{Alibaba VPC} トラフィックミラーリングの操作Work with traffic mirroring

https://www.alibabacloud.com/help/ja/vpc/user-guide/create-and-manage-traffic-mirror-sources

https://www.alibabacloud.com/help/ja/vpc/user-guide/traffic-mirroring-overview

ecs01へのssh接続トラフィックをecs02へミラーする

-- 前提

トラフィックミラーリング有効化済

-- 1. TerraformでECSインスタンスを2個作成

cat <<-'EOF' > variables.tf

locals {
availability_zone = "ap-northeast-1a"
}

EOF

cat <<-'EOF' > main.tf

terraform {
required_version = ">= 1.0.0, < 2.0.0"
required_providers {
alicloud = {
source = "aliyun/alicloud"
version = "= 1.217.0"
}
}
}

provider "alicloud" {
region = "ap-northeast-1"
}

resource "alicloud_vpc" "vpc01" {
vpc_name = "vpc01"
description = "vpc01"
cidr_block = "10.2.0.0/16"
}

resource "alicloud_vswitch" "sw01" {
vswitch_name = "sw01"
description = "sw01"
vpc_id = alicloud_vpc.vpc01.id
cidr_block = "10.2.1.0/24"
zone_id = local.availability_zone
}

resource "alicloud_security_group" "sg01" {
name = "sg01"
description = "sg01"
vpc_id = alicloud_vpc.vpc01.id
security_group_type = "normal"
}

resource "alicloud_security_group_rule" "sg0101" {
type = "ingress"
ip_protocol = "tcp"
port_range = "22/22"
security_group_id = alicloud_security_group.sg01.id
nic_type = "intranet"
policy = "accept"
priority = 10
cidr_ip = "0.0.0.0/0"
description = "sg0101"
}

resource "alicloud_vpc_ipv4_gateway" "gw01" {
ipv4_gateway_name = "gw01"
ipv4_gateway_description = "gw01"
vpc_id = alicloud_vpc.vpc01.id
enabled = true
}

# ルートテーブルへvSwitchの関連付け
resource "alicloud_route_table_attachment" "sw01_rt01" {
vswitch_id = alicloud_vswitch.sw01.id
route_table_id = alicloud_vpc.vpc01.route_table_id
}

# ルートテーブルへカスタムルート追加
resource "alicloud_route_entry" "rt0101" {
name = "rt0101"
route_table_id = alicloud_vpc.vpc01.route_table_id
destination_cidrblock = "0.0.0.0/0"
nexthop_type = "Ipv4Gateway"
nexthop_id = alicloud_vpc_ipv4_gateway.gw01.id
}

resource "alicloud_instance" "ecs01" {

image_id = "aliyun_2_1903_x64_20G_alibase_20231221.vhd"
instance_type = "ecs.t5-lc2m1.nano"
security_groups = [alicloud_security_group.sg01.id]
instance_name = "ecs01"
system_disk_category = "cloud_ssd"
system_disk_name = "ecs01"
system_disk_size = 20
description = "ecs01"
internet_charge_type = "PayByBandwidth"
internet_max_bandwidth_out = 0
host_name = "ecs01"
vswitch_id = alicloud_vswitch.sw01.id
instance_charge_type = "PostPaid"
key_name = "alibabakey01"
deletion_protection = false
credit_specification = "Standard"
tags ={
Key = "hoge"
Value = "123"
}

}

resource "alicloud_eip_address" "eip01" {
address_name = "eip01"
bandwidth = 1
deletion_protection = false
description = "eip01"
internet_charge_type = "PayByTraffic"
isp = "BGP"
payment_type = "PayAsYouGo"
netmode = "public"
}

# インスタンスとEIPの関連付け
resource "alicloud_eip_association" "ecs01_eip01" {
instance_id = alicloud_instance.ecs01.id
allocation_id = alicloud_eip_address.eip01.id
}

resource "alicloud_instance" "ecs02" {

image_id = "aliyun_2_1903_x64_20G_alibase_20231221.vhd"
instance_type = "ecs.t5-lc2m1.nano"
security_groups = [alicloud_security_group.sg01.id]
instance_name = "ecs02"
system_disk_category = "cloud_ssd"
system_disk_name = "ecs02"
system_disk_size = 20
description = "ecs02"
internet_charge_type = "PayByBandwidth"
internet_max_bandwidth_out = 0
host_name = "ecs02"
vswitch_id = alicloud_vswitch.sw01.id
instance_charge_type = "PostPaid"
key_name = "alibabakey01"
deletion_protection = false
credit_specification = "Standard"
tags = {
Key = "fuga"
Value = "123"
}

}

resource "alicloud_eip_address" "eip02" {
address_name = "eip02"
bandwidth = 1
deletion_protection = false
description = "eip02"
internet_charge_type = "PayByTraffic"
isp = "BGP"
payment_type = "PayAsYouGo"
netmode = "public"
}

# インスタンスとEIPの関連付け
resource "alicloud_eip_association" "ecs02_eip02" {
instance_id = alicloud_instance.ecs02.id
allocation_id = alicloud_eip_address.eip02.id
}

EOF

cat <<-'EOF' > outputs.tf

output "vpc01_id" {
value = alicloud_vpc.vpc01.id
description = "vpc01.id"
}

output "sw01_id" {
value = alicloud_vswitch.sw01.id
description = "sw01.id"
}

output "sg01_id" {
value = alicloud_security_group.sg01.id
description = "sg01.id"
}

output "eip01_id" {
value = alicloud_eip_address.eip01.id
description = "eip01.id"
}

output "ecs01_primary_ip_address" {
value = alicloud_instance.ecs01.primary_ip_address
description = "ecs01.primary_ip_address"
}

output "eip02_id" {
value = alicloud_eip_address.eip02.id
description = "eip02.id"
}

output "ecs02_primary_ip_address" {
value = alicloud_instance.ecs02.primary_ip_address
description = "ecs02.primary_ip_address"
}

EOF

terraform init
terraform fmt
terraform -version

terraform plan

terraform apply -auto-approve

-- 2. トラフィックミラーフィルター作成

aliyun vpc CreateTrafficMirrorFilter \
--TrafficMirrorFilterName tmf01 \
--IngressRules.1.Action "accept" \
--IngressRules.1.Protocol "TCP" \
--IngressRules.1.DestinationCidrBlock "10.2.1.0/24" \
--IngressRules.1.DestinationPortRange "22/22" \
--IngressRules.1.Priority 1 \
--IngressRules.1.SourceCidrBlock "0.0.0.0/0" \
--IngressRules.1.SourcePortRange="-1/-1"

aliyun vpc ListTrafficMirrorFilters

-- 3. トラフィックミラーセッションの作成

aliyun vpc CreateTrafficMirrorSession \
--Priority 1 \
--TrafficMirrorFilterId tmf-111111111111111111111 \
--TrafficMirrorSourceIds.1 eni-11111111111111111111 \
--TrafficMirrorTargetId eni-11111111111111111111 \
--TrafficMirrorTargetType NetworkInterface \
--Enabled true \
--PacketLength 1500 \
--TrafficMirrorSessionName tms01

aliyun vpc ListTrafficMirrorSessions

-- 4. 動作確認

tcpdump -i eth0 -A udp port 4789

-- 5. クリーンアップ

aliyun vpc ListTrafficMirrorSessions

aliyun vpc DeleteTrafficMirrorSession \
--TrafficMirrorSessionId tms-111111111111111111111

aliyun vpc ListTrafficMirrorFilters

aliyun vpc DeleteTrafficMirrorFilter \
--TrafficMirrorFilterId tmf-111111111111111111111

terraform destroy -auto-approve