AWS SSM Automationで実現するEC2スケジュール起動停止設計｜コスト削減VPC運用パターン

この記事のポイント

・SSM AutomationはEC2操作の実行ログがSystems Managerコンソールに残り監査対応にも使える
・EventBridgeスケジューラのcron式でJSTタイムゾーン指定（Asia/Tokyo）が可能
・プライベートサブネット構成ではVPCエンドポイント3本でNATゲートウェイが不要になる
・IAMロールは「SSMAutomationRole」と「EventBridgeSchedulerRole」の2つが必要

# 信頼ポリシーファイルを作成
cat << 'EOF' > /tmp/ssm-trust.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ssm.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# IAMロール作成
aws iam create-role   --role-name SSMAutomationRole   --assume-role-policy-document file:///tmp/ssm-trust.json

# AWS管理ポリシーをアタッチ
aws iam attach-role-policy   --role-name SSMAutomationRole   --policy-arn arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole

{
    "Role": {
        "Path": "/",
        "RoleName": "SSMAutomationRole",
        "RoleId": "AROAXXXXXXXXXXXXXXXXX",
        "Arn": "arn:aws:iam::123456789012:role/SSMAutomationRole",
        "CreateDate": "2026-10-01T08:30:00+00:00"
    }
}

# EC2上でSSM Agentのステータス確認
sudo systemctl status amazon-ssm-agent

* amazon-ssm-agent.service - amazon-ssm-agent
     Loaded: loaded (/usr/lib/systemd/system/amazon-ssm-agent.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-10-01 08:00:01 UTC; 12h ago
   Main PID: 1234 (amazon-ssm-agen)

aws ssm describe-instance-information   --filters "Key=InstanceIds,Values=i-0abc1234def567890"   --query "InstanceInformationList[*].{ID:InstanceId,Ping:PingStatus,OS:PlatformName}"   --output table

--------------------------------------------------------------
|         DescribeInstanceInformation                       |
+----------------------+-------------------+----------------+
|          ID          |        OS         |      Ping      |
+----------------------+-------------------+----------------+
|  i-0abc1234def567890 | Amazon Linux 2023 |  Online        |
+----------------------+-------------------+----------------+

# EC2を起動するAutomationを手動実行
aws ssm start-automation-execution   --document-name "AWS-StartEC2Instance"   --parameters "InstanceId=i-0abc1234def567890,AutomationAssumeRole=arn:aws:iam::123456789012:role/SSMAutomationRole"

{
    "AutomationExecutionId": "4105a4fc-f944-11ed-a05b-0a1b2c3d4e5f"
}

aws ssm get-automation-execution   --automation-execution-id "4105a4fc-f944-11ed-a05b-0a1b2c3d4e5f"   --query "AutomationExecution.{Status:AutomationExecutionStatus}"   --output json

# 正常終了時の出力
{
    "Status": "Success"
}

# 平日9時（JST）に起動するスケジュールを作成
aws scheduler create-schedule   --name "ec2-start-weekday-morning"   --schedule-expression "cron(0 9 ? * MON-FRI *)"   --schedule-expression-timezone "Asia/Tokyo"   --target '{
    "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartEC2Instance",
    "RoleArn": "arn:aws:iam::123456789012:role/EventBridgeSchedulerRole",
    "Input": "{"InstanceId":["i-0abc1234def567890"],"AutomationAssumeRole":["arn:aws:iam::123456789012:role/SSMAutomationRole"]}"
  }'   --flexible-time-window '{"Mode": "OFF"}'

# 平日20時（JST）に停止するスケジュールを作成
aws scheduler create-schedule   --name "ec2-stop-weekday-evening"   --schedule-expression "cron(0 20 ? * MON-FRI *)"   --schedule-expression-timezone "Asia/Tokyo"   --target '{
    "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StopEC2Instance",
    "RoleArn": "arn:aws:iam::123456789012:role/EventBridgeSchedulerRole",
    "Input": "{"InstanceId":["i-0abc1234def567890"],"AutomationAssumeRole":["arn:aws:iam::123456789012:role/SSMAutomationRole"]}"
  }'   --flexible-time-window '{"Mode": "OFF"}'

aws scheduler get-schedule   --name "ec2-start-weekday-morning"   --query "{Expression:ScheduleExpression,Timezone:ScheduleExpressionTimezone,State:State}"

# 出力例
{
    "Expression": "cron(0 9 ? * MON-FRI *)",
    "Timezone": "Asia/Tokyo",
    "State": "ENABLED"
}

aws ec2 create-vpc-endpoint   --vpc-id vpc-0a1b2c3d4e5f67890   --service-name com.amazonaws.ap-northeast-1.ssm   --vpc-endpoint-type Interface   --subnet-ids subnet-0a1b2c3d4e5f67890   --security-group-ids sg-0a1b2c3d4e5f67890   --private-dns-enabled

# SSMAutomationRoleのポリシーを確認
aws iam list-attached-role-policies   --role-name SSMAutomationRole

# 出力例
{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonSSMAutomationRole",
            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole"
        }
    ]
}

# SSM Agentのログを確認（EC2上で実行）
sudo tail -50 /var/log/amazon/ssm/amazon-ssm-agent.log

# VPCエンドポイント経由での疎通確認（EC2上）
curl -s https://ssm.ap-northeast-1.amazonaws.com/ping

# 正常時の出力
{"PingStatus":"Success"}

aws scheduler get-schedule   --name "ec2-start-weekday-morning"   --query "{Expression:ScheduleExpression,Timezone:ScheduleExpressionTimezone}"

# タイムゾーン未設定だった場合の出力（UTC動作になる）
{
    "Expression": "cron(0 0 ? * MON-FRI *)",
    "Timezone": "UTC"
}