AI が自動で脆弱性診断！ AWS Security Agent のハンズオンをやってみた

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  AWS Security Agent Hands-on: EC2 with ALB Deploys a vulnerable web application for penetration testing with AWS Security Agent.Requires a existing ACM certificate.

# ============================================================
# Architecture Overview
# ============================================================
#
# 前提条件:
#   - 独自ドメインを所有していること
#   - ACM で対象ドメインの証明書が発行済み（検証完了）であること
#
# このテンプレートで作成するもの:
#   - VPC / サブネット / IGW / ルートテーブル
#   - ALB（HTTPS リスナー + ACM 証明書適用）
#   - EC2（OWASP Juice Shop を Docker で起動）
#   - セキュリティグループ / IAM ロール
#
# このテンプレートで作成しないもの（手動作業）:
#   - Route 53 への ALB エイリアスレコード登録
#   - Security Agent のエージェントスペース作成
#   - Security Agent のペネトレーションテスト設定・実行
# ============================================================

Parameters:
  CertificateArn:
    Type: String
    Description: >
      ACM ARN *example: arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxx

Resources:
  # ============================================================
  # VPC & Networking
  # - EC2 と ALB を配置するネットワーク基盤。
  # - IGW 経由でインターネットアクセスを提供（Docker イメージ pull、ALB 公開）。
  # ============================================================
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: security-agent-handson-vpc

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: security-agent-handson-igw

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: security-agent-handson-public-1a

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [1, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: security-agent-handson-public-1c

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: security-agent-handson-public-rt

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # ============================================================
  # Security Groups
  # - ALB SG: インターネットからの HTTPS (443) を許可
  # - EC2 SG: ALB からのポート 3000 のみ許可
  # ============================================================
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Agent Handson - ALB SG (HTTPS)
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: Allow HTTPS from internet
      Tags:
        - Key: Name
          Value: security-agent-handson-alb-sg

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Agent Handson - EC2 SG
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          SourceSecurityGroupId: !Ref ALBSecurityGroup
          Description: Allow traffic from ALB
      Tags:
        - Key: Name
          Value: security-agent-handson-ec2-sg

  # ============================================================
  # IAM Role for EC2
  # - SSM Session Manager 経由で EC2 に接続するためのロール。
  # - SSH キーペア不要でセキュアにインスタンスへアクセスできる。
  # ============================================================
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-ec2-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-ec2-role'

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${AWS::StackName}-ec2-profile'
      Roles:
        - !Ref EC2Role

  # ============================================================
  # EC2 Instance (OWASP Juice Shop)
  # - Docker で OWASP Juice Shop を起動し、ポート 3000 で待ち受ける。
  # ============================================================
  JuiceShopInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Sub '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}'
      InstanceType: t3.medium
      IamInstanceProfile: !Ref EC2InstanceProfile
      SubnetId: !Ref PublicSubnet2
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          exec > /var/log/userdata.log 2>&1

          # Install Docker
          dnf update -y
          dnf install -y docker

          # Add ec2-user to docker group
          usermod -aG docker ec2-user

          # Start Docker service
          systemctl enable docker
          systemctl start docker

          # Wait for Docker daemon to be ready
          for i in $(seq 1 30); do
            docker info > /dev/null 2>&1 && break
            echo "Waiting for Docker daemon... ($i/30)"
            sleep 2
          done

          # Pull and run OWASP Juice Shop container
          docker pull bkimminich/juice-shop:latest
          docker run -d --name juice-shop \
            --restart always \
            -p 3000:3000 \
            bkimminich/juice-shop:latest

          # Wait for Juice Shop to be ready (healthcheck)
          for i in $(seq 1 60); do
            curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/ | grep -q "200" && break
            echo "Waiting for Juice Shop to start... ($i/60)"
            sleep 5
          done
          echo "Juice Shop is ready"

      Tags:
        - Key: Name
          Value: security-agent-handson-juiceshop

  # ============================================================
  # Application Load Balancer
  # - HTTPS でアプリケーションを公開する。
  # - ACM 証明書を適用し、Security Agent が HTTPS 経由でテスト可能にする。
  # ============================================================
  ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: security-agent-handson-alb
      Scheme: internet-facing
      Type: application
      SecurityGroups:
        - !Ref ALBSecurityGroup
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: security-agent-handson-alb

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: security-agent-handson-tg
      Protocol: HTTP
      Port: 3000
      VpcId: !Ref VPC
      TargetType: instance
      Targets:
        - Id: !Ref JuiceShopInstance
          Port: 3000
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckPort: '3000'
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 3
      HealthCheckIntervalSeconds: 30
      HealthCheckTimeoutSeconds: 5
      Tags:
        - Key: Name
          Value: security-agent-handson-tg

  # HTTPS リスナー（ACM 証明書を適用）
  ALBListenerHTTPS:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ALB
      Protocol: HTTPS
      Port: 443
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
      Certificates:
        - CertificateArn: !Ref CertificateArn
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

# ============================================================
# Outputs
# ============================================================
Outputs:
  ALBDNSName:
    Description: >
      ALB の DNS 名。Route 53 で A レコード（エイリアス）を作成する際のターゲット。
    Value: !GetAtt ALB.DNSName

  ALBHostedZoneId:
    Description: >
      ALB の Hosted Zone ID。Route 53 エイリアスレコード作成時に必要。
    Value: !GetAtt ALB.CanonicalHostedZoneID

  EC2InstanceId:
    Description: EC2 Instance ID — SSM Session Manager で接続する際に使用
    Value: !Ref JuiceShopInstance

  VpcId:
    Description: VPC ID
    Value: !Ref VPC