ハンズオンで使う IAM ユーザーを AWS CloudFormation StackSets で一括作成してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: Create an IAM user for hands-on

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: IAM User Settings
        Parameters:
          - UserName
          - PasswordLength
      - Label:
          default: Password Reader Role Settings
        Parameters:
          - AdminAccountId
          - PasswordReaderRoleName
    ParameterLabels:
      UserName:
        default: IAM user name
      PasswordLength:
        default: Generated password length
      AdminAccountId:
        default: Trusted admin account ID
      PasswordReaderRoleName:
        default: Password reader role name

Parameters:
  UserName:
    Type: String
    Description: IAM user name for the hands-on user.
    Default: handson-user
    MinLength: 1
    MaxLength: 64

  PasswordLength:
    Type: Number
    Description: Length of the generated password.
    Default: 20
    MinValue: 8
    MaxValue: 128

  AdminAccountId:
    Type: String
    Description: AWS account ID that runs StackSets and is allowed to assume the password reader role.
    AllowedPattern: '\d{12}'
    ConstraintDescription: Must be a 12-digit AWS account ID.

  PasswordReaderRoleName:
    Type: String
    Description: Name of the IAM role that the admin account assumes to read the password secret.
    Default: handson-password-reader-role
    MinLength: 1
    MaxLength: 64

Resources:
  UserPasswordSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub '/handson/iam-user/${UserName}'
      Description: !Sub 'Console login password for IAM user ${UserName}'
      GenerateSecretString:
        SecretStringTemplate: !Sub '{"username": "${UserName}"}'
        GenerateStringKey: password
        PasswordLength: !Ref PasswordLength
        ExcludeCharacters: '"@/\$`'
        RequireEachIncludedType: true

  HandsOnUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref UserName
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      LoginProfile:
        Password: !Sub '{{resolve:secretsmanager:${UserPasswordSecret}:SecretString:password}}'
        PasswordResetRequired: true

  PasswordReaderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref PasswordReaderRoleName
      Description: !Sub 'Allows account ${AdminAccountId} to read the hands-on user password secret.'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AdminAccountId}:root'
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ReadHandsOnUserPasswordSecret
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: ReadPasswordSecret
                Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                  - secretsmanager:DescribeSecret
                Resource: !Ref UserPasswordSecret

#!/bin/sh

OU_ID="ou-xxxx-xxxxxxxx"
USER_NAME="handson-user"
ROLE_NAME="handson-password-reader-role"
SECRET_ID="/handson/iam-user/${USER_NAME}"

echo "account_id,account_name,username,password"

aws organizations list-accounts-for-parent \
  --parent-id "${OU_ID}" \
  --query 'Accounts[?Status==`ACTIVE`].[Id,Name]' \
  --output text |
while read -r ACCOUNT_ID ACCOUNT_NAME; do
  CREDS=$(aws sts assume-role \
    --role-arn "arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}" \
    --role-session-name "fetch-handson-password" \
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
    --output text)

  AWS_ACCESS_KEY_ID=$(echo "${CREDS}" | awk '{print $1}')
  AWS_SECRET_ACCESS_KEY=$(echo "${CREDS}" | awk '{print $2}')
  AWS_SESSION_TOKEN=$(echo "${CREDS}" | awk '{print $3}')

  PASSWORD=$(AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
    AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
    AWS_SESSION_TOKEN="${AWS_SESSION_TOKEN}" \
    aws secretsmanager get-secret-value \
      --secret-id "${SECRET_ID}" \
      --query SecretString --output text |
    jq -r .password)

  echo "${ACCOUNT_ID},${ACCOUNT_NAME},${USER_NAME},${PASSWORD}"
done

sh fetch-handson-passwords.sh

$ sh fetch-handson-passwords.sh 
account_id,account_name,username,password
111122223333,Sandbox01,handson-user,Nd&JEK9s-6x4b}d
444455556666,Sandbox02,handson-user,c'Ho4ki9^TVS5n]

sh fetch-handson-passwords.sh > output.csv