AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudTrail IAM操作履歴のSlack通知システム（EventBridge版）'
Parameters:
SlackWorkspaceId:
Type: String
Description: 'Slack ワークスペースID'
SlackChannelId:
Type: String
Description: 'Slack チャンネルID'
Resources:
# CloudTrail用のS3バケット
CloudTrailBucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: !Sub '${AWS::AccountId}-cloudtrail-logs'
VersioningConfiguration:
Status: Enabled
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
# CloudTrail用のS3バケットポリシー
CloudTrailBucketPolicy:
Type: 'AWS::S3::BucketPolicy'
Properties:
Bucket: !Ref CloudTrailBucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: 'AWSCloudTrailAclCheck'
Effect: 'Allow'
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 's3:GetBucketAcl'
Resource: !GetAtt CloudTrailBucket.Arn
- Sid: 'AWSCloudTrailWrite'
Effect: 'Allow'
Principal:
Service: 'cloudtrail.amazonaws.com'
Action: 's3:PutObject'
Resource: !Sub '${CloudTrailBucket.Arn}/*'
Condition:
StringEquals:
's3:x-amz-acl': 'bucket-owner-full-control'
# CloudTrailの証跡
CloudTrail:
Type: 'AWS::CloudTrail::Trail'
DependsOn:
- CloudTrailBucketPolicy
Properties:
IsLogging: true
IsMultiRegionTrail: true
IncludeGlobalServiceEvents: true
EnableLogFileValidation: true
S3BucketName: !Ref CloudTrailBucket
EventSelectors:
- ReadWriteType: WriteOnly
IncludeManagementEvents: true
# SNSトピック
SNSTopic:
Type: 'AWS::SNS::Topic'
Properties:
TopicName: 'iam-events-notification'
# EventBridgeルール
EventBridgeRule:
Type: 'AWS::Events::Rule'
Properties:
Name: 'IAMEventDetection'
Description: 'IAMの変更操作を検知するルール'
State: 'ENABLED'
EventPattern:
source:
- "aws.iam"
detail-type:
- "AWS API Call via CloudTrail"
detail:
eventSource:
- "iam.amazonaws.com"
Targets:
- Arn: !Ref SNSTopic
Id: "IAMEventToSNS"
# AWS Chatbot用のIAMロール
ChatbotRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: chatbot.amazonaws.com
Action: 'sts:AssumeRole'
Policies:
- PolicyName: ChatbotBasicPolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'sns:GetTopicAttributes'
- 'sns:SetTopicAttributes'
- 'sns:Subscribe'
- 'sns:Unsubscribe'
Resource: !Ref SNSTopic
# AWS Chatbot設定
AWSChatbotConfiguration:
Type: 'AWS::Chatbot::SlackChannelConfiguration'
Properties:
ConfigurationName: 'IAMEventsNotification'
IamRoleArn: !GetAtt ChatbotRole.Arn
SlackWorkspaceId: !Ref SlackWorkspaceId
SlackChannelId: !Ref SlackChannelId
SnsTopicArns:
- !Ref SNSTopic
# EventBridgeからSNSへの権限
SNSTopicPolicy:
Type: 'AWS::SNS::TopicPolicy'
Properties:
Topics:
- !Ref SNSTopic
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: events.amazonaws.com
Action: 'sns:Publish'
Resource: !Ref SNSTopic
Outputs:
SNSTopicArn:
Description: 'SNSトピックのARN'
Value: !Ref SNSTopic
CloudTrailBucketName:
Description: 'CloudTrail用S3バケット名'
Value: !Ref CloudTrailBucket
