⑦ELB (ALB)

---
AWSTemplateFormatVersion: "2010-09-09"
Description: Create Access Analyzer

Resources:
  ## Access Analyzer: Analyzer (External)
  ExternalAccessAnalyzer:
    Type: AWS::AccessAnalyzer::Analyzer
    Properties:
      AnalyzerName: ExternalAccessAnalyzer
      Type: ACCOUNT

Outputs:
  ## Access Analyzer: Analyzer (External)
  ExternalAccessAnalyzer:
    Value: !Ref ExternalAccessAnalyzer
    Export:
      Name: !Sub ${AWS::StackName}-ExternalAccessAnalyzer

---
### [Change System Name] awsmaster
## The following CFn stack must be created first in order to be referenced by the ImportValue function.
## 1. ${SystemName}-${Environment}-route53
## 2. ${SystemName}-${Environment}-certificatemanager
## 3. ${SystemName}-${Environment}-vpc
AWSTemplateFormatVersion: "2010-09-09"
Description: Create ELB

Parameters:
  SystemName:
    Description: System Name
    Type: String
    Default: awsmaster ### [Change System Name]
  Environment:
    Description: Environment
    Type: String
    Default: prod
    AllowedValues:
      - prod
      - stg
      - dev
  SubDomain:
    Description: Sub Domain
    Type: String
    Default: elb
    AllowedPattern: ^[^.]*$

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Environment Configuration"
        Parameters:
          - SystemName
          - Environment
          - SubDomain

Resources:
  ## S3: Bucket (Access Logs)
  S3BucketAccessLogs:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${SystemName}-${Environment}-alb-accesslogs-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true

  ## S3: Bucket (Connection Logs)
  S3BucketConnectionLogs:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${SystemName}-${Environment}-alb-connectionlogs-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true

  ## S3: Bucket Policy (Access Logs)
  S3BucketPolicyAccessLogs:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketAccessLogs
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: s3:PutObject
            Principal:
              ## The account ID for ELB log output is fixed: 582318560864
              ## Enable access logs for your Application Load Balancer - Elastic Load Balancing
              ## https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html
              AWS: arn:aws:iam::582318560864:root
            Resource: !Sub ${S3BucketAccessLogs.Arn}/AWSLogs/${AWS::AccountId}/*

  ## S3: Bucket Policy (Connection Logs)
  S3BucketPolicyConnectionLogs:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketConnectionLogs
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: s3:PutObject
            Principal:
              ## The account ID for ELB log output is fixed: 582318560864
              ## Enable connection logs for your Application Load Balancer - Elastic Load Balancing
              ## https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-connection-logging.html
              AWS: arn:aws:iam::582318560864:root
            Resource: !Sub ${S3BucketConnectionLogs.Arn}/AWSLogs/${AWS::AccountId}/*

  ## EC2(VPC): Security Group
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${SystemName}-${Environment}-alb-sg
      GroupDescription: !Sub ${SystemName}-${Environment}-alb-sg
      VpcId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-VPC
      Tags:
        - Key: Name
          Value: !Sub ${SystemName}-${Environment}-alb-sg

  ## EC2(VPC): Security Group Inbound Rule From Any (HTTP)
  EC2SecurityGroupIngressHttp:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EC2SecurityGroup
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      CidrIp: 0.0.0.0/0
      Description: any

  ## EC2(VPC): Security Group Inbound Rule From Any (HTTPS)
  EC2SecurityGroupIngressHttps:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EC2SecurityGroup
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      CidrIp: 0.0.0.0/0
      Description: any

  ## ELB: Load Balancer (ALB)
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    ## Because permission to output access and connection logs is required first when creating ALB.
    DependsOn:
      - S3BucketPolicyAccessLogs
      - S3BucketPolicyConnectionLogs
    Properties:
      Name: !Sub ${SystemName}-${Environment}-alb
      IpAddressType: ipv4
      Type: application
      Subnets:
        - Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-SubnetPublicA
        - Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-SubnetPublicC
        - Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-SubnetPublicD
      LoadBalancerAttributes:
        - Key: routing.http2.enabled
          Value: true
        - Key: deletion_protection.enabled
          Value: true
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: !Ref S3BucketAccessLogs
        - Key: connection_logs.s3.enabled
          Value: true
        - Key: connection_logs.s3.bucket
          Value: !Ref S3BucketConnectionLogs
      SecurityGroups:
        - !Ref EC2SecurityGroup
      Tags:
        - Key: Name
          Value: !Sub ${SystemName}-${Environment}-alb

  ## ELB: Listener (HTTP)
  ListenerHttp:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS
            Port: "443"
            Host: "#{host}"
            Path: "/#{path}"
            Query: "#{query}"
            StatusCode: HTTP_301

  ## ELB: Listener (HTTPS)
  ListenerHttps:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn:
            Fn::ImportValue: !Sub ${SystemName}-${Environment}-certificatemanager-Certificate
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-Res-2021-06
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "403"
            ContentType: text/html
            MessageBody: |
              <html>
              <head><title>403 Forbidden</title></head>
              <body>
              <center><h1>403 Forbidden</h1></center>
              </body>
              </html>

  ## ELB: Listener Rule (302 Found)
  ListenerRuleRedirect:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref ListenerHttps
      Priority: 11
      Conditions:
        - Field: host-header
          HostHeaderConfig:
            Values:
              - !Sub
                - "${SubDomain}.${DomainName}"
                - DomainName:
                    Fn::ImportValue: !Sub ${SystemName}-${Environment}-route53-HostedZoneDomainName
        - Field: path-pattern
          PathPatternConfig:
            Values:
              - /
      Actions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS
            Port: "443"
            Host: "#{host}"
            Path: /users
            Query: "#{query}"
            StatusCode: HTTP_302

  ## ELB: Listener Rule (404 Not Found)
  ListenerRuleNotFound:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref ListenerHttps
      Priority: 100
      Conditions:
        - Field: host-header
          HostHeaderConfig:
            Values:
              - !Sub
                - "${SubDomain}.${DomainName}"
                - DomainName:
                    Fn::ImportValue: !Sub ${SystemName}-${Environment}-route53-HostedZoneDomainName
      Actions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "404"
            ContentType: text/html
            MessageBody: |
              <html>
              <head><title>404 Not Found</title></head>
              <body>
              <center><h1>404 Not Found</h1></center>
              </body>
              </html>

  ## Route 53: Record Set (IPv4)
  Route53RecordSetIPv4:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-route53-HostedZone
      Name: !Sub
          - "${SubDomain}.${DomainName}."
          - DomainName:
              Fn::ImportValue: !Sub ${SystemName}-${Environment}-route53-HostedZoneDomainName
      Type: A
      AliasTarget:
        HostedZoneId: !GetAtt LoadBalancer.CanonicalHostedZoneID
        DNSName: !Sub dualstack.${LoadBalancer.DNSName}

Outputs:
  ## S3: Bucket (Access Logs)
  S3BucketAccessLogs:
    Value: !Ref S3BucketAccessLogs
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketAccessLogs

  S3BucketAccessLogsArn:
    Value: !GetAtt S3BucketAccessLogs.Arn
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketAccessLogsArn

  S3BucketAccessLogsDomainName:
    Value: !GetAtt S3BucketAccessLogs.DomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketAccessLogsDomainName

  S3BucketAccessLogsDualStackDomainName:
    Value: !GetAtt S3BucketAccessLogs.DualStackDomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketAccessLogsDualStackDomainName

  S3BucketAccessLogsRegionalDomainName:
    Value: !GetAtt S3BucketAccessLogs.RegionalDomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketAccessLogsRegionalDomainName

  ## S3: Bucket (Connection Logs)
  S3BucketConnectionLogs:
    Value: !Ref S3BucketConnectionLogs
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketConnectionLogs

  S3BucketConnectionLogsArn:
    Value: !GetAtt S3BucketConnectionLogs.Arn
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketConnectionLogsArn

  S3BucketConnectionLogsDomainName:
    Value: !GetAtt S3BucketConnectionLogs.DomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketConnectionLogsDomainName

  S3BucketConnectionLogsDualStackDomainName:
    Value: !GetAtt S3BucketConnectionLogs.DualStackDomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketConnectionLogsDualStackDomainName

  S3BucketConnectionLogsRegionalDomainName:
    Value: !GetAtt S3BucketConnectionLogs.RegionalDomainName
    Export:
      Name: !Sub ${AWS::StackName}-S3BucketConnectionLogsRegionalDomainName

  ## EC2(VPC): Security Group
  EC2SecurityGroup:
    Value: !Ref EC2SecurityGroup
    Export:
      Name: !Sub ${AWS::StackName}-EC2SecurityGroup

  EC2SecurityGroupVpcId:
    Value: !GetAtt EC2SecurityGroup.VpcId
    Export:
      Name: !Sub ${AWS::StackName}-EC2SecurityGroupVpcId

  ## ELB: LoadBalancer (ALB)
  LoadBalancer:
    Value: !Ref LoadBalancer
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancer

  LoadBalancerCanonicalHostedZoneID:
    Value: !GetAtt LoadBalancer.CanonicalHostedZoneID
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerCanonicalHostedZoneID

  LoadBalancerDNSName:
    Value: !GetAtt LoadBalancer.DNSName
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerDNSName

  LoadBalancerFullName:
    Value: !GetAtt LoadBalancer.LoadBalancerFullName
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerFullName

  LoadBalancerName:
    Value: !GetAtt LoadBalancer.LoadBalancerName
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerName

  LoadBalancerSecurityGroup1:
    Value: !Select [ 0, !GetAtt LoadBalancer.SecurityGroups ]
    Export:
      Name: !Sub ${AWS::StackName}-LoadBalancerSecurityGroup1

  ## ELB: Listener (HTTP)
  ListenerHttp:
    Value: !Ref ListenerHttp
    Export:
      Name: !Sub ${AWS::StackName}-ListenerHttp

  ## ELB: Listener (HTTPS)
  ListenerHttps:
    Value: !Ref ListenerHttps
    Export:
      Name: !Sub ${AWS::StackName}-ListenerHttps

  ## ELB: Listener Rule (301 Redirect)
  ListenerRuleRedirect:
    Value: !Ref ListenerRuleRedirect
    Export:
      Name: !Sub ${AWS::StackName}-ListenerRuleRedirect

  ## ELB: Listener Rule (404 Not Found)
  ListenerRuleNotFound:
    Value: !Ref ListenerRuleNotFound
    Export:
      Name: !Sub ${AWS::StackName}-ListenerRuleNotFound

  ## Route 53: Record Set (IPv4)
  Route53RecordSetIPv4:
    Value: !Ref Route53RecordSetIPv4
    Export:
      Name: !Sub ${AWS::StackName}-Route53RecordSetIPv4

---
### [Change System Name] awsmaster
## The following CFn stack must be created first in order to be referenced by the ImportValue function.
## 1. ${SystemName}-${Environment}-route53
## 2. ${SystemName}-${Environment}-vpc
## 3. ${SystemName}-${Environment}-rds
## 4. ${SystemName}-${Environment}-elb
AWSTemplateFormatVersion: "2010-09-09"
Description: Create EC2 Instance etc.

Parameters:
  SystemName:
    Description: System Name
    Type: String
    Default: awsmaster ### [Change System Name]
  Environment:
    Description: Environment
    Type: String
    Default: prod
    AllowedValues:
      - prod
      - stg
      - dev
  SubDomain:
    Description: Sub Domain
    Type: String
    Default: elb
    AllowedPattern: ^[^.]*$
  ResourceName:
    Description: Resource Name
    Type: String
    Default: viaelb
  EC2ImageId:
    Description: >
      Amazon Linux 2023 on Amazon EC2 - Amazon Linux 2023
      https://docs.aws.amazon.com/ja_jp/linux/al2023/ug/ec2.html#launch-via-aws-cli
      https://ap-northeast-1.console.aws.amazon.com/systems-manager/parameters/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64/description
      e.g. al2023-ami-2023.3.20240122.0-kernel-6.1-x86_64
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  ELBListenerRulePriority:
    Description: ELB Listner Rule Priority
    Type: Number
    Default: 21
    MinValue: 1
    MaxValue: 50000
  UseSubnetProtected:
    Description: Use Protected Subnet
    Type: String
    Default: true
    AllowedValues:
      - true
      - false

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Environment Configuration"
        Parameters:
          - SystemName
          - Environment
          - SubDomain
          - ResourceName
          - EC2ImageId
          - ELBListenerRulePriority
          - UseSubnetProtected

Conditions:
  ShouldUseSubnetProtected: !Equals [ !Ref UseSubnetProtected, true ]

Resources:
  ## IAM: Role
  IAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${SystemName}-${Environment}-${ResourceName}-ec2-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        ## To push images to ECR
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser
        ## To use the Session Manager
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        ## To get secret value from Secrets Manager
        - !ImportValue iam-role-SecretsManagerGetSecretValuePolicy

  ## IAM: Instance Profile
  IAMInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Ref IAMRole
      Roles:
        - !Ref IAMRole

  ## EC2(VPC): Security Group
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${SystemName}-${Environment}-${ResourceName}-ec2-sg
      GroupDescription: !Sub ${SystemName}-${Environment}-${ResourceName}-ec2-sg
      VpcId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-VPC
      Tags:
        - Key: Name
          Value: !Sub ${SystemName}-${Environment}-${ResourceName}-ec2-sg

  ## EC2(VPC): Security Group Inbound Rule From ELB (HTTP)
  EC2SecurityGroupIngressHttpFromLoadBalancer:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EC2SecurityGroup
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      SourceSecurityGroupId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-elb-EC2SecurityGroup
      Description: !Sub ${SystemName}-${Environment}-alb-sg

  ## EC2(VPC): Security Group Inbound Rule To RDS (MySQL)
  EC2SecurityGroupIngressMySQLToRDS:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-rds-EC2SecurityGroup
      IpProtocol: tcp
      FromPort:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-rds-DBClusterEndpointPort
      ToPort:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-rds-DBClusterEndpointPort
      SourceSecurityGroupId: !Ref EC2SecurityGroup
      Description: !Sub ${SystemName}-${Environment}-${ResourceName}-ec2-sg

  ## EC2: Instance
  Instance:
    Type: AWS::EC2::Instance
    ## To retain the instance to be replaced when updating the instance
    UpdateReplacePolicy: Retain
    Properties:
      ImageId: !Ref EC2ImageId
      InstanceType: t2.micro
      IamInstanceProfile: !Ref IAMInstanceProfile
      NetworkInterfaces:
        - DeviceIndex: "0"
          Description: Primary network interface
          AssociatePublicIpAddress: !If [ ShouldUseSubnetProtected, false, true ]
          GroupSet:
            - !Ref EC2SecurityGroup
          SubnetId:
            Fn::If:
              - ShouldUseSubnetProtected
              - Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-SubnetProtectedC
              - Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-SubnetPublicC
      Monitoring: false
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          dnf -y update
          aws configure set default.region ${AWS::Region}
          ## Install Docker Engine
          dnf install -y docker
          systemctl enable --now docker
          ## Install Docker Compose
          CLI_DIR=/usr/local/lib/docker/cli-plugins
          LATEST_RELEASE=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep browser_download_url | grep -i $(uname -s)-$(uname -m) | grep -v sha256 | cut -d : -f 2,3 | tr -d \")
          mkdir -p ${!CLI_DIR}
          curl -sL ${!LATEST_RELEASE} -o ${!CLI_DIR}/docker-compose
          chmod +x ${!CLI_DIR}/docker-compose
          ln -s ${!CLI_DIR}/docker-compose /usr/bin/docker-compose
          ## Run Docker Container
          docker container run --name nginx --restart=always -d -p 80:80 nginx
      ## Required in Amazon Linux 2, but no longer required in Amazon Linux 2023
      # BlockDeviceMappings:
      #   - DeviceName: /dev/xvda
      #     Ebs:
      #       VolumeSize: 8
      #       VolumeType: gp3
      #       # Encrypted: true
      Tags:
        - Key: Name
          Value: !Sub ${SystemName}-${Environment}-${ResourceName}
      PropagateTagsToVolumeOnCreation: true

  ## ELB: Target Group
  ELBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${SystemName}-${Environment}-${ResourceName}-tg
      TargetType: instance
      Protocol: HTTP
      Port: 80
      VpcId:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-vpc-VPC
      HealthCheckEnabled: true
      HealthCheckProtocol: HTTP
      HealthCheckPath: /
      HealthCheckPort: traffic-port
      HealthyThresholdCount: 5
      UnhealthyThresholdCount: 2
      HealthCheckTimeoutSeconds: 5
      HealthCheckIntervalSeconds: 30
      Matcher:
        HttpCode: "200,301"
      # TargetGroupAttributes:
      #   - Key: stickiness.enabled
      #     Value: true
      #   - Key: stickiness.lb_cookie.duration_seconds
      #     Value: 3600
      Targets:
        - Id: !Ref Instance
      Tags:
        - Key: Name
          Value: !Sub ${SystemName}-${Environment}-${ResourceName}-tg

  ## ELB: Listener Rule
  ELBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn:
        Fn::ImportValue: !Sub ${SystemName}-${Environment}-elb-ListenerHttps
      Priority: !Ref ELBListenerRulePriority
      Conditions:
        - Field: host-header
          HostHeaderConfig:
            Values:
              - !Sub
                - "${SubDomain}.${DomainName}"
                - DomainName:
                    Fn::ImportValue: !Sub ${SystemName}-${Environment}-route53-HostedZoneDomainName
        - Field: path-pattern
          PathPatternConfig:
            Values:
              - /*
      Actions:
        - Type: forward
          ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref ELBTargetGroup

Outputs:
  ## IAM: Role
  IAMRole:
    Value: !Ref IAMRole
    Export:
      Name: !Sub ${AWS::StackName}-IAMRole

  IAMRoleArn:
    Value: !GetAtt IAMRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-IAMRoleArn

  ## IAM: Instance Profile
  IAMInstanceProfile:
    Value: !Ref IAMInstanceProfile
    Export:
      Name: !Sub ${AWS::StackName}-IAMInstanceProfile

  IAMInstanceProfileArn:
    Value: !GetAtt IAMInstanceProfile.Arn
    Export:
      Name: !Sub ${AWS::StackName}-IAMInstanceProfileArn

  ## EC2(VPC): Security Group
  EC2SecurityGroup:
    Value: !Ref EC2SecurityGroup
    Export:
      Name: !Sub ${AWS::StackName}-EC2SecurityGroup

  EC2SecurityGroupVpcId:
    Value: !GetAtt EC2SecurityGroup.VpcId
    Export:
      Name: !Sub ${AWS::StackName}-EC2SecurityGroupVpcId

  ## EC2: Instance
  Instance:
    Value: !Ref Instance
    Export:
      Name: !Sub ${AWS::StackName}-Instance

  InstanceAvailabilityZone:
    Value: !GetAtt Instance.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}-InstanceAvailabilityZone

  InstancePrivateDnsName:
    Value: !GetAtt Instance.PrivateDnsName
    Export:
      Name: !Sub ${AWS::StackName}-InstancePrivateDnsName

  InstancePrivateIp:
    Value: !GetAtt Instance.PrivateIp
    Export:
      Name: !Sub ${AWS::StackName}-InstancePrivateIp

  ## ELB: Target Group
  ELBTargetGroup:
    Value: !Ref ELBTargetGroup
    Export:
      Name: !Sub ${AWS::StackName}-ELBTargetGroup

  ELBTargetGroupLoadBalancerArns1:
    Value: !Select [ 0, !GetAtt ELBTargetGroup.LoadBalancerArns ]
    Export:
      Name: !Sub ${AWS::StackName}-ELBTargetGroupLoadBalancerArns1

  ELBTargetGroupFullName:
    Value: !GetAtt ELBTargetGroup.TargetGroupFullName
    Export:
      Name: !Sub ${AWS::StackName}-ELBTargetGroupFullName

  ELBTargetGroupName:
    Value: !GetAtt ELBTargetGroup.TargetGroupName
    Export:
      Name: !Sub ${AWS::StackName}-ELBTargetGroupName

  ## ELB: Listener Rule
  ELBListenerRule:
    Value: !Ref ELBListenerRule
    Export:
      Name: !Sub ${AWS::StackName}-ELBListenerRule

-- テーブルの作成 (CREATE TABLE)
CREATE EXTERNAL TABLE IF NOT EXISTS alb_logs (

-- (中略)

   -- 読み込むS3バケットのパス (LOCATION)
   LOCATION 's3://your-alb-logs-directory/AWSLogs/<ACCOUNT-ID>/elasticloadbalancing/<REGION>/'

CREATE DATABASE alb_logs;

-- alb_logs → alb_logs.awsmaster_prod_alb_202201
CREATE EXTERNAL TABLE IF NOT EXISTS alb_logs.awsmaster_prod_alb_202201 (

-- (中略)

   -- 2022/01/ を末尾に追加
   LOCATION 's3://your-alb-logs-directory/AWSLogs/<ACCOUNT-ID>/elasticloadbalancing/<REGION>/2022/01/'