「監視対象を登録して」で完了？Kiroとzabbix-mcpでZabbixを操作してみる

zabbix-sample.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Zabbix 7.0 LTS sample template.

# ==============================================================================
# Parameters
# ==============================================================================
Parameters:
  AllowedCidr:
    Type: String
    Default: 0.0.0.0/0
    Description: CIDR block allowed to access Zabbix Web UI and SSH (restrict in production)
    AllowedPattern: ^(\d{1,3}\.){3}\d{1,3}/\d{1,2}$

  DBRootPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    Description: MySQL root password
    AllowedPattern: ^[a-zA-Z0-9!@#$%^&*()_+=\-]*$

  DBZabbixPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    Description: MySQL user password for Zabbix
    AllowedPattern: ^[a-zA-Z0-9!@#$%^&*()_+=\-]*$

# ==============================================================================
# Metadata
# ==============================================================================
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Network Settings
        Parameters:
          - AllowedCidr
      - Label:
          default: Database Settings
        Parameters:
          - DBRootPassword
          - DBZabbixPassword

# ==============================================================================
# Resources
# ==============================================================================
Resources:
  # ----------------------------------------------------------------------------
  # VPC
  # ----------------------------------------------------------------------------
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  # ----------------------------------------------------------------------------
  # Internet Gateway
  # ----------------------------------------------------------------------------
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # ----------------------------------------------------------------------------
  # Public Subnet
  # ----------------------------------------------------------------------------
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet"

  # ----------------------------------------------------------------------------
  # Public Route Table
  # ----------------------------------------------------------------------------
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rt"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  # ----------------------------------------------------------------------------
  # NAT Gateway (Elastic IP + NAT GW)
  # ----------------------------------------------------------------------------
  NatGatewayEIP:
    Type: AWS::EC2::EIP
    DependsOn: VPCGatewayAttachment
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-nat-eip"

  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicSubnet
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-nat-gw"

  # ----------------------------------------------------------------------------
  # Private Subnet
  # ----------------------------------------------------------------------------
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-subnet"

  # ----------------------------------------------------------------------------
  # Private Route Table
  # ----------------------------------------------------------------------------
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-rt"

  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable

  # ----------------------------------------------------------------------------
  # Security Group - Zabbix Server
  # ----------------------------------------------------------------------------
  ZabbixSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Zabbix Server
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref AllowedCidr
          Description: Zabbix Web UI (HTTP)
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-sg"

  # ----------------------------------------------------------------------------
  # Security Group - Monitored Instance
  # ----------------------------------------------------------------------------
  MonitoredInstanceSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for monitored instances
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 10050
          ToPort: 10050
          SourceSecurityGroupId: !Ref ZabbixSecurityGroup
          Description: Allow Zabbix Server passive checks
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-monitored-sg"

  # ----------------------------------------------------------------------------
  # IAM Role - Zabbix
  # ----------------------------------------------------------------------------
  ZabbixInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-zabbix-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-zabbix-monitoring-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:GetMetricData
                  - cloudwatch:ListMetrics
                  - ec2:DescribeInstances
                  - ec2:DescribeRegions
                  - ec2:DescribeVolumes
                Resource: "*"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-role"

  ZabbixInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref ZabbixInstanceRole

  # ----------------------------------------------------------------------------
  # EC2 Instance
  # ----------------------------------------------------------------------------
  ZabbixInstance:
    Type: AWS::EC2::Instance
    DependsOn: VPCGatewayAttachment
    Properties:
      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
      InstanceType: t3.medium
      IamInstanceProfile: !Ref ZabbixInstanceProfile
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: "0"
          SubnetId: !Ref PublicSubnet
          GroupSet:
            - !Ref ZabbixSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 30
            VolumeType: gp3
            Encrypted: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-server"
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          exec > >(tee /var/log/zabbix-install.log) 2>&1

          echo "=========================================="
          echo " Zabbix 7.0 LTS Installation Start"
          echo "=========================================="

          # ------------------------------------------------------------------
          # 0. Wait for any existing dnf/rpm lock to be released
          # ------------------------------------------------------------------
          echo "Waiting for dnf/rpm lock to be released..."
          while fuser /var/lib/rpm/.rpm.lock /var/cache/dnf/metadata_lock.pid 2>/dev/null; do
            echo "  Another process is using dnf/rpm. Waiting 5 seconds..."
            sleep 5
          done
          echo "Lock released. Proceeding with installation."

          # ------------------------------------------------------------------
          # 1. System Update
          # ------------------------------------------------------------------
          dnf update -y

          # ------------------------------------------------------------------
          # 2. Install MySQL 8.4 LTS
          # ------------------------------------------------------------------
          dnf install -y https://dev.mysql.com/get/mysql84-community-release-el9-1.noarch.rpm
          dnf install -y mysql-community-server mysql-community-client

          systemctl enable mysqld --now

          # Retrieve temporary root password generated by MySQL
          TEMP_PASSWORD=$(grep 'temporary password' /var/log/mysqld.log | awk '{print $NF}')

          # Secure MySQL: set root password and remove defaults
          mysql --connect-expired-password -uroot -p"$TEMP_PASSWORD" <<EOF
          ALTER USER 'root'@'localhost' IDENTIFIED BY '${DBRootPassword}';
          DELETE FROM mysql.user WHERE User='';
          DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
          DROP DATABASE IF EXISTS test;
          DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
          FLUSH PRIVILEGES;
          EOF

          # ------------------------------------------------------------------
          # 3. Install Zabbix 7.0 Repository & Packages
          # ------------------------------------------------------------------
          rpm -Uvh https://repo.zabbix.com/zabbix/7.0/amazonlinux/2023/x86_64/zabbix-release-latest-7.0.amzn2023.noarch.rpm
          dnf clean all
          dnf install -y zabbix-server-mysql zabbix-web-mysql zabbix-apache-conf zabbix-sql-scripts zabbix-selinux-policy zabbix-agent zabbix-web-japanese

          # ------------------------------------------------------------------
          # 4. Create Zabbix Database & User
          # ------------------------------------------------------------------
          mysql -uroot -p'${DBRootPassword}' <<EOF
          CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
          CREATE USER 'zabbix'@'localhost' IDENTIFIED BY '${DBZabbixPassword}';
          GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix'@'localhost';
          SET GLOBAL log_bin_trust_function_creators = 1;
          FLUSH PRIVILEGES;
          EOF

          # ------------------------------------------------------------------
          # 5. Import Initial Schema & Data
          # ------------------------------------------------------------------
          zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | \
            mysql --default-character-set=utf8mb4 -uzabbix -p'${DBZabbixPassword}' zabbix

          # Disable log_bin_trust_function_creators after import
          mysql -uroot -p'${DBRootPassword}' -e "SET GLOBAL log_bin_trust_function_creators = 0;"

          # ------------------------------------------------------------------
          # 6. Configure Zabbix Server - DB Password
          # ------------------------------------------------------------------
          sed -i "s/^# DBPassword=.*/DBPassword=${DBZabbixPassword}/" /etc/zabbix/zabbix_server.conf

          # ------------------------------------------------------------------
          # 7. Configure Zabbix PHP Frontend (bypass setup wizard)
          # ------------------------------------------------------------------
          cat > /etc/zabbix/web/zabbix.conf.php <<'PHPCONF'
          <?php
          $DB['TYPE']             = 'MYSQL';
          $DB['SERVER']           = 'localhost';
          $DB['PORT']             = '0';
          $DB['DATABASE']         = 'zabbix';
          $DB['USER']             = 'zabbix';
          PHPCONF

          # Append DB password separately to avoid heredoc interpolation issues
          echo "\$DB['PASSWORD']         = '${DBZabbixPassword}';" >> /etc/zabbix/web/zabbix.conf.php

          cat >> /etc/zabbix/web/zabbix.conf.php <<'PHPCONF'
          $DB['SCHEMA']           = '';
          $DB['ENCRYPTION']       = false;
          $DB['KEY_FILE']         = '';
          $DB['CERT_FILE']        = '';
          $DB['CA_FILE']          = '';
          $DB['VERIFY_HOST']      = false;
          $DB['CIPHER_LIST']      = '';
          $DB['VAULT_URL']        = '';
          $DB['VAULT_DB_PATH']    = '';
          $DB['VAULT_TOKEN']      = '';
          $DB['DOUBLE_IEEE754']   = true;

          $ZBX_SERVER             = 'localhost';
          $ZBX_SERVER_PORT        = '10051';

          $IMAGE_FORMAT_DEFAULT   = IMAGE_FORMAT_PNG;
          PHPCONF

          # Append server name separately to use CloudFormation stack name
          echo "\$ZBX_SERVER_NAME        = '${AWS::StackName}';" >> /etc/zabbix/web/zabbix.conf.php

          chown apache:apache /etc/zabbix/web/zabbix.conf.php
          chmod 640 /etc/zabbix/web/zabbix.conf.php

          # ------------------------------------------------------------------
          # 8. Set default language to Japanese for Admin user
          # ------------------------------------------------------------------
          mysql -uzabbix -p'${DBZabbixPassword}' zabbix <<EOF
          UPDATE users SET lang = 'ja_JP' WHERE username = 'Admin';
          UPDATE config SET default_lang = 'ja_JP';
          EOF

          # ------------------------------------------------------------------
          # 9. Start & Enable All Services
          # ------------------------------------------------------------------
          systemctl enable zabbix-server zabbix-agent httpd php-fpm --now

          # ------------------------------------------------------------------
          # 9. Installation Complete
          # ------------------------------------------------------------------
          echo "=========================================="
          echo " Zabbix 7.0 LTS Installation Complete!"
          echo " Web UI: http://<public-ip>/zabbix"
          echo " Default login: Admin / zabbix"
          echo "=========================================="

  # ----------------------------------------------------------------------------
  # IAM Role - Monitored Instance
  # ----------------------------------------------------------------------------
  MonitoredInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-monitored-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-monitored-role"

  MonitoredInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref MonitoredInstanceRole

  # ----------------------------------------------------------------------------
  # EC2 Instance - Monitored Target
  # ----------------------------------------------------------------------------
  MonitoredInstance:
    Type: AWS::EC2::Instance
    DependsOn: PrivateRoute
    Properties:
      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
      InstanceType: t3.micro
      IamInstanceProfile: !Ref MonitoredInstanceProfile
      SubnetId: !Ref PrivateSubnet
      SecurityGroupIds:
        - !Ref MonitoredInstanceSG
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-monitored-instance"
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          exec > >(tee /var/log/zabbix-agent-install.log) 2>&1

          echo "=========================================="
          echo " Zabbix Agent 7.0 Installation Start"
          echo "=========================================="

          # ------------------------------------------------------------------
          # 0. Wait for any existing dnf/rpm lock to be released
          # ------------------------------------------------------------------
          echo "Waiting for dnf/rpm lock to be released..."
          while fuser /var/lib/rpm/.rpm.lock /var/cache/dnf/metadata_lock.pid 2>/dev/null; do
            echo "  Another process is using dnf/rpm. Waiting 5 seconds..."
            sleep 5
          done
          echo "Lock released. Proceeding with installation."

          # ------------------------------------------------------------------
          # 1. System Update
          # ------------------------------------------------------------------
          dnf update -y

          # ------------------------------------------------------------------
          # 2. Install Zabbix Agent
          # ------------------------------------------------------------------
          rpm -Uvh https://repo.zabbix.com/zabbix/7.0/amazonlinux/2023/x86_64/zabbix-release-latest-7.0.amzn2023.noarch.rpm
          dnf clean all
          dnf install -y zabbix-agent

          # ------------------------------------------------------------------
          # 3. Configure Zabbix Agent
          # ------------------------------------------------------------------
          ZABBIX_SERVER_IP="${ZabbixInstance.PrivateIp}"

          cat > /etc/zabbix/zabbix_agentd.conf <<EOF
          # Zabbix Agent Configuration
          PidFile=/run/zabbix/zabbix_agentd.pid
          LogFile=/var/log/zabbix/zabbix_agentd.log
          LogFileSize=0

          # Zabbix Server connection
          Server=$ZABBIX_SERVER_IP
          ServerActive=$ZABBIX_SERVER_IP
          Hostname=$(hostname)

          # Security
          AllowKey=system.run[*]
          Include=/etc/zabbix/zabbix_agentd.d/*.conf
          EOF

          # ------------------------------------------------------------------
          # 4. Start & Enable Zabbix Agent
          # ------------------------------------------------------------------
          systemctl enable zabbix-agent --now

          # ------------------------------------------------------------------
          # 5. Installation Complete
          # ------------------------------------------------------------------
          echo "=========================================="
          echo " Zabbix Agent 7.0 Installation Complete!"
          echo " Server: $ZABBIX_SERVER_IP"
          echo "=========================================="

# ==============================================================================
# Outputs
# ==============================================================================
Outputs:
  ZabbixWebUrl:
    Description: Zabbix Web UI URL
    Value: !Sub "http://${ZabbixInstance.PublicIp}/zabbix"

  ZabbixServerPrivateIp:
    Description: Private IP address of the Zabbix Server
    Value: !GetAtt ZabbixInstance.PrivateIp

  MonitoredInstanceId:
    Description: Instance ID of the monitored target
    Value: !Ref MonitoredInstance

  MonitoredInstancePrivateIp:
    Description: Private IP address of the monitored instance
    Value: !GetAtt MonitoredInstance.PrivateIp