IaCによるクラウドコスト最適化の「裏技」：Terraform/CDKで実現する、リソースの自動停止・削除と費用削減

# main.tf (抜粋)
# 1. EC2インスタンスを停止・起動するLambda関数
resource "aws_lambda_function" "ec2_scheduler_lambda" {
  function_name = "ec2-scheduler-lambda"
  handler       = "main.lambda_handler"
  runtime       = "python3.9"
  timeout       = 30
  memory_size   = 128
  role          = aws_iam_role.lambda_exec_role.arn
  filename      = data.archive_file.lambda_zip.output_path
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  tags = {
    Environment = "development"
  }
}
# 2. Lambda関数の実行ロール
resource "aws_iam_role" "lambda_exec_role" {
  name = "ec2-scheduler-lambda-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}
# 3. Lambda関数にEC2操作権限を付与するポリシー
resource "aws_iam_role_policy" "lambda_ec2_policy" {
  name = "ec2-scheduler-lambda-policy"
  role = aws_iam_role.lambda_exec_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:DescribeInstances",
          "ec2:StartInstances",
          "ec2:StopInstances"
        ]
        Effect = "Allow"
        Resource = "*"
      },
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Effect = "Allow"
        Resource = "arn:aws:logs:*:*:*"
      }
    ]
  })
}
# 4. Lambda関数のPythonコード (main.py)
# EC2インスタンスのタグ (e.g., "AutoStop": "true") を見て停止・起動するロジックを記述
# (ここではコードの詳細は省略)
# 5. EventBridgeルールでLambdaを定期実行 (停止用)
resource "aws_cloudwatch_event_rule" "stop_ec2_rule" {
  name                = "stop-ec2-daily"
  schedule_expression = "cron(0 22 * * ? *)" # 毎日UTC 22:00 (JST 7:00) に停止
}
resource "aws_cloudwatch_event_target" "stop_ec2_target" {
  rule      = aws_cloudwatch_event_rule.stop_ec2_rule.name
  target_id = "StopEC2Lambda"
  arn       = aws_lambda_function.ec2_scheduler_lambda.arn
  input     = jsonencode({"action": "stop"})
}
# 6. EventBridgeルールでLambdaを定期実行 (起動用)
resource "aws_cloudwatch_event_rule" "start_ec2_rule" {
  name                = "start-ec2-daily"
  schedule_expression = "cron(0 9 * * ? *)" # 毎日UTC 9:00 (JST 18:00) に起動
}
resource "aws_cloudwatch_event_target" "start_ec2_target" {
  rule      = aws_cloudwatch_event_rule.start_ec2_rule.name
  target_id = "StartEC2Lambda"
  arn       = aws_lambda_function.ec2_scheduler_lambda.arn
  input     = jsonencode({"action": "start"})
}

// lib/resource-cleanup-stack.ts (抜粋)
import * as cdk from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as events from 'aws-cdk-lib/aws-events';
import * as targets from 'aws-cdk-lib/aws-events-targets';
import * as iam from 'aws-cdk-lib/aws-iam';
export class ResourceCleanupStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    // 1. リソースをクリーンアップするLambda関数
    const cleanupLambda = new lambda.Function(this, 'CleanupLambda', {
      runtime: lambda.Runtime.PYTHON_3_9,
      handler: 'main.handler',
      code: lambda.Code.fromAsset('lambda'), // lambda/main.py を参照
      timeout: cdk.Duration.minutes(5),
      memorySize: 128,
      environment: {
        TAG_KEY: 'Cleanup', // クリーンアップ対象を識別するタグキー
        TAG_VALUE: 'true', // クリーンアップ対象を識別するタグ値
      },
    });
    // 2. Lambda関数にリソース操作権限を付与
    cleanupLambda.addToRolePolicy(new iam.PolicyStatement({
      actions: [
        'ec2:DescribeVolumes',
        'ec2:DeleteVolume',
        's3:ListAllMyBuckets',
        's3:DeleteBucket',
        's3:DeleteObject',
        's3:ListBucket',
      ],
      resources: ['*'],
    }));
    // 3. EventBridgeルールでLambdaを定期実行
    new events.Rule(this, 'DailyCleanupRule', {
      schedule: events.Schedule.cron({ minute: '0', hour: '1', day: '*' }), // 毎日UTC 1:00に実行
      targets: [new targets.LambdaFunction(cleanupLambda)],
    });
  }
}

# lambda/main.py (抜粋)
import os
import boto3
def handler(event, context):
ec2 = boto3.client('ec2')
s3 = boto3.client('s3')
tag_key = os.environ.get('TAG_KEY')
tag_value = os.environ.get('TAG_VALUE')
# 未使用のEBSボリュームを削除するロジック
# (ここでは詳細省略。タグやアタッチ状態をチェック)
# 特定のタグが付与されたS3バケットを削除するロジック
# (ここでは詳細省略。タグをチェックし、バケット内のオブジェクトも削除)
print("Cleanup process completed.")