https://dev.classmethod.jp/articles/config-rule-required-tags/
-- 1. コマンド等のインストール
-- 1.1 aws cli version 2 インストール
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version
-- 1.2 jqインストール
sudo yum -y install jq
-- 2. S3 バケットを作成する
aws s3 ls
aws s3 mb s3://bucket123
-- 3. バケットポリシーの設定
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::bucket123",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "999999999999"
}
}
},
{
"Sid": "AWSConfigBucketExistenceCheck",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::bucket123",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "999999999999"
}
}
},
{
"Sid": "AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucket123/*",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "999999999999",
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
aws s3api put-bucket-policy \
--bucket bucket123 \
--policy file://b.json
aws s3api get-bucket-policy \
--bucket bucket123
-- 4. SNSトピック作成
aws sns list-topics
aws sns list-subscriptions
aws sns create-topic --name topic01
aws sns subscribe \
--topic-arn arn:aws:sns:ap-northeast-1:999999999999:topic01 \
--protocol email \
--notification-endpoint test@example.com
aws sns confirm-subscription \
--authenticate-on-unsubscribe true \
--topic-arn arn:aws:sns:ap-northeast-1:999999999999:topic01 \
--token 0336412f37fb687f5d51e6e2425dacbba8bdb5a1004ce34ee3318157b1c1eeabbe5f42fcd57f85e6f71a0659199830b44544100dcf0efe7e94da97d194daa3021d81168646efca8cc6e98e5868b8c62c77bca111f61824316c92bdaaffac99956376602df648e09a2a322fb4b9be4280
※tokenは届いたメールのURLから取得
-- 5. SNSアクセスポリシー設定
aws sns get-topic-attributes \
--topic-arn arn:aws:sns:ap-northeast-1:999999999999:topic01
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "__default_statement_ID",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"sns:GetTopicAttributes",
"sns:SetTopicAttributes",
"sns:AddPermission",
"sns:RemovePermission",
"sns:DeleteTopic",
"sns:Subscribe",
"sns:ListSubscriptionsByTopic",
"sns:Publish"
],
"Resource": "arn:aws:sns:ap-northeast-1:999999999999:topic01",
"Condition": {
"StringEquals": {
"AWS:SourceOwner": "999999999999"
}
}
},
{
"Sid": "AWSConfigSNSPolicy20180529",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::999999999999:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
},
"Action": "sns:Publish",
"Resource": "arn:aws:sns:ap-northeast-1:999999999999:topic01"
}
]
}
aws sns set-topic-attributes \
--topic-arn arn:aws:sns:ap-northeast-1:999999999999:topic01 \
--attribute-name Policy \
--attribute-value file://a.json
-- 6. AWS Config の有効化
aws configservice put-configuration-recorder \
--configuration-recorder name=default,roleARN=arn:aws:iam::999999999999:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig \
--recording-group '{
"allSupported": false,
"includeGlobalResourceTypes": false,
"resourceTypes": [
"AWS::EC2::Instance",
"AWS::EC2::Volume"
]
}'
aws configservice put-delivery-channel \
--delivery-channel '{
"name": "default",
"s3BucketName": "bucket123",
"snsTopicARN": "arn:aws:sns:ap-northeast-1:999999999999:topic01",
"configSnapshotDeliveryProperties": {
"deliveryFrequency": "TwentyFour_Hours"
}
}'
aws configservice start-configuration-recorder \
--configuration-recorder-name default
aws configservice put-retention-configuration \
--retention-period-in-days 30
aws configservice describe-delivery-channels
aws configservice describe-configuration-recorders
aws configservice describe-configuration-recorder-status
aws configservice describe-retention-configurations
-- 7. ルールの追加
{
"ConfigRule": {
"ConfigRuleName": "rule01",
"Description": "required-tags",
"Scope": {
"ComplianceResourceTypes": ["AWS::EC2::Instance"]
},
"Source": {
"Owner": "AWS",
"SourceIdentifier": "REQUIRED_TAGS"
},
"InputParameters": "{\"tag1Key\":\"key1\",\"tag1Value\":\"val1,val2\",\"tag2Key\":\"env\"}"
}
}
※ルール評価対象はConfigの変更管理の対象リソースとして登録しておく必要がある
aws configservice put-config-rule \
--cli-input-json file://rule01.json
aws configservice describe-config-rules
-- 8. 動作確認用EC2インスタンス作成
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance01}]'
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance02},{Key=key1,Value=val1}]'
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance03},{Key=env,Value=prd}]'
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance04},{Key=key1,Value=val1},{Key=env,Value=prd}]'
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance05},{Key=key1,Value=val2},{Key=env,Value=prd}]'
aws ec2 run-instances \
--image-id ami-0404778e217f54308 \
--key-name key1 \
--instance-type t3.nano \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=instance06},{Key=key1,Value=val3},{Key=env,Value=prd}]'
-- 9. オンデマンド評価
aws configservice start-config-rules-evaluation \
--config-rule-names rule01
aws configservice describe-config-rule-evaluation-status
-- 10. 評価結果の削除
aws configservice delete-evaluation-results \
--config-rule-name rule01
-- 11. クリーンアップ
-- ルールの削除
aws configservice describe-config-rules
aws configservice delete-config-rule \
--config-rule-name rule01
少し時間がかかる
-- AWS Config の無効化
aws configservice describe-delivery-channels
aws configservice describe-configuration-recorders
aws configservice describe-configuration-recorder-status
aws configservice describe-retention-configurations
aws configservice delete-retention-configuration \
--retention-configuration-name default
aws configservice stop-configuration-recorder \
--configuration-recorder-name default
aws configservice delete-delivery-channel \
--delivery-channel-name default
aws configservice delete-configuration-recorder \
--configuration-recorder-name default
-- SNSトピック削除
aws sns list-topics
aws sns list-subscriptions
aws sns unsubscribe --subscription-arn arn:aws:sns:ap-northeast-1:999999999999:topic01:11111111-1111-1111-1111-111111111111
aws sns delete-topic --topic-arn arn:aws:sns:ap-northeast-1:999999999999:topic01
-- バケットの削除
aws s3 ls
aws s3 rb s3://bucket123 --force