AWS Workload Credentials ProviderでACMエクスポート可能証明書のデプロイを自動化してみた

aws acm request-certificate \
  --domain-name wcp-demo.example.com \
  --validation-method DNS \
  --key-algorithm EC_prime256v1 \
  --options ExportOption=ENABLED \
  --region ap-northeast-1

# パッケージインストール
sudo dnf install -y httpd mod_ssl nginx jq

# 証明書エクスポート（--passphrase は blob 型のため Base64 エンコード値を指定）
# temppass は検証用。本番では十分な強度のパスフレーズを使用する
aws acm export-certificate \
  --certificate-arn arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --passphrase $(echo -n 'temppass' | base64) \
  --region ap-northeast-1 \
  --output json > cert-export.json

# JSON から各ファイルを抽出
jq -r '.Certificate' cert-export.json > certificate.pem
jq -r '.CertificateChain' cert-export.json > chain.pem
jq -r '.PrivateKey' cert-export.json > encrypted_key.pem

# 秘密鍵のパスフレーズ解除
openssl pkey -in encrypted_key.pem -out private.key -passin pass:temppass

# fullchain 作成・配置
cat certificate.pem chain.pem > fullchain.pem
sudo mkdir -p /etc/ssl/acm
sudo cp fullchain.pem /etc/ssl/acm/
sudo cp private.key /etc/ssl/acm/
sudo chmod 600 /etc/ssl/acm/private.key

# httpd SSL 設定
sudo sed -i 's|^SSLCertificateFile.*|SSLCertificateFile /etc/ssl/acm/fullchain.pem|' /etc/httpd/conf.d/ssl.conf
sudo sed -i 's|^SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/ssl/acm/private.key|' /etc/httpd/conf.d/ssl.conf
sudo systemctl start httpd && sudo systemctl enable httpd

# Nginx デフォルトポートを変更（httpd の 80 番と競合回避）
sudo sed -i 's/listen       80;/listen       8080;/' /etc/nginx/nginx.conf
sudo sed -i 's/listen       \[::]:80;/listen       [::]:8080;/' /etc/nginx/nginx.conf

# Nginx SSL 設定（8443 ポート、httpd と共存）
sudo tee /etc/nginx/conf.d/ssl.conf > /dev/null << 'EOF'
server {
    listen 8443 ssl;
    server_name wcp-demo.example.com;

    ssl_certificate /etc/ssl/acm/fullchain.pem;
    ssl_certificate_key /etc/ssl/acm/private.key;

    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}
EOF
sudo systemctl start nginx && sudo systemctl enable nginx

# 疎通確認
curl -sk https://localhost        # httpd (443)
curl -sk https://localhost:8443   # Nginx (8443)

# 一時ファイル削除（秘密情報を含むため）
rm -f cert-export.json certificate.pem chain.pem fullchain.pem encrypted_key.pem private.key

# ユーザー作成
aws iam create-user --user-name wcp-demo-user

# ロール作成（ユーザーからAssumeRole可能）
aws iam create-role \
  --role-name wcp-demo-role \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Allow",
      "Principal":{"AWS":"arn:aws:iam::123456789012:user/wcp-demo-user"},
      "Action":"sts:AssumeRole"
    }]
  }'

# ロールにACMエクスポート権限を付与
aws iam put-role-policy \
  --role-name wcp-demo-role \
  --policy-name acm-export-policy \
  --policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Allow",
      "Action":["acm:ExportCertificate","acm:DescribeCertificate"],
      "Resource":"arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    }]
  }'

# ユーザーにAssumeRole権限を付与
aws iam put-user-policy \
  --user-name wcp-demo-user \
  --policy-name assume-role-policy \
  --policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Allow",
      "Action":"sts:AssumeRole",
      "Resource":"arn:aws:iam::123456789012:role/wcp-demo-role"
    }]
  }'

# Access Key発行（出力にSecretAccessKeyが含まれるため取り扱い注意）
aws iam create-access-key --user-name wcp-demo-user

# スワップ追加
dd if=/dev/zero of=/swapfile bs=1M count=2048
chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile

# 開発ツール・Rust インストール
dnf -y groupinstall "Development Tools"
dnf -y install git
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
export PATH=/root/.cargo/bin:$PATH

# ソース取得・ビルド
git clone --branch v3.0.0 https://github.com/aws/aws-workload-credentials-provider.git /opt/aws-wcp
cd /opt/aws-wcp
cargo build --release

# バイナリ配置
mkdir -p /opt/aws/workload-credentials-provider/bin
cp /opt/aws-wcp/target/release/aws-workload-credentials-provider \
  /opt/aws/workload-credentials-provider/bin/
chmod +x /opt/aws/workload-credentials-provider/bin/aws-workload-credentials-provider
mkdir -p /opt/aws/workload-credentials-provider/logs

# 専用ユーザー・グループ作成
useradd -r -s /sbin/nologin aws-wcp
groupadd -f awscreds
usermod -a -G awscreds aws-wcp

# ディレクトリ所有権
chown root:root /opt/aws/workload-credentials-provider
chmod 0755 /opt/aws/workload-credentials-provider
chown -R root:root /opt/aws/workload-credentials-provider/bin
chmod 0755 /opt/aws/workload-credentials-provider/bin/aws-workload-credentials-provider
chown -R aws-wcp:aws-wcp /opt/aws/workload-credentials-provider/logs
chmod 0750 /opt/aws/workload-credentials-provider/logs

# 証明書配置先ディレクトリ
mkdir -p /etc/ssl/acm
chown -R aws-wcp:aws-wcp /etc/ssl/acm

[logging]
log_level = "DEBUG"
log_to_file = true

[capabilities.secrets_manager]
enabled = false

[capabilities.acm]
enabled = true

[[capabilities.acm.certificates]]
certificate_arn = "arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
certificate_path = "/etc/ssl/acm/fullchain.pem"
private_key_path = "/etc/ssl/acm/private.key"
role_arn = "arn:aws:iam::123456789012:role/wcp-demo-role"
refresh_command = "/usr/local/bin/reload-webservers.sh"
certificate_and_chain_permission = { mode = "0644" }
key_permission = { mode = "0600" }

mkdir -p /etc/aws-workload-credentials-provider
# (上記内容を config.toml として保存)
chown root:awscreds /etc/aws-workload-credentials-provider/config.toml
chmod 0640 /etc/aws-workload-credentials-provider/config.toml

cat > /usr/local/bin/reload-webservers.sh << 'EOF'
#!/bin/bash
set -euo pipefail
/bin/systemctl reload httpd
/usr/sbin/nginx -s reload
EOF
chown root:root /usr/local/bin/reload-webservers.sh
chmod 755 /usr/local/bin/reload-webservers.sh

/opt/aws/workload-credentials-provider/bin/aws-workload-credentials-provider \
  setup-config-based-permissions \
  --config /etc/aws-workload-credentials-provider/config.toml

aws-wcp ALL=(ALL) NOPASSWD: /usr/local/bin/reload-webservers.sh

[Service]
ReadWriteDirectories=/etc/ssl/acm /opt/aws/workload-credentials-provider/logs

cat > /etc/systemd/system/aws-workload-credentials-provider-acm.service << 'EOF'
[Unit]
Description=AWS Workload Credentials Provider - ACM
After=network-online.target
Wants=network-online.target

[Service]
User=aws-wcp
WorkingDirectory=/opt/aws/workload-credentials-provider
Type=simple
Restart=on-failure
RestartSec=5s
TimeoutSec=1min
ExecStart=/opt/aws/workload-credentials-provider/bin/aws-workload-credentials-provider acm start

[Install]
WantedBy=multi-user.target
EOF

# AWS 認証情報を drop-in で設定
mkdir -p /etc/systemd/system/aws-workload-credentials-provider-acm.service.d
cat > /etc/systemd/system/aws-workload-credentials-provider-acm.service.d/creds.conf << 'EOF'
[Service]
Environment="AWS_ACCESS_KEY_ID=<ACCESS_KEY>"
Environment="AWS_SECRET_ACCESS_KEY=<SECRET_KEY>"
Environment="AWS_REGION=ap-northeast-1"
EOF
chown root:root /etc/systemd/system/aws-workload-credentials-provider-acm.service.d/creds.conf
chmod 0600 /etc/systemd/system/aws-workload-credentials-provider-acm.service.d/creds.conf

# 起動
systemctl daemon-reload
systemctl enable --now aws-workload-credentials-provider-acm

INFO  ACM Scheduler starting with 1 certificate(s)
INFO  Certificate task started for arn:aws:acm:...
INFO  Starting certificate refresh
INFO  Certificate files written
INFO  Running refresh command: first cycle after provider startup
INFO  Refresh command succeeded
INFO  Certificate refresh successful

# WCP が書き出したファイル
openssl x509 -in /etc/ssl/acm/fullchain.pem -noout -subject -issuer -serial -dates

# httpd / Nginx が配信している証明書
openssl s_client -connect localhost:443 -servername wcp-demo.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -serial -dates
openssl s_client -connect localhost:8443 -servername wcp-demo.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -serial -dates

WCP (User=aws-wcp)
  → sudo -n /usr/local/bin/reload-webservers.sh
  → /etc/sudoers.d/aws-workload-credentials-provider で NOPASSWD 許可
  → root として reload スクリプト実行
  → httpd reload + nginx reload