【環境構築編】AWS DevOps AgentはZabbixアラートをどこまで調査できる？zabbix-mcp-server連携で監視情報を深掘り

zabbix-sample.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Zabbix 7.0 LTS monitoring infrastructure with application server.

# ==============================================================================
# Parameters
# ==============================================================================
Parameters:
  AllowedCidr:
    Type: String
    Default: 0.0.0.0/0
    Description: CIDR block allowed to access Zabbix Web UI (restrict in production)
    AllowedPattern: ^(\d{1,3}\.){3}\d{1,3}/\d{1,2}$

  DBRootPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    Description: MySQL root password
    AllowedPattern: ^[a-zA-Z0-9!@#$%^&*()_+=\-]*$

  DBZabbixPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    Description: MySQL user password for Zabbix
    AllowedPattern: ^[a-zA-Z0-9!@#$%^&*()_+=\-]*$

  MCPAdminPassword:
    Type: String
    NoEcho: true
    MinLength: 10
    MaxLength: 64
    Description: MCP Server admin portal password (min 10 chars, must include uppercase and digit)

  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair name for SSH access to application server

# ==============================================================================
# Metadata
# ==============================================================================
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Network Settings
        Parameters:
          - AllowedCidr
      - Label:
          default: Database Settings
        Parameters:
          - DBRootPassword
          - DBZabbixPassword
      - Label:
          default: MCP Server Settings
        Parameters:
          - MCPAdminPassword
      - Label:
          default: SSH Settings
        Parameters:
          - KeyPairName

# ==============================================================================
# Resources
# ==============================================================================
Resources:
  # ============================================================================
  # VPC & Networking
  # ============================================================================
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # --------------------------------------------------------------------------
  # Public Subnet
  # --------------------------------------------------------------------------
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet"

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rt"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  # ============================================================================
  # Security Groups
  # ============================================================================
  ZabbixSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Zabbix Server
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref AllowedCidr
          Description: Zabbix Web UI (HTTP)
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 10.0.0.0/16
          Description: Application endpoint (VPC internal)
        - IpProtocol: tcp
          FromPort: 9090
          ToPort: 9090
          CidrIp: !Ref AllowedCidr
          Description: Admin portal
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-sg"

  AppServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for application server
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 10050
          ToPort: 10050
          SourceSecurityGroupId: !Ref ZabbixSecurityGroup
          Description: Allow Zabbix Server passive checks
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedCidr
          Description: SSH access
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-sg"

  # ============================================================================
  # IAM Roles
  # ============================================================================
  ZabbixInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-zabbix-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-zabbix-monitoring-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:GetMetricData
                  - cloudwatch:ListMetrics
                  - ec2:DescribeInstances
                  - ec2:DescribeRegions
                  - ec2:DescribeVolumes
                Resource: "*"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-role"

  ZabbixInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref ZabbixInstanceRole

  AppServerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-app-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-role"

  AppServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref AppServerRole

  # ============================================================================
  # EC2 - Zabbix Server
  # ============================================================================
  ZabbixInstance:
    Type: AWS::EC2::Instance
    DependsOn: VPCGatewayAttachment
    Properties:
      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
      InstanceType: t3.medium
      IamInstanceProfile: !Ref ZabbixInstanceProfile
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: "0"
          SubnetId: !Ref PublicSubnet
          GroupSet:
            - !Ref ZabbixSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 30
            VolumeType: gp3
            Encrypted: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-zabbix-server"
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          exec > >(tee /var/log/zabbix-install.log) 2>&1

          # Wait for dnf/rpm lock
          while fuser /var/lib/rpm/.rpm.lock /var/cache/dnf/metadata_lock.pid 2>/dev/null; do
            sleep 5
          done

          dnf update -y

          # Install Python 3.14
          dnf install -y python3.14
          ln -sf /usr/bin/python3.14 /usr/local/bin/python3
          ln -sf /usr/bin/pip3.14 /usr/local/bin/pip3

          # Install MySQL 8.4 LTS
          dnf install -y https://dev.mysql.com/get/mysql84-community-release-el9-1.noarch.rpm
          dnf install -y mysql-community-server mysql-community-client
          systemctl enable mysqld --now

          TEMP_PASSWORD=$(grep 'temporary password' /var/log/mysqld.log | awk '{print $NF}')

          mysql --connect-expired-password -uroot -p"$TEMP_PASSWORD" <<EOF
          ALTER USER 'root'@'localhost' IDENTIFIED BY '${DBRootPassword}';
          DELETE FROM mysql.user WHERE User='';
          DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
          DROP DATABASE IF EXISTS test;
          DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
          FLUSH PRIVILEGES;
          EOF

          # Install Zabbix 7.0
          rpm -Uvh https://repo.zabbix.com/zabbix/7.0/amazonlinux/2023/x86_64/zabbix-release-latest-7.0.amzn2023.noarch.rpm
          dnf clean all
          dnf install -y zabbix-server-mysql zabbix-web-mysql zabbix-apache-conf zabbix-sql-scripts zabbix-selinux-policy zabbix-agent zabbix-web-japanese

          # Create Zabbix Database
          mysql -uroot -p'${DBRootPassword}' <<EOF
          CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
          CREATE USER 'zabbix'@'localhost' IDENTIFIED BY '${DBZabbixPassword}';
          GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix'@'localhost';
          SET GLOBAL log_bin_trust_function_creators = 1;
          FLUSH PRIVILEGES;
          EOF

          # Import Schema
          zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | \
            mysql --default-character-set=utf8mb4 -uzabbix -p'${DBZabbixPassword}' zabbix
          mysql -uroot -p'${DBRootPassword}' -e "SET GLOBAL log_bin_trust_function_creators = 0;"

          # Configure Zabbix Server
          sed -i "s/^# DBPassword=.*/DBPassword=${DBZabbixPassword}/" /etc/zabbix/zabbix_server.conf

          # Configure PHP Frontend
          cat > /etc/zabbix/web/zabbix.conf.php <<'PHPCONF'
          <?php
          $DB['TYPE']             = 'MYSQL';
          $DB['SERVER']           = 'localhost';
          $DB['PORT']             = '0';
          $DB['DATABASE']         = 'zabbix';
          $DB['USER']             = 'zabbix';
          PHPCONF
          echo "\$DB['PASSWORD']         = '${DBZabbixPassword}';" >> /etc/zabbix/web/zabbix.conf.php
          cat >> /etc/zabbix/web/zabbix.conf.php <<'PHPCONF'
          $DB['SCHEMA']           = '';
          $DB['ENCRYPTION']       = false;
          $DB['KEY_FILE']         = '';
          $DB['CERT_FILE']        = '';
          $DB['CA_FILE']          = '';
          $DB['VERIFY_HOST']      = false;
          $DB['CIPHER_LIST']      = '';
          $DB['VAULT_URL']        = '';
          $DB['VAULT_DB_PATH']    = '';
          $DB['VAULT_TOKEN']      = '';
          $DB['DOUBLE_IEEE754']   = true;
          $ZBX_SERVER             = 'localhost';
          $ZBX_SERVER_PORT        = '10051';
          $IMAGE_FORMAT_DEFAULT   = IMAGE_FORMAT_PNG;
          PHPCONF
          echo "\$ZBX_SERVER_NAME        = '${AWS::StackName}';" >> /etc/zabbix/web/zabbix.conf.php
          chown apache:apache /etc/zabbix/web/zabbix.conf.php
          chmod 640 /etc/zabbix/web/zabbix.conf.php

          # Set Japanese locale
          mysql -uzabbix -p'${DBZabbixPassword}' zabbix <<EOF
          UPDATE users SET lang = 'ja_JP' WHERE username = 'Admin';
          UPDATE config SET default_lang = 'ja_JP';
          EOF

          # Install dependencies
          dnf install -y pango gdk-pixbuf2 cairo git

          # Install initMAX MCP Server
          cd /opt
          git clone https://github.com/initMAX/zabbix-mcp-server.git
          cd zabbix-mcp-server
          ./deploy/install.sh

          # Create TLS certificate
          mkdir -p /etc/zabbix-mcp/tls
          LOCAL_IP=$(hostname -I | awk '{print $1}')
          openssl req -x509 -newkey rsa:2048 \
            -keyout /etc/zabbix-mcp/tls/key.pem \
            -out /etc/zabbix-mcp/tls/cert.pem \
            -days 365 -nodes \
            -subj "/CN=zabbix-mcp" \
            -addext "subjectAltName=IP:$LOCAL_IP,DNS:localhost"
          chmod 600 /etc/zabbix-mcp/tls/key.pem
          chmod 644 /etc/zabbix-mcp/tls/cert.pem
          chown -R zabbix-mcp:zabbix-mcp /etc/zabbix-mcp/tls/

          # Configure MCP Server
          LOCAL_IP=$(hostname -I | awk '{print $1}')
          sed -i 's/^host = .*/host = "0.0.0.0"/' /etc/zabbix-mcp/config.toml
          sed -i 's/^public_url = .*/public_url = "https:\/\/'"$LOCAL_IP"'"/' /etc/zabbix-mcp/config.toml
          # TLS: uncomment and set
          sed -i 's|^# *tls_cert_file = .*|tls_cert_file = "/etc/zabbix-mcp/tls/cert.pem"|' /etc/zabbix-mcp/config.toml
          sed -i 's|^# *tls_key_file = .*|tls_key_file = "/etc/zabbix-mcp/tls/key.pem"|' /etc/zabbix-mcp/config.toml

          # Set admin password
          cd /opt/zabbix-mcp-server
          ./deploy/install.sh set-admin-password <<EOF
          ${MCPAdminPassword}
          ${MCPAdminPassword}
          EOF

          # Start MCP Server
          systemctl enable zabbix-mcp-server --now

          # Start Zabbix services
          systemctl enable zabbix-server zabbix-agent httpd php-fpm --now

  # ============================================================================
  # EC2 - Application Server
  # ============================================================================
  AppServer:
    Type: AWS::EC2::Instance
    DependsOn: VPCGatewayAttachment
    Properties:
      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
      InstanceType: t3.small
      IamInstanceProfile: !Ref AppServerInstanceProfile
      KeyName: !Ref KeyPairName
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: "0"
          SubnetId: !Ref PublicSubnet
          GroupSet:
            - !Ref AppServerSG
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-server"
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          exec > >(tee /var/log/app-setup.log) 2>&1

          while fuser /var/lib/rpm/.rpm.lock /var/cache/dnf/metadata_lock.pid 2>/dev/null; do
            sleep 5
          done

          dnf update -y

          # Install Zabbix Agent 2
          rpm -Uvh https://repo.zabbix.com/zabbix/7.0/amazonlinux/2023/x86_64/zabbix-release-latest-7.0.amzn2023.noarch.rpm
          dnf clean all
          dnf install -y zabbix-agent2

          # Configure Zabbix Agent 2
          ZABBIX_SERVER_IP="${ZabbixInstance.PrivateIp}"

          cat > /etc/zabbix/zabbix_agent2.conf <<EOF
          PidFile=/run/zabbix/zabbix_agent2.pid
          LogFile=/var/log/zabbix/zabbix_agent2.log
          LogFileSize=0
          Server=$ZABBIX_SERVER_IP
          ServerActive=$ZABBIX_SERVER_IP
          Hostname=$(hostname)
          Include=/etc/zabbix/zabbix_agent2.d/*.conf
          EOF

          systemctl enable zabbix-agent2 --now

# ==============================================================================
# Outputs
# ==============================================================================
Outputs:
  ZabbixWebUrl:
    Description: Zabbix Web UI URL
    Value: !Sub "http://${ZabbixInstance.PublicIp}/zabbix"

  ZabbixServerPublicIp:
    Description: Public IP of the Zabbix Server
    Value: !GetAtt ZabbixInstance.PublicIp

  ZabbixServerPrivateIp:
    Description: Private IP of the Zabbix Server
    Value: !GetAtt ZabbixInstance.PrivateIp

  ZabbixServerInstanceId:
    Description: Instance ID of the Zabbix Server
    Value: !Ref ZabbixInstance

  AppServerInstanceId:
    Description: Instance ID of the application server
    Value: !Ref AppServer

  AppServerPrivateIp:
    Description: Private IP of the application server
    Value: !GetAtt AppServer.PrivateIp

  AppServerPublicIp:
    Description: Public IP of the application server (for SSH access)
    Value: !GetAtt AppServer.PublicIp