Claude Code on Amazon Bedrockのお試し環境をCloudFormationテンプレートで構築した

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Claude Code on AWS - Linux EC2 + Bedrock + Token Monitoring.
  Single stack. SSM tunnel SSH for VSCode Remote SSH. Cost-aware.

# ============================================================
# Parameter Groups (for AWS Console display)
# ============================================================
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Project Settings
        Parameters:
          - ProjectName
          - CostTag
      - Label:
          default: EC2 Configuration
        Parameters:
          - InstanceType
          - VolumeSize
      - Label:
          default: Network Configuration
        Parameters:
          - VpcCidr
          - SubnetCidr
      - Label:
          default: Bedrock Model Configuration
        Parameters:
          - SonnetInferenceProfileId
          - OpusInferenceProfileId
      - Label:
          default: Token Monitoring
        Parameters:
          - AlertEmail
          - TokenThreshold

# ============================================================
# Parameters
# ============================================================
Parameters:
  ProjectName:
    Type: String
    Default: claude-code
    Description: "Prefix for all resource names (e.g. claude-code -> claude-code-vpc)"
    AllowedPattern: "^[a-zA-Z][a-zA-Z0-9-]*$"
    ConstraintDescription: "Must start with a letter, then alphanumeric and hyphens only"

  CostTag:
    Type: String
    Default: claude-code
    Description: "Cost allocation tag applied to all resources"

  InstanceType:
    Type: String
    Default: t3.medium
    Description: "EC2 instance type (e.g. t3.small, t3.medium, t3.large)"

  VolumeSize:
    Type: Number
    Default: 20
    MinValue: 8
    MaxValue: 100
    Description: "EBS disk size in GiB. Amazon Linux uses ~2GB. 20GB is sufficient"

  VpcCidr:
    Type: String
    Default: 10.0.0.0/16
    Description: "VPC CIDR block"
    AllowedPattern: "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$"

  SubnetCidr:
    Type: String
    Default: 10.0.1.0/24
    Description: "Public subnet CIDR block"
    AllowedPattern: "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$"

  SonnetInferenceProfileId:
    Type: String
    Default: jp.anthropic.claude-sonnet-4-6
    Description: "Bedrock Sonnet inference profile ID for ap-northeast-1"

  OpusInferenceProfileId:
    Type: String
    Default: global.anthropic.claude-opus-4-6-v1
    Description: "Bedrock Opus inference profile ID (global prefix, cross-region)"

  AlertEmail:
    Type: String
    Description: "Email address for token usage alerts"
    AllowedPattern: "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$"
    ConstraintDescription: "Must be a valid email address"

  TokenThreshold:
    Type: Number
    Default: 150000
    Description: "Token alert threshold (input+output+cache total per hour). Alert if exceeded"

Resources:
  # ============================================================
  # VPC / Network
  # ============================================================
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-vpc"
        - Key: Cost
          Value: !Ref CostTag

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-igw"
        - Key: Cost
          Value: !Ref CostTag

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref SubnetCidr
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-public-subnet"
        - Key: Cost
          Value: !Ref CostTag

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-public-rt"
        - Key: Cost
          Value: !Ref CostTag

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  # ============================================================
  # Security Group - HTTPS outbound only, no inbound (SSM access)
  # ============================================================
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub "${ProjectName} - HTTPS outbound only, SSM access"
      VpcId: !Ref VPC
      SecurityGroupIngress: []
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-sg"
        - Key: Cost
          Value: !Ref CostTag

  # ============================================================
  # EC2 Key Pair (for VSCode Remote SSH via SSM tunnel)
  # Private key is stored in Systems Manager Parameter Store
  # ============================================================
  EC2KeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: !Sub "${ProjectName}-keypair"
      KeyType: rsa
      KeyFormat: pem

  # ============================================================
  # Bedrock Application Inference Profiles
  # Enables per-model cost tracking via Cost Explorer tags
  # ============================================================
  SonnetProfile:
    Type: AWS::Bedrock::ApplicationInferenceProfile
    Properties:
      InferenceProfileName: !Sub "${ProjectName}-sonnet"
      Description: !Sub "Sonnet profile: ${SonnetInferenceProfileId}"
      ModelSource:
        CopyFrom: !Sub "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/${SonnetInferenceProfileId}"
      Tags:
        - Key: Application
          Value: !Ref ProjectName
        - Key: Cost
          Value: !Ref CostTag

  OpusProfile:
    Type: AWS::Bedrock::ApplicationInferenceProfile
    Properties:
      InferenceProfileName: !Sub "${ProjectName}-opus"
      Description: !Sub "Opus profile: ${OpusInferenceProfileId}"
      ModelSource:
        CopyFrom: !Sub "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/${OpusInferenceProfileId}"
      Tags:
        - Key: Application
          Value: !Ref ProjectName
        - Key: Cost
          Value: !Ref CostTag

  # ============================================================
  # IAM Role - SSM + Bedrock + AWS MCP (least privilege)
  # ============================================================
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${ProjectName}-ec2-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: BedrockAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: InvokeModels
                Effect: Allow
                Action:
                  - bedrock:InvokeModel
                  - bedrock:InvokeModelWithResponseStream
                Resource:
                  - !GetAtt SonnetProfile.InferenceProfileArn
                  - !GetAtt OpusProfile.InferenceProfileArn
                  - "arn:aws:bedrock:*:*:foundation-model/*"
                  - "arn:aws:bedrock:*:*:inference-profile/*"
              - Sid: ListModels
                Effect: Allow
                Action:
                  - bedrock:ListFoundationModels
                  - bedrock:ListInferenceProfiles
                  - bedrock:GetFoundationModel
                Resource: "*"
        - PolicyName: AWSMCPAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: AllowAWSMCP
                Effect: Allow
                Action:
                  - aws-mcp:InvokeMcp
                  - aws-mcp:CallReadOnlyTool
                  - aws-mcp:CallReadWriteTool
                Resource: "*"
        - PolicyName: MarketplaceAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: AllowMarketplace
                Effect: Allow
                Action:
                  - aws-marketplace:ViewSubscriptions
                  - aws-marketplace:Subscribe
                Resource: "*"
                Condition:
                  StringEquals:
                    aws:CalledViaLast: bedrock.amazonaws.com
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-ec2-role"
        - Key: Cost
          Value: !Ref CostTag

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub "${ProjectName}-instance-profile"
      Roles:
        - !Ref EC2Role

  # ============================================================
  # EC2 Instance - Amazon Linux 2023
  # Auto-installs: Git, Node.js, Python, Claude Code, uv, AWS MCP
  # ============================================================
  EC2Instance:
    Type: AWS::EC2::Instance
    DependsOn:
      - SonnetProfile
      - OpusProfile
    Properties:
      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
      InstanceType: !Ref InstanceType
      KeyName: !Ref EC2KeyPair
      IamInstanceProfile: !Ref InstanceProfile
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - !Ref SecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: !Ref VolumeSize
            VolumeType: gp3
            Encrypted: true
      PropagateTagsToVolumeOnCreation: true
      UserData:
        Fn::Base64: !Sub
          - |
            #!/bin/bash
            set -e
            exec > >(tee /var/log/user-data.log) 2>&1
            echo "=== Setup started: $(date) ==="

            # System update
            dnf update -y

            # Install Node.js 22, Git, Python3
            curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
            dnf install -y nodejs git python3 python3-pip

            # Setup as ec2-user
            sudo -u ec2-user bash << 'USEREOF'
            set -e
            export HOME=/home/ec2-user
            cd $HOME

            # Install Claude Code (native installer)
            curl -fsSL https://claude.ai/install.sh | bash -s stable
            export PATH="$HOME/.local/bin:$PATH"

            # Install uv (required for uvx / AWS MCP proxy)
            curl -LsSf https://astral.sh/uv/install.sh | sh

            # Bedrock environment variables
            cat << EOF >> ~/.bashrc
            # Claude Code on Bedrock
            export CLAUDE_CODE_USE_BEDROCK=1
            export AWS_REGION=${AWS::Region}
            export AWS_DEFAULT_REGION=${AWS::Region}
            export ANTHROPIC_DEFAULT_SONNET_MODEL="${SonnetArn}"
            export ANTHROPIC_DEFAULT_OPUS_MODEL="${OpusArn}"
            export CLAUDE_CODE_SUBAGENT_MODEL="${SonnetArn}"
            export CLAUDE_CODE_MAX_OUTPUT_TOKENS=16384
            export MAX_THINKING_TOKENS=10000
            export PATH="\$HOME/.local/bin:\$HOME/.cargo/bin:\$PATH"
            EOF

            # Claude Code user settings
            mkdir -p ~/.claude
            cat << 'SETTINGS' > ~/.claude/settings.json
            {
              "provider": "bedrock",
              "autoUpdates": true,
              "autoUpdatesChannel": "stable",
              "language": "japanese",
              "statusLine": {
                "type": "command",
                "command": "npx -y ccstatusline@latest",
                "padding": 0
              },
              "permissions": {
                "deny": [
                  "Bash(rm -rf:*)",
                  "Bash(sudo:*)",
                  "Read(.env)"
                ]
              }
            }
            SETTINGS

            # AWS MCP Server (managed, via mcp-proxy-for-aws)
            cat << 'MCP' > ~/.mcp.json
            {
              "mcpServers": {
                "aws-mcp": {
                  "command": "uvx",
                  "timeout": 100000,
                  "transport": "stdio",
                  "args": [
                    "mcp-proxy-for-aws@latest",
                    "https://aws-mcp.us-east-1.api.aws/mcp",
                    "--metadata",
                    "AWS_REGION=us-west-2"
                  ]
                }
              }
            }
            MCP

            # ccstatusline config (Model | Session Cost | Tokens Total)
            mkdir -p ~/.config/ccstatusline
            cat << 'CCSTATUS' > ~/.config/ccstatusline/config.json
            {
              "lines": [
                [
                  {"category": "model", "widget": "model"},
                  {"category": "separator", "widget": "separator"},
                  {"category": "cost", "widget": "session_cost"},
                  {"category": "separator", "widget": "separator"},
                  {"category": "tokens", "widget": "tokens_total"}
                ]
              ]
            }
            CCSTATUS

            # Verify installations
            source ~/.bashrc
            claude --version && echo "Claude Code OK" || echo "Claude Code FAILED"
            USEREOF

            echo "=== Setup completed: $(date) ==="
          - SonnetArn: !GetAtt SonnetProfile.InferenceProfileArn
            OpusArn: !GetAtt OpusProfile.InferenceProfileArn
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-ec2"
        - Key: Cost
          Value: !Ref CostTag

  # ============================================================
  # Bedrock Model Invocation Logging
  # Required for token monitoring via Metric Filters.
  # After deploy, enable logging in Bedrock console and
  # point to this log group and select the logging role.
  # ============================================================
  BedrockLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/bedrock/${ProjectName}"
      RetentionInDays: 30
      Tags:
        - Key: Cost
          Value: !Ref CostTag

  BedrockLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${ProjectName}-bedrock-logging-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:*"
      Policies:
        - PolicyName: BedrockLoggingCloudWatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/bedrock/${ProjectName}:*"
      Tags:
        - Key: Cost
          Value: !Ref CostTag

  # ============================================================
  # Token Monitoring - SNS Topic (KMS encrypted)
  # Alert emails may contain IAM ARN info, so encryption applied.
  # After deploy, confirm the subscription email!
  # ============================================================
  AlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "${ProjectName}-token-alert"
      Tags:
        - Key: Cost
          Value: !Ref CostTag

  AlertSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: !Ref AlertTopic
      Protocol: email
      Endpoint: !Ref AlertEmail

  # ============================================================
  # Token Monitoring - CloudWatch Metric Filters
  # Extracts token counts from Bedrock invocation logs and
  # publishes as custom CloudWatch metrics. No Lambda needed.
  # Includes cache tokens (cacheRead/cacheWrite) for accurate totals.
  # ============================================================
  InputTokenMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref BedrockLogGroup
      FilterPattern: '{ $.input.inputTokenCount = "*" }'
      MetricTransformations:
        - MetricNamespace: !Sub "${ProjectName}/BedrockTokens"
          MetricName: InputTokenCount
          MetricValue: "$.input.inputTokenCount"
          DefaultValue: 0

  CacheReadTokenMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref BedrockLogGroup
      FilterPattern: '{ $.input.cacheReadInputTokenCount = "*" }'
      MetricTransformations:
        - MetricNamespace: !Sub "${ProjectName}/BedrockTokens"
          MetricName: CacheReadInputTokenCount
          MetricValue: "$.input.cacheReadInputTokenCount"
          DefaultValue: 0

  CacheWriteTokenMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref BedrockLogGroup
      FilterPattern: '{ $.input.cacheWriteInputTokenCount = "*" }'
      MetricTransformations:
        - MetricNamespace: !Sub "${ProjectName}/BedrockTokens"
          MetricName: CacheWriteInputTokenCount
          MetricValue: "$.input.cacheWriteInputTokenCount"
          DefaultValue: 0

  OutputTokenMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref BedrockLogGroup
      FilterPattern: '{ $.output.outputTokenCount = "*" }'
      MetricTransformations:
        - MetricNamespace: !Sub "${ProjectName}/BedrockTokens"
          MetricName: OutputTokenCount
          MetricValue: "$.output.outputTokenCount"
          DefaultValue: 0

  # ============================================================
  # Token Monitoring - CloudWatch Alarms
  # Fires when total tokens (input + output) exceed threshold
  # within the monitoring window. Uses Metric Math to sum both.
  # ============================================================
  TokenUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub "${ProjectName}-token-threshold-alarm"
      AlarmDescription: !Sub "Bedrock token usage exceeded ${TokenThreshold} in monitoring window"
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      Threshold: !Ref TokenThreshold
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlertTopic
      Metrics:
        - Id: input_tokens
          ReturnData: false
          MetricStat:
            Metric:
              Namespace: !Sub "${ProjectName}/BedrockTokens"
              MetricName: InputTokenCount
            Period: 3600
            Stat: Sum
        - Id: cache_read_tokens
          ReturnData: false
          MetricStat:
            Metric:
              Namespace: !Sub "${ProjectName}/BedrockTokens"
              MetricName: CacheReadInputTokenCount
            Period: 3600
            Stat: Sum
        - Id: cache_write_tokens
          ReturnData: false
          MetricStat:
            Metric:
              Namespace: !Sub "${ProjectName}/BedrockTokens"
              MetricName: CacheWriteInputTokenCount
            Period: 3600
            Stat: Sum
        - Id: output_tokens
          ReturnData: false
          MetricStat:
            Metric:
              Namespace: !Sub "${ProjectName}/BedrockTokens"
              MetricName: OutputTokenCount
            Period: 3600
            Stat: Sum
        - Id: total_tokens
          Expression: "input_tokens + cache_read_tokens + cache_write_tokens + output_tokens"
          Label: "Total Tokens (1 hour)"
          ReturnData: true

# ============================================================
# Outputs
# ============================================================
Outputs:
  InstanceId:
    Description: "EC2 Instance ID"
    Value: !Ref EC2Instance

  SSMConnectCommand:
    Description: "Connect via SSM Session Manager (terminal only)"
    Value: !Sub "aws ssm start-session --target ${EC2Instance}"

  SSMPortForwardCommand:
    Description: "SSM tunnel for VSCode Remote SSH (port 22 -> localhost:10022)"
    Value: !Sub "aws ssm start-session --target ${EC2Instance} --document-name AWS-StartPortForwardingSession --parameters portNumber=22,localPortNumber=10022"

  KeyPairName:
    Description: "EC2 Key Pair name (retrieve private key from Systems Manager Parameter Store)"
    Value: !Ref EC2KeyPair

  ConsoleURL:
    Description: "EC2 Console direct link"
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2/home?region=${AWS::Region}#InstanceDetails:instanceId=${EC2Instance}"

  SonnetProfileArn:
    Description: "Bedrock Sonnet Application Inference Profile ARN"
    Value: !GetAtt SonnetProfile.InferenceProfileArn

  OpusProfileArn:
    Description: "Bedrock Opus Application Inference Profile ARN"
    Value: !GetAtt OpusProfile.InferenceProfileArn

  BedrockLogGroupName:
    Description: "Enable Bedrock Model Invocation Logging to this log group"
    Value: !Ref BedrockLogGroup

  BedrockLoggingRoleName:
    Description: "Select this role in Bedrock console when enabling invocation logging"
    Value: !Ref BedrockLoggingRole

  AlertTopicArn:
    Description: "SNS Topic for alerts (confirm email subscription after deploy!)"
    Value: !Ref AlertTopic

  StopCommand:
    Description: "Stop instance (saves cost)"
    Value: !Sub "aws ec2 stop-instances --instance-ids ${EC2Instance}"

  StartCommand:
    Description: "Start instance"
    Value: !Sub "aws ec2 start-instances --instance-ids ${EC2Instance}"

  CleanupCommand:
    Description: "Delete all resources"
    Value: !Sub "aws cloudformation delete-stack --stack-name ${AWS::StackName}"