AWS Step FunctionsでIAMユーザーを削除してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS Config Remediation IAM Role for AWSConfigRemediation-DeleteIAMUser'

Parameters:
  AWSConfigRemediationDeleteIAMUserRoleName:
    Type: String
    Default: AWSConfigRemediation-DeleteIAMUserRole
    Description: Name for the IAM role used by AWSConfigRemediation-DeleteIAMUser automation

  AWSConfigRemediationDeleteIAMUserPolicyName:
    Type: String
    Default: AWSConfigRemediation-DeleteIAMUserPolicy
    Description: Name for the policy attached to the remediation role

Resources:
  AWSConfigRemediationDeleteIAMUserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref AWSConfigRemediationDeleteIAMUserRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
                - states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: !Ref AWSConfigRemediationDeleteIAMUserPolicyName
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:DeactivateMFADevice
                  - iam:DeleteAccessKey
                  - iam:DeleteLoginProfile
                  - iam:DeleteServiceSpecificCredential
                  - iam:DeleteSigningCertificate
                  - iam:DeleteSSHPublicKey
                  - iam:DeleteVirtualMFADevice
                  - iam:DeleteUser
                  - iam:DeleteUserPolicy
                  - iam:DetachUserPolicy
                  - iam:GetUser
                  - iam:ListAttachedUserPolicies
                  - iam:ListAccessKeys
                  - iam:ListGroupsForUser
                  - iam:ListMFADevices
                  - iam:ListServiceSpecificCredentials
                  - iam:ListSigningCertificates
                  - iam:ListSSHPublicKeys
                  - iam:ListUserPolicies
                  - iam:ListUsers
                  - iam:RemoveUserFromGroup
                Resource: '*'
              - Effect: Allow
                Action:
                  - ssm:GetAutomationExecution
                  - ssm:StartAutomationExecution
                Resource: '*'

{
  "Comment": "IAMユーザー削除ワークフロー - SSM Automationを使用したユーザー削除",
  "QueryLanguage": "JSONata",
  "StartAt": "GetUserDetails",
  "States": {
    "GetUserDetails": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:iam:getUser",
      "Arguments": {
        "UserName": "{% $states.input.username %}"
      },
      "Assign": {
        "userId": "{% $states.result.User.UserId %}"
      },
      "Comment": "指定されたユーザー名からユーザーIDを取得し、削除処理に必要な情報を準備",
      "Next": "StartDeletionAutomation"
    },
    "StartDeletionAutomation": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:ssm:startAutomationExecution",
      "Arguments": {
        "DocumentName": "AWSConfigRemediation-DeleteIAMUser",
        "Parameters": {
          "AutomationAssumeRole": [
            "arn:aws:iam::アカウントID:role/AWSConfigRemediation-DeleteIAMUserRole"
          ],
          "IAMUserId": [
            "{% $userId %}"
          ]
        }
      },
      "Assign": {
        "automationExecutionId": "{% $states.result.AutomationExecutionId %}"
      },
      "Comment": "SSM Automationを使用してIAMユーザー削除処理を開始",
      "Next": "WaitForAutomation"
    },
    "WaitForAutomation": {
      "Type": "Wait",
      "Seconds": 15,
      "Comment": "Automation実行の進行を待機（15秒間隔でポーリング）",
      "Next": "CheckAutomationExecution"
    },
    "CheckAutomationExecution": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:ssm:getAutomationExecution",
      "Arguments": {
        "AutomationExecutionId": "{% $automationExecutionId %}"
      },
      "Assign": {
        "executionStatus": "{% $states.result.AutomationExecution.AutomationExecutionStatus %}"
      },
      "Comment": "SSM Automation実行の現在のステータスを取得",
      "Next": "EvaluateExecutionStatus"
    },
    "EvaluateExecutionStatus": {
      "Type": "Choice",
      "Comment": "Automation実行ステータスに基づいて次のアクションを決定",
      "Choices": [
        {
          "Condition": "{% $executionStatus = 'Success' %}",
          "Comment": "削除処理が正常に完了した場合",
          "Next": "DeletionCompleted"
        },
        {
          "Condition": "{% $executionStatus = 'Failed' %}",
          "Comment": "削除処理が失敗した場合",
          "Next": "DeletionFailed"
        },
        {
          "Condition": "{% $executionStatus in ['InProgress', 'Waiting'] %}",
          "Comment": "削除処理が進行中または待機中の場合は継続監視",
          "Next": "WaitForAutomation"
        }
      ],
      "Default": "DeletionFailed"
    },
    "DeletionCompleted": {
      "Type": "Succeed",
      "Comment": "IAMユーザーの削除が正常に完了"
    },
    "DeletionFailed": {
      "Type": "Fail",
      "Cause": "SSM Automation実行が失敗しました。ログを確認してください。",
      "Error": "IAMUserDeletionFailed",
      "Comment": "IAMユーザーの削除処理が失敗"
    }
  }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IAMUserOperations",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ssm:StartAutomationExecution",
            "Resource": "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-DeleteIAMUser:*"
        },
        {
            "Effect": "Allow",
            "Action": "ssm:GetAutomationExecution",
            "Resource": "arn:aws:ssm:*:アカウントID:automation-execution/*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::アカウントID:role/AWSConfigRemediation-DeleteIAMUserRole"
        }
    ]
}

{
  "username": "test8"
}