閉域 3層 Multi-AZ エンタープライズ基盤（HULFT ファイル連携）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import * as rds from "aws-cdk-lib/aws-rds";
import * as kms from "aws-cdk-lib/aws-kms";

// インターネット非公開の閉域 VPC（IGW なし）。Web/AP/DB を分離し、内部 ALB で受ける。
export class ClosedThreeTierStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 公開サブネットを作らず、Isolated + Egress(NATは保守用) のみ
    const vpc = new ec2.Vpc(this, "Vpc", {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        { name: "web", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
        { name: "app", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
        { name: "data", subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 },
      ],
    });

    // 内部 ALB（インターネット非公開）。Direct Connect / Transit Gateway 経由のみ到達。
    const alb = new elbv2.ApplicationLoadBalancer(this, "InternalAlb", { vpc, internetFacing: false });
    alb.addListener("Http", { port: 80 });

    new ec2.CfnTransitGatewayVpcAttachment(this, "TgwAttach", {
      transitGatewayId: cdk.Fn.importValue("SharedTransitGatewayId"),
      vpcId: vpc.vpcId,
      subnetIds: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }).subnetIds,
    });

    const key = new kms.Key(this, "DataKey", { enableKeyRotation: true });

    // Aurora Multi-AZ（保存時暗号化）。HULFT は専用 EC2 上で稼働させる想定。
    new rds.DatabaseCluster(this, "Aurora", {
      engine: rds.DatabaseClusterEngine.auroraPostgres({ version: rds.AuroraPostgresEngineVersion.VER_16_1 }),
      writer: rds.ClusterInstance.provisioned("writer"),
      readers: [rds.ClusterInstance.provisioned("reader")],
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      storageEncryptionKey: key,
      storageEncrypted: true,
    });
  }
}