# ワークロード一覧の取得
aws wellarchitected list-workloads \
  --query 'WorkloadSummaries[*].{Name:WorkloadName,Id:WorkloadId,Risk:RiskCounts}'
 
# ワークロードの作成
aws wellarchitected create-workload \
  --workload-name "MyApp-Production" \
  --description "Production e-commerce application" \
  --environment PRODUCTION \
  --review-owner "architect@example.com" \
  --lenses wellarchitected serverless \
  --aws-regions ap-northeast-1 \
  --tags Project=myapp,Environment=production
 
# 特定の柱の質問一覧を取得
aws wellarchitected list-answers \
  --workload-id "abc123def456" \
  --lens-alias wellarchitected \
  --pillar-id operationalExcellence \
  --query 'AnswerSummaries[*].{Q:QuestionTitle,Risk:Risk}'
 
# 質問への回答を更新
aws wellarchitected update-answer \
  --workload-id "abc123def456" \
  --lens-alias wellarchitected \
  --question-id "ops-how-do-you-design-workload" \
  --selected-choices "ops_ops-how-do-you-design-workload_1" "ops_ops-how-do-you-design-workload_2" \
  --notes "IaC with CDK, CI/CD with CodePipeline"
 
# マイルストーンの作成
aws wellarchitected create-milestone \
  --workload-id "abc123def456" \
  --milestone-name "Q1-2025-Review"
 
# レビュー結果のレポート取得
aws wellarchitected get-lens-review-report \
  --workload-id "abc123def456" \
  --lens-alias wellarchitected \
  --query 'LensReviewReport.Base64String' \
  --output text | base64 --decode > wa-report.pdf

# 設計原則
principles:
  - 運用をコードとして管理 (IaC)
  - 小さく可逆的な変更を頻繁に行う
  - 運用手順を頻繁に改善する
  - 障害を予測する
  - 全ての運用上の障害から学ぶ
 
# チェックリスト例
checklist:
  organization:
    - チームの責任範囲が明確か
    - 運用の優先順位がビジネス目標と整合しているか
  prepare:
    - ワークロードの可観測性が設計されているか
    - デプロイ戦略 (Blue/Green, Canary) が定義されているか
  operate:
    - ランブックとプレイブックが整備されているか
    - ダッシュボードとアラートが適切に設定されているか
  evolve:
    - ポストモーテム (振り返り) プロセスがあるか
    - 改善項目がバックログに追加されているか

# === IaC (Infrastructure as Code) の実装 ===
 
# CloudFormation スタックのドリフト検出
aws cloudformation detect-stack-drift --stack-name my-production-stack
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id "aaaabbbb-1234-5678"
 
# Systems Manager Automation でランブックを自動化
aws ssm start-automation-execution \
  --document-name "AWS-RestartEC2Instance" \
  --parameters '{"InstanceId":["i-0123456789abcdef0"]}'
 
# === 可観測性の実装 ===
 
# CloudWatch ダッシュボードの作成
aws cloudwatch put-dashboard \
  --dashboard-name "ProductionOverview" \
  --dashboard-body file://dashboard-definition.json
 
# X-Ray トレーシンググループの作成
aws xray create-group \
  --group-name "HighLatencyTraces" \
  --filter-expression 'responsetime > 5'
 
# CloudWatch Synthetics Canary でエンドポイント監視
aws synthetics create-canary \
  --name "api-health-check" \
  --artifact-s3-location "s3://my-canary-artifacts/" \
  --execution-role-arn "arn:aws:iam::123456789012:role/canary-role" \
  --schedule '{"Expression":"rate(5 minutes)"}' \
  --runtime-version "syn-nodejs-puppeteer-6.2" \
  --code '{"Handler":"apiCanary.handler","ZipFile":"..."}'
 
# === デプロイ戦略 ===
 
# CodeDeploy で Blue/Green デプロイ設定
aws deploy create-deployment-group \
  --application-name MyApp \
  --deployment-group-name Production \
  --deployment-config-name CodeDeployDefault.ECSLinear10PercentEvery1Minutes \
  --ecs-services '[{"ServiceName":"my-service","ClusterName":"my-cluster"}]' \
  --load-balancer-info '{"TargetGroupPairInfoList":[{"TargetGroups":[{"Name":"blue-tg"},{"Name":"green-tg"}],"ProdTrafficRoute":{"ListenerArns":["arn:aws:elasticloadbalancing:..."]}}]}'

# 図1: 運用ダッシュボード自動生成スクリプト
import boto3
import json
 
def create_operations_dashboard(stack_name: str, region: str = "ap-northeast-1"):
    """CloudFormation スタックから自動的に運用ダッシュボードを生成"""
    cf_client = boto3.client("cloudformation", region_name=region)
    cw_client = boto3.client("cloudwatch", region_name=region)
 
    # スタックのリソースを取得
    resources = cf_client.list_stack_resources(StackName=stack_name)
    widgets = []
    y_pos = 0
 
    for resource in resources["StackResourceSummaries"]:
        resource_type = resource["ResourceType"]
        logical_id = resource["LogicalResourceId"]
        physical_id = resource["PhysicalResourceId"]
 
        if resource_type == "AWS::ECS::Service":
            # ECS サービスのCPU/メモリウィジェット
            cluster_name, service_name = physical_id.rsplit("/", 1)
            widgets.append({
                "type": "metric",
                "x": 0, "y": y_pos, "width": 12, "height": 6,
                "properties": {
                    "title": f"ECS: {logical_id}",
                    "metrics": [
                        ["AWS/ECS", "CPUUtilization", "ServiceName", service_name,
                         "ClusterName", cluster_name.split("/")[-1]],
                        [".", "MemoryUtilization", ".", ".", ".", "."],
                    ],
                    "period": 300,
                    "stat": "Average",
                    "region": region,
                },
            })
            y_pos += 6
 
        elif resource_type == "AWS::RDS::DBInstance":
            # RDS のコネクション数/CPU ウィジェット
            widgets.append({
                "type": "metric",
                "x": 0, "y": y_pos, "width": 12, "height": 6,
                "properties": {
                    "title": f"RDS: {logical_id}",
                    "metrics": [
                        ["AWS/RDS", "CPUUtilization",
                         "DBInstanceIdentifier", physical_id],
                        [".", "DatabaseConnections", ".", "."],
                        [".", "FreeStorageSpace", ".", "."],
                    ],
                    "period": 300,
                    "stat": "Average",
                    "region": region,
                },
            })
            y_pos += 6
 
        elif resource_type == "AWS::Lambda::Function":
            # Lambda のエラー率/実行時間ウィジェット
            widgets.append({
                "type": "metric",
                "x": 0, "y": y_pos, "width": 12, "height": 6,
                "properties": {
                    "title": f"Lambda: {logical_id}",
                    "metrics": [
                        ["AWS/Lambda", "Errors", "FunctionName", physical_id],
                        [".", "Duration", ".", "."],
                        [".", "ConcurrentExecutions", ".", "."],
                    ],
                    "period": 300,
                    "stat": "Sum",
                    "region": region,
                },
            })
            y_pos += 6
 
    # ダッシュボード作成
    dashboard_body = {"widgets": widgets}
    cw_client.put_dashboard(
        DashboardName=f"{stack_name}-operations",
        DashboardBody=json.dumps(dashboard_body),
    )
    print(f"Dashboard created: {stack_name}-operations ({len(widgets)} widgets)")
    return dashboard_body

principles:
  - 強力な ID 基盤を実装する
  - トレーサビリティを有効にする
  - 全レイヤーにセキュリティを適用する
  - セキュリティのベストプラクティスを自動化する
  - 転送中および保管中のデータを保護する
  - データに人の手を触れさせない
  - セキュリティイベントに備える
 
checklist:
  identity:
    - MFA が全 IAM ユーザーに強制されているか
    - ルートアカウントが日常業務で使われていないか
    - 最小権限の原則が適用されているか
  detection:
    - CloudTrail が全リージョンで有効か
    - GuardDuty が有効か
    - Security Hub が設定されているか
  protection:
    - VPC フローログが有効か
    - WAF が設定されているか
    - データが暗号化されているか (KMS)

# 図2: Security Hub の検出結果を集約し自動修復をトリガーするスクリプト
import boto3
from datetime import datetime, timedelta
 
def audit_security_hub_findings(region: str = "ap-northeast-1"):
    """Security Hub の CRITICAL/HIGH 検出結果を取得し改善アクションを生成"""
    sh_client = boto3.client("securityhub", region_name=region)
 
    # 過去7日間のCRITICAL/HIGH検出結果を取得
    response = sh_client.get_findings(
        Filters={
            "SeverityLabel": [
                {"Value": "CRITICAL", "Comparison": "EQUALS"},
                {"Value": "HIGH", "Comparison": "EQUALS"},
            ],
            "WorkflowStatus": [
                {"Value": "NEW", "Comparison": "EQUALS"},
            ],
            "RecordState": [
                {"Value": "ACTIVE", "Comparison": "EQUALS"},
            ],
            "CreatedAt": [
                {
                    "Start": (datetime.utcnow() - timedelta(days=7)).isoformat() + "Z",
                    "End": datetime.utcnow().isoformat() + "Z",
                }
            ],
        },
        SortCriteria=[
            {"Field": "SeverityLabel", "SortOrder": "desc"},
        ],
        MaxResults=100,
    )
 
    findings_by_pillar = {
        "identity": [],
        "detection": [],
        "protection": [],
        "data_protection": [],
        "incident_response": [],
    }
 
    for finding in response["Findings"]:
        title = finding["Title"]
        severity = finding["Severity"]["Label"]
        resource_type = finding["Resources"][0]["Type"] if finding["Resources"] else "Unknown"
        resource_id = finding["Resources"][0]["Id"] if finding["Resources"] else "Unknown"
 
        item = {
            "title": title,
            "severity": severity,
            "resource_type": resource_type,
            "resource_id": resource_id,
            "standard": finding.get("ProductFields", {}).get("StandardsControlArn", ""),
            "remediation": finding.get("Remediation", {}).get("Recommendation", {}).get("Text", ""),
        }
 
        # 検出結果をカテゴリ別に分類
        if "IAM" in title or "MFA" in title or "credential" in title.lower():
            findings_by_pillar["identity"].append(item)
        elif "CloudTrail" in title or "GuardDuty" in title or "logging" in title.lower():
            findings_by_pillar["detection"].append(item)
        elif "encryption" in title.lower() or "KMS" in title or "S3" in title:
            findings_by_pillar["data_protection"].append(item)
        elif "VPC" in title or "Security Group" in title or "WAF" in title:
            findings_by_pillar["protection"].append(item)
        else:
            findings_by_pillar["incident_response"].append(item)
 
    # サマリーレポート生成
    total = sum(len(v) for v in findings_by_pillar.values())
    print(f"=== Security Hub Audit Report ===")
    print(f"Total findings: {total}")
    for category, items in findings_by_pillar.items():
        if items:
            print(f"\n[{category.upper()}] ({len(items)} findings)")
            for item in items:
                print(f"  [{item['severity']}] {item['title']}")
                print(f"    Resource: {item['resource_id']}")
                if item["remediation"]:
                    print(f"    Fix: {item['remediation'][:100]}...")
 
    return findings_by_pillar

# Security Hub の有効化と標準の適用
aws securityhub enable-security-hub \
  --enable-default-standards
 
# CIS AWS Foundations Benchmark の有効化
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[
    {"StandardsArn":"arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0"}
  ]'
 
# GuardDuty の有効化
aws guardduty create-detector --enable
 
# Config Rules のコンプライアンスサマリー
aws configservice get-compliance-summary-by-config-rule \
  --query 'ComplianceSummary.{Compliant:CompliantResourceCount.CappedCount,NonCompliant:NonCompliantResourceCount.CappedCount}'

principles:
  - 障害から自動的に復旧する
  - 復旧手順をテストする
  - 水平にスケールする
  - キャパシティの推測をやめる
  - 自動化で変更を管理する
 
checklist:
  foundations:
    - サービスクォータが適切に設定されているか
    - ネットワークトポロジが冗長化されているか
  workload_architecture:
    - マイクロサービス or SOA で障害分離ができているか
    - 分散システムでの障害処理が実装されているか
  change_management:
    - Auto Scaling が設定されているか
    - 変更がモニタリングされているか
  failure_management:
    - バックアップと DR 戦略が定義されているか
    - RTO/RPO が明確に定義されているか

# === サービスクォータの管理 ===
 
# 現在のクォータ値を確認
aws service-quotas get-service-quota \
  --service-code ec2 \
  --quota-code L-1216C47A  # Running On-Demand Standard instances
 
# クォータ引き上げリクエスト
aws service-quotas request-service-quota-increase \
  --service-code ec2 \
  --quota-code L-1216C47A \
  --desired-value 200
 
# === バックアップ戦略 ===
 
# AWS Backup プラン作成
aws backup create-backup-plan --backup-plan '{
  "BackupPlanName": "DailyBackup",
  "Rules": [
    {
      "RuleName": "DailyRule",
      "TargetBackupVaultName": "Default",
      "ScheduleExpression": "cron(0 3 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 120,
      "Lifecycle": {
        "DeleteAfterDays": 35,
        "MoveToColdStorageAfterDays": 7
      },
      "CopyActions": [
        {
          "DestinationBackupVaultArn": "arn:aws:backup:us-west-2:123456789012:backup-vault:DR-Vault",
          "Lifecycle": {"DeleteAfterDays": 90}
        }
      ]
    }
  ]
}'
 
# === Route 53 ヘルスチェック ===
 
# ヘルスチェックの作成
aws route53 create-health-check --caller-reference "$(date +%s)" \
  --health-check-config '{
    "IPAddress": "203.0.113.1",
    "Port": 443,
    "Type": "HTTPS",
    "ResourcePath": "/health",
    "FullyQualifiedDomainName": "api.example.com",
    "RequestInterval": 10,
    "FailureThreshold": 3,
    "EnableSNI": true
  }'
 
# フェイルオーバーレコードの作成
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890 \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "api.example.com",
        "Type": "A",
        "SetIdentifier": "primary",
        "Failover": "PRIMARY",
        "AliasTarget": {
          "HostedZoneId": "Z35SXDOTRQ7X7K",
          "DNSName": "alb-primary.ap-northeast-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true
        },
        "HealthCheckId": "abcd1234-5678-efgh"
      }
    }]
  }'

# 図3: サービスクォータ自動監視スクリプト
import boto3
 
def check_service_quotas(services: list[str], threshold_pct: float = 80.0):
    """サービスクォータの使用率をチェックし閾値超過をアラート"""
    sq_client = boto3.client("service-quotas", region_name="ap-northeast-1")
    alerts = []
 
    for service_code in services:
        try:
            paginator = sq_client.get_paginator("list_service_quotas")
            for page in paginator.paginate(ServiceCode=service_code):
                for quota in page["Quotas"]:
                    quota_name = quota["QuotaName"]
                    quota_value = quota["Value"]
 
                    # 使用量の取得（利用可能な場合）
                    if quota.get("UsageMetric"):
                        metric = quota["UsageMetric"]
                        cw_client = boto3.client("cloudwatch", region_name="ap-northeast-1")
                        stats = cw_client.get_metric_statistics(
                            Namespace=metric["MetricNamespace"],
                            MetricName=metric["MetricName"],
                            Dimensions=[
                                {"Name": k, "Value": v}
                                for k, v in metric.get("MetricDimensions", {}).items()
                            ],
                            StartTime="2025-01-01T00:00:00Z",
                            EndTime="2025-01-02T00:00:00Z",
                            Period=86400,
                            Statistics=[metric.get("MetricStatisticRecommendation", "Maximum")],
                        )
                        if stats["Datapoints"]:
                            usage = stats["Datapoints"][0].get("Maximum", 0)
                            usage_pct = (usage / quota_value) * 100 if quota_value > 0 else 0
 
                            if usage_pct >= threshold_pct:
                                alerts.append({
                                    "service": service_code,
                                    "quota": quota_name,
                                    "limit": quota_value,
                                    "usage": usage,
                                    "usage_pct": round(usage_pct, 1),
                                })
        except Exception as e:
            print(f"Error checking {service_code}: {e}")
 
    # アラートレポート
    if alerts:
        print(f"⚠ {len(alerts)} quotas above {threshold_pct}% threshold:")
        for a in alerts:
            print(f"  [{a['service']}] {a['quota']}: {a['usage']}/{a['limit']} ({a['usage_pct']}%)")
    else:
        print(f"All quotas below {threshold_pct}% threshold")
 
    return alerts
 
# 使用例
# check_service_quotas(["ec2", "lambda", "rds", "elasticloadbalancing"])

principles:
  - 高度なテクノロジーを民主化する
  - 数分でグローバルにデプロイする
  - サーバーレスアーキテクチャを活用する
  - より頻繁に実験する
  - メカニカルシンパシー (技術への共感) を持つ
 
checklist:
  selection:
    - ワークロードに最適なコンピュートタイプを選択しているか
      (EC2 / Lambda / ECS / EKS / Fargate)
    - ストレージ種別は適切か (gp3 / io2 / S3 Intelligent-Tiering)
    - データベースエンジンは適切か (Aurora / DynamoDB / ElastiCache)
  review:
    - ベンチマークテストが定期的に実施されているか
    - CloudWatch メトリクスでパフォーマンスを継続監視しているか
  monitoring:
    - P50/P90/P99 レイテンシが計測されているか
    - ボトルネックの特定プロセスがあるか (X-Ray / Profiler)
  tradeoffs:
    - キャッシュ戦略が定義されているか (CloudFront / ElastiCache / DAX)
    - リードレプリカが活用されているか

# === パフォーマンス分析 ===
 
# Compute Optimizer の推奨事項を取得
aws compute-optimizer get-ec2-instance-recommendations \
  --query 'InstanceRecommendations[*].{
    Instance:InstanceArn,
    Current:CurrentInstanceType,
    Recommended:RecommendationOptions[0].InstanceType,
    Finding:Finding,
    Savings:RecommendationOptions[0].ProjectedUtilizationMetrics[?Name==`CPU`].Value|[0]
  }'
 
# Lambda 関数のパフォーマンス分析
aws lambda get-function-configuration \
  --function-name my-function \
  --query '{MemorySize:MemorySize,Timeout:Timeout,Architecture:Architectures[0]}'
 
# Lambda Power Tuning の結果を確認（Step Functions 経由で実行後）
# 最適なメモリサイズを特定: 128MB → 256MB → 512MB → 1024MB の比較
 
# CloudFront キャッシュヒット率の確認
aws cloudwatch get-metric-statistics \
  --namespace AWS/CloudFront \
  --metric-name CacheHitRate \
  --dimensions Name=DistributionId,Value=E1234567890 \
  --start-time "$(date -u -v-7d +%Y-%m-%dT%H:%M:%SZ)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --period 86400 \
  --statistics Average
 
# RDS Performance Insights の有効化
aws rds modify-db-instance \
  --db-instance-identifier my-database \
  --enable-performance-insights \
  --performance-insights-retention-period 731

# 図4: パフォーマンスベースライン自動取得スクリプト
import boto3
from datetime import datetime, timedelta
 
def get_performance_baseline(resource_type: str, resource_id: str, days: int = 30):
    """リソースの過去N日間のパフォーマンスベースラインを取得"""
    cw = boto3.client("cloudwatch", region_name="ap-northeast-1")
    end_time = datetime.utcnow()
    start_time = end_time - timedelta(days=days)
 
    metrics_map = {
        "ec2": {
            "namespace": "AWS/EC2",
            "dimension": "InstanceId",
            "metrics": ["CPUUtilization", "NetworkIn", "NetworkOut",
                        "EBSReadOps", "EBSWriteOps"],
        },
        "rds": {
            "namespace": "AWS/RDS",
            "dimension": "DBInstanceIdentifier",
            "metrics": ["CPUUtilization", "DatabaseConnections",
                        "ReadLatency", "WriteLatency", "FreeableMemory"],
        },
        "lambda": {
            "namespace": "AWS/Lambda",
            "dimension": "FunctionName",
            "metrics": ["Duration", "Errors", "Throttles", "ConcurrentExecutions"],
        },
        "alb": {
            "namespace": "AWS/ApplicationELB",
            "dimension": "LoadBalancer",
            "metrics": ["TargetResponseTime", "HTTPCode_Target_5XX_Count",
                        "RequestCount", "ActiveConnectionCount"],
        },
    }
 
    config = metrics_map.get(resource_type)
    if not config:
        raise ValueError(f"Unsupported resource type: {resource_type}")
 
    baseline = {}
    for metric_name in config["metrics"]:
        response = cw.get_metric_statistics(
            Namespace=config["namespace"],
            MetricName=metric_name,
            Dimensions=[{"Name": config["dimension"], "Value": resource_id}],
            StartTime=start_time,
            EndTime=end_time,
            Period=86400,  # 日次
            Statistics=["Average", "Maximum", "p99"],
            ExtendedStatistics=["p50", "p90", "p99"],
        )
 
        datapoints = sorted(response.get("Datapoints", []), key=lambda x: x["Timestamp"])
        if datapoints:
            averages = [dp["Average"] for dp in datapoints if "Average" in dp]
            maximums = [dp["Maximum"] for dp in datapoints if "Maximum" in dp]
            baseline[metric_name] = {
                "avg": round(sum(averages) / len(averages), 2) if averages else 0,
                "max": round(max(maximums), 2) if maximums else 0,
                "trend": "increasing" if len(averages) > 1 and averages[-1] > averages[0] else "stable",
            }
 
    print(f"=== Performance Baseline: {resource_type}/{resource_id} ({days} days) ===")
    for metric, stats in baseline.items():
        trend_indicator = "↑" if stats["trend"] == "increasing" else "→"
        print(f"  {metric}: avg={stats['avg']}, max={stats['max']} {trend_indicator}")
 
    return baseline

principles:
  - クラウド財務管理を実装する
  - 消費モデルを導入する
  - 全体的な効率を測定する
  - 差別化につながらない高負荷の作業への支出をやめる
  - 費用を分析し帰属させる
 
checklist:
  practice_cloud_financial_management:
    - コスト配分タグが全リソースに適用されているか
    - 予算アラートが設定されているか (AWS Budgets)
    - 月次のコストレビューミーティングが実施されているか
  expenditure_and_usage_awareness:
    - Cost Explorer で使用状況を分析しているか
    - 未使用リソース (EIP, EBS, snapshots) の棚卸しが定期的か
  cost_effective_resources:
    - Savings Plans / Reserved Instances を活用しているか
    - Spot インスタンスの活用を検討しているか
    - Graviton (ARM) インスタンスへの移行を検討しているか
  manage_demand_and_supply:
    - Auto Scaling で需要に応じたスケーリングをしているか
    - サーバーレスアーキテクチャへの移行を検討しているか
  optimize_over_time:
    - Compute Optimizer の推奨事項を定期的に確認しているか
    - S3 Intelligent-Tiering を活用しているか

# === コスト可視化と最適化 ===
 
# コスト配分タグの有効化確認
aws ce list-cost-allocation-tags \
  --status Active \
  --query 'CostAllocationTags[*].TagKey'
 
# 月次コストサマリー
aws ce get-cost-and-usage \
  --time-period Start=2025-01-01,End=2025-02-01 \
  --granularity MONTHLY \
  --metrics "BlendedCost" "UsageQuantity" \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[0].Groups | sort_by(@, &Metrics.BlendedCost.Amount) | reverse(@) | [:10]'
 
# 未使用リソースの検出
# 未使用 EIP
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].{IP:PublicIp,AllocId:AllocationId}'
 
# 未アタッチ EBS ボリューム
aws ec2 describe-volumes \
  --filters Name=status,Values=available \
  --query 'Volumes[*].{Id:VolumeId,Size:Size,Type:VolumeType,Created:CreateTime}'
 
# 古い EBS スナップショット（90日以上前）
aws ec2 describe-snapshots --owner-ids self \
  --query "Snapshots[?StartTime<='$(date -u -v-90d +%Y-%m-%dT%H:%M:%S)'].{Id:SnapshotId,Size:VolumeSize,Date:StartTime}"
 
# Savings Plans カバレッジの確認
aws ce get-savings-plans-coverage \
  --time-period Start=2025-01-01,End=2025-02-01 \
  --query 'SavingsPlansCoverages[*].{Date:TimePeriod.Start,Coverage:CoveragePercentage}'
 
# Savings Plans 推奨事項の取得
aws ce get-savings-plans-purchase-recommendation \
  --savings-plans-type COMPUTE_SP \
  --term-in-years ONE_YEAR \
  --payment-option NO_UPFRONT \
  --lookback-period-in-days SIXTY_DAYS

# 図5: コスト異常検出と自動アラートスクリプト
import boto3
from datetime import datetime, timedelta
 
def detect_cost_anomalies(threshold_pct: float = 20.0):
    """前月比でコスト異常を検出"""
    ce = boto3.client("ce", region_name="us-east-1")
 
    # 今月と先月のコストを取得
    today = datetime.utcnow()
    this_month_start = today.replace(day=1).strftime("%Y-%m-%d")
    last_month_start = (today.replace(day=1) - timedelta(days=1)).replace(day=1).strftime("%Y-%m-%d")
    last_month_end = today.replace(day=1).strftime("%Y-%m-%d")
 
    # 先月のサービス別コスト
    last_month = ce.get_cost_and_usage(
        TimePeriod={"Start": last_month_start, "End": last_month_end},
        Granularity="MONTHLY",
        Metrics=["BlendedCost"],
        GroupBy=[{"Type": "DIMENSION", "Key": "SERVICE"}],
    )
 
    # 今月のサービス別コスト（日割り換算）
    this_month = ce.get_cost_and_usage(
        TimePeriod={"Start": this_month_start, "End": today.strftime("%Y-%m-%d")},
        Granularity="MONTHLY",
        Metrics=["BlendedCost"],
        GroupBy=[{"Type": "DIMENSION", "Key": "SERVICE"}],
    )
 
    days_elapsed = (today - today.replace(day=1)).days or 1
    days_in_month = 30  # 概算
 
    anomalies = []
    last_costs = {}
    for group in last_month["ResultsByTime"][0].get("Groups", []):
        service = group["Keys"][0]
        cost = float(group["Metrics"]["BlendedCost"]["Amount"])
        last_costs[service] = cost
 
    for group in this_month["ResultsByTime"][0].get("Groups", []):
        service = group["Keys"][0]
        current_cost = float(group["Metrics"]["BlendedCost"]["Amount"])
        projected_cost = current_cost * (days_in_month / days_elapsed)
 
        last_cost = last_costs.get(service, 0)
        if last_cost > 1:  # $1以上のサービスのみ
            change_pct = ((projected_cost - last_cost) / last_cost) * 100
            if change_pct > threshold_pct:
                anomalies.append({
                    "service": service,
                    "last_month": round(last_cost, 2),
                    "projected": round(projected_cost, 2),
                    "change_pct": round(change_pct, 1),
                })
 
    anomalies.sort(key=lambda x: x["change_pct"], reverse=True)
 
    print(f"=== Cost Anomaly Report (threshold: +{threshold_pct}%) ===")
    for a in anomalies:
        print(f"  {a['service']}: ${a['last_month']} → ${a['projected']} (+{a['change_pct']}%)")
 
    return anomalies

principles:
  - 影響を理解する
  - 持続可能性の目標を設定する
  - 使用率を最大化する
  - より効率的な新しいハードウェアとソフトウェアを活用する
  - マネージドサービスを使用する
  - クラウドワークロードの下流への影響を最小化する
 
checklist:
  region_selection:
    - カーボンフリーエネルギーの比率が高いリージョンを選択しているか
    - ユーザーに近いリージョンで無駄な通信を削減しているか
  compute:
    - Graviton (ARM) プロセッサを利用しているか
    - Spot インスタンスで余剰キャパシティを活用しているか
    - Lambda でアイドル時のリソース消費をゼロにしているか
  storage:
    - S3 Intelligent-Tiering でストレージクラスを自動最適化しているか
    - 不要なデータのライフサイクルポリシーを設定しているか
  data_transfer:
    - CloudFront でエッジキャッシュを活用しているか
    - VPC エンドポイントで不要なインターネット通信を削減しているか

# === 持続可能性の実践 ===
 
# Graviton インスタンスの利用状況確認
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].{
    Id:InstanceId,
    Type:InstanceType,
    Arch:Architecture,
    Platform:PlatformDetails
  }' --output table
 
# Customer Carbon Footprint Tool（コンソールでのみ利用可能）
# 代替: CloudWatch で CO2 関連メトリクスを推定
 
# S3 Intelligent-Tiering の設定
aws s3api put-bucket-intelligent-tiering-configuration \
  --bucket my-data-bucket \
  --id "FullTiering" \
  --intelligent-tiering-configuration '{
    "Id": "FullTiering",
    "Status": "Enabled",
    "Tierings": [
      {"AccessTier": "ARCHIVE_ACCESS", "Days": 90},
      {"AccessTier": "DEEP_ARCHIVE_ACCESS", "Days": 180}
    ]
  }'
 
# S3 ライフサイクルポリシーの設定
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-logs-bucket \
  --lifecycle-configuration '{
    "Rules": [
      {
        "ID": "LogRetention",
        "Status": "Enabled",
        "Filter": {"Prefix": "logs/"},
        "Transitions": [
          {"Days": 30, "StorageClass": "STANDARD_IA"},
          {"Days": 90, "StorageClass": "GLACIER"},
          {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
        ],
        "Expiration": {"Days": 730}
      }
    ]
  }'

# Well-Architected レビューの自動化スクリプト例
import boto3
 
def run_well_architected_review():
    """Well-Architected Tool でワークロードレビューを自動化"""
    wa_client = boto3.client("wellarchitected", region_name="ap-northeast-1")
 
    # ワークロード作成
    workload = wa_client.create_workload(
        WorkloadName="MyApp Production",
        Description="Main production workload",
        Environment="PRODUCTION",
        ArchitecturalDesign="https://wiki.example.com/architecture",
        ReviewOwner="architect@example.com",
        Lenses=["wellarchitected"],          # AWS Well-Architected Lens
        AwsRegions=["ap-northeast-1"],
        Tags={"Project": "myapp"},
    )
 
    workload_id = workload["WorkloadId"]
 
    # 質問一覧の取得
    answers = wa_client.list_answers(
        WorkloadId=workload_id,
        LensAlias="wellarchitected",
        PillarId="operationalExcellence",    # 柱を指定
    )
 
    for answer in answers["AnswerSummaries"]:
        print(f"Q: {answer['QuestionTitle']}")
        print(f"  Risk: {answer.get('Risk', 'UNANSWERED')}")
        print()
 
    return workload_id

# 利用可能な Lens の一覧
aws wellarchitected list-lenses --query 'LensSummaries[*].{Name:LensName,Alias:LensAlias}'
 
# よく使う Lens:
# - wellarchitected          : AWS Well-Architected (デフォルト)
# - serverless               : Serverless Applications Lens
# - saas                     : SaaS Lens
# - foundational-technical-review : FTR Lens (APN パートナー向け)
# - machine-learning         : Machine Learning Lens
 
# カスタム Lens の作成
aws wellarchitected create-lens-version \
  --lens-alias "arn:aws:wellarchitected:ap-northeast-1:123456789012:lens/my-custom-lens" \
  --lens-version "2.0.0"
 
# ワークロードに Lens を関連付け
aws wellarchitected associate-lenses \
  --workload-id "abc123def456" \
  --lens-aliases serverless saas
 
# Lens の改善計画を取得
aws wellarchitected list-lens-review-improvements \
  --workload-id "abc123def456" \
  --lens-alias wellarchitected \
  --pillar-id security \
  --query 'ImprovementSummaries[*].{Question:QuestionTitle,Risk:Risk,Count:ImprovementPlans|length(@)}'

# Step 1: ワークロードの作成
WORKLOAD_ID=$(aws wellarchitected create-workload \
  --workload-name "E-Commerce-Production" \
  --description "Primary e-commerce platform serving ap-northeast-1" \
  --environment PRODUCTION \
  --review-owner "tech-lead@example.com" \
  --lenses wellarchitected serverless \
  --aws-regions ap-northeast-1 \
  --account-ids 123456789012 987654321098 \
  --tags Project=ecommerce,Team=platform,ReviewCycle=Q1-2025 \
  --query 'WorkloadId' --output text)
 
echo "Created workload: $WORKLOAD_ID"
 
# Step 2: 各柱の質問と回答状況を確認
for PILLAR in operationalExcellence security reliability performance costOptimization sustainability; do
  echo "=== $PILLAR ==="
  aws wellarchitected list-answers \
    --workload-id "$WORKLOAD_ID" \
    --lens-alias wellarchitected \
    --pillar-id "$PILLAR" \
    --query 'AnswerSummaries[*].{Q:QuestionTitle,Risk:Risk}' \
    --output table
done
 
# Step 3: 回答の更新（選択肢を選ぶ）
aws wellarchitected update-answer \
  --workload-id "$WORKLOAD_ID" \
  --lens-alias wellarchitected \
  --question-id "sec-how-do-you-manage-identities" \
  --selected-choices \
    "sec_sec-how-do-you-manage-identities_1" \
    "sec_sec-how-do-you-manage-identities_2" \
    "sec_sec-how-do-you-manage-identities_3" \
  --notes "IAM Identity Center with SAML 2.0 federation. MFA enforced for all users. Service-linked roles for AWS services."
 
# Step 4: マイルストーンの作成（レビュー完了時点のスナップショット）
aws wellarchitected create-milestone \
  --workload-id "$WORKLOAD_ID" \
  --milestone-name "Q1-2025-Initial-Review"
 
# Step 5: 改善計画の取得
aws wellarchitected list-lens-review-improvements \
  --workload-id "$WORKLOAD_ID" \
  --lens-alias wellarchitected \
  --pillar-id security \
  --query 'ImprovementSummaries[?Risk==`HIGH`].{Q:QuestionTitle,Risk:Risk}'

## Well-Architected 改善計画
 
### High Risk Items (最優先)
 
| # | 柱 | 質問 | 現状のリスク | 改善アクション | 担当 | 期限 |
|---|---|------|------------|---------------|------|------|
| 1 | セキュリティ | 認証情報の管理 | ハードコード | Secrets Manager 導入 | @security | 2W |
| 2 | 信頼性 | バックアップ | 手動・不定期 | AWS Backup 自動化 | @infra | 3W |
| 3 | 運用 | モニタリング | ログ未収集 | CloudWatch + X-Ray | @sre | 4W |
 
### Medium Risk Items (次フェーズ)
 
| # | 柱 | 質問 | 改善アクション | 期限 |
|---|---|------|---------------|------|
| 4 | コスト | ライトサイジング | Compute Optimizer 適用 | Q2 |
| 5 | パフォーマンス | キャッシュ戦略 | ElastiCache 導入 | Q2 |

# 図6: Well-Architected レビュー結果をMarkdownレポートとして出力
import boto3
from datetime import datetime
 
def generate_wa_report(workload_id: str, output_file: str = "wa-report.md"):
    """Well-Architected レビュー結果をMarkdownレポートに変換"""
    wa = boto3.client("wellarchitected", region_name="ap-northeast-1")
 
    # ワークロード情報の取得
    workload = wa.get_workload(WorkloadId=workload_id)["Workload"]
 
    # Lens レビューの取得
    review = wa.get_lens_review(
        WorkloadId=workload_id,
        LensAlias="wellarchitected",
    )["LensReview"]
 
    report_lines = [
        f"# Well-Architected Review Report",
        f"",
        f"**Workload:** {workload['WorkloadName']}",
        f"**Date:** {datetime.utcnow().strftime('%Y-%m-%d')}",
        f"**Environment:** {workload['Environment']}",
        f"**Review Owner:** {workload.get('ReviewOwner', 'N/A')}",
        f"",
        f"## Risk Summary",
        f"",
    ]
 
    # リスクサマリー
    risk_counts = review.get("RiskCounts", {})
    total_questions = sum(risk_counts.values())
    report_lines.extend([
        f"| Risk Level | Count | Percentage |",
        f"|-----------|-------|-----------|",
        f"| HIGH | {risk_counts.get('HIGH', 0)} | {risk_counts.get('HIGH', 0)/total_questions*100:.0f}% |",
        f"| MEDIUM | {risk_counts.get('MEDIUM', 0)} | {risk_counts.get('MEDIUM', 0)/total_questions*100:.0f}% |",
        f"| NONE | {risk_counts.get('NONE', 0)} | {risk_counts.get('NONE', 0)/total_questions*100:.0f}% |",
        f"| UNANSWERED | {risk_counts.get('UNANSWERED', 0)} | {risk_counts.get('UNANSWERED', 0)/total_questions*100:.0f}% |",
        f"",
    ])
 
    # 柱ごとの詳細
    pillars = [
        ("operationalExcellence", "Operational Excellence (運用上の優秀性)"),
        ("security", "Security (セキュリティ)"),
        ("reliability", "Reliability (信頼性)"),
        ("performance", "Performance Efficiency (パフォーマンス効率)"),
        ("costOptimization", "Cost Optimization (コスト最適化)"),
        ("sustainability", "Sustainability (持続可能性)"),
    ]
 
    for pillar_id, pillar_name in pillars:
        report_lines.extend([f"", f"## {pillar_name}", f""])
 
        answers = wa.list_answers(
            WorkloadId=workload_id,
            LensAlias="wellarchitected",
            PillarId=pillar_id,
        )
 
        report_lines.extend([
            f"| Question | Risk | Notes |",
            f"|---------|------|-------|",
        ])
 
        for ans in answers["AnswerSummaries"]:
            risk = ans.get("Risk", "UNANSWERED")
            risk_emoji = {"HIGH": "[HIGH]", "MEDIUM": "[MED]", "NONE": "[OK]"}.get(risk, "[?]")
            notes = ans.get("Notes", "").replace("\n", " ")[:50]
            report_lines.append(
                f"| {ans['QuestionTitle'][:60]} | {risk_emoji} | {notes} |"
            )
 
    # 改善計画
    report_lines.extend([
        f"",
        f"## Improvement Plan",
        f"",
        f"### High Risk Items (Immediate Action Required)",
        f"",
    ])
 
    for pillar_id, pillar_name in pillars:
        improvements = wa.list_lens_review_improvements(
            WorkloadId=workload_id,
            LensAlias="wellarchitected",
            PillarId=pillar_id,
        )
        high_risk = [i for i in improvements["ImprovementSummaries"] if i.get("Risk") == "HIGH"]
        for item in high_risk:
            report_lines.append(
                f"- **[{pillar_name}]** {item['QuestionTitle']}: "
                f"{item.get('ImprovementPlanUrl', 'See AWS documentation')}"
            )
 
    # ファイル出力
    report_content = "\n".join(report_lines)
    with open(output_file, "w") as f:
        f.write(report_content)
 
    print(f"Report saved to {output_file}")
    print(f"Total risks: HIGH={risk_counts.get('HIGH', 0)}, MEDIUM={risk_counts.get('MEDIUM', 0)}")
    return report_content

# Trusted Advisor チェック結果の取得（Business/Enterprise Support 必要）
aws support describe-trusted-advisor-checks \
  --language ja \
  --query 'checks[*].{Id:id,Name:name,Category:category}' \
  --output table
 
# 特定のチェックの結果を取得
aws support describe-trusted-advisor-check-result \
  --check-id "Qch7DwouX1" \
  --query 'result.{Status:status,Flagged:flaggedResources|length(@)}'
 
# 全チェックのサマリー
aws support describe-trusted-advisor-check-summaries \
  --check-ids $(aws support describe-trusted-advisor-checks \
    --language en \
    --query 'checks[*].id' --output text) \
  --query 'summaries[?status!=`ok`].{Check:checkId,Status:status,Flagged:flaggedResources.resourcesFlagged}'
 
# チェック結果のリフレッシュ
aws support refresh-trusted-advisor-check --check-id "Qch7DwouX1"

# 図7: Trusted Advisor 結果を Well-Architected 形式で集約するスクリプト
import boto3
 
def aggregate_trusted_advisor_by_pillar():
    """Trusted Advisor の結果を Well-Architected の柱別に集約"""
    support = boto3.client("support", region_name="us-east-1")
 
    # カテゴリと柱のマッピング
    category_to_pillar = {
        "cost_optimizing": "costOptimization",
        "performance": "performance",
        "security": "security",
        "fault_tolerance": "reliability",
        "service_limits": "reliability",
    }
 
    checks = support.describe_trusted_advisor_checks(language="en")["checks"]
 
    pillar_results = {
        "operationalExcellence": {"ok": 0, "warning": 0, "error": 0, "items": []},
        "security": {"ok": 0, "warning": 0, "error": 0, "items": []},
        "reliability": {"ok": 0, "warning": 0, "error": 0, "items": []},
        "performance": {"ok": 0, "warning": 0, "error": 0, "items": []},
        "costOptimization": {"ok": 0, "warning": 0, "error": 0, "items": []},
    }
 
    for check in checks:
        pillar = category_to_pillar.get(check["category"], "operationalExcellence")
 
        try:
            result = support.describe_trusted_advisor_check_result(
                checkId=check["id"]
            )["result"]
 
            status = result["status"]
            flagged_count = len(result.get("flaggedResources", []))
 
            pillar_results[pillar][status] = pillar_results[pillar].get(status, 0) + 1
 
            if status in ("warning", "error"):
                pillar_results[pillar]["items"].append({
                    "check": check["name"],
                    "status": status,
                    "flagged": flagged_count,
                    "description": check.get("description", "")[:100],
                })
        except Exception:
            pass  # チェックがサポートプランで利用不可の場合
 
    # レポート出力
    print("=== Trusted Advisor → Well-Architected Mapping ===\n")
    for pillar, data in pillar_results.items():
        total = data["ok"] + data["warning"] + data["error"]
        if total > 0:
            score = data["ok"] / total * 100
            print(f"[{pillar}] Score: {score:.0f}% ({data['ok']}/{total} checks OK)")
            for item in data["items"]:
                indicator = "!!" if item["status"] == "error" else "!"
                print(f"  {indicator} {item['check']} ({item['flagged']} resources)")
 
    return pillar_results

// 図8: Well-Architected 準拠の基盤スタック（CDK TypeScript）
import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as rds from "aws-cdk-lib/aws-rds";
import * as backup from "aws-cdk-lib/aws-backup";
import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
import * as sns from "aws-cdk-lib/aws-sns";
import * as budgets from "aws-cdk-lib/aws-budgets";
import * as iam from "aws-cdk-lib/aws-iam";
import * as kms from "aws-cdk-lib/aws-kms";
 
export interface WellArchitectedStackProps extends cdk.StackProps {
  environment: "production" | "staging" | "development";
  monthlyBudgetUsd: number;
  alertEmail: string;
}
 
export class WellArchitectedFoundationStack extends cdk.Stack {
  public readonly vpc: ec2.IVpc;
  public readonly alarmTopic: sns.ITopic;
 
  constructor(scope: Construct, id: string, props: WellArchitectedStackProps) {
    super(scope, id, props);
 
    // ============================================================
    // 柱1: セキュリティ — 暗号化キーの集中管理
    // ============================================================
    const encryptionKey = new kms.Key(this, "EncryptionKey", {
      alias: `${props.environment}-master-key`,
      enableKeyRotation: true,           // 年次自動ローテーション
      removalPolicy: cdk.RemovalPolicy.RETAIN,
      description: "Master encryption key for all data-at-rest encryption",
    });
 
    // ============================================================
    // 柱2: 信頼性 — マルチAZ VPC
    // ============================================================
    this.vpc = new ec2.Vpc(this, "Vpc", {
      maxAzs: 3,                          // 3AZ 冗長構成
      natGateways: props.environment === "production" ? 3 : 1,
      ipAddresses: ec2.IpAddresses.cidr("10.0.0.0/16"),
      subnetConfiguration: [
        {
          name: "Public",
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,
        },
        {
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
          cidrMask: 24,
        },
        {
          name: "Isolated",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
          cidrMask: 24,
        },
      ],
      flowLogs: {
        "VpcFlowLog": {
          destination: ec2.FlowLogDestination.toCloudWatchLogs(),
          trafficType: ec2.FlowLogTrafficType.ALL,
        },
      },
    });
 
    // ============================================================
    // 柱3: 運用上の優秀性 — アラーム通知
    // ============================================================
    this.alarmTopic = new sns.Topic(this, "AlarmTopic", {
      topicName: `${props.environment}-wa-alarms`,
      displayName: `[${props.environment.toUpperCase()}] Well-Architected Alarms`,
    });
 
    new sns.Subscription(this, "AlarmEmail", {
      topic: this.alarmTopic,
      protocol: sns.SubscriptionProtocol.EMAIL,
      endpoint: props.alertEmail,
    });
 
    // VPC NAT Gateway のエラー監視
    const natErrorAlarm = new cloudwatch.Alarm(this, "NatGatewayError", {
      metric: new cloudwatch.Metric({
        namespace: "AWS/NATGateway",
        metricName: "ErrorPortAllocation",
        statistic: "Sum",
        period: cdk.Duration.minutes(5),
      }),
      threshold: 0,
      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
      evaluationPeriods: 1,
      alarmDescription: "NAT Gateway port allocation errors detected",
    });
    natErrorAlarm.addAlarmAction(
      new cdk.aws_cloudwatch_actions.SnsAction(this.alarmTopic)
    );
 
    // ============================================================
    // 柱4: 信頼性 — 自動バックアップ
    // ============================================================
    const backupPlan = new backup.BackupPlan(this, "BackupPlan", {
      backupPlanName: `${props.environment}-daily-backup`,
      backupPlanRules: [
        new backup.BackupPlanRule({
          ruleName: "DailyBackup",
          scheduleExpression: cdk.aws_events.Schedule.cron({
            hour: "3",
            minute: "0",
          }),
          startWindow: cdk.Duration.hours(1),
          completionWindow: cdk.Duration.hours(2),
          deleteAfter: cdk.Duration.days(35),
          moveToColdStorageAfter: cdk.Duration.days(7),
        }),
        new backup.BackupPlanRule({
          ruleName: "MonthlyBackup",
          scheduleExpression: cdk.aws_events.Schedule.cron({
            day: "1",
            hour: "3",
            minute: "0",
          }),
          deleteAfter: cdk.Duration.days(365),
          moveToColdStorageAfter: cdk.Duration.days(30),
        }),
      ],
    });
 
    // タグベースでバックアップ対象を選択
    backupPlan.addSelection("TaggedResources", {
      resources: [
        backup.BackupResource.fromTag("backup", "true"),
      ],
    });
 
    // ============================================================
    // 柱5: コスト最適化 — 予算アラート
    // ============================================================
    new budgets.CfnBudget(this, "MonthlyBudget", {
      budget: {
        budgetName: `${props.environment}-monthly-budget`,
        budgetType: "COST",
        timeUnit: "MONTHLY",
        budgetLimit: {
          amount: props.monthlyBudgetUsd,
          unit: "USD",
        },
      },
      notificationsWithSubscribers: [
        {
          notification: {
            notificationType: "ACTUAL",
            comparisonOperator: "GREATER_THAN",
            threshold: 80,
            thresholdType: "PERCENTAGE",
          },
          subscribers: [
            { subscriptionType: "EMAIL", address: props.alertEmail },
          ],
        },
        {
          notification: {
            notificationType: "FORECASTED",
            comparisonOperator: "GREATER_THAN",
            threshold: 100,
            thresholdType: "PERCENTAGE",
          },
          subscribers: [
            { subscriptionType: "EMAIL", address: props.alertEmail },
          ],
        },
      ],
    });
 
    // ============================================================
    // タグ付け（全柱共通のベストプラクティス）
    // ============================================================
    cdk.Tags.of(this).add("Environment", props.environment);
    cdk.Tags.of(this).add("ManagedBy", "CDK");
    cdk.Tags.of(this).add("WellArchitected", "true");
    cdk.Tags.of(this).add("backup", "true");
 
    // ============================================================
    // 出力
    // ============================================================
    new cdk.CfnOutput(this, "VpcId", { value: this.vpc.vpcId });
    new cdk.CfnOutput(this, "AlarmTopicArn", { value: this.alarmTopic.topicArn });
    new cdk.CfnOutput(this, "KmsKeyArn", { value: encryptionKey.keyArn });
  }
}

# 図9: Well-Architected ベストプラクティスの自動チェック（Config Rules）
AWSTemplateFormatVersion: "2010-09-09"
Description: "Well-Architected compliance checks via AWS Config"
 
Parameters:
  AlertEmail:
    Type: String
    Description: Email for compliance alerts
 
Resources:
  # === コンプライアンス通知 ===
  ComplianceTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: wa-compliance-alerts
      Subscription:
        - Protocol: email
          Endpoint: !Ref AlertEmail
 
  # === セキュリティの柱 ===
 
  # S3 バケットのパブリックアクセスブロック確認
  S3PublicAccessCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-public-access-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
 
  # 暗号化されていない EBS ボリュームの検出
  EbsEncryptionCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ebs-encryption-by-default
      Source:
        Owner: AWS
        SourceIdentifier: EC2_EBS_ENCRYPTION_BY_DEFAULT
 
  # MFA 削除が有効でない S3 バケット
  S3MfaDeleteCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-versioning-enabled
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED
 
  # ルートアカウントの MFA 確認
  RootMfaCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: root-account-mfa-enabled
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED
 
  # === 信頼性の柱 ===
 
  # RDS のマルチ AZ 確認
  RdsMultiAzCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: rds-multi-az-support
      Source:
        Owner: AWS
        SourceIdentifier: RDS_MULTI_AZ_SUPPORT
 
  # RDS の自動バックアップ確認
  RdsBackupCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: rds-automatic-backup-enabled
      Source:
        Owner: AWS
        SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
      InputParameters:
        backupRetentionMinimum: "7"
 
  # ELB の Cross-Zone Load Balancing 確認
  ElbCrossZoneCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: elb-cross-zone-load-balancing
      Source:
        Owner: AWS
        SourceIdentifier: ELB_CROSS_ZONE_LOAD_BALANCING_ENABLED
 
  # === コスト最適化の柱 ===
 
  # 未使用 EIP の検出
  UnusedEipCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: eip-attached
      Source:
        Owner: AWS
        SourceIdentifier: EIP_ATTACHED
 
  # 未使用 EBS ボリュームの検出
  UnusedEbsCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ec2-volume-inuse-check
      Source:
        Owner: AWS
        SourceIdentifier: EC2_VOLUME_INUSE_CHECK
 
  # === 運用上の優秀性の柱 ===
 
  # CloudTrail の有効化確認
  CloudTrailEnabledCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cloudtrail-enabled
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_ENABLED
 
  # CloudWatch ログの保持期間確認
  CloudWatchLogRetentionCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cw-loggroup-retention-period-check
      Source:
        Owner: AWS
        SourceIdentifier: CW_LOGGROUP_RETENTION_PERIOD_CHECK
      InputParameters:
        MinRetentionTime: "90"
 
  # === コンプライアンス変更の自動通知 ===
  ComplianceChangeRule:
    Type: AWS::Events::Rule
    Properties:
      Name: wa-compliance-change
      EventPattern:
        source:
          - aws.config
        detail-type:
          - Config Rules Compliance Change
        detail:
          newEvaluationResult:
            complianceType:
              - NON_COMPLIANT
      Targets:
        - Arn: !Ref ComplianceTopic
          Id: ComplianceNotification
 
  ComplianceTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref ComplianceTopic
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sns:Publish
            Resource: !Ref ComplianceTopic
 
Outputs:
  ComplianceTopicArn:
    Value: !Ref ComplianceTopic
    Description: SNS topic for compliance alerts

# 図10: GitHub Actions / CodePipeline でのレビュー自動化
import boto3
import json
import sys
 
def ci_well_architected_gate(workload_id: str, max_high_risk: int = 0):
    """CI/CD パイプラインのゲートとして Well-Architected チェックを実行
 
    High Risk が閾値を超えた場合にデプロイをブロック
    """
    wa = boto3.client("wellarchitected", region_name="ap-northeast-1")
 
    review = wa.get_lens_review(
        WorkloadId=workload_id,
        LensAlias="wellarchitected",
    )["LensReview"]
 
    risk_counts = review.get("RiskCounts", {})
    high_risk = risk_counts.get("HIGH", 0)
    medium_risk = risk_counts.get("MEDIUM", 0)
    unanswered = risk_counts.get("UNANSWERED", 0)
 
    print(f"=== Well-Architected Gate Check ===")
    print(f"Workload: {workload_id}")
    print(f"HIGH: {high_risk}, MEDIUM: {medium_risk}, UNANSWERED: {unanswered}")
 
    # High Risk の詳細を取得
    if high_risk > 0:
        print(f"\n--- High Risk Details ---")
        pillars = ["operationalExcellence", "security", "reliability",
                    "performance", "costOptimization", "sustainability"]
        for pillar in pillars:
            improvements = wa.list_lens_review_improvements(
                WorkloadId=workload_id,
                LensAlias="wellarchitected",
                PillarId=pillar,
            )
            for item in improvements["ImprovementSummaries"]:
                if item.get("Risk") == "HIGH":
                    print(f"  [{pillar}] {item['QuestionTitle']}")
 
    # ゲート判定
    if high_risk > max_high_risk:
        print(f"\n❌ GATE FAILED: {high_risk} high risk items (max: {max_high_risk})")
        sys.exit(1)
    else:
        print(f"\n✅ GATE PASSED: {high_risk} high risk items within threshold")
        return True

# GitHub Actions でのパイプライン統合例
# .github/workflows/well-architected-gate.yml
name: Well-Architected Gate
 
on:
  pull_request:
    branches: [main]
    paths:
      - 'infrastructure/**'
      - 'cdk/**'
 
jobs:
  wa-check:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-wa-check
          aws-region: ap-northeast-1
 
      - name: Well-Architected Gate Check
        run: |
          python3 -c "
          import boto3
          wa = boto3.client('wellarchitected')
          review = wa.get_lens_review(
              WorkloadId='${{ vars.WA_WORKLOAD_ID }}',
              LensAlias='wellarchitected',
          )['LensReview']
          risk = review.get('RiskCounts', {})
          high = risk.get('HIGH', 0)
          print(f'High Risk: {high}')
          if high > 0:
              print('::error::Well-Architected review has HIGH risk items')
              exit(1)
          "

# カスタム Lens の作成例
aws wellarchitected import-lens \
  --json-string file://custom-lens.json \
  --tags Department=Engineering,Standard=InternalV2
 
# カスタム Lens の公開（組織内共有）
aws wellarchitected create-lens-share \
  --lens-alias "arn:aws:wellarchitected:ap-northeast-1:123456789012:lens/my-custom-lens" \
  --shared-with "arn:aws:organizations::123456789012:organization/o-abc123"