AWS Configルールを利用し、認証情報が一定期間未利用のIAMユーザーを無効化する前に事前通知する仕組み

{
  "Comment": "IAMユーザー認証情報の自動無効化アラート通知ワークフロー - Config Rule評価結果に基づいて対象ユーザーにSNS通知を送信",
  "QueryLanguage": "JSONata",
  "StartAt": "Initialize Configuration",
  "States": {
    "Initialize Configuration": {
      "Type": "Pass",
      "Comment": "初期設定値を定義：AWSアカウントID、Config Rule名、最大未使用日数を設定",
      "Assign": {
        "awsAccountId": "{% $states.input.detail.awsAccountId %}",
        "configRuleName": "{% $states.input.detail.configRuleName %}",
        "maxUnusedDays": "{% 90 %}"
      },
      "Next": "Calculate Days"
    },
    "Calculate Days": {
      "Type": "Pass",
      "Comment": "ConfigRule名に基づいて残り日数を計算：check-1なら7日、check-2なら14日",
      "Assign": {
        "remainingDays": "{% $configRuleName = \"iam-credential-expiry-check-1\" ? 7 : $configRuleName = \"iam-credential-expiry-check-2\" ? 14 %}"
      },
      "Next": "Calculate Disable Deadline"
    },
    "Calculate Disable Deadline": {
      "Type": "Pass",
      "Comment": "無効化予定日を計算：現在日時 + 残り日数から YYYY/MM/DD 形式の文字列を生成",
      "Assign": {
        "disableDeadline": "{% (\n  $remainingDays := (\n    $configRuleName = \"iam-credential-expiry-check-1\" ? 7 :\n    $configRuleName = \"iam-credential-expiry-check-2\" ? 14\n  );\n  $targetDate := $toMillis($now()) + ($remainingDays * 24 * 60 * 60 * 1000);\n  $dateStr := $substring($fromMillis($targetDate), 0, 10);\n  $replace($replace($dateStr, \"-\", \"/\"), /^(\\d{4})\\/(\\d{2})\\/(\\d{2})$/, \"$1/$2/$3\")\n) %}"
      },
      "Next": "ListUsers"
    },
    "ListUsers": {
      "Comment": "全ユーザー一覧を取得し、ユーザーID（resourceId）に該当するユーザーの名前を特定",
      "Arguments": {},
      "Assign": {
        "userName": "{% $states.result.Users[UserId=$states.input.detail.resourceId].UserName[0] %}"
      },
      "Next": "SNS Publish",
      "Resource": "arn:aws:states:::aws-sdk:iam:listUsers",
      "Type": "Task"
    },
    "SNS Publish": {
      "Arguments": {
        "TopicArn": "arn:aws:sns:ap-northeast-1:AWSアカウントID:cm-hirai",
        "Subject": "{% 'IAM認証情報無効化通知 - ' & $userName %}",
        "Message": "{% 'IAMユーザー「' & $userName & '」の認証情報（コンソールパスワード or アクセスキー）が' & $string($remainingDays) & '日後（' & $disableDeadline & '）に自動無効化されます。\n\n▼ 継続利用される場合の対応方法\n・AWSマネジメントコンソールへのログイン\n・アクセスキーを使用したAWS操作の実行\n\n※' & $string($maxUnusedDays) & '日間未使用の認証情報は、セキュリティ対策として自動無効化されます。\n\n■ 対象情報\n- AWSアカウントID: ' & $awsAccountId & '\n- IAMユーザー名: ' & $userName & '\n- 無効化予定日: ' & $disableDeadline & '\n- 残り日数: ' & $string($remainingDays) & '日\n\n本メールは自動送信されています。' %}"
      },
      "End": true,
      "Resource": "arn:aws:states:::sns:publish",
      "Type": "Task"
    }
  }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

{
  "detail-type": ["Config Rules Compliance Change"],
  "source": ["aws.config"],
  "detail": {
    "configRuleName": ["iam-credential-expiry-check-1", "iam-credential-expiry-check-2"],
    "messageType": ["ComplianceChangeNotification"],
    "newEvaluationResult": {
      "complianceType": ["NON_COMPLIANT"]
    }
  }
}

{
  "version": "0",
  "id": "3262a2d6-39ab-714f-158e-00d29af1402f",
  "detail-type": "Config Rules Compliance Change",
  "source": "aws.config",
  "account": "アカウントID",
  "time": "2025-07-30T07:21:24Z",
  "region": "ap-northeast-1",
  "resources": [],
  "detail": {
    "resourceId": "AIDATCKAQT2XMYOT37SQY",
    "awsRegion": "ap-northeast-1",
    "awsAccountId": "アカウントID",
    "configRuleName": "iam-credential-expiry-check-2",
    "recordVersion": "1.0",
    "configRuleARN": "arn:aws:config:ap-northeast-1:アカウントID:config-rule/config-rule-ydinvr",
    "messageType": "ComplianceChangeNotification",
    "newEvaluationResult": {
      "evaluationResultIdentifier": {
        "evaluationResultQualifier": {
          "configRuleName": "iam-credential-expiry-check-2",
          "resourceType": "AWS::IAM::User",
          "resourceId": "AIDATCKAQT2XMYOT37SQY",
          "evaluationMode": "DETECTIVE"
        },
        "orderingTimestamp": "2025-07-30T07:20:49.600Z"
      },
      "complianceType": "NON_COMPLIANT",
      "resultRecordedTime": "2025-07-30T07:21:24.168Z",
      "configRuleInvokedTime": "2025-07-30T07:20:53.047Z"
    },
    "notificationCreationTime": "2025-07-30T07:21:24.867Z",
    "resourceType": "AWS::IAM::User"
  }
}