Amazon GuardDuty S3マルウェアプロテクションをAWS Organizations組織全体で一括有効化しようとして諦めた話

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM Role for GuardDuty S3 Malware Protection'

Parameters:
  KMSKeyId:
    Type: String
    Description: 'ID of the KMS key used for bucket encryption (if applicable)'
    Default: ''

  Region:
    Type: String
    Description: 'AWS Region'
    Default: 'ap-northeast-1'

Conditions:
  HasKMSKey: !Not [!Equals [!Ref KMSKeyId, '']]

Resources:
  MalwareProtectionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'GuardDutyS3MalwareProtectionRole'
      Description: 'Role for GuardDuty to scan S3 objects for malware'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: malware-protection-plan.guardduty.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: 'S3MalwareProtectionPolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: 'AllowManagedRuleToSendS3EventsToGuardDuty'
                Effect: Allow
                Action:
                  - 'events:PutRule'
                  - 'events:DeleteRule'
                  - 'events:PutTargets'
                  - 'events:RemoveTargets'
                Resource:
                  - !Sub 'arn:aws:events:${Region}:${AWS::AccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*'
                Condition:
                  StringLike:
                    'events:ManagedBy': 'malware-protection-plan.guardduty.amazonaws.com'
                    
              - Sid: 'AllowGuardDutyToMonitorEventBridgeManagedRule'
                Effect: Allow
                Action:
                  - 'events:DescribeRule'
                  - 'events:ListTargetsByRule'
                Resource:
                  - !Sub 'arn:aws:events:${Region}:${AWS::AccountId}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*'
                  
              - Sid: 'AllowPostScanTag'
                Effect: Allow
                Action:
                  - 's3:PutObjectTagging'
                  - 's3:GetObjectTagging'
                  - 's3:PutObjectVersionTagging'
                  - 's3:GetObjectVersionTagging'
                Resource:
                  - !Sub 'arn:aws:s3:::*/*'
                  
              - Sid: 'AllowEnableS3EventBridgeEvents'
                Effect: Allow
                Action:
                  - 's3:PutBucketNotification'
                  - 's3:GetBucketNotification'
                Resource:
                  - !Sub 'arn:aws:s3:::*'
                  
              - Sid: 'AllowPutValidationObject'
                Effect: Allow
                Action:
                  - 's3:PutObject'
                Resource:
                  - !Sub 'arn:aws:s3:::*/malware-protection-resource-validation-object'
                  
              - Sid: 'AllowCheckBucketOwnership'
                Effect: Allow
                Action:
                  - 's3:ListBucket'
                Resource:
                  - !Sub 'arn:aws:s3:::*'
                  
              - Sid: 'AllowMalwareScan'
                Effect: Allow
                Action:
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                Resource:
                  - !Sub 'arn:aws:s3:::*/*'
                  
              - !If
                - HasKMSKey
                - Sid: 'AllowDecryptForMalwareScan'
                  Effect: Allow
                  Action:
                    - 'kms:GenerateDataKey'
                    - 'kms:Decrypt'
                  Resource: !Sub 'arn:aws:kms:${Region}:${AWS::AccountId}:key/${KMSKeyId}'
                  Condition:
                    StringLike:
                      'kms:ViaService': !Sub 's3.${Region}.amazonaws.com'
                - !Ref 'AWS::NoValue'

  MalwareProtectionPlan:
    Type: 'AWS::GuardDuty::MalwareProtectionPlan'
    Properties:
      Role: !GetAtt MalwareProtectionRole.Arn
      ProtectedResource:
        S3Bucket:
          BucketName: "[バケット名]"
      Actions:
        Tagging:
          Status: 'ENABLED'
      Tags:
        - Key: 'Purpose'
          Value: 'MalwareProtection'

Outputs:
  MalwareProtectionRoleArn:
    Description: 'ARN of the IAM Role for GuardDuty S3 Malware Protection'
    Value: !GetAtt MalwareProtectionRole.Arn
    
  MalwareProtectionPlanId:
    Description: 'ID of the Malware Protection Plan'
    Value: !GetAtt MalwareProtectionPlan.MalwareProtectionPlanId
    
  MalwareProtectionPlanArn:
    Description: 'ARN of the Malware Protection Plan'
    Value: !GetAtt MalwareProtectionPlan.Arn

ProtectedResource:
  S3Bucket:
    BucketName: "*"

ProtectedResource:
  S3Bucket:
    BucketName: null

bash-5.2$ aws cloudformation deploy --template-file s3malware.yaml --stack-name sample-stack --capabilities CAPABILITY_NAMED_IAM

An error occurred (ValidationError) when calling the CreateChangeSet operation: [/Resources/MalwareProtectionPlan/Type/ProtectedResource/S3Bucket/BucketName] 'null' values are not allowed in templates

# 事前にS3マルウェアプロテクション用のIAMロールを作成しておく
MALWARE_PROTECTION_ROLE_ARN="arn:aws:iam::111122223333:role/GuardDutyMalwareProtectionRole"
REGIONS=$(aws ec2 describe-regions --query 'Regions[?RegionOptStatusEquals!=`disabled`].RegionName' --output text)
# 各リージョンですべてのバケットリストを取得し、S3マルウェアプロテクションを有効化
for region in ${REGIONS}; do
  echo "##### Enabling S3 Malware Protection for all buckets in ${region}"
  
  # リージョン内のすべてのバケットを取得
  BUCKETS=$(aws --region ${region} s3api list-buckets --query "Buckets[].Name" --output text)
  
  # 各バケットに対してマルウェアプロテクションを有効化
  for bucket in ${BUCKETS}; do
    # バケットのリージョンを確認（クロスリージョンのバケットはスキップ）
    BUCKET_REGION=$(aws s3api get-bucket-location --bucket ${bucket} --query "LocationConstraint" --output text)
    # null または空の場合は us-east-1
    if [ "$BUCKET_REGION" = "null" ] || [ -z "$BUCKET_REGION" ]; then
      BUCKET_REGION="us-east-1"
    fi
    
    # バケットが現在のリージョンにある場合のみ処理
    if [ "$BUCKET_REGION" = "$region" ]; then
      echo "Creating malware protection plan for bucket: ${bucket}"
      aws --region ${region} guardduty create-malware-protection-plan \
        --role "${MALWARE_PROTECTION_ROLE_ARN}" \
        --protected-resource "S3Bucket"={"BucketName"="${bucket}"} \
        --actions "Tagging"={"Status"="ENABLED"}
    fi
  done
done