# IAM User の作成（非推奨だがレガシー対応）
aws iam create-user --user-name legacy-service-user
aws iam create-access-key --user-name legacy-service-user
 
# IAM Group の作成とユーザー追加
aws iam create-group --group-name Developers
aws iam add-user-to-group --group-name Developers --user-name dev-user-01
aws iam attach-group-policy \
  --group-name Developers \
  --policy-arn arn:aws:iam::123456789012:policy/DeveloperAccess
 
# IAM Role の作成（推奨）
aws iam create-role \
  --role-name MyAppRole \
  --assume-role-policy-document file://trust-policy.json \
  --tags Key=Environment,Value=Production Key=Team,Value=Backend
 
# IAM Role にポリシーをアタッチ
aws iam attach-role-policy \
  --role-name MyAppRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 
# インラインポリシーの追加（特定ロール固有の権限）
aws iam put-role-policy \
  --role-name MyAppRole \
  --policy-name CustomDynamoDBAccess \
  --policy-document file://dynamodb-policy.json

#!/bin/bash
# IAM ユーザーの棚卸しスクリプト
# 90日以上アクセスキーを使っていないユーザーを検出
 
echo "=== IAM User Access Key Audit ==="
echo "Date: $(date)"
echo ""
 
aws iam generate-credential-report > /dev/null 2>&1
sleep 5
 
aws iam get-credential-report \
  --query 'Content' \
  --output text | base64 -d | \
  awk -F',' 'NR>1 {
    user=$1;
    key1_active=$9;
    key1_last_used=$11;
    key2_active=$14;
    key2_last_used=$16;
    mfa=$8;
    printf "User: %-30s MFA: %-5s Key1Active: %-5s Key1LastUsed: %-20s Key2Active: %-5s Key2LastUsed: %-20s\n",
      user, mfa, key1_active, key1_last_used, key2_active, key2_last_used
  }'
 
echo ""
echo "=== 90日以上未使用のアクセスキー ==="
THRESHOLD=$(date -d "90 days ago" +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -v-90d +%Y-%m-%dT%H:%M:%S)
 
for user in $(aws iam list-users --query 'Users[*].UserName' --output text); do
  for key_id in $(aws iam list-access-keys --user-name "$user" \
    --query 'AccessKeyMetadata[?Status==`Active`].AccessKeyId' --output text); do
 
    last_used=$(aws iam get-access-key-last-used --access-key-id "$key_id" \
      --query 'AccessKeyLastUsed.LastUsedDate' --output text)
 
    if [[ "$last_used" < "$THRESHOLD" ]] || [[ "$last_used" == "None" ]]; then
      echo "STALE: User=$user KeyId=$key_id LastUsed=$last_used"
    fi
  done
done

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "ap-northeast-1"
        },
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        },
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    },
    {
      "Sid": "DenyDeleteActions",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowTagBasedAccess",
      "Effect": "Allow",
      "Action": ["ec2:StartInstances", "ec2:StopInstances"],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "${aws:PrincipalTag/Environment}"
        }
      }
    },
    {
      "Sid": "RestrictToWorkingHours",
      "Effect": "Deny",
      "Action": ["rds:DeleteDBInstance", "rds:DeleteDBCluster"],
      "Resource": "*",
      "Condition": {
        "DateGreaterThan": {
          "aws:CurrentTime": "2026-01-01T00:00:00Z"
        },
        "NumericGreaterThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    },
    {
      "Sid": "RequireMFA",
      "Effect": "Deny",
      "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "sts:GetSessionToken"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConditionOperatorExamples",
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3:prefix": "home/${aws:username}/"
        },
        "StringLike": {
          "s3:prefix": ["home/*", "shared/*"]
        },
        "StringNotEquals": {
          "aws:RequestedRegion": "us-east-1"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:sns:*:123456789012:*"
        },
        "IpAddress": {
          "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
        },
        "NotIpAddress": {
          "aws:SourceIp": "0.0.0.0/0"
        },
        "DateLessThan": {
          "aws:CurrentTime": "2026-12-31T23:59:59Z"
        },
        "NumericLessThanEquals": {
          "s3:max-keys": "100"
        },
        "Bool": {
          "aws:SecureTransport": "true"
        },
        "Null": {
          "aws:TokenIssueTime": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": ["Environment", "Project"]
        },
        "ForAnyValue:StringLike": {
          "aws:PrincipalOrgPaths": ["o-xxx/r-xxx/ou-xxx/*"]
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ABACFullExample",
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Project": "${aws:PrincipalTag/Project}",
          "ec2:ResourceTag/Environment": "${aws:PrincipalTag/Environment}"
        }
      }
    },
    {
      "Sid": "AllowCreateTaggedResources",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/Project": "${aws:PrincipalTag/Project}",
          "aws:RequestTag/Environment": "${aws:PrincipalTag/Environment}"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": ["Project", "Environment", "Name"]
        }
      }
    },
    {
      "Sid": "DenyUntaggedResources",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/Project": "true",
          "aws:RequestTag/Environment": "true"
        }
      }
    },
    {
      "Sid": "AllowS3HomeDirectory",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::company-data/home/${aws:PrincipalTag/Department}/${aws:userid}/*"
    }
  ]
}

import boto3
from datetime import datetime
 
# クロスアカウントの AssumeRole
def assume_cross_account_role(
    role_arn: str,
    session_name: str,
    external_id: str = None,
    duration_seconds: int = 3600,
) -> boto3.Session:
    """別アカウントのロールを引き受けてセッションを返す"""
    sts = boto3.client("sts")
 
    params = {
        "RoleArn": role_arn,
        "RoleSessionName": session_name,
        "DurationSeconds": duration_seconds,
    }
    if external_id:
        params["ExternalId"] = external_id
 
    response = sts.assume_role(**params)
    credentials = response["Credentials"]
 
    return boto3.Session(
        aws_access_key_id=credentials["AccessKeyId"],
        aws_secret_access_key=credentials["SecretAccessKey"],
        aws_session_token=credentials["SessionToken"],
    )
 
# 使用例: Account B の S3 にアクセス
session_b = assume_cross_account_role(
    role_arn="arn:aws:iam::222222222222:role/CrossAccountS3Access",
    session_name="my-app-session",
    external_id="UniqueExternalId123",
)
 
s3 = session_b.client("s3")
objects = s3.list_objects_v2(Bucket="account-b-bucket")

def assume_role_chain(role_chain: list[dict]) -> boto3.Session:
    """複数のロールを連鎖的に引き受ける
 
    Args:
        role_chain: [{"role_arn": "...", "session_name": "...", "external_id": "..."}]
 
    Returns:
        最終ロールのセッション
    """
    session = boto3.Session()  # 初期セッション（元のクレデンシャル）
 
    for i, role_config in enumerate(role_chain):
        sts = session.client("sts")
        params = {
            "RoleArn": role_config["role_arn"],
            "RoleSessionName": role_config.get("session_name", f"chain-step-{i}"),
            "DurationSeconds": role_config.get("duration", 3600),
        }
        if "external_id" in role_config:
            params["ExternalId"] = role_config["external_id"]
 
        response = sts.assume_role(**params)
        creds = response["Credentials"]
 
        session = boto3.Session(
            aws_access_key_id=creds["AccessKeyId"],
            aws_secret_access_key=creds["SecretAccessKey"],
            aws_session_token=creds["SessionToken"],
        )
        print(f"Step {i+1}: Assumed {role_config['role_arn']}")
        print(f"  Expiration: {creds['Expiration']}")
 
    return session
 
# 使用例: Management Account → Security Account → Target Account
final_session = assume_role_chain([
    {
        "role_arn": "arn:aws:iam::111111111111:role/SecurityHubRole",
        "session_name": "security-audit",
    },
    {
        "role_arn": "arn:aws:iam::222222222222:role/AuditTargetRole",
        "session_name": "target-audit",
        "external_id": "audit-2026",
    },
])

def assume_role_with_tags(
    role_arn: str,
    session_name: str,
    tags: dict[str, str],
    transitive_keys: list[str] = None,
) -> boto3.Session:
    """セッションタグ付きで AssumeRole"""
    sts = boto3.client("sts")
 
    session_tags = [
        {"Key": k, "Value": v} for k, v in tags.items()
    ]
 
    params = {
        "RoleArn": role_arn,
        "RoleSessionName": session_name,
        "Tags": session_tags,
    }
 
    if transitive_keys:
        params["TransitiveTagKeys"] = transitive_keys
 
    response = sts.assume_role(**params)
    creds = response["Credentials"]
 
    return boto3.Session(
        aws_access_key_id=creds["AccessKeyId"],
        aws_secret_access_key=creds["SecretAccessKey"],
        aws_session_token=creds["SessionToken"],
    )
 
# セッションタグでコスト配分・アクセス制御を動的に設定
session = assume_role_with_tags(
    role_arn="arn:aws:iam::123456789012:role/DeveloperRole",
    session_name="dev-session",
    tags={
        "Project": "payment-service",
        "CostCenter": "engineering-tokyo",
        "Environment": "staging",
    },
    transitive_keys=["Project", "CostCenter"],  # ロールチェーンで引き継ぐタグ
)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "UniqueExternalId123"
        }
      }
    },
    {
      "Sid": "AllowGitHubOIDC",
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:*"
        }
      }
    },
    {
      "Sid": "AllowEC2",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

# .github/workflows/deploy.yml
name: Deploy to AWS
on:
  push:
    branches: [main]
 
permissions:
  id-token: write   # OIDC トークンの発行に必要
  contents: read
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsDeployRole
          aws-region: ap-northeast-1
          role-session-name: github-actions-${{ github.run_id }}
 
      - name: Deploy
        run: |
          aws sts get-caller-identity
          aws s3 sync ./dist s3://my-app-bucket/

# OIDC プロバイダの作成
aws iam create-open-id-connect-provider \
  --url "https://token.actions.githubusercontent.com" \
  --client-id-list "sts.amazonaws.com" \
  --thumbprint-list "6938fd4d98bab03faadb97b34396831e3780aea1"
 
# GitHub Actions 用ロールの作成
aws iam create-role \
  --role-name GitHubActionsDeployRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
          },
          "StringLike": {
            "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:ref:refs/heads/main"
          }
        }
      }
    ]
  }'

# 1. IAM Access Analyzer で必要な権限を分析
aws accessanalyzer create-analyzer \
  --analyzer-name my-analyzer \
  --type ACCOUNT
 
# 2. CloudTrail から実際に使用されたアクションを抽出
aws accessanalyzer generate-findings-report \
  --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/my-analyzer
 
# 3. IAM Access Analyzer でポリシーを生成
aws accessanalyzer generate-policy \
  --policy-generation-details '{
    "trailProperties": {
      "cloudTrailArn": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail/my-trail",
      "regions": ["ap-northeast-1"],
      "allRegions": false
    },
    "principalArn": "arn:aws:iam::123456789012:role/MyAppRole"
  }'
 
# 4. 未使用の権限を確認
aws iam generate-service-last-accessed-details \
  --arn arn:aws:iam::123456789012:role/MyAppRole
 
aws iam get-service-last-accessed-details \
  --job-id "job-id-from-above"
 
# 5. Access Analyzer で生成されたポリシーの取得
aws accessanalyzer get-generated-policy \
  --job-id "policy-generation-job-id" \
  --include-resource-placeholders

import boto3
import json
from datetime import datetime, timedelta
 
def audit_unused_permissions(days_threshold: int = 90) -> list[dict]:
    """未使用の IAM 権限を検出する"""
    iam = boto3.client("iam")
    results = []
 
    # 全ロールの一覧取得
    paginator = iam.get_paginator("list_roles")
    for page in paginator.paginate():
        for role in page["Roles"]:
            role_name = role["RoleName"]
 
            # AWS サービスロールはスキップ
            if role_name.startswith("aws-service-role/"):
                continue
 
            # サービス最終アクセス情報を取得
            job_id = iam.generate_service_last_accessed_details(
                Arn=role["Arn"]
            )["JobId"]
 
            # ジョブ完了を待機
            import time
            while True:
                result = iam.get_service_last_accessed_details(JobId=job_id)
                if result["JobStatus"] == "COMPLETED":
                    break
                time.sleep(1)
 
            threshold_date = datetime.now() - timedelta(days=days_threshold)
 
            for service in result["ServicesLastAccessed"]:
                last_accessed = service.get("LastAuthenticated")
                if last_accessed and last_accessed.replace(tzinfo=None) < threshold_date:
                    results.append({
                        "Role": role_name,
                        "Service": service["ServiceNamespace"],
                        "LastAccessed": str(last_accessed),
                        "DaysUnused": (datetime.now() - last_accessed.replace(tzinfo=None)).days,
                    })
                elif last_accessed is None and service.get("TotalAuthenticatedEntities", 0) == 0:
                    results.append({
                        "Role": role_name,
                        "Service": service["ServiceNamespace"],
                        "LastAccessed": "Never",
                        "DaysUnused": "N/A",
                    })
 
    return results
 
# 実行
unused = audit_unused_permissions(90)
for item in unused:
    print(f"Role: {item['Role']}, Service: {item['Service']}, "
          f"Last: {item['LastAccessed']}, Unused: {item['DaysUnused']} days")

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DynamoDBMinimalAccess",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": [
        "arn:aws:dynamodb:ap-northeast-1:123456789012:table/Users",
        "arn:aws:dynamodb:ap-northeast-1:123456789012:table/Users/index/*"
      ]
    },
    {
      "Sid": "S3SpecificBucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-app-uploads/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    },
    {
      "Sid": "CloudWatchLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:ap-northeast-1:123456789012:log-group:/aws/lambda/my-function:*"
    }
  ]
}

# Permission Boundary ポリシーの作成
aws iam create-policy \
  --policy-name DeveloperBoundary \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowedServices",
        "Effect": "Allow",
        "Action": [
          "s3:*",
          "dynamodb:*",
          "lambda:*",
          "logs:*",
          "cloudwatch:*",
          "sqs:*",
          "sns:*",
          "apigateway:*",
          "xray:*"
        ],
        "Resource": "*"
      },
      {
        "Sid": "DenyDangerousActions",
        "Effect": "Deny",
        "Action": [
          "iam:CreateUser",
          "iam:DeleteUser",
          "iam:CreateRole",
          "iam:DeleteRole",
          "organizations:*",
          "account:*"
        ],
        "Resource": "*"
      }
    ]
  }'
 
# ロールに Permission Boundary を設定
aws iam put-role-permissions-boundary \
  --role-name DeveloperRole \
  --permissions-boundary "arn:aws:iam::123456789012:policy/DeveloperBoundary"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCreateRolesWithBoundary",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy"
      ],
      "Resource": "arn:aws:iam::123456789012:role/app-*",
      "Condition": {
        "StringEquals": {
          "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/DeveloperBoundary"
        }
      }
    },
    {
      "Sid": "DenyBoundaryModification",
      "Effect": "Deny",
      "Action": [
        "iam:DeleteRolePermissionsBoundary",
        "iam:PutRolePermissionsBoundary"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyBoundaryPolicyModification",
      "Effect": "Deny",
      "Action": [
        "iam:CreatePolicyVersion",
        "iam:DeletePolicy",
        "iam:DeletePolicyVersion",
        "iam:SetDefaultPolicyVersion"
      ],
      "Resource": "arn:aws:iam::123456789012:policy/DeveloperBoundary"
    }
  ]
}

# Permission Set の作成
aws sso-admin create-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-xxxxxxxxxxxx" \
  --name "DeveloperAccess" \
  --description "Developer permissions for dev/staging accounts" \
  --session-duration "PT8H" \
  --relay-state "https://ap-northeast-1.console.aws.amazon.com/"
 
# AWS マネージドポリシーのアタッチ
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-xxxxxxxxxxxx" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-xxxxxxxxxxxx/ps-xxxxxxxxxxxx" \
  --managed-policy-arn "arn:aws:iam::aws:policy/PowerUserAccess"
 
# カスタムインラインポリシーのアタッチ
aws sso-admin put-inline-policy-to-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-xxxxxxxxxxxx" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-xxxxxxxxxxxx/ps-xxxxxxxxxxxx" \
  --inline-policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "DenyProductionResourceDeletion",
        "Effect": "Deny",
        "Action": [
          "rds:DeleteDBInstance",
          "rds:DeleteDBCluster",
          "ec2:TerminateInstances",
          "s3:DeleteBucket"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "aws:ResourceTag/Environment": "production"
          }
        }
      }
    ]
  }'
 
# Permission Set をアカウントに割り当て
aws sso-admin create-account-assignment \
  --instance-arn "arn:aws:sso:::instance/ssoins-xxxxxxxxxxxx" \
  --target-id "111111111111" \
  --target-type AWS_ACCOUNT \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-xxxxxxxxxxxx/ps-xxxxxxxxxxxx" \
  --principal-type GROUP \
  --principal-id "group-id-from-identity-store"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRegionsOutsideAllowed",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "ap-northeast-1",
            "us-east-1"
          ]
        },
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/OrganizationAccountAccessRole"
          ]
        }
      }
    },
    {
      "Sid": "DenyRootAccountUsage",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:root"
        }
      }
    },
    {
      "Sid": "DenyCloudTrailModification",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail",
        "cloudtrail:UpdateTrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyGuardDutyDisable",
      "Effect": "Deny",
      "Action": [
        "guardduty:DisableOrganizationAdminAccount",
        "guardduty:DeleteDetector",
        "guardduty:DeleteMembers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyLeavingOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    },
    {
      "Sid": "RequireS3Encryption",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": ["aws:kms", "AES256"]
        },
        "Null": {
          "s3:x-amz-server-side-encryption": "false"
        }
      }
    }
  ]
}

import boto3
import json
from datetime import datetime, timedelta
 
def monitor_iam_events(hours: int = 24) -> list[dict]:
    """過去N時間のIAM関連イベントを監視"""
    ct = boto3.client("cloudtrail", region_name="ap-northeast-1")
 
    start_time = datetime.utcnow() - timedelta(hours=hours)
    end_time = datetime.utcnow()
 
    critical_events = [
        "CreateUser", "DeleteUser",
        "CreateRole", "DeleteRole",
        "AttachUserPolicy", "AttachRolePolicy",
        "PutUserPolicy", "PutRolePolicy",
        "CreateAccessKey",
        "UpdateAssumeRolePolicy",
        "CreateLoginProfile",
        "DeactivateMFADevice",
    ]
 
    results = []
    for event_name in critical_events:
        response = ct.lookup_events(
            LookupAttributes=[
                {"AttributeKey": "EventName", "AttributeValue": event_name}
            ],
            StartTime=start_time,
            EndTime=end_time,
            MaxResults=50,
        )
 
        for event in response.get("Events", []):
            detail = json.loads(event["CloudTrailEvent"])
            results.append({
                "EventTime": str(event["EventTime"]),
                "EventName": event["EventName"],
                "Username": event.get("Username", "N/A"),
                "SourceIP": detail.get("sourceIPAddress", "N/A"),
                "UserAgent": detail.get("userAgent", "N/A"),
                "ErrorCode": detail.get("errorCode", "None"),
                "Resources": [r.get("ARN", "") for r in event.get("Resources", [])],
            })
 
    return sorted(results, key=lambda x: x["EventTime"], reverse=True)

# CloudFormation: IAM 変更の自動検知
AWSTemplateFormatVersion: "2010-09-09"
Resources:
  IAMChangeEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: iam-critical-change-alert
      Description: "Detect critical IAM changes"
      EventPattern:
        source:
          - "aws.iam"
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
            - "iam.amazonaws.com"
          eventName:
            - "CreateUser"
            - "CreateAccessKey"
            - "AttachUserPolicy"
            - "AttachRolePolicy"
            - "PutUserPolicy"
            - "PutRolePolicy"
            - "DeleteRolePermissionsBoundary"
            - "UpdateAssumeRolePolicy"
            - "DeactivateMFADevice"
      State: ENABLED
      Targets:
        - Arn: !GetAtt AlertFunction.Arn
          Id: iam-alert-lambda
        - Arn: !Ref AlertTopic
          Id: iam-alert-sns
 
  AlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: iam-security-alerts
      Subscription:
        - Protocol: email
          Endpoint: security-team@example.com
 
  AlertFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: iam-change-alerter
      Runtime: python3.12
      Handler: index.handler
      Role: !GetAtt AlertFunctionRole.Arn
      Code:
        ZipFile: |
          import json
          import boto3
          import os
 
          def handler(event, context):
              sns = boto3.client("sns")
              detail = event["detail"]
 
              message = {
                  "Event": detail["eventName"],
                  "User": detail.get("userIdentity", {}).get("arn", "Unknown"),
                  "SourceIP": detail.get("sourceIPAddress", "Unknown"),
                  "Time": detail.get("eventTime", "Unknown"),
                  "Region": detail.get("awsRegion", "Unknown"),
                  "RequestParameters": detail.get("requestParameters", {}),
              }
 
              sns.publish(
                  TopicArn=os.environ["TOPIC_ARN"],
                  Subject=f"IAM Alert: {detail['eventName']}",
                  Message=json.dumps(message, indent=2, default=str)
              )
      Environment:
        Variables:
          TOPIC_ARN: !Ref AlertTopic

# Access Analyzer の作成（アカウントレベル）
aws accessanalyzer create-analyzer \
  --analyzer-name account-analyzer \
  --type ACCOUNT \
  --tags Environment=Production
 
# Access Analyzer の作成（組織レベル）
aws accessanalyzer create-analyzer \
  --analyzer-name org-analyzer \
  --type ORGANIZATION \
  --tags Environment=Production
 
# 検出結果の一覧取得
aws accessanalyzer list-findings \
  --analyzer-arn "arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/account-analyzer" \
  --filter '{
    "status": {"eq": ["ACTIVE"]},
    "resourceType": {"eq": ["AWS::S3::Bucket", "AWS::IAM::Role"]}
  }'
 
# 検出結果の詳細
aws accessanalyzer get-finding \
  --analyzer-arn "arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/account-analyzer" \
  --id "finding-id-xxxx"
 
# 未使用アクセスの検出（IAM Access Analyzer v2）
aws accessanalyzer create-analyzer \
  --analyzer-name unused-access-analyzer \
  --type ACCOUNT_UNUSED_ACCESS \
  --configuration '{
    "unusedAccess": {
      "unusedAccessAge": 90
    }
  }'

import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';
 
export class IamStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
 
    // Permission Boundary の定義
    const boundary = new iam.ManagedPolicy(this, 'DeveloperBoundary', {
      managedPolicyName: 'DeveloperBoundary',
      statements: [
        new iam.PolicyStatement({
          sid: 'AllowedServices',
          effect: iam.Effect.ALLOW,
          actions: [
            's3:*', 'dynamodb:*', 'lambda:*',
            'logs:*', 'cloudwatch:*', 'sqs:*',
            'sns:*', 'apigateway:*', 'xray:*',
          ],
          resources: ['*'],
        }),
        new iam.PolicyStatement({
          sid: 'DenyDangerousActions',
          effect: iam.Effect.DENY,
          actions: [
            'iam:CreateUser', 'iam:DeleteUser',
            'organizations:*', 'account:*',
          ],
          resources: ['*'],
        }),
      ],
    });
 
    // アプリケーションロールの定義
    const appRole = new iam.Role(this, 'AppRole', {
      roleName: 'MyAppRole',
      assumedBy: new iam.CompositePrincipal(
        new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
        new iam.ServicePrincipal('lambda.amazonaws.com'),
      ),
      permissionsBoundary: boundary,
      maxSessionDuration: cdk.Duration.hours(4),
    });
 
    // 最小権限ポリシーの定義
    appRole.addToPolicy(new iam.PolicyStatement({
      sid: 'DynamoDBAccess',
      actions: [
        'dynamodb:GetItem', 'dynamodb:PutItem',
        'dynamodb:UpdateItem', 'dynamodb:Query',
      ],
      resources: [
        `arn:aws:dynamodb:${this.region}:${this.account}:table/Users`,
        `arn:aws:dynamodb:${this.region}:${this.account}:table/Users/index/*`,
      ],
    }));
 
    appRole.addToPolicy(new iam.PolicyStatement({
      sid: 'S3Access',
      actions: ['s3:GetObject', 's3:PutObject'],
      resources: ['arn:aws:s3:::my-app-uploads/*'],
      conditions: {
        'StringEquals': {
          's3:x-amz-server-side-encryption': 'aws:kms',
        },
      },
    }));
 
    // OIDC プロバイダと GitHub Actions ロール
    const githubOidc = new iam.OpenIdConnectProvider(this, 'GitHubOidc', {
      url: 'https://token.actions.githubusercontent.com',
      clientIds: ['sts.amazonaws.com'],
    });
 
    const githubRole = new iam.Role(this, 'GitHubDeployRole', {
      roleName: 'GitHubActionsDeployRole',
      assumedBy: new iam.OpenIdConnectPrincipal(githubOidc, {
        'StringEquals': {
          'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
        },
        'StringLike': {
          'token.actions.githubusercontent.com:sub': 'repo:my-org/my-repo:*',
        },
      }),
      maxSessionDuration: cdk.Duration.hours(1),
    });
 
    // タグの付与
    cdk.Tags.of(appRole).add('Environment', 'Production');
    cdk.Tags.of(appRole).add('ManagedBy', 'CDK');
  }
}