【AWS】NAT Gatewayのスケジュール管理方法【Lambda+EventBridge】

// Lambda実行関数 NatGatewayを削除するNode.js
const AWS = require('aws-sdk'); //CommonJS(require)なのでESMインポートに移行必要
const { // utils.jsから関数を取得
  waitForNatGatewayDeletion,
  waitForNatGatewayAvailable,
  getNatGatewayIdByTag,
  getEipAllocationIdByTag
} = require('./utils');
const ec2 = new AWS.EC2();

exports.handler = async (event) => {
  const action = event.action;  // "start" or "stop" ←Lambda関数のinputで指定する

  try {
    if (action === "stop") {
      // NAT GatewayのIDを取得
      const natGatewayId = await getNatGatewayIdByTag("lambda-nat-gateway");
      if (!natGatewayId) {
        throw new Error("NAT Gateway not found");
      }

      // ルートテーブルからNAT Gatewayへのルートを削除
      try {
        await ec2.deleteRoute({
          RouteTableId: [TODO_ルートテーブルのIDを入力],
          DestinationCidrBlock: "0.0.0.0/0"
        }).promise();
        console.log("Route to NAT Gateway deleted");
      } catch (e) {
        console.warn("Route deletion failed (possibly already deleted:)");
      }

      // NAT Gateway削除
      await ec2.deleteNatGateway({ NatGatewayId: natGatewayId }).promise();

      // NAT Gatewayが削除完了するまで待つ
      await waitForNatGatewayDeletion(natGatewayId);
      console.log(`Nat Gateway ${natGatewayId} stopped`);

      // EIPの割当ID取得と解放
      const allocationId = await getEipAllocationIdByTag("lambda-natgateway-eip");
      if (allocationId) {
        await ec2.releaseAddress({AllocationId: allocationId }).promise();
        console.log(`Elastic IP ${allocationId} released`);
      } else {
        console.warn("ALLOCATION_ID is not set, or EIP not released");
      }
    } else if (action === "start") {
      // Elastic IPを新規割当
      const eipResult = await ec2.allocateAddress({
        Domain: "vpc",
        TagSpecifications: [
          {
            ResourceType: "elastic-ip",
            Tags: [
              { Key: "Name", Value: "lambda-natgateway-eip"},
              { Key: "Description", Value: "Lambdaで自動生成 NAT Gateway用のElastic IP(固定グローバルIP)"}
            ]
          }
        ]
      }).promise();
      console.log(`Elastic IP allocated: ${eipResult.AllocationId}`);

      // NAT Gatewayの作成
      const result = await ec2.createNatGateway({
        AllocationId: eipResult.AllocationId,
        SubnetId:     [TODO_サブネットのIDを入力],
        TagSpecifications: [
          {
            ResourceType: "natgateway",
            Tags: [
              { Key: "Name", Value: "lambda-nat-gateway"},
              { Key: "Description", Value: "Lambdaで自動生成 パブリックサブネット(AZ:1a)に配置されたNAT Gateway"}
            ]
          }
        ]
      }).promise();
      console.log(`NAT Gateway started: ${JSON.stringify(result)}`);

      // NAT Gatewayが利用可能になるまで待つ
      await waitForNatGatewayAvailable(result.NatGateway.NatGatewayId);

      // ルートテーブルにNAT Gatewayへのルートを追加
      await ec2.createRoute({
        RouteTableId: [TODO_ルートテーブルのIDを入力],
        DestinationCidrBlock: "0.0.0.0/0",
        NatGatewayId: result.NatGateway.NatGatewayId
      }).promise();
      console.log(`Route added: 0.0.0.0/0 -> NAT Gateway ${result.NatGateway.NatGatewayId}`);

    } else {
      throw new Error(`Unknown action: ${action}`);
    }
  } catch (err) {
    console.error(err);
    throw err;
  }
};

const AWS = require('aws-sdk');
const ec2 = new AWS.EC2();

/**
 * NAT Gatewayが削除完了するまで最大3分間待機する関数
 * @param {string} natGatewayId - NAT GatewayのID
 * @returns {Promise<void>} 削除完了時は何も返さず、タイムアウト時は例外を投げる
 */
async function waitForNatGatewayDeletion(natGatewayId) {
  const maxRetries = 18;    // 3分
  for (let i = 0; i < maxRetries; i++) {
    const describe = await ec2.describeNatGateways({
      NatGatewayIds: [natGatewayId]
    }).promise();

    const state = describe.NatGateways[0]?.State;
    if (state === "deleted" || state === "failed" || !state) {
      return;
    }
    console.log(`Waiting for NAT Gateway deletion... (state: ${state})`);
    await new Promise(resolve => setTimeout(resolve, 10000));
  }
  throw new Error("Timeout: NAT Gateway was not deleted");
}

/**
 * NAT Gatewayが利用可能になるまで最大3分間待機する関数
 * @param {string} natGatewayId - NAT GatewayのID
 * @returns {Promise<void>} 利用可能時は何も返さず、タイムアウト時は例外を投げる
 */
async function waitForNatGatewayAvailable(natGatewayId) {
  const maxRetries = 30;    // 30回 * 10秒 = 5分 
  for (let i = 0; i < maxRetries; i++) {
    const describe = await ec2.describeNatGateways({
      NatGatewayIds: [natGatewayId]
    }).promise();

    const state = describe.NatGateways[0]?.State;
    if (state === "available") {
      console.log(`Nat Gateway is available: ${natGatewayId}`);
      return;
    } else if (state === "failed") {
      throw new Error(`NAT Gateway failed to become available: ${natGatewayId}`);
    } else if (!state) {
      throw new Error(`NAT Gateway state is undefined (ID: ${natGatewayId})`);
    } else {
      console.log(`Waiting for NAT Gateway to become available... (state: ${state})`);
    }
    await new Promise(resolve => setTimeout(resolve, 10000)); // 10秒待機
  }
  throw new Error("Timeout: NAT Gateway did not become available in time");
}

/**
 * 指定したタグ値でNAT GatewayのIDを取得する関数
 * @param {string} tagValue - NAT GatewayのNameタグ値
 * @returns {Promise<string|undefined>} NAT GatewayのID（見つからなければundefined）
 */
async function getNatGatewayIdByTag(tagValue) {
  console.log(`Searching for NAT Gateway with tag: ${tagValue}`);
  const response = await ec2.describeNatGateways({
    Filter: [
      { Name: "tag:Name", Values: [tagValue] },
      { Name: "state", Values: ["available", "pending"] }
    ]
  }).promise();
  const nat = response.NatGateways[0];
  console.log(`Found NAT Gateway: ${nat?.NatGatewayId}`);
  return nat?.NatGatewayId;
}

/**
 * 指定したタグ値でElastic IPのAllocationIdを取得する
 * @param {string} tagValue - Elastic IPのNameタグ値
 * @returns {Promise<string|undefined>} AllocationId（見つからなければundefined）
 */
async function getEipAllocationIdByTag(tagValue) {
  console.log(`Searching for Elastic IP with tag: ${tagValue}`);
  const response = await ec2.describeAddresses({
    Filters: [
      { Name: "tag:Name", Values: [tagValue] }
    ]
  }).promise();
  const eip = response.Addresses[0];
  console.log(`Found Elastic IP: ${eip?.AllocationId}`);
  return eip?.AllocationId;
}

module.exports = {
  waitForNatGatewayDeletion,
  waitForNatGatewayAvailable,
  getNatGatewayIdByTag,
  getEipAllocationIdByTag
};

{
    "Statement": [
        {
            "Action": [
                "ec2:DescribeNatGateways",
                "ec2:DescribeAddresses",
                "ec2:CreateNatGateway",
                "ec2:DeleteNatGateway",
                "ec2:DescribeSubnets",
                "ec2:AllocateAddress",
                "ec2:ReleaseAddress",
                "ec2:CreateTags",
                "ec2:CreateRoute",
                "ec2:DeleteRoute"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "sns:Publish"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

npm install aws-sdk

zip -r lambda.zip index.js utils.js node_modules/ package.json

# 作成
aws lambda invoke --function-name nat-gateway-scheduler --payload '{"action":"start"}' --cli-binary-format raw-in-base64-out --cli-read-timeout 300 result.json

# 削除
aws lambda invoke --function-name nat-gateway-scheduler --payload '{"action":"stop"}' --cli-binary-format raw-in-base64-out --cli-read-timeout 300 result.json

{
  "action": "start"
}

{
  "action": "stop"
}