IaC(Infra as Code) on AWSで環境構築するための準備（その1）

#!/bin/bash
# define
mydir=$(dirname $0)
source "${mydir}"/common.sh
source "${mydir}"/awsenv.sh
grptag="resource"

# ---- Define ----
rBucket="${RESOURCE_S3_KEY}$(altAwsIdStr 12)" # リソースファイル格納用S3バケット

info "== Confirm =="
info "アカウント                     : ${ACCOUNT_ID}"
info "リージョン                     : ${REGION}"
info "リソースファイル格納用S3バケット : ${rBucket}"

while true
do
  input "S3バケットの作成を続行しますか? (y/n): "
  read input
  if [ "${input}" == "y" ]; then
    break
  elif [ "${input}" == "n" ]; then
    warn "Process cancelled."
    exit 0
  fi
done

# ---- Create S3 Bucket ----
# Create bucket
if aws s3api head-bucket --region "${REGION}" --bucket "${rBucket}" 2>/dev/null; then
  info "S3 bucket exists: ${rBucket}"
else
  info "Creating S3 bucket: ${rBucket}"
  # リージョンが us-east-1 以外なら LocationConstraint 必須
  if [ "${REGION}" == "us-east-1" ]; then
    exec aws s3api create-bucket --region "${REGION}" --bucket "${rBucket}"
  else
    exec aws s3api create-bucket --region "${REGION}" --bucket "${rBucket}" \
      --create-bucket-configuration LocationConstraint="${REGION}"
  fi
  if [ $? -ne 0 ]; then
    abort "Process aborted."
    exit 1
  fi
fi

# Bucket policy setting for Resource Bucket
cat <<EOF > "${TEMPFILE}"
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonSSLRequests",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::${rBucket}",
        "arn:aws:s3:::${rBucket}/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}	
EOF
exec aws s3api put-bucket-policy --bucket "${rBucket}" --policy file://"${TEMPFILE}"
if [ $? -ne 0 ]; then
  abort "Process aborted."
  exit 1
fi

# Set Versining
exec aws s3api put-bucket-versioning --region "${REGION}" --bucket "${rBucket}" \
  --versioning-configuration Status=Enabled
if [ $? -ne 0 ]; then
  abort "Process aborted."
  exit 1
fi

# Public access block
exec aws s3api put-public-access-block \
  --region "${REGION}" \
  --bucket "${rBucket}" \
  --public-access-block-configuration \
    '{"BlockPublicAcls":true,"IgnorePublicAcls":true,"BlockPublicPolicy":true,"RestrictPublicBuckets":true}'
if [ $? -ne 0 ]; then
  abort "Process aborted."
  exit 1
fi

# Serverside Encryption
exec aws s3api put-bucket-encryption \
  --region "${REGION}" \
  --bucket  "${rBucket}"\
  --server-side-encryption-configuration \
    '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'
if [ $? -ne 0 ]; then
  abort "Process aborted."
  exit 1
fi

# --Tagging--
exec aws s3api put-bucket-tagging --region "${REGION}" --bucket "${rBucket}" \
  --tagging "TagSet=[{Key=environment,Value=${ENVTAG}},{Key=group,Value=${grptag}}]"

rm -f "${TEMPFILE}*"
info "Process succeeded."
exit 0

#!/bin/bash

mydir=$(dirname $0)
source "${mydir}"/common.sh
source "${mydir}"/awsenv.sh
grptag="trail"

# ---- Define ----
trailName="Orgless-Management-Events"        # CloudTrail名
s3Bucket="${TRAIL_S3_KEY}$(altAwsIdStr 12)"  # S3バケット名
trailLogGroupARN="arn:aws:logs:${REGION}:${ACCOUNT_ID}:log-group:${TRAIL_LOG_GROUP}" # LogGroup名
tagEnv="Key=environment,Value=${ENVTAG}"
tagGroup="Key=group,Value=${grptag}"

rBucket="${RESOURCE_S3_KEY}$(altAwsIdStr 12)" # (S3アクセスログ取得)リソースファイル格納用S3バケット
rBucketARN="arn:aws:s3:::${rBucket}"
eventType="WriteOnly"                         # (S3アクセスログ取得)取得するイベントタイプ(All/ReadOnly/WriteOnly)

info "== Confirm =="
info "アカウント                   : ${ACCOUNT_ID}"
info "CloudTrail証跡名            : ${trailName}"
info "連携先S3バケット             : ${s3Bucket}"
info "  格納先フォルダ             : ${TRIL_S3_PREFIX}"
info "連携先CloudWatchロググループ  : ${TRAIL_LOG_GROUP}"
info "アクセスログ取得S3バケット    : ${rBucket}"
info "  イベントタイプ             : ${eventType}"

while true
do
  input "CloudTrailの作成を続行しますか? (y/n): "
  read input
  if [ "${input}" == "y" ]; then
    break
  elif [ "${input}" == "n" ]; then
    warn "Process cancelled."
    exit 0
  fi
done

# ---- CloudTrail (multi-region) ----
if aws cloudtrail get-trail --name "${trailName}" >& /dev/null; then
  info "Trail exists: ${trailName}"
else
  info "Creating trail: ${trailName}"
  ctArgs=(
    --region "${REGION}"
    --name "${trailName}"
    --s3-bucket-name "${s3Bucket}"
    --is-multi-region-trail
    --include-global-service-events
    --enable-log-file-validation
    --cloud-watch-logs-log-group-arn "${trailLogGroupARN}:*"
    --cloud-watch-logs-role-arn "arn:aws:iam::${ACCOUNT_ID}:role/${TRAIL_CW_ROLE}"
    --s3-key-prefix "${TRIL_S3_PREFIX}"
  )
  exec aws cloudtrail create-trail "${ctArgs[@]}"
fi

# (S3アクセスログ取得) Add S3 Data Event
aws cloudtrail put-event-selectors \
  --trail-name "${trailName}" \
  --event-selectors "[
    {
      \"ReadWriteType\": \"${eventType}\",
      \"IncludeManagementEvents\": true,
      \"DataResources\": [
        {
          \"Type\": \"AWS::S3::Object\",
          \"Values\": [\"${rBucketARN}/\"]
        }
      ]
    }
  ]"

exec aws cloudtrail start-logging --region "${REGION}" --name "${trailName}"

## --Tagging--
trailARN="arn:aws:cloudtrail:${REGION}:${ACCOUNT_ID}:trail/${trailName}"
exec aws cloudtrail add-tags --region "${REGION}" --resource-id "${trailARN}" --tags-list "${tagEnv}" "${tagGroup}"


# --- Check ---
iErr=0
aws cloudtrail get-trail --region "${REGION}" --name "${trailName}" >& /dev/null
if [ $? -ne 0 ]; then
  abort "CloudTrail ${trailName} is missing."
  ((iErr++))
fi
if [ ${iErr} -gt 0 ]; then
  abort "Process aborted."
fi


info "Process succeeded."
exit 0

#!/bin/bash

mydir=$(dirname $0)
source "${mydir}"/common.sh
source "${mydir}"/awsenv.sh
grptag="trail"

# ---- Define ----
queryDir="alarm/"                                       # クエリをまとめるディレクトリ
queryRootName="${queryDir}QUERY-RootLoginSuccess"       # rootユーザログイン確認用クエリ
queryApiRegionName="${queryDir}QUERY-APICallOutsideAllowedRegions"  # 未使用リージョンアクセス確認用クエリ
allowedRegionsCSV="${REGION},${OTHER_REGION}"

queryS3AccDir="s3Access/"                                                      # (S3アクセスログ取得)S3アクセスログクエリディレクトリ
queryResourceS3AccessName="${queryS3AccDir}QUERY-${RESOURCE_S3_KEY}AccessLog"  # (S3アクセスログ取得)リソースファイル格納用S3バケットアクセスログクエリ

info "== Confirm =="
info "CloudWatchロググループ名                      : ${TRAIL_LOG_GROUP}"
info "rootユーザログイン確認用クエリ                 : ${queryRootName}"
info "未使用リージョンアクセス確認用クエリ            : ${queryApiRegionName}"
info "  通常使用するリージョン                       : ${allowedRegionsCSV}"
info "リソースファイル格納用S3アクセスログ確認用クエリ : ${queryResourceS3AccessName}"

while true
do
  input "CloudWatchアラームの設定を続行しますか? (y/n): "
  read input
  if [ "${input}" == "y" ]; then
    break
  elif [ "${input}" == "n" ]; then
    warn "Process cancelled."
    exit 0
  fi
done

# ---- Investigation Query for alarm ----
# 1) Root login success
queryString="$(cat <<'QL'
fields @timestamp, awsRegion, eventSource, eventName,
       userIdentity.type as userType,
       userIdentity.arn  as userArn,
       sourceIPAddress, userAgent, eventID
| filter eventName = "ConsoleLogin"
| filter userIdentity.type = "Root"
| filter responseElements.ConsoleLogin = "Success"
| sort @timestamp desc
| limit 200
QL
)"

queryExists="$(aws logs describe-query-definitions \
  --region "${REGION}" \
  --query-definition-name-prefix "${queryRootName}" \
  --query 'queryDefinitions[?name==`'"${queryRootName}"'`].queryDefinitionId' \
  --output text 2>/dev/null || true)"

if [[ -n "${queryExists:-}" && "${queryExists}" != "None" ]]; then
  info "Updating existing query definition: ${queryRootName} ($queryExists)"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --query-definition-id "${queryExists}" \
    --name "${queryRootName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
else
  info "Creating new query definition: ${queryRootName}"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --name "${queryRootName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
fi

# 2) API calls in NOT-allowed regions (exclude global services)
allowedRegionsJSON=$(printf '"%s"' "${allowedRegionsCSV//,/\",\"}")
queryString="$(cat <<EOF
fields @timestamp, awsRegion, eventSource, eventName,
       userIdentity.type as userType,
       userIdentity.arn  as userArn,
       sourceIPAddress, userAgent, eventID
| filter ispresent(awsRegion)
| filter eventCategory = "Management"
| filter awsRegion not in [${allowedRegionsJSON}]
| filter eventSource not in [
    "iam.amazonaws.com","cloudfront.amazonaws.com","route53.amazonaws.com",
    "globalaccelerator.amazonaws.com","waf.amazonaws.com","wafv2.amazonaws.com",
    "support.amazonaws.com","health.amazonaws.com",
    "signin.amazonaws.com","sts.amazonaws.com","sso.amazonaws.com","sso-oidc.amazonaws.com",
    "ce.amazonaws.com"
]
| filter userIdentity.invokedBy not in ["resource-explorer-2.amazonaws.com"]
| filter readOnly = false
| sort @timestamp desc
| limit 200
EOF
)"

queryExists="$(aws logs describe-query-definitions \
  --region "${REGION}" \
  --query-definition-name-prefix "${queryApiRegionName}" \
  --query 'queryDefinitions[?name==`'"${queryApiRegionName}"'`].queryDefinitionId' \
  --output text 2>/dev/null || true)"

if [[ -n "${queryExists:-}" && "${queryExists}" != "None" ]]; then
  info "Updating existing query definition: ${queryApiRegionName} ($queryExists)"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --query-definition-id "${queryExists}" \
    --name "${queryApiRegionName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
else
  info "Creating new query definition: ${queryApiRegionName}"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --name "${queryApiRegionName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
fi

# ---- Investigation Query for S3 Accesslog ----
# 1) (S3アクセスログ取得)Resource S3 Bucket AccessLog
queryString="$(cat <<EOF
fields @timestamp, eventName, userIdentity.arn, requestParameters.bucketName, requestParameters.key
| filter eventSource = "s3.amazonaws.com"
| filter eventCategory = "Data"
| filter requestParameters.bucketName = "${RESOURCE_S3_KEY}$(altAwsIdStr 12)"
| sort @timestamp desc
EOF
)"

queryExists="$(aws logs describe-query-definitions \
  --region "${REGION}" \
  --query-definition-name-prefix "${queryResourceS3AccessName}" \
  --query 'queryDefinitions[?name==`'"${queryResourceS3AccessName}"'`].queryDefinitionId' \
  --output text 2>/dev/null || true)"

if [[ -n "${queryExists:-}" && "${queryExists}" != "None" ]]; then
  info "Updating existing query definition: ${queryResourceS3AccessName} ($queryExists)"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --query-definition-id "${queryExists}" \
    --name "${queryResourceS3AccessName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
else
  info "Creating new query definition: ${queryResourceS3AccessName}"
  exec aws logs put-query-definition \
    --region "${REGION}" \
    --name "${queryResourceS3AccessName}" \
    --query-string "${queryString}" \
    --log-group-names "${TRAIL_LOG_GROUP}"
fi

# --- Check ---
iErr=0
queryExists=$(aws logs describe-query-definitions --region "${REGION}" --query-definition-name-prefix "${queryRootName}" --query 'queryDefinitions[].name' | jq -r '.[]')
if [ -z "${queryExists}" ];then
  abort "Metrics alarm ${queryRootName} is missing."
  ((iErr++))
fi
queryExists=$(aws logs describe-query-definitions --region "${REGION}" --query-definition-name-prefix "${queryApiRegionName}" --query 'queryDefinitions[].name' | jq -r '.[]')
if [ -z "${queryExists}" ];then
  abort "Metrics alarm ${queryApiRegionName} is missing."
  ((iErr++))
fi
queryExists=$(aws logs describe-query-definitions --region "${REGION}" --query-definition-name-prefix "${queryResourceS3AccessName}" --query 'queryDefinitions[].name' | jq -r '.[]')
if [ -z "${queryExists}" ];then
  abort "Metrics alarm ${queryResourceS3AccessName} is missing."
  ((iErr++))
fi
if [ ${iErr} -gt 0 ]; then
  abort "Process aborted."
fi

info "Process succeeded."
exit 0