AWS Configルールを利用して、IAMアクセスキーが一定期間ローテーションされていない場合の自動無効化前に事前通知する仕組み

			
			{
  "Comment": "IAMユーザーアクセスキーローテーション通知ステートマシン",
  "QueryLanguage": "JSONata",
  "StartAt": "Initialize Configuration",
  "States": {
    "Initialize Configuration": {
      "Type": "Pass",
      "Comment": "初期設定値を定義：AWSアカウントID、Config Rule名、最大未使用日数、送信者・宛先メールアドレスを設定",
      "Assign": {
        "awsAccountId": "{% $states.input.detail.awsAccountId %}",
        "configRuleName": "{% $states.input.detail.configRuleName %}",
        "maxUnusedDays": "{% 90 %}",
        "toEmailAddress": "{% 'example1@example.com' %}",
        "fromEmailAddress": "{% 'example2@example.com' %}"
      },
      "Next": "Calculate Days"
    },
    "Calculate Days": {
      "Type": "Pass",
      "Comment": "ConfigRule名に基づいて残り日数を計算：access-keys-rotated-1なら7日、access-keys-rotated-2なら14日",
      "Assign": {
        "remainingDays": "{% $configRuleName = \"access-keys-rotated-1\" ? 7 : $configRuleName = \"access-keys-rotated-2\" ? 14 %}"
      },
      "Next": "Calculate Disable Deadline"
    },
    "Calculate Disable Deadline": {
      "Type": "Pass",
      "Comment": "ローテーション期限日を計算：現在日時に残り日数を加算してYYYY/MM/DD形式の文字列として生成",
      "Assign": {
        "rotationDeadline": "{% (\n  $remainingDays := (\n    $configRuleName = \"access-keys-rotated-1\" ? 7 :\n    $configRuleName = \"access-keys-rotated-2\" ? 14\n  );\n  $targetDate := $toMillis($now()) + ($remainingDays * 24 * 60 * 60 * 1000);\n  $dateStr := $substring($fromMillis($targetDate), 0, 10);\n  $replace($replace($dateStr, \"-\", \"/\"), /^(\\d{4})\\/(\\d{2})\\/(\\d{2})$/, \"$1/$2/$3\")\n) %}"
      },
      "Next": "ListUsers"
    },
    "ListUsers": {
      "Type": "Task",
      "Comment": "IAMサービスから全ユーザー一覧を取得し、resourceIdに該当するユーザー名を特定",
      "Arguments": {},
      "Assign": {
        "userName": "{% $states.result.Users[UserId=$states.input.detail.resourceId].UserName[0] %}"
      },
      "Resource": "arn:aws:states:::aws-sdk:iam:listUsers",
      "Next": "SES Send Email"
    },
    "SES Send Email": {
      "Type": "Task",
      "Comment": "SESv2を使用してアクセスキーローテーション通知メールを送信（件名、本文、宛先を設定）",
      "Arguments": {
        "ConfigurationSetName": "ses-bounce-configuration-set",
        "Content": {
          "Simple": {
            "Body": {
              "Text": {
                "Charset": "UTF-8",
                "Data": "{% '【IAMアクセスキーローテーション通知】\n\nIAMユーザー「' & $userName & '」のアクセスキーローテーション期限が' & $string($remainingDays) & '日後（' & $rotationDeadline & '）に迫っています。\n\n▼ 継続利用される場合の対応方法\n・新しいアクセスキーの発行\n・古いアクセスキーの削除\n・アプリケーションでの新しいアクセスキー設定\n\n※' & $string($maxUnusedDays) & '日間ローテーションされていないアクセスキーは、セキュリティ対策として自動無効化されます。\n\n■ 対象情報\n- AWSアカウントID: ' & $awsAccountId & '\n- IAMユーザー名: ' & $userName & '\n- ローテーション期限: ' & $rotationDeadline & '\n- 残り日数: ' & $string($remainingDays) & '日\n- ルール名: ' & $configRuleName & '\n\n本メールは自動送信されています。' %}"
              }
            },
            "Subject": {
              "Charset": "UTF-8",
              "Data": "{% '【アクション必要】IAMアクセスキー期限通知 - ' & $userName & ' (残り' & $string($remainingDays) & '日)' %}"
            }
          }
        },
        "Destination": {
          "ToAddresses": [
            "{% $toEmailAddress %}"
          ]
        },
        "FromEmailAddress": "{% $fromEmailAddress %}"
      },
      "Resource": "arn:aws:states:::aws-sdk:sesv2:sendEmail",
      "End": true
    }
  }
}

		

			
			{
	"Version": "2012-10-17",
	"Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail",
                "iam:ListUsers"
            ],
            "Resource": "*"
        }
	]
}

		

			
			{
  "detail-type": ["Config Rules Compliance Change"],
  "source": ["aws.config"],
  "detail": {
    "configRuleName": ["access-keys-rotated-1", "access-keys-rotated-2"],
    "messageType": ["ComplianceChangeNotification"],
    "newEvaluationResult": {
      "complianceType": ["NON_COMPLIANT"]
    }
  }
}

		

			
			{
  "version": "0",
  "id": "2c2a2284-0651-1c08-768c-8140299f1f37",
  "detail-type": "Config Rules Compliance Change",
  "source": "aws.config",
  "account": "アカウントID",
  "time": "2025-07-02T03:23:19Z",
  "region": "ap-northeast-1",
  "resources": [],
  "detail": {
    "resourceId": "AIDATCKAQT2XHRAS7UPNO",
    "awsRegion": "ap-northeast-1",
    "awsAccountId": "アカウントID",
    "configRuleName": "access-keys-rotated-1",
    "recordVersion": "1.0",
    "configRuleARN": "arn:aws:config:ap-northeast-1:アカウントID:config-rule/config-rule-1xk3vm",
    "messageType": "ComplianceChangeNotification",
    "newEvaluationResult": {
      "evaluationResultIdentifier": {
        "evaluationResultQualifier": {
          "configRuleName": "access-keys-rotated-1",
          "resourceType": "AWS::IAM::User",
          "resourceId": "AIDATCKAQT2XHRAS7UPNO",
          "evaluationMode": "DETECTIVE"
        },
        "orderingTimestamp": "2025-07-02T03:22:44.084Z"
      },
      "complianceType": "NON_COMPLIANT",
      "resultRecordedTime": "2025-07-02T03:23:18.689Z",
      "configRuleInvokedTime": "2025-07-02T03:22:47.595Z"
    },
    "oldEvaluationResult": {
      "evaluationResultIdentifier": {
        "evaluationResultQualifier": {
          "configRuleName": "access-keys-rotated-1",
          "resourceType": "AWS::IAM::User",
          "resourceId": "AIDATCKAQT2XHRAS7UPNO",
          "evaluationMode": "DETECTIVE"
        },
        "orderingTimestamp": "2025-07-01T03:22:44.079Z"
      },
      "complianceType": "COMPLIANT",
      "resultRecordedTime": "2025-07-01T03:23:18.588Z",
      "configRuleInvokedTime": "2025-07-01T03:22:47.462Z"
    },
    "notificationCreationTime": "2025-07-02T03:23:19.371Z",
    "resourceType": "AWS::IAM::User"
  }
}