[アップデート]AWS CloudFormationがIaCジェネレーターで特定のリソースタイプをスキャンできるようになったので、AWS CLIで試してみた

---
Metadata:
  AWSToolsMetrics:
    IaC_Generator: "arn:aws:cloudformation:ap-northeast-1:xxxxxxxxxxxx:generatedTemplate/xxxx-xxxx-xxxx"
Parameters:
  LambdaFunctionAWSTestCodeZipFileS05PE:
    NoEcho: "true"
    Type: "String"
    Description:
      "(Node.js and Python) The source code of your Lambda function. If\
      \ you include your function source inline with this parameter, CFN places it\
      \ in a file named ``index`` and zips it to create a [deployment package](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html).\
      \ This zip file cannot exceed 4MB. For the ``Handler`` property, the first part\
      \ of the handler identifier must be ``index``. For example, ``index.handler``.\n\
      \  When you specify source code inline for a Node.js function, the ``index``\
      \ file that CFN creates uses the extension ``.js``. This means that LAM treats\
      \ the file as a CommonJS module. ES modules aren't supported for inline functions.\n\
      \   For JSON, you must escape quotes and special characters such as newline\
      \ (``\\n``) with a backslash.\n If you specify a function that interacts with\
      \ an AWS CloudFormation custom resource, you don't have to write your own functions\
      \ to send responses to the custom resource that invoked the function. AWS CloudFormation\
      \ provides a response module ([cfn-response](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html))\
      \ that simplifies sending responses. See [Using Lambda with CloudFormation](https://docs.aws.amazon.com/lambda/latest/dg/services-cloudformation.html)\
      \ for details."
  LambdaFunctionAWSTestCodeS3Bucketxxxxx:
    NoEcho: "true"
    Type: "String"
    Description:
      "An Amazon S3 bucket in the same AWS-Region as your function. The\
      \ bucket can be in a different AWS-account."
  LambdaFunctionAWSTestCodeS3Keyxxxxx:
    NoEcho: "true"
    Type: "String"
    Description: "The Amazon S3 key of the deployment package."
  LambdaFunctionAWSTestCodeS3ObjectVersionxxxxx:
    NoEcho: "true"
    Type: "String"
    Description:
      "For versioned objects, the version of the deployment package object\
      \ to use."
  LambdaFunctionAWSTestCodeImageUrixxxxx:
    NoEcho: "true"
    Type: "String"
    Description:
      "URI of a [container image](https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html)\
      \ in the Amazon ECR registry."
  LambdaFunctionAWSTestCodeSourceKMSKeyArnxxxxx:
    NoEcho: "true"
    Type: "String"
    Description:
      "The ARN of the KMSlong (KMS) customer managed key that's used to\
      \ encrypt your function's .zip deployment package. If you don't provide a customer\
      \ managed key, Lambda uses an [owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk)."
Resources:
  LambdaPermissionFunctionAWSTestxx:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::Lambda::Permission"
    DeletionPolicy: "Retain"
    Properties:
      FunctionName:
        Fn::GetAtt:
          - "LambdaFunctionAWSTest"
          - "Arn"
      Action: "lambda:InvokeFunction"
      SourceArn:
        Fn::GetAtt:
          - "S3BucketAWSTestxxxxxxxxxxxx"
          - "Arn"
      Principal: "s3.amazonaws.com"
      SourceAccount: "xxxxxxxxxxxx"
  LambdaFunctionAWSTest:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::Lambda::Function"
    DeletionPolicy: "Retain"
    Properties:
      MemorySize: 128
      Description: ""
      TracingConfig:
        Mode: "Active"
      Timeout: 20
      RuntimeManagementConfig:
        UpdateRuntimeOn: "Auto"
      Handler: "lambda_function.lambda_handler"
      Code:
        SourceKMSKeyArn:
          Ref: "LambdaFunctionAWSTestCodeSourceKMSKeyArnxxxxx"
        S3ObjectVersion:
          Ref: "LambdaFunctionAWSTestCodeS3ObjectVersionxxxxx"
        S3Bucket:
          Ref: "LambdaFunctionAWSTestCodeS3Bucketxxxxx"
        ZipFile:
          Ref: "LambdaFunctionAWSTestCodeZipFilexxxxx"
        ImageUri:
          Ref: "LambdaFunctionAWSTestCodeImageUrixxxxx"
        S3Key:
          Ref: "LambdaFunctionAWSTestCodeS3Keyxxxx"
      Role: "arn:aws:iam::xxxxxxxxxxxx:role/aws-test-lambda-role"
      FileSystemConfigs: []
      FunctionName: "aws-test-function"
      Runtime: "python3.11"
      PackageType: "Zip"
      LoggingConfig:
        LogFormat: "Text"
        LogGroup: "/aws/lambda/aws-test-function"
      RecursiveLoop: "Terminate"
      Environment:
        Variables:
          AWS_LAMBDA_EXEC_WRAPPER: "/opt/otel-instrument"
          SLACK_WEBHOOK_URL: "https://hooks.slack.com/services/xxxxxxxx/xxxxxxxxxxxxxxxx"
      EphemeralStorage:
        Size: 512
      Layers:
        - "arn:aws:lambda:ap-northeast-1:xxxxxxxxxxxx:layer:aws-test-layer-1:1"
        - "arn:aws:lambda:ap-northeast-1:xxxxxxxxxxxx:layer:aws-test-layer-2:2"
      Architectures:
        - "x86_64"
  S3BucketAWSTestxxxxxxxxxxxx:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::S3::Bucket"
    DeletionPolicy: "Retain"
    Properties:
      PublicAccessBlockConfiguration:
        RestrictPublicBuckets: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        BlockPublicAcls: true
      BucketName: "aws-test-bucket-1-xxxxxxxxxxxx"
      OwnershipControls:
        Rules:
          - ObjectOwnership: "BucketOwnerEnforced"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: "aws:kms"
              KMSMasterKeyID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      ObjectLockConfiguration:
        ObjectLockEnabled: "Enabled"
      ObjectLockEnabled: true
      LifecycleConfiguration:
        TransitionDefaultMinimumObjectSize: "all_storage_classes_128K"
        Rules:
          - Status: "Enabled"
            ExpirationInDays: 1095
            Id: "Delete-After-3years"
          - Status: "Enabled"
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            Id: "Delete-Incomplete-Multipart-Upload-7days"
      VersioningConfiguration:
        Status: "Enabled"
      Tags:
        - Value: "SecureAccount"
          Key: "aws:test"
  LambdaPermissionFunctionAWSTest:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::Lambda::Permission"
    DeletionPolicy: "Retain"
    Properties:
      FunctionName:
        Fn::GetAtt:
          - "LambdaFunctionAWSTest"
          - "Arn"
      Action: "lambda:InvokeFunction"
      SourceArn:
        Fn::GetAtt:
          - "S3BucketCmmemberscloudtrailxxxxxxxxxxxx"
          - "Arn"
      Principal: "s3.amazonaws.com"
      SourceAccount: "xxxxxxxxxxxx"
  S3BucketCmmemberscloudtrailxxxxxxxxxxxx:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::S3::Bucket"
    DeletionPolicy: "Retain"
    Properties:
      PublicAccessBlockConfiguration:
        RestrictPublicBuckets: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        BlockPublicAcls: true
      BucketName: "aws-test-bucket-2-xxxxxxxxxxxx"
      OwnershipControls:
        Rules:
          - ObjectOwnership: "BucketOwnerEnforced"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: "aws:kms"
              KMSMasterKeyID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      ObjectLockConfiguration:
        ObjectLockEnabled: "Enabled"
        Rule:
          DefaultRetention:
            Years: 1
            Mode: "COMPLIANCE"
      ObjectLockEnabled: true
      LoggingConfiguration:
        TargetObjectKeyFormat:
          SimplePrefix: {}
        DestinationBucketName: "aws-test-bucket-2-xxxxxxxxxxxx"
        LogFilePrefix: ""
      NotificationConfiguration:
        QueueConfigurations: []
        TopicConfigurations: []
        LambdaConfigurations:
          - Function:
              Fn::GetAtt:
                - "LambdaFunctionAWSTest"
                - "Arn"
            Filter:
              S3Key:
                Rules:
                  - Value: ""
                    Name: "Prefix"
                  - Value: ""
                    Name: "Suffix"
            Event: "s3:LifecycleExpiration:*"
      LifecycleConfiguration:
        TransitionDefaultMinimumObjectSize: "all_storage_classes_128K"
        Rules:
          - Status: "Enabled"
            Id: "Delete-After-3years"
            NoncurrentVersionExpiration:
              NoncurrentDays: 1
            ExpirationInDays: 1095
          - Status: "Enabled"
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            Id: "Delete-Incomplete-Multipart-Upload-7days"
      VersioningConfiguration:
        Status: "Enabled"
      Tags:
        - Value: "SecureAccount"
          Key: "aws:test"
  LambdaPermissionFunctionAWSTestDt:
    UpdateReplacePolicy: "Retain"
    Type: "AWS::Lambda::Permission"
    DeletionPolicy: "Retain"
    Properties:
      FunctionName:
        Fn::GetAtt:
          - "LambdaFunctionAWSTest"
          - "Arn"
      Action: "lambda:InvokeFunction"
      SourceArn: "arn:aws:events:ap-northeast-1:xxxxxxxxxxxx:rule/aws-test-lambda-role"
      Principal: "events.amazonaws.com"