{"id":26842536,"url":"https://github.com/casl0/closed-network-on-aws","last_synced_at":"2026-05-06T08:32:42.108Z","repository":{"id":283827391,"uuid":"881934791","full_name":"CASL0/closed-network-on-aws","owner":"CASL0","description":"閉域網からアクセス可能な AWS 上の Web アプリケーションを構築します","archived":false,"fork":false,"pushed_at":"2025-03-22T12:22:46.000Z","size":94,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-25T04:46:17.310Z","etag":null,"topics":["aws","closed-network","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CASL0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-01T14:25:29.000Z","updated_at":"2025-03-22T12:22:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"1d291ff0-b47c-49e8-8156-f7349e7b71ee","html_url":"https://github.com/CASL0/closed-network-on-aws","commit_stats":null,"previous_names":["casl0/closed-network-on-aws"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/CASL0/closed-network-on-aws","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CASL0%2Fclosed-network-on-aws","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CASL0%2Fclosed-network-on-aws/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CASL0%2Fclosed-network-on-aws/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CASL0%2Fclosed-network-on-aws/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CASL0","download_url":"https://codeload.github.com/CASL0/closed-network-on-aws/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CASL0%2Fclosed-network-on-aws/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32684645,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-06T02:33:58.958Z","status":"ssl_error","status_checked_at":"2026-05-06T02:33:39.611Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","closed-network","terraform"],"created_at":"2025-03-30T18:30:04.067Z","updated_at":"2026-05-06T08:32:42.081Z","avatar_url":"https://github.com/CASL0.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# closed-network-on-aws\n\n閉域網からアクセス可能な AWS 上の Web アプリケーションを構築します。\n\n## 構成\n\n![infra](https://raw.githubusercontent.com/CASL0/closed-network-on-aws/refs/heads/images/infra.svg)\n\n## Prerequisites\n\n### Terraform\n\n以下を参考に Terraform をインストールしてください。\n\n- https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli\n\n### AWS CLI\n\n以下を参考に AWS CLI をインストールしてください。\n\n- https://docs.aws.amazon.com/ja_jp/cli/latest/userguide/getting-started-install.html\n\n### OpenVPN easy-rsa\n\n以下を参考に easy-rsa のインストール、サーバーとクライアントの証明書・秘密鍵の生成をしてください。\n\n- https://catalog.us-east-1.prod.workshops.aws/workshops/be2b90c2-06a1-4ae6-84b3-c705049d2b6f/ja-JP/03-hands-on/03-01-common/04-certificate\n\n## Usage\n\n1. 上記で生成したサーバーとクライアントの証明書・秘密鍵を以下のパスに配置してください。\n   - `files/ca.crt`：ルート証明書\n   - `files/vpn/server.crt`：VPN サーバー証明書\n   - `files/vpn/server.key`：VPN サーバー秘密鍵\n   - `files/vpn/client.crt`：VPN クライアント証明書\n   - `files/vpn/client.key`：VPN クライアント秘密鍵\n   - `files/ssl/server.crt`：SSL サーバー証明書\n   - `files/ssl/server.key`：SSL サーバー秘密鍵\n1. 以下のコマンドを実行してください。\n\n```bash\nterraform init\nterraform apply\n```\n\n## 構築した環境に接続\n\n### AWS Client VPN のインストール\n\n以下のサイトから VPN クライアントソフトをインストールしてください。\n\n- https://aws.amazon.com/jp/vpn/client-vpn-download/\n\n### VPN プロファイルの設定\n\n1.  AWS マネジメントコンソールにてクライアント VPN エンドポイントの設定にアクセスします。\n1.  [クライアント設定ファイルをダウンロード]をクリックし、`downloaded-client-config.ovpn`をダウンロードします。\n1.  `downloaded-client-config.ovpn`を編集し、クライアント証明書の情報を末尾に追加してください。\n\n    ```\n    \u003ccert\u003e\n    -----BEGIN CERTIFICATE-----\n    ~ クライアント証明書 ~\n    -----END CERTIFICATE-----\n    \u003c/cert\u003e\n\n    \u003ckey\u003e\n    -----BEGIN PRIVATE KEY-----\n    ~ クライアント秘密鍵 ~\n    -----END PRIVATE KEY-----\n    \u003c/key\u003e\n    ```\n\n1.  上記で編集して`downloaded-client-config.ovpn`を VPN クライアントで読み込みプロファイルを追加してください。\n1.  DNS を Route53 にフォワードするために、接続する PC の DNS 設定を[インバウンドエンドポイント](https://ap-northeast-1.console.aws.amazon.com/route53resolver/home?region=ap-northeast-1#/inbound-endpoints)の IP アドレスに修正してください。\n\n\u003c!-- prettier-ignore-start --\u003e\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.00 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 5.92.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_alb\"\u003e\u003c/a\u003e [alb](#module\\_alb) | terraform-aws-modules/alb/aws | ~\u003e 9.0 |\n| \u003ca name=\"module_ecr\"\u003e\u003c/a\u003e [ecr](#module\\_ecr) | terraform-aws-modules/ecr/aws | ~\u003e 2.0 |\n| \u003ca name=\"module_ecs\"\u003e\u003c/a\u003e [ecs](#module\\_ecs) | terraform-aws-modules/ecs/aws | ~\u003e 5.0 |\n| \u003ca name=\"module_endpoints\"\u003e\u003c/a\u003e [endpoints](#module\\_endpoints) | terraform-aws-modules/vpc/aws//modules/vpc-endpoints | ~\u003e 5.0 |\n| \u003ca name=\"module_inbound_resolver_endpoints\"\u003e\u003c/a\u003e [inbound\\_resolver\\_endpoints](#module\\_inbound\\_resolver\\_endpoints) | terraform-aws-modules/route53/aws//modules/resolver-endpoints | ~\u003e 5.0 |\n| \u003ca name=\"module_s3\"\u003e\u003c/a\u003e [s3](#module\\_s3) | terraform-aws-modules/s3-bucket/aws | ~\u003e 4.0 |\n| \u003ca name=\"module_security_group\"\u003e\u003c/a\u003e [security\\_group](#module\\_security\\_group) | terraform-aws-modules/security-group/aws | ~\u003e 5.0 |\n| \u003ca name=\"module_security_group_inbound_resolver_endpoints\"\u003e\u003c/a\u003e [security\\_group\\_inbound\\_resolver\\_endpoints](#module\\_security\\_group\\_inbound\\_resolver\\_endpoints) | terraform-aws-modules/security-group/aws | ~\u003e 5.0 |\n| \u003ca name=\"module_security_group_vpc_endpoints\"\u003e\u003c/a\u003e [security\\_group\\_vpc\\_endpoints](#module\\_security\\_group\\_vpc\\_endpoints) | terraform-aws-modules/security-group/aws | ~\u003e 5.0 |\n| \u003ca name=\"module_vpc\"\u003e\u003c/a\u003e [vpc](#module\\_vpc) | terraform-aws-modules/vpc/aws | ~\u003e 5.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_acm_certificate.ssl_server](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |\n| [aws_acm_certificate.vpn_client](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |\n| [aws_acm_certificate.vpn_server](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | resource |\n| [aws_ec2_client_vpn_authorization_rule.allow_all_users](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_authorization_rule) | resource |\n| [aws_ec2_client_vpn_endpoint.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_endpoint) | resource |\n| [aws_ec2_client_vpn_network_association.vpn_to_subnet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_network_association) | resource |\n| [aws_route53_zone.private_hosted_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |\n| [aws_s3_bucket_policy.vpce_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |\n| [aws_service_discovery_http_namespace.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/service_discovery_http_namespace) | resource |\n| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.dkr_image_layer_pull_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.s3_vpce_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_additional_repository_read_write_access_arns\"\u003e\u003c/a\u003e [additional\\_repository\\_read\\_write\\_access\\_arns](#input\\_additional\\_repository\\_read\\_write\\_access\\_arns) | ECRリポジトリアクセス権を付与するIAM | `list(string)` | `[]` | no |\n| \u003ca name=\"input_az_count\"\u003e\u003c/a\u003e [az\\_count](#input\\_az\\_count) | AZ数 | `number` | `2` | no |\n| \u003ca name=\"input_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#input\\_domain\\_name) | ドメイン名 | `string` | `\"casl0.github.io\"` | no |\n| \u003ca name=\"input_ssl_policy\"\u003e\u003c/a\u003e [ssl\\_policy](#input\\_ssl\\_policy) | TLS セキュリティポリシー | `string` | `\"ELBSecurityPolicy-TLS13-1-2-2021-06\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_acm_client_certificate_arn\"\u003e\u003c/a\u003e [acm\\_client\\_certificate\\_arn](#output\\_acm\\_client\\_certificate\\_arn) | VPNクライアント証明書のARN |\n| \u003ca name=\"output_acm_server_certificate_arn\"\u003e\u003c/a\u003e [acm\\_server\\_certificate\\_arn](#output\\_acm\\_server\\_certificate\\_arn) | VPNサーバー証明書のARN |\n| \u003ca name=\"output_ecr_repository_url\"\u003e\u003c/a\u003e [ecr\\_repository\\_url](#output\\_ecr\\_repository\\_url) | ECRのリポジトリURL |\n| \u003ca name=\"output_route53_resolver_endpoint_ip_addresses\"\u003e\u003c/a\u003e [route53\\_resolver\\_endpoint\\_ip\\_addresses](#output\\_route53\\_resolver\\_endpoint\\_ip\\_addresses) | Route53 Inbound EndpointのIPアドレス |\n| \u003ca name=\"output_vpce_for_s3\"\u003e\u003c/a\u003e [vpce\\_for\\_s3](#output\\_vpce\\_for\\_s3) | S3用のVPC Endpoint |\n\u003c!-- END_TF_DOCS --\u003e\n\u003c!-- prettier-ignore-end --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcasl0%2Fclosed-network-on-aws","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcasl0%2Fclosed-network-on-aws","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcasl0%2Fclosed-network-on-aws/lists"}