フォレンジック作業の証拠をS3に集めるAWSのフレームワークを試してみた

git clone https://github.com/aws-samples/sample-collect-forensic-artifacts-s3
cd sample-collect-forensic-artifacts-s3
npm install

$ npx cdk synth
Successfully synthesized to cdk.out/

export const SECURITY_ACCOUNT = "111122223333";
export const CUSTOMER_ACCOUNTS = ["111122223333"]; // 検証では同一アカウントに載せた
export const ALLOW_LISTED_ROLE_NAMES = ["SecurityAnalystRole", "ForensicsOperatorRole"];
export const ALERT_EMAIL_RECIPIENTS = ["security-alerts@example.com"];

$ npx cdk bootstrap aws://111122223333/us-east-1
 ✅  Environment aws://111122223333/us-east-1 bootstrapped.

$ npx cdk deploy SecurityStack AlertStack --require-approval never
 ✅  SecurityStack
 ✅  AlertStack

$ npx cdk deploy CustomerStack-111122223333 --require-approval never
 ✅  CustomerStack-111122223333

CREATE_FAILED | AWS::IAM::Role | SecurityTriageRole
Resource handler returned message: "Invalid principal in policy: ...:role/LambdaRole"

// 例: 概念だけ（実ファイルの構造に合わせて読み替えてください）
const lambdaRole = new iam.Role(this, "LambdaRole", { /* ... */ });

const securityTriageRole = new iam.Role(this, "SecurityTriageRole", {
  assumedBy: new iam.ArnPrincipal(lambdaRole.roleArn),
});

$ aws ssm describe-instance-information \
    --filters "Key=InstanceIds,Values=i-0a1b2c3d4e5f67890" \
    --query 'InstanceInformationList[0].[InstanceId,PingStatus,AgentVersion]' \
    --output text

i-0a1b2c3d4e5f67890  Online  3.3.xxxx

$ aws sts assume-role \
    --role-arn arn:aws:iam::111122223333:role/SecurityTriageRole \
    --role-session-name CASE-0001 \
    --duration-seconds 3600 \
    --policy '{"Version":"2012-10-17","Statement":[
      {"Effect":"Allow","Action":["s3:PutObject","s3:AbortMultipartUpload"],
       "Resource":"arn:aws:s3:::111122223333-evidence-bucket-us-east-1/CASE-0001/*"},
      {"Effect":"Allow","Action":["kms:GenerateDataKey","kms:Encrypt","kms:Decrypt"],
       "Resource":"arn:aws:kms:us-east-1:111122223333:key/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"}
    ]}'

$ aws s3 cp evidence.txt s3://111122223333-evidence-bucket-us-east-1/CASE-0001/evidence.txt
upload: ./evidence.txt to s3://111122223333-evidence-bucket-us-east-1/CASE-0001/evidence.txt

$ aws s3 cp evidence.txt s3://111122223333-evidence-bucket-us-east-1/CASE-0004/evidence.txt
An error occurred (AccessDenied) when calling the PutObject operation:
User: arn:aws:sts::111122223333:assumed-role/SecurityTriageRole/CASE-0001 is not authorized
to perform: s3:PutObject on resource: "arn:aws:s3:::111122223333-evidence-bucket-us-east-1/CASE-0004/evidence.txt"
because no session policy allows the s3:PutObject action

$ aws sqs send-message \
    --queue-url https://sqs.us-east-1.amazonaws.com/111122223333/AlertQueue \
    --message-body '{
      "account": "111122223333",
      "ticket_id": "CASE-0002",
      "region": "us-east-1",
      "instance_id": "i-0a1b2c3d4e5f67890"
    }'

{
    "MD5OfMessageBody": "...",
    "MessageId": "11111111-2222-3333-4444-555555555555"
}

$ aws stepfunctions describe-execution \
    --execution-arn "arn:aws:states:us-east-1:111122223333:execution:SecurityWorkflow-demo:exec-demo-001"

{
  "status": "SUCCEEDED",
  "startDate": "...",
  "stopDate": "..."
}

Evaluate Instance
  → Check Evaluation Results
  → ToolSync（run_collection.sh を EC2 に同期）
  → Check ToolSync Execution Status
  → Execute Tooling（run_collection.sh 実行）
  → Check Tool Execution Status
  → Upload Results（出力を S3 にアップロード）
  → Check Upload Results Status
  → Update DynamoDB Table
  → Finish

$ aws dynamodb scan --table-name AlertMetricsTable --max-items 1

{
  "Items": [
    {
      "ID": { "S": "CASE-0002" },
      "AccountID": { "S": "111122223333" },
      "InstanceId": { "S": "i-0a1b2c3d4e5f67890" },
      "Region": { "S": "us-east-1" },
      "S3ArtifactLocation": {
        "S": "s3://111122223333-evidence-bucket-us-east-1/CASE-0002/111122223333/i-0a1b2c3d4e5f67890/..."
      },
      "ToolSyncStatus": { "BOOL": true },
      "CollectionScriptStatus": { "BOOL": true },
      "UploadResultsStatus": { "BOOL": true }
    }
  ],
  ...
}

$ aws s3 ls s3://111122223333-evidence-bucket-us-east-1/ --recursive

CASE-0001/evidence.txt
CASE-0002/111122223333/i-0a1b2c3d4e5f67890/CASE-0002_i-0a1b2c3d4e5f67890_output.txt

$ aws s3api get-object \
    --bucket 111122223333-evidence-bucket-us-east-1 \
    --key "CASE-0002/111122223333/i-0a1b2c3d4e5f67890/CASE-0002_i-0a1b2c3d4e5f67890_output.txt" \
    /tmp/out.txt

An error occurred (AccessDenied) when calling the GetObject operation:
User: arn:aws:sts::111122223333:assumed-role/SecurityTriageRole/alert-test-001
is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::111122223333-evidence-bucket-us-east-1/.../CASE-0002_..._output.txt"
with an explicit deny in a resource-based policy