AWS CDK を使用して作成されたリソースに対してタグを付与し、そのタグを条件として IAM ポリシーでアクセス制御を行う

import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as sns from "aws-cdk-lib/aws-sns";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // Lambda 関数および SNS トピックの作成
    const lambdaFunction = new lambda.Function(this, "LambdaFunction", {
      runtime: lambda.Runtime.NODEJS_LATEST,
      handler: "index.handler",
      code: lambda.Code.fromInline(`
        exports.handler = async (event) => {
          console.log("Hello from inline Lambda!");
          return {
            statusCode: 200,
            body: JSON.stringify({ message: "Hello, World!" }),
          };
        }
      `),
    });
    const topic = new sns.Topic(this, "MyTopic");

    // トピックへのパブリッシュ権限を Lambda 関数に付与
    topic.grantPublish(lambdaFunction);
  }
}

import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as sns from "aws-cdk-lib/aws-sns";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // Lambda 関数および SNS トピックの作成
    const lambdaFunction = new lambda.Function(this, "LambdaFunction", {
      runtime: lambda.Runtime.NODEJS_LATEST,
      handler: "index.handler",
      code: lambda.Code.fromInline(`
        exports.handler = async (event) => {
          console.log("Hello from inline Lambda!");
          return {
            statusCode: 200,
            body: JSON.stringify({ message: "Hello, World!" }),
          };
        }
      `),
    });
    const topic = new sns.Topic(this, "MyTopic");

    // トピックへのパブリッシュ権限を Lambda 関数に付与
    topic.grantPublish(lambdaFunction);

    // スコープ内の全てのリソースにタグを付ける
    cdk.Tags.of(this).add("Protection", "Enabled");
  }
}

$ npx cdk diff Main
start: Building Main Template
success: Built Main Template
start: Publishing Main Template (current_account-current_region)
success: Published Main Template (current_account-current_region)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack Main
Resources
[~] AWS::IAM::Role LambdaFunction/ServiceRole LambdaFunctionServiceRoleC555A460
 └─ [+] Tags
     └─ [{"Key":"Protection","Value":"Enabled"}]
[~] AWS::Lambda::Function LambdaFunction LambdaFunctionBF21E41F
 └─ [+] Tags
     └─ [{"Key":"Protection","Value":"Enabled"}]
[~] AWS::SNS::Topic MyTopic MyTopic86869434
 └─ [+] Tags
     └─ [{"Key":"Protection","Value":"Enabled"}]

✨  Number of stacks with differences: 1

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

export class Main2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // リソースタグ "Protection": "Enabled" が付与されたリソースへの操作を拒否する IAM グループの作成
    const group = new iam.Group(this, "Group", {
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"),
      ],
    });
    group.addToPolicy(
      new iam.PolicyStatement({
        actions: ["*"],
        resources: ["*"],
        conditions: {
          StringEquals: {
            "aws:ResourceTag/Protection": "Enabled",
          },
        },
        effect: cdk.aws_iam.Effect.DENY,
      })
    );
    // IAM ユーザーおよびグループに対する操作を拒否するポリシーを追加
    group.addToPolicy(
      new iam.PolicyStatement({
        actions: ["*"],
        resources: ["arn:aws:iam::*:user/*", "arn:aws:iam::*:group/*"],
        effect: cdk.aws_iam.Effect.DENY,
      })
    );

    // IAM ユーザーの作成
    new iam.User(this, "User", {
      userName: "User",
      groups: [group],
    });
  }
}

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    new cdk.aws_s3.Bucket(this, "MyBucket", {
      autoDeleteObjects: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
  }
}

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    new cdk.aws_s3.Bucket(this, "MyBucket", {
      autoDeleteObjects: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    cdk.Tags.of(this).add("Protection", "Enabled");
  }
}

$ npx cdk diff Main
start: Building Main Template
success: Built Main Template
start: Publishing Main Template (current_account-current_region)
success: Published Main Template (current_account-current_region)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack Main
Resources
[~] AWS::S3::Bucket MyBucket MyBucketF68F3FF0
 └─ [~] Tags
     └─ @@ -2,5 +2,9 @@
        [ ]   {
        [ ]     "Key": "aws-cdk:auto-delete-objects",
        [ ]     "Value": "true"
        [+]   },
        [+]   {
        [+]     "Key": "Protection",
        [+]     "Value": "Enabled"
        [ ]   }
        [ ] ]

✨  Number of stacks with differences: 1