn > /dev/null

EFS_Id=$(aws efs create-file-system --creation-token FileStstemForWalkthough1 --region us-east-2 | jq .FileSystemId -r)
aws efs create-tags --file-system-id $EFS_Id --tags  Key=Name,Value=WebEFS Key=Owner,Value=$Ownertag Key=Use,Value=$Usetag
sleep 10
echo "EFS_Id = $EFS_Id"



aws efs create-mount-target --file-system-id $EFS_Id --subnet-id $ProtectSubnet1 --security-groups $EFSSG > /dev/null
aws efs create-mount-target --file-system-id $EFS_Id --subnet-id $ProtectSubnet2 --security-groups $EFSSG > /dev/null
echo "          Created MountTarget"

aws rds create-db-subnet-group --db-subnet-group-name WebSubnetGroup --db-subnet-group-description Production \
--subnet-ids $PrivateSubnet1 $PrivateSubnet2 > /dev/null
echo "          Created WebSubnetGroup"


echo "****success****"
```
実行ログ 

```
sh networking.sh
What is the Name tag?
Webapp
What is the Owner tag?
Admin
What is the Use tag?
Default
MyVPC = vpc-019faa54bf0145d63
MyIGW = igw-09495ff95d31f92ee
          Attach IGW
PublicSubnet1 = subnet-08902e5b716e68104
PublicSubnet2 = subnet-0f67409bfc9f86055
ProtectSubnet1 = subnet-0b7af1f31bc24ba46
ProtectSubnet2 = subnet-02257829dec75cc1a
PrivateSubnet1 = subnet-003187a137fce0082
PrivateSubnet2 = subnet-0d400568d6ac4634c
ElasticIP1 = eipalloc-09acb3fb3bb3b9117
ElasticIP2 = eipalloc-0b627e9fb60ce294d
NatGateway1 = nat-0b580e3e51290add1
NatGateway2 = nat-09f7d2b26ee06d67c
PublicTable = rtb-0661cd4c53e84a3dc
ProtectedTable1 = rtb-0297258bd60a14ad0
ProtectedTable2 = rtb-05511d770175210b5
PrivateTable = rtb-07c31c2a6b74073de
          Create Route
          Associate-Routetable-Subnet
ALBSG = sg-0bcbb697803d299b4
WEBSG = sg-090e679f2c321aa04
BastionSG = sg-0399dc90a82c43a63
DBSG = sg-0eb829baf265963f0
EFSSG = sg-0f45f76e0c8857c8d
          Allowtraffic
ALB_arn = arn:aws:elasticloadbalancing:us-east-2:986846499074:loadbalancer/app/WebELB/19e958e908f71604
ALB_dns = WebELB-2107117061.us-east-2.elb.amazonaws.com
TG_arn = arn:aws:elasticloadbalancing:us-east-2:986846499074:targetgroup/WebTG/5a357cd361b30404
EFS_Id = fs-988fc0e1
          Created MountTarget
          Created WebSubnetGroup
****success****

```
固定値の部分もありますがかなり簡単にネットワーキングが完了します