10分でできる！AWS Security Hub のアラートを見やすく整形して Slack に通知してみた（CloudFormation 利用）

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Send AWS Security Hub findings to SNS using EventBridge
  with input transformers.

Parameters:

  # 通知送信先の E メール
  NotificationEmail:
    Type: String
    Default: ""
    Description: >
      (Optional) Email address to subscribe to the SNS topic.
      Example: security-alert@example.com
      Leave empty to skip email subscription.

  # 通知対象とする Security Hub の重要度
  SecurityHubSeverity:
    Type: String
    Default: "CRITICAL,HIGH"
    Description: >
      (Optional) Comma-separated list of Security Hub severity labels.
      Allowed values:
      CRITICAL,HIGH,MEDIUM,LOW,INFORMATIONAL
      Example: CRITICAL,HIGH

Conditions:
  HasEmailSubscription: !Not [!Equals [!Ref NotificationEmail, ""]]

Resources:

  # 通知用 SNS トピック  
  AlertSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: SecurityAlerts

  # SNS のサブスクリプション（Eメール）      
  AlertSnsSubscription:
    Type: AWS::SNS::Subscription
    Condition: HasEmailSubscription
    Properties:
      Protocol: email
      TopicArn: !Ref AlertSnsTopic
      Endpoint: !Ref NotificationEmail

  # EventBridge から SNS への通知を許可する IAM ロール      
  EventBridgeToSnsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowPublishToSns
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: sns:Publish
                Resource: !Ref AlertSnsTopic

  # EventBridge ルール（入力トランスフォーマーによる整形付き）
  SecurityHubEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Send Security Hub findings to SNS with transformer
      EventPattern:
        source:
          - aws.securityhub
        detail-type:
          - Security Hub Findings - Imported
        detail:
          findings:
            Severity:
              Label: !Split [",", !Ref SecurityHubSeverity]
      Targets:
        - Arn: !Ref AlertSnsTopic
          Id: SecurityHubToSns
          RoleArn: !GetAtt EventBridgeToSnsRole.Arn
          InputTransformer:
            InputPathsMap:
              account: "$.account"
              compliance: "$.detail.findings[0].Compliance.Status"
              controlid: "$.detail.findings[0].Compliance.SecurityControlId"
              description: "$.detail.findings[0].Description"
              firstObservedAt: "$.detail.findings[0].FirstObservedAt"
              id: "$.detail.findings[0].Id"
              label: "$.detail.findings[0].Severity.Label"
              lastObservedAt: "$.detail.findings[0].LastObservedAt"
              recommendationUrl: "$.detail.findings[0].Remediation.Recommendation.Url"
              recordState: "$.detail.findings[0].RecordState"
              resource: "$.detail.findings[0].Resources"
              time: "$.time"
              title: "$.detail.findings[0].Title"
              updatedAt: "$.detail.findings[0].UpdatedAt"
              workflowState: "$.detail.findings[0].WorkflowState"
            InputTemplate: |
              "タイトル: <title>"
              "対象アカウント: <account>"
              "時刻: <time>"
              "コントロール ID: <controlid>"
              "内容: <description>"
              "ワークフローステータス: <workflowState>"
              "コンプライアンス: <compliance>"
              "初回検知日時: <firstObservedAt>"
              "最終検知日時: <lastObservedAt>"
              "重要度ラベル: <label>"
              "対象リソース: <resource>"
              "レコードステータス: <recordState>"
              "更新日時: <updatedAt>"
              "参考URL: <recommendationUrl>"
              "ID: <id>"

Outputs:
  SnsTopicArn:
    Description: SNS Topic ARN for security alerts
    Value: !Ref AlertSnsTopic

aws securityhub batch-import-findings --region ap-northeast-1 --findings '[
     {
       "SchemaVersion": "2018-10-08",
       "Id": "test-finding-'$(date +%s)'",
       "ProductArn": "arn:aws:securityhub:ap-northeast-1:アカウントID:product/アカウントID/default",
       "GeneratorId": "test-generator",
       "AwsAccountId": "アカウントID",
       "Types": ["Software and Configuration Checks"],
       "CreatedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
       "UpdatedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
       "FirstObservedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
       "LastObservedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
       "Severity": {"Label": "CRITICAL"},
       "Title": "Test Finding for EventBridge Rule",
       "Description": "This is a test finding to verify EventBridge notification.",
       "Resources": [{"Type": "AwsEc2Instance", "Id": "arn:aws:ec2:ap-northeast-1:アカウントID:instance/i-test12345678"}],
       "Compliance": {
         "Status": "FAILED",
         "SecurityControlId": "EC2.99"
       },
       "RecordState": "ACTIVE",
       "Workflow": {"Status": "NEW"},
       "WorkflowState": "NEW",
       "Remediation": {
         "Recommendation": {
           "Text": "This is a test finding to verify EventBridge notification.",
           "Url": "https://docs.aws.amazon.com/console/securityhub/EC2.99/remediation"
         }
       }
     }
   ]'