CloudWatch エージェント
× VPC エンドポイント
完全ガイド

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  # VPC Endpoint 用セキュリティグループ
  VPCEndpointSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for CW VPC Endpoints
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 10.0.0.0/16

  # CloudWatch Logs 用 VPC Endpoint
  LogsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.logs
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnetA
        - !Ref PrivateSubnetB
      SecurityGroupIds:
        - !Ref VPCEndpointSG
      PrivateDnsEnabled: true

  # CloudWatch Metrics 用 VPC Endpoint
  MonitoringEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.monitoring
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnetA
        - !Ref PrivateSubnetB
      SecurityGroupIds:
        - !Ref VPCEndpointSG
      PrivateDnsEnabled: true

# VPC Endpoint 用セキュリティグループ
resource "aws_security_group" "vpce_cw" {
  name        = "vpce-cw-sg"
  description = "SG for CW VPC Endpoints"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }
}

# CloudWatch Logs 用 VPC Endpoint
resource "aws_vpc_endpoint" "cw_logs" {
  vpc_id             = aws_vpc.main.id
  service_name       = "com.amazonaws.ap-northeast-1.logs"
  vpc_endpoint_type  = "Interface"
  subnet_ids         = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id
  ]
  security_group_ids  = [aws_security_group.vpce_cw.id]
  private_dns_enabled = true
}

# CloudWatch Metrics 用 VPC Endpoint
resource "aws_vpc_endpoint" "cw_monitoring" {
  vpc_id             = aws_vpc.main.id
  service_name       = "com.amazonaws.ap-northeast-1.monitoring"
  vpc_endpoint_type  = "Interface"
  subnet_ids         = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id
  ]
  security_group_ids  = [aws_security_group.vpce_cw.id]
  private_dns_enabled = true
}

dig logs.ap-northeast-1.amazonaws.com +short
# 期待結果: 10.0.1.55 など VPC 内のプライベート IP

dig monitoring.ap-northeast-1.amazonaws.com +short
# 期待結果: 10.0.2.88 など VPC 内のプライベート IP