# ルートユーザー用メールアドレスは専用のものを使う
# 例: aws-root@example.com（個人メールは避ける）
 
# アカウント作成後、最初にやるべきこと
# 1. ルートユーザーに MFA を設定
# 2. IAM 管理者ユーザーを作成
# 3. ルートユーザーのアクセスキーを作成しない（絶対に）
# 4. デフォルトリージョンを確認して東京リージョンに切り替え
# 5. 請求アラートを設定する

#!/bin/bash
# AWS アカウント初期セキュリティ設定スクリプト
# 前提: IAM 管理者ユーザーの認証情報で実行
 
set -euo pipefail
 
ACCOUNT_ALIAS="my-company-prod"
ADMIN_USER="admin-user"
ADMIN_GROUP="Administrators"
REGION="ap-northeast-1"
 
echo "=== Step 1: アカウントエイリアスの設定 ==="
aws iam create-account-alias --account-alias "$ACCOUNT_ALIAS"
echo "アカウントエイリアス '$ACCOUNT_ALIAS' を設定しました"
 
echo "=== Step 2: パスワードポリシーの設定 ==="
aws iam update-account-password-policy \
  --minimum-password-length 14 \
  --require-symbols \
  --require-numbers \
  --require-uppercase-characters \
  --require-lowercase-characters \
  --allow-users-to-change-password \
  --max-password-age 90 \
  --password-reuse-prevention 12 \
  --hard-expiry
echo "パスワードポリシーを設定しました"
 
echo "=== Step 3: 管理者グループの作成 ==="
aws iam create-group --group-name "$ADMIN_GROUP"
aws iam attach-group-policy \
  --group-name "$ADMIN_GROUP" \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
echo "管理者グループ '$ADMIN_GROUP' を作成しました"
 
echo "=== Step 4: CloudTrail の有効化 ==="
TRAIL_BUCKET="cloudtrail-logs-$(aws sts get-caller-identity --query Account --output text)"
aws s3 mb "s3://$TRAIL_BUCKET" --region "$REGION" 2>/dev/null || true
 
# バケットポリシーを設定
cat > /tmp/trail-bucket-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::$TRAIL_BUCKET"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::$TRAIL_BUCKET/AWSLogs/*",
      "Condition": {
        "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}
      }
    }
  ]
}
EOF
 
aws s3api put-bucket-policy \
  --bucket "$TRAIL_BUCKET" \
  --policy file:///tmp/trail-bucket-policy.json
 
aws cloudtrail create-trail \
  --name management-trail \
  --s3-bucket-name "$TRAIL_BUCKET" \
  --is-multi-region-trail \
  --enable-log-file-validation \
  --include-global-service-events
 
aws cloudtrail start-logging --name management-trail
echo "CloudTrail を有効化しました"
 
echo "=== Step 5: GuardDuty の有効化 ==="
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES \
  --region "$REGION"
echo "GuardDuty を有効化しました"
 
echo "=== Step 6: EBS デフォルト暗号化の有効化 ==="
aws ec2 enable-ebs-encryption-by-default --region "$REGION"
echo "EBS デフォルト暗号化を有効化しました"
 
echo "=== Step 7: S3 パブリックアクセスブロック（アカウントレベル）==="
aws s3control put-public-access-block \
  --account-id "$(aws sts get-caller-identity --query Account --output text)" \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
echo "S3 パブリックアクセスブロックを設定しました"
 
echo "=== 初期セキュリティ設定が完了しました ==="

# AWS CLI で仮想 MFA デバイスを作成
aws iam create-virtual-mfa-device \
  --virtual-mfa-device-name root-mfa \
  --outfile /tmp/QRCode.png \
  --bootstrap-method QRCodePNG
 
# MFA デバイスを有効化（TOTP コード2つが必要）
aws iam enable-mfa-device \
  --user-name root \
  --serial-number arn:aws:iam::123456789012:mfa/root-mfa \
  --authentication-code1 123456 \
  --authentication-code2 789012

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowViewAccountInfo",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountPasswordPolicy",
        "iam:ListVirtualMFADevices"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowManageOwnPasswords",
      "Effect": "Allow",
      "Action": [
        "iam:ChangePassword",
        "iam:GetUser"
      ],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
      "Sid": "AllowManageOwnMFA",
      "Effect": "Allow",
      "Action": [
        "iam:CreateVirtualMFADevice",
        "iam:DeleteVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:ListMFADevices",
        "iam:ResyncMFADevice"
      ],
      "Resource": [
        "arn:aws:iam::*:mfa/${aws:username}",
        "arn:aws:iam::*:user/${aws:username}"
      ]
    },
    {
      "Sid": "DenyAllExceptListedIfNoMFA",
      "Effect": "Deny",
      "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ChangePassword",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "iam:ResyncMFADevice",
        "sts:GetSessionToken"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}

# 開発者グループを作成
aws iam create-group --group-name Developers
 
# IAM ポリシーをアタッチ
aws iam attach-group-policy \
  --group-name Developers \
  --policy-arn arn:aws:iam::aws:policy/PowerUserAccess
 
# IAM ユーザーを作成
aws iam create-user --user-name tanaka
 
# ユーザーをグループに追加
aws iam add-user-to-group \
  --user-name tanaka \
  --group-name Developers
 
# ログインプロファイル（パスワード）を作成
aws iam create-login-profile \
  --user-name tanaka \
  --password 'TempP@ssw0rd!' \
  --password-reset-required
 
# タグを付与（部署、チーム情報）
aws iam tag-user \
  --user-name tanaka \
  --tags \
    Key=Department,Value=Engineering \
    Key=Team,Value=Backend \
    Key=CostCenter,Value=CC-001

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-app-bucket",
        "arn:aws:s3:::my-app-bucket/*"
      ]
    },
    {
      "Sid": "DenyDeleteBucket",
      "Effect": "Deny",
      "Action": "s3:DeleteBucket",
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEC2InTokyoRegionOnly",
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "ap-northeast-1"
        }
      }
    },
    {
      "Sid": "DenyEC2TerminateWithoutMFA",
      "Effect": "Deny",
      "Action": "ec2:TerminateInstances",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    },
    {
      "Sid": "AllowActionsOnlyDuringBusinessHours",
      "Effect": "Deny",
      "Action": [
        "rds:DeleteDBInstance",
        "rds:DeleteDBCluster"
      ],
      "Resource": "*",
      "Condition": {
        "DateGreaterThan": {
          "aws:CurrentTime": "2025-01-01T18:00:00Z"
        },
        "DateLessThan": {
          "aws:CurrentTime": "2025-01-02T09:00:00Z"
        }
      }
    },
    {
      "Sid": "RestrictBySourceIP",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "203.0.113.0/24",
            "198.51.100.0/24"
          ]
        },
        "Bool": {
          "aws:ViaAWSService": "false"
        }
      }
    }
  ]
}

# 信頼ポリシーを作成
cat > trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
 
# ロールを作成
aws iam create-role \
  --role-name EC2-S3-ReadOnly \
  --assume-role-policy-document file://trust-policy.json
 
# ポリシーをアタッチ
aws iam attach-role-policy \
  --role-name EC2-S3-ReadOnly \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 
# インスタンスプロファイルを作成してロールを関連付け
aws iam create-instance-profile \
  --instance-profile-name EC2-S3-ReadOnly-Profile
aws iam add-role-to-instance-profile \
  --instance-profile-name EC2-S3-ReadOnly-Profile \
  --role-name EC2-S3-ReadOnly

# アカウント B（対象）にロールを作成
# アカウント A（呼び出し元）からのアクセスを許可する信頼ポリシー
cat > cross-account-trust.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "my-external-id-12345"
        }
      }
    }
  ]
}
EOF
 
aws iam create-role \
  --role-name CrossAccountReadOnly \
  --assume-role-policy-document file://cross-account-trust.json
 
aws iam attach-role-policy \
  --role-name CrossAccountReadOnly \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
 
# アカウント A（呼び出し元）からロールを引き受ける
aws sts assume-role \
  --role-arn arn:aws:iam::222222222222:role/CrossAccountReadOnly \
  --role-session-name cross-account-session \
  --external-id my-external-id-12345

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowedServices",
      "Effect": "Allow",
      "Action": [
        "s3:*",
        "dynamodb:*",
        "lambda:*",
        "logs:*",
        "cloudwatch:*",
        "sqs:*",
        "sns:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyDangerousActions",
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser",
        "iam:CreateRole",
        "iam:DeleteRole",
        "organizations:*",
        "account:*"
      ],
      "Resource": "*"
    }
  ]
}

# アクセス許可境界をユーザーに設定
aws iam put-user-permissions-boundary \
  --user-name developer-tanaka \
  --permissions-boundary arn:aws:iam::123456789012:policy/DeveloperBoundary
 
# アクセス許可境界をロールに設定
aws iam put-role-permissions-boundary \
  --role-name LambdaExecutionRole \
  --permissions-boundary arn:aws:iam::123456789012:policy/LambdaBoundary

# Access Analyzer を作成（アカウントレベル）
aws accessanalyzer create-analyzer \
  --analyzer-name account-analyzer \
  --type ACCOUNT
 
# 分析結果（外部からアクセス可能なリソース）を確認
aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/account-analyzer \
  --query 'findings[].{Resource:resource,ResourceType:resourceType,Status:status}' \
  --output table
 
# ポリシー生成（CloudTrail ログから最小権限ポリシーを生成）
aws accessanalyzer start-policy-generation \
  --policy-generation-details '{
    "principalArn": "arn:aws:iam::123456789012:role/MyAppRole",
    "cloudTrailDetails": {
      "trails": [
        {
          "cloudTrailArn": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail/management-trail",
          "regions": ["ap-northeast-1"],
          "allRegions": false
        }
      ],
      "accessRole": "arn:aws:iam::123456789012:role/AccessAnalyzerRole",
      "startTime": "2025-01-01T00:00:00Z",
      "endTime": "2025-02-01T00:00:00Z"
    }
  }'
 
# 未使用のアクセスキー・パスワードを検出
aws accessanalyzer create-analyzer \
  --analyzer-name unused-access-analyzer \
  --type ACCOUNT_UNUSED_ACCESS \
  --configuration '{
    "unusedAccess": {
      "unusedAccessAge": 90
    }
  }'

# IAM Identity Center のインスタンスを作成
aws sso-admin create-instance --name "my-org-sso"
 
# 権限セットを作成
aws sso-admin create-permission-set \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxx \
  --name "DeveloperAccess" \
  --description "Developer team access" \
  --session-duration "PT8H" \
  --relay-state ""
 
# 管理ポリシーをアタッチ
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxx \
  --permission-set-arn arn:aws:sso:::permissionSet/ssoins-xxxx/ps-xxxx \
  --managed-policy-arn arn:aws:iam::aws:policy/PowerUserAccess
 
# カスタムインラインポリシーをアタッチ
aws sso-admin put-inline-policy-to-permission-set \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxx \
  --permission-set-arn arn:aws:sso:::permissionSet/ssoins-xxxx/ps-xxxx \
  --inline-policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": [
          "iam:CreateUser",
          "iam:DeleteUser",
          "organizations:*"
        ],
        "Resource": "*"
      }
    ]
  }'
 
# アカウントに権限セットを割り当て
aws sso-admin create-account-assignment \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxx \
  --target-id 123456789012 \
  --target-type AWS_ACCOUNT \
  --permission-set-arn arn:aws:sso:::permissionSet/ssoins-xxxx/ps-xxxx \
  --principal-type GROUP \
  --principal-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# 組織を作成
aws organizations create-organization --feature-set ALL
 
# OU (組織単位) を作成
ROOT_ID=$(aws organizations list-roots --query 'Roots[0].Id' --output text)
 
aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" \
  --name "Security"
 
aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" \
  --name "Infrastructure"
 
aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" \
  --name "Workloads"
 
aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" \
  --name "Sandbox"
 
# 新しいメンバーアカウントを作成
aws organizations create-account \
  --email prod@example.com \
  --account-name "Production"
 
# SCP（サービスコントロールポリシー）をアタッチ
aws organizations attach-policy \
  --policy-id p-xxxx \
  --target-id ou-xxxx
 
# OU の一覧を確認
aws organizations list-organizational-units-for-parent \
  --parent-id "$ROOT_ID" \
  --query 'OrganizationalUnits[].[Id,Name]' \
  --output table
 
# アカウント一覧
aws organizations list-accounts \
  --query 'Accounts[].[Id,Name,Email,Status]' \
  --output table

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLeaveOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    },
    {
      "Sid": "RestrictRegions",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "sts:*",
        "organizations:*",
        "support:*",
        "budgets:*",
        "health:*",
        "ce:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "ap-northeast-1",
            "us-east-1"
          ]
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRootUserActions",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:root"
        }
      }
    },
    {
      "Sid": "ProtectCloudTrail",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "cloudtrail:UpdateTrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ProtectGuardDuty",
      "Effect": "Deny",
      "Action": [
        "guardduty:DeleteDetector",
        "guardduty:DisassociateFromMasterAccount",
        "guardduty:UpdateDetector"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyPublicS3",
      "Effect": "Deny",
      "Action": "s3:PutBucketPublicAccessBlock",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:publicAccessBlockConfiguration/BlockPublicAcls": "true"
        }
      }
    },
    {
      "Sid": "RequireEncryptedVolumes",
      "Effect": "Deny",
      "Action": "ec2:CreateVolume",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "ec2:Encrypted": "false"
        }
      }
    },
    {
      "Sid": "DenyLargeInstances",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "ec2:InstanceType": [
            "*.8xlarge",
            "*.12xlarge",
            "*.16xlarge",
            "*.24xlarge",
            "*.metal",
            "p4*",
            "p5*"
          ]
        }
      }
    }
  ]
}

# 請求メトリクスを有効化（コンソールで先に有効化が必要）
# Billing > Billing Preferences > Receive Billing Alerts
 
# SNS トピックを作成
aws sns create-topic --name billing-alerts
aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:billing-alerts \
  --protocol email \
  --notification-endpoint admin@example.com
 
# CloudWatch 請求アラームを作成（月額 $50 超過で通知）
aws cloudwatch put-metric-alarm \
  --alarm-name "MonthlyBillingAlarm-50USD" \
  --metric-name EstimatedCharges \
  --namespace AWS/Billing \
  --statistic Maximum \
  --period 21600 \
  --threshold 50 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:billing-alerts \
  --dimensions Name=Currency,Value=USD \
  --region us-east-1
 
# 段階的なアラーム（$100, $200, $500）
for threshold in 100 200 500; do
  aws cloudwatch put-metric-alarm \
    --alarm-name "MonthlyBillingAlarm-${threshold}USD" \
    --metric-name EstimatedCharges \
    --namespace AWS/Billing \
    --statistic Maximum \
    --period 21600 \
    --threshold "$threshold" \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 1 \
    --alarm-actions arn:aws:sns:us-east-1:123456789012:billing-alerts \
    --dimensions Name=Currency,Value=USD \
    --region us-east-1
done

# 月間予算を作成（$100 の予算、80% で通知）
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "MonthlyBudget",
    "BudgetLimit": {"Amount": "100", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST"
  }' \
  --notifications-with-subscribers '[
    {
      "Notification": {
        "NotificationType": "ACTUAL",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 80,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [
        {
          "SubscriptionType": "EMAIL",
          "Address": "admin@example.com"
        }
      ]
    },
    {
      "Notification": {
        "NotificationType": "FORECASTED",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 100,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [
        {
          "SubscriptionType": "EMAIL",
          "Address": "admin@example.com"
        }
      ]
    }
  ]'
 
# サービス別の予算を作成
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "EC2-MonthlyBudget",
    "BudgetLimit": {"Amount": "50", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST",
    "CostFilters": {
      "Service": ["Amazon Elastic Compute Cloud - Compute"]
    }
  }' \
  --notifications-with-subscribers '[
    {
      "Notification": {
        "NotificationType": "ACTUAL",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 80,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [
        {
          "SubscriptionType": "EMAIL",
          "Address": "admin@example.com"
        }
      ]
    }
  ]'

# 過去30日のサービス別コスト
aws ce get-cost-and-usage \
  --time-period Start=$(date -v-30d +%Y-%m-%d),End=$(date +%Y-%m-%d) \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[].Groups[?Metrics.BlendedCost.Amount > `1.0`].{Service:Keys[0],Cost:Metrics.BlendedCost.Amount}' \
  --output table
 
# 日別のコスト推移
aws ce get-cost-and-usage \
  --time-period Start=$(date -v-7d +%Y-%m-%d),End=$(date +%Y-%m-%d) \
  --granularity DAILY \
  --metrics BlendedCost \
  --query 'ResultsByTime[].{Date:TimePeriod.Start,Cost:Total.BlendedCost.Amount}' \
  --output table
 
# コスト予測（今月末の予測値）
aws ce get-cost-forecast \
  --time-period Start=$(date +%Y-%m-%d),End=$(date -v+1m -v1d -v-1d +%Y-%m-%d) \
  --metric BLENDED_COST \
  --granularity MONTHLY

# コスト異常検知モニターを作成
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "ServiceMonitor",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "SERVICE"
  }'
 
# サブスクリプション（通知先）を作成
aws ce create-anomaly-subscription \
  --anomaly-subscription '{
    "SubscriptionName": "CostAnomalyAlerts",
    "MonitorArnList": ["arn:aws:ce::123456789012:anomalymonitor/xxxx"],
    "Subscribers": [
      {
        "Address": "admin@example.com",
        "Type": "EMAIL"
      }
    ],
    "Threshold": 10.0,
    "Frequency": "DAILY"
  }'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM初期設定 - ユーザー、グループ、ポリシーの作成'
 
Parameters:
  EnvironmentName:
    Type: String
    Default: production
    AllowedValues: [production, staging, development]
 
Resources:
  # パスワードポリシー
  # CloudFormation では直接設定できないため、カスタムリソースが必要
 
  # 管理者グループ
  AdminGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub '${EnvironmentName}-administrators'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
 
  # 開発者グループ
  DeveloperGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub '${EnvironmentName}-developers'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/PowerUserAccess
      Policies:
        - PolicyName: DenyIAMAndOrganizations
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Deny
                Action:
                  - 'iam:CreateUser'
                  - 'iam:DeleteUser'
                  - 'iam:CreateRole'
                  - 'iam:DeleteRole'
                  - 'organizations:*'
                Resource: '*'
 
  # 読み取り専用グループ
  ReadOnlyGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub '${EnvironmentName}-readonly'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
 
  # MFA 強制ポリシー
  MFAEnforcementPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub '${EnvironmentName}-mfa-enforcement'
      Groups:
        - !Ref DeveloperGroup
        - !Ref ReadOnlyGroup
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowManageOwnMFA
            Effect: Allow
            Action:
              - 'iam:CreateVirtualMFADevice'
              - 'iam:EnableMFADevice'
              - 'iam:ListMFADevices'
              - 'iam:ResyncMFADevice'
            Resource:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:mfa/${!aws:username}'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${!aws:username}'
          - Sid: DenyWithoutMFA
            Effect: Deny
            NotAction:
              - 'iam:CreateVirtualMFADevice'
              - 'iam:EnableMFADevice'
              - 'iam:ListMFADevices'
              - 'iam:GetUser'
              - 'iam:ChangePassword'
              - 'sts:GetSessionToken'
            Resource: '*'
            Condition:
              BoolIfExists:
                'aws:MultiFactorAuthPresent': 'false'
 
  # EC2 用ロール
  EC2WebServerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${EnvironmentName}-ec2-webserver'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
 
  EC2WebServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${EnvironmentName}-ec2-webserver-profile'
      Roles:
        - !Ref EC2WebServerRole
 
Outputs:
  AdminGroupArn:
    Value: !GetAtt AdminGroup.Arn
    Export:
      Name: !Sub '${EnvironmentName}-admin-group-arn'
  DeveloperGroupArn:
    Value: !GetAtt DeveloperGroup.Arn
    Export:
      Name: !Sub '${EnvironmentName}-developer-group-arn'
  EC2WebServerRoleArn:
    Value: !GetAtt EC2WebServerRole.Arn
    Export:
      Name: !Sub '${EnvironmentName}-ec2-webserver-role-arn'

import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';
 
export class IamSetupStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
 
    // 開発者グループ
    const developerGroup = new iam.Group(this, 'DeveloperGroup', {
      groupName: 'developers',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('PowerUserAccess'),
      ],
    });
 
    // カスタムポリシー
    const restrictedPolicy = new iam.ManagedPolicy(this, 'RestrictedPolicy', {
      managedPolicyName: 'developer-restrictions',
      statements: [
        new iam.PolicyStatement({
          effect: iam.Effect.DENY,
          actions: [
            'iam:CreateUser',
            'iam:DeleteUser',
            'organizations:*',
          ],
          resources: ['*'],
        }),
        new iam.PolicyStatement({
          effect: iam.Effect.DENY,
          actions: ['ec2:*'],
          resources: ['*'],
          conditions: {
            StringNotEquals: {
              'aws:RequestedRegion': ['ap-northeast-1', 'us-east-1'],
            },
          },
        }),
      ],
    });
    developerGroup.addManagedPolicy(restrictedPolicy);
 
    // EC2 用ロール
    const ec2Role = new iam.Role(this, 'EC2WebServerRole', {
      roleName: 'ec2-webserver-role',
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
      ],
      maxSessionDuration: cdk.Duration.hours(4),
    });
 
    // Lambda 実行ロール
    const lambdaRole = new iam.Role(this, 'LambdaExecutionRole', {
      roleName: 'lambda-execution-role',
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          'service-role/AWSLambdaBasicExecutionRole'
        ),
      ],
      inlinePolicies: {
        dynamoAccess: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              actions: [
                'dynamodb:GetItem',
                'dynamodb:PutItem',
                'dynamodb:Query',
              ],
              resources: [
                `arn:aws:dynamodb:${this.region}:${this.account}:table/MyTable`,
              ],
            }),
          ],
        }),
      },
    });
 
    // 出力
    new cdk.CfnOutput(this, 'EC2RoleArn', {
      value: ec2Role.roleArn,
      exportName: 'ec2-webserver-role-arn',
    });
  }
}

# main.tf
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
provider "aws" {
  region = "ap-northeast-1"
}
 
# IAM グループ
resource "aws_iam_group" "developers" {
  name = "developers"
  path = "/teams/"
}
 
resource "aws_iam_group" "readonly" {
  name = "readonly"
  path = "/teams/"
}
 
# グループポリシーアタッチメント
resource "aws_iam_group_policy_attachment" "developers_power_user" {
  group      = aws_iam_group.developers.name
  policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
}
 
resource "aws_iam_group_policy_attachment" "readonly_access" {
  group      = aws_iam_group.readonly.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}
 
# カスタムポリシー
resource "aws_iam_policy" "developer_restrictions" {
  name        = "developer-restrictions"
  description = "開発者の権限制限"
  policy      = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyDangerousActions"
        Effect = "Deny"
        Action = [
          "iam:CreateUser",
          "iam:DeleteUser",
          "iam:CreateRole",
          "iam:DeleteRole",
          "organizations:*",
        ]
        Resource = "*"
      },
      {
        Sid    = "RestrictRegions"
        Effect = "Deny"
        NotAction = [
          "iam:*",
          "sts:*",
          "support:*",
        ]
        Resource = "*"
        Condition = {
          StringNotEquals = {
            "aws:RequestedRegion" = ["ap-northeast-1", "us-east-1"]
          }
        }
      }
    ]
  })
}
 
resource "aws_iam_group_policy_attachment" "developers_restrictions" {
  group      = aws_iam_group.developers.name
  policy_arn = aws_iam_policy.developer_restrictions.arn
}
 
# EC2 用ロール
resource "aws_iam_role" "ec2_webserver" {
  name = "ec2-webserver-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "ec2.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
  max_session_duration = 14400  # 4時間
}
 
resource "aws_iam_role_policy_attachment" "ec2_s3_readonly" {
  role       = aws_iam_role.ec2_webserver.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}
 
resource "aws_iam_instance_profile" "ec2_webserver" {
  name = "ec2-webserver-profile"
  role = aws_iam_role.ec2_webserver.name
}
 
# パスワードポリシー
resource "aws_iam_account_password_policy" "strict" {
  minimum_password_length        = 14
  require_lowercase_characters   = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_symbols                = true
  allow_users_to_change_password = true
  max_password_age               = 90
  password_reuse_prevention      = 12
  hard_expiry                    = true
}
 
# 出力
output "ec2_webserver_role_arn" {
  value       = aws_iam_role.ec2_webserver.arn
  description = "EC2 Web Server ロールの ARN"
}

# アクセスキーの最終使用日を確認
aws iam get-access-key-last-used \
  --access-key-id AKIAIOSFODNN7EXAMPLE
 
# 90日以上未使用のキーを一覧表示
aws iam list-access-keys --user-name tanaka
# → CreateDate を確認し、古いキーは無効化 → 削除
 
# アクセスキーのローテーションスクリプト
#!/bin/bash
USER_NAME="tanaka"
OLD_KEY_ID=$(aws iam list-access-keys --user-name "$USER_NAME" \
  --query 'AccessKeyMetadata[0].AccessKeyId' --output text)
 
# 新しいキーを作成
NEW_KEY=$(aws iam create-access-key --user-name "$USER_NAME")
echo "新しいアクセスキー: $(echo $NEW_KEY | jq -r '.AccessKey.AccessKeyId')"
 
# アプリケーションに新しいキーを設定した後に古いキーを削除
# aws iam delete-access-key --user-name "$USER_NAME" --access-key-id "$OLD_KEY_ID"

# 緊急対応スクリプト
#!/bin/bash
echo "=== 不正アクセス緊急対応 ==="
 
# 1. 全 IAM ユーザーのアクセスキーを無効化
for user in $(aws iam list-users --query 'Users[].UserName' --output text); do
  for key in $(aws iam list-access-keys --user-name "$user" \
    --query 'AccessKeyMetadata[].AccessKeyId' --output text); do
    aws iam update-access-key --user-name "$user" --access-key-id "$key" --status Inactive
    echo "無効化: $user / $key"
  done
done
 
# 2. 不審な EC2 インスタンスを停止
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].[InstanceId,LaunchTime,InstanceType]' \
  --output table
 
# 3. CloudTrail で不審なアクティビティを確認
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --start-time "$(date -v-24H -u +%Y-%m-%dT%H:%M:%SZ)" \
  --query 'Events[].[EventTime,Username,EventName]' \
  --output table