AWS DevOps Agent の複数 AWS アカウントへの接続を AWS CDK で実装して、各アカウントを調査してみた

Security スタック（ハブアカウント）
└── DevOpsAgentConstruct
    ├── AgentSpaceConstruct
    │   └── OperatorRoleConstruct
    ├── AwsAssociationConstruct
    │   └── AgentSpaceRoleConstruct
    └── SecondaryAwsAssociationConstruct

DevOpsAgentSecondaryAccount スタック（セカンダリアカウント）
└── DevOpsAgentSecondaryAccountRole

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

/** セカンダリアカウントに作成する IAM ロール名（ハブアカウント側から ARN 参照するため固定値） */
export const SECONDARY_ACCOUNT_ROLE_NAME = "DevOpsAgentSecondaryAccountRole";

interface DevOpsAgentSecondaryAccountStackProps extends cdk.StackProps {
  primaryAccountId: string;
  primaryRegion: string;
}

/**
 * DevOps Agent のセカンダリアカウント用スタック
 *
 * ハブアカウントの Agent Space がこのアカウントのリソースを調査できるよう、
 * ハブアカウントの DevOps Agent が AssumeRole できる IAM ロールを作成する。
 *
 * @see https://docs.aws.amazon.com/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-connecting-multiple-aws-accounts.html
 */
export class DevOpsAgentSecondaryAccountStack extends cdk.Stack {
  constructor(
    scope: Construct,
    id: string,
    props: DevOpsAgentSecondaryAccountStackProps,
  ) {
    super(scope, id, props);

    const { primaryAccountId, primaryRegion } = props;

    /** ハブアカウントの DevOps Agent サービスプリンシパル */
    const servicePrincipal = new iam.ServicePrincipal("aidevops.amazonaws.com", {
      conditions: {
        StringEquals: {
          "aws:SourceAccount": primaryAccountId,
        },
        ArnLike: {
          // ハブアカウントの任意の Agent Space からの AssumeRole を許可（循環参照回避のためワイルドカード）
          "aws:SourceArn": cdk.Arn.format(
            {
              service: "aidevops",
              region: primaryRegion,
              account: primaryAccountId,
              resource: "agentspace",
              resourceName: "*",
            },
            this,
          ),
        },
      },
    });

    /** セカンダリアカウント用 IAM ロール */
    new iam.Role(this, "AgentSpaceRole", {
      roleName: SECONDARY_ACCOUNT_ROLE_NAME,
      assumedBy: servicePrincipal,
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName("AIDevOpsAgentAccessPolicy"),
      ],
      inlinePolicies: {
        /** @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#step-1-update-monitoring-roles */
        AllowCreateServiceLinkedRoles: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              actions: ["iam:CreateServiceLinkedRole"],
              resources: [
                this.formatArn({
                  service: "iam",
                  region: "",
                  resource: "role",
                  resourceName:
                    "aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer",
                }),
              ],
            }),
          ],
        }),
      },
    });
  }
}

import * as devopsagent from "aws-cdk-lib/aws-devopsagent";
import { Construct } from "constructs";

interface SecondaryAwsAssociationConstructProps {
  agentSpace: devopsagent.CfnAgentSpace;
  secondaryAccountId: string;
  secondaryAccountRoleArn: string;
}

/**
 * DevOps Agent のセカンダリ AWS アカウントの関連付け実装
 * @see https://docs.aws.amazon.com/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-connecting-multiple-aws-accounts.html
 */
export class SecondaryAwsAssociationConstruct extends Construct {
  public readonly association: devopsagent.CfnAssociation;

  constructor(
    scope: Construct,
    id: string,
    props: SecondaryAwsAssociationConstructProps,
  ) {
    super(scope, id);

    const { agentSpace, secondaryAccountId, secondaryAccountRoleArn } = props;

    /** セカンダリ AWS アカウントの関連付け */
    this.association = new devopsagent.CfnAssociation(this, "Default", {
      agentSpaceId: agentSpace.ref,
      serviceId: "aws",
      configuration: {
        sourceAws: {
          assumableRoleArn: secondaryAccountRoleArn,
          accountId: secondaryAccountId,
          accountType: "source",
        },
      },
    });
  }
}

import * as devopsagent from "aws-cdk-lib/aws-devopsagent";
import { Construct } from "constructs";

import { AgentSpaceConstruct } from "./agent-space";
import { AwsAssociationConstruct } from "./aws-association";
import { SecondaryAwsAssociationConstruct } from "./secondary-aws-association";

interface SecondaryAwsAssociationProps {
  secondaryAccountId: string;
  secondaryAccountRoleArn: string;
}

interface DevOpsAgentConstructProps {
  secondaryAwsAssociation?: SecondaryAwsAssociationProps;
}

/**
 * DevOps Agent リソース実装
 * @see https://github.com/aws-samples/sample-aws-devops-agent-cdk/blob/main/lib/devops-agent-stack.ts
 */
export class DevOpsAgentConstruct extends Construct {
  public readonly agentSpace: devopsagent.CfnAgentSpace;

  constructor(scope: Construct, id: string, props: DevOpsAgentConstructProps) {
    super(scope, id);

    const { secondaryAwsAssociation } = props;

    /** Agent Space 本体とオペレーターロールの作成 */
    const agentSpaceConstruct = new AgentSpaceConstruct(this, "AgentSpace");
    this.agentSpace = agentSpaceConstruct.agentSpace;

    /** Agent Space と AWS アカウントの関連付け */
    const awsAssociation = new AwsAssociationConstruct(this, "AwsAssociation", {
      agentSpace: agentSpaceConstruct.agentSpace,
    });
    awsAssociation.association.addDependency(agentSpaceConstruct.agentSpace);

    /** Agent Space とセカンダリ AWS アカウントの関連付け */
    if (secondaryAwsAssociation) {
      const secondaryAssociation = new SecondaryAwsAssociationConstruct(
        this,
        "SecondaryAwsAssociation",
        {
          agentSpace: agentSpaceConstruct.agentSpace,
          ...secondaryAwsAssociation,
        },
      );
      secondaryAssociation.association.addDependency(
        agentSpaceConstruct.agentSpace,
      );
    }
  }
}

npx cdk deploy DevOpsAgentSecondaryAccount -c environment=dev --profile <secondary-profile>

npx cdk deploy Security -c environment=dev --profile <hub-profile>