Amazon Managed Grafana ワークスペースの作成と SAML の構成を AWS CDK で行ってみた

import {
  aws_grafana,
  aws_iam,
  Stack,
  StackProps,
  CfnOutput,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps) {
    super(scope, id, props);

    // Grafana Workspace 用の IAM Role を作成
    const principal = new aws_iam.ServicePrincipal(
      'grafana.amazonaws.com'
    ).withConditions({
      StringEquals: {
        'aws:SourceAccount': this.account,
      },
      StringLike: {
        'aws:SourceArn': `arn:aws:grafana:${this.region}:${this.account}:/workspaces/*`,
      },
    });
    const grafanaRole = new aws_iam.Role(this, 'GrafanaRole', {
      assumedBy: principal,
    });

    // Grafana Workspace を作成
    const cfnWorkspace = new aws_grafana.CfnWorkspace(this, 'Workspace', {
      accountAccessType: 'CURRENT_ACCOUNT',
      authenticationProviders: ['SAML'],
      permissionType: 'SERVICE_MANAGED',
      roleArn: grafanaRole.roleArn,
    });

    const workspaceId = cfnWorkspace.ref;

    // Service provider identifier (Entity ID) の出力
    new CfnOutput(this, 'WorkspaceServiceProviderIdentifier', {
      value: `https://${workspaceId}.grafana-workspace.${this.region}.amazonaws.com/saml/metadata`,
    });

    // Service provider reply URL (Assertion consumer service URL) の出力
    new CfnOutput(this, 'WorkspaceServiceProviderReplyUrl', {
      value: `https://${workspaceId}.grafana-workspace.${this.region}.amazonaws.com/saml/acs`,
    });
  }
}

{
  "audience": "<Service provider identifier (/metadata で終わる方)>",
  "destination": "<Service provider reply URL (/acs で終わる方)>",
  "mappings": {
      "email": "email",
      "nickname": "nickname"
  },
  "createUpnClaim": false,
  "passthroughClaimsWithNoMapping": false,
  "mapUnknownClaimsAsIs": false
}

import {
  aws_grafana,
  aws_iam,
  Stack,
  StackProps,
  CfnOutput,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

interface CdkSampleStackProps extends StackProps {
  readonly grafanaWorkspaceSamlAdminRoles: string[];
  readonly grafanaWorkspaceSamlEditorRoles: string[];
  readonly grafanaWorkspaceSamlIdpMetadataUrl: string;
}

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string, props: CdkSampleStackProps) {
    super(scope, id, props);

    // Grafana Workspace 用の IAM Role を作成
    const principal = new aws_iam.ServicePrincipal(
      'grafana.amazonaws.com'
    ).withConditions({
      StringEquals: {
        'aws:SourceAccount': this.account,
      },
      StringLike: {
        'aws:SourceArn': `arn:aws:grafana:${this.region}:${this.account}:/workspaces/*`,
      },
    });
    const grafanaRole = new aws_iam.Role(this, 'GrafanaRole', {
      assumedBy: principal,
    });

    // Grafana Workspace を作成
    const cfnWorkspace = new aws_grafana.CfnWorkspace(this, 'Workspace', {
      accountAccessType: 'CURRENT_ACCOUNT',
      authenticationProviders: ['SAML'],
      permissionType: 'SERVICE_MANAGED',
      roleArn: grafanaRole.roleArn,
      samlConfiguration: {
        assertionAttributes: {
          name: 'nickname',
          login: 'email',
          email: 'email',
          role: 'email', // どの SAML 属性をロールのアサーションに使用するか（Assertion attribute role）を指定
        },
        loginValidityDuration: 1440,
        roleValues: {
          admin: props.grafanaWorkspaceSamlAdminRoles,
          editor: props.grafanaWorkspaceSamlEditorRoles,
        },
        idpMetadata: {
          url: props.grafanaWorkspaceSamlIdpMetadataUrl,
        },
      },
    });

    const workspaceId = cfnWorkspace.ref;

    // Grafana workspace URL の出力
    new CfnOutput(this, 'WorkspaceServiceProviderIdentifier', {
      value: `https://${workspaceId}.grafana-workspace.${this.region}.amazonaws.com`,
    });
  }
}