AWS Organizations の SCP クォータが倍増したので実際に10個アタッチと10,240文字ポリシーを試してみた

#!/bin/bash
# AWS Organizations SCP クォータ引き上げ検証スクリプト
# 前提: Organizations 管理アカウントの認証情報、python3
# 実行: ./test-scp-quota.sh

set -euo pipefail
REGION="us-east-1"
SCP_CONTENT='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'

GREEN='\033[0;32m'; RED='\033[0;31m'; NC='\033[0m'
pass() { echo -e "${GREEN}✅ PASS${NC}: $1"; }
fail() { echo -e "${RED}❌ FAIL${NC}: $1"; }

ROOT_ID=$(aws organizations list-roots --region "$REGION" --query 'Roots[0].Id' --output text)

echo "=== Part 1: アタッチ数上限テスト ==="
OU_ID=$(aws organizations create-organizational-unit \
  --parent-id "$ROOT_ID" --name "SCP-Quota-Test" \
  --region "$REGION" --query 'OrganizationalUnit.Id' --output text)

POLICY_IDS=()
for i in $(seq -w 1 10); do
  PID=$(aws organizations create-policy \
    --name "SCP-QuotaTest-${i}" --description "Quota test ${i}" \
    --type SERVICE_CONTROL_POLICY --content "$SCP_CONTENT" \
    --region "$REGION" --query 'Policy.PolicySummary.Id' --output text)
  POLICY_IDS+=("$PID")
  sleep 1
done

for i in $(seq 0 5); do
  aws organizations attach-policy --policy-id "${POLICY_IDS[$i]}" --target-id "$OU_ID" --region "$REGION"
  sleep 1
done
COUNT=$(aws organizations list-policies-for-target --target-id "$OU_ID" \
  --filter SERVICE_CONTROL_POLICY --region "$REGION" --query 'length(Policies)' --output text)
[ "$COUNT" -eq 7 ] && pass "旧上限超え: ${COUNT}個" || fail "期待7個、実際${COUNT}個"

for i in $(seq 6 8); do
  aws organizations attach-policy --policy-id "${POLICY_IDS[$i]}" --target-id "$OU_ID" --region "$REGION"
  sleep 1
done
COUNT=$(aws organizations list-policies-for-target --target-id "$OU_ID" \
  --filter SERVICE_CONTROL_POLICY --region "$REGION" --query 'length(Policies)' --output text)
[ "$COUNT" -eq 10 ] && pass "新上限到達: ${COUNT}個" || fail "期待10個、実際${COUNT}個"

if ERROR=$(aws organizations attach-policy --policy-id "${POLICY_IDS[9]}" \
  --target-id "$OU_ID" --region "$REGION" 2>&1); then
  fail "11個目がエラーにならなかった"
else
  echo "$ERROR" | grep -q "MAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED" && \
    pass "11個目でエラー: MAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED" || fail "$ERROR"
fi

echo "=== クリーンアップ ==="
for PID in "${POLICY_IDS[@]}"; do
  aws organizations detach-policy --policy-id "$PID" --target-id "$OU_ID" --region "$REGION" 2>/dev/null || true
  sleep 0.5
  aws organizations delete-policy --policy-id "$PID" --region "$REGION"
  sleep 0.5
done
aws organizations delete-organizational-unit --organizational-unit-id "$OU_ID" --region "$REGION"

echo "=== Part 2: ポリシーサイズ上限テスト ==="
python3 -c "
import json
cidrs = [f'10.{i}.{j}.0/24' for i in range(50) for j in range(256)]
policy = {'Version':'2012-10-17','Statement':[{'Sid':'Test','Effect':'Deny','Action':'*','Resource':'*','Condition':{'NotIpAddress':{'aws:SourceIp':cidrs}}}]}
compact = json.dumps(policy, separators=(',',':'))
while len(compact) > 10240:
    cidrs.pop()
    policy['Statement'][0]['Condition']['NotIpAddress']['aws:SourceIp'] = cidrs
    compact = json.dumps(policy, separators=(',',':'))
with open('/tmp/scp-max.json','w') as f: f.write(compact)
cidrs.append(f'10.{len(cidrs)//256}.{len(cidrs)%256}.0/24')
policy['Statement'][0]['Condition']['NotIpAddress']['aws:SourceIp'] = cidrs
with open('/tmp/scp-over.json','w') as f: f.write(json.dumps(policy, separators=(',',':')))
print(f'Max: {len(compact)} chars ({len(cidrs)-1} CIDRs), Over: {len(json.dumps(policy, separators=(chr(44),chr(58))))} chars ({len(cidrs)} CIDRs)')
"

if PID=$(aws organizations create-policy --name "SCP-SizeTest-Max" --description "Size test" \
  --type SERVICE_CONTROL_POLICY --content file:///tmp/scp-max.json \
  --region "$REGION" --query 'Policy.PolicySummary.Id' --output text 2>&1); then
  pass "上限以内のポリシー作成成功"
  aws organizations delete-policy --policy-id "$PID" --region "$REGION"
else
  fail "$PID"
fi

if ERROR=$(aws organizations create-policy --name "SCP-SizeTest-Over" --description "Size test over" \
  --type SERVICE_CONTROL_POLICY --content file:///tmp/scp-over.json \
  --region "$REGION" 2>&1); then
  fail "上限超過がエラーにならなかった"
else
  echo "$ERROR" | grep -q "POLICY_CONTENT_LIMIT_EXCEEDED" && \
    pass "上限超過でエラー: POLICY_CONTENT_LIMIT_EXCEEDED" || fail "$ERROR"
fi

echo "=== 全検証完了 ==="