アクセスキー払い出しの承認ワークフローを作ってみた

AWSTemplateFormatVersion: '2010-09-09'
Description: IAM Access Key Request Automation

Parameters:
  # 承認者の通知先のメールアドレス
  AdminEmail:
    Type: String
    Description: Email address of the administrator

  # 承認用 IAM ユーザー名
  ApprovalUser:
    Type: String
    Description: IAM user to approve access key requests

Resources:
  # Lambda の IAM ロール
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - iam:CreateAccessKey
                  - iam:DeleteAccessKey
                  - iam:GetUser
                  - iam:ListAccessKeys
                  - secretsmanager:CreateSecret
                  - secretsmanager:DeleteSecret
                Resource: '*'
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref NotificationTopic

  # アクセスキー処理用 Lambda
  AccessKeyRequestFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import boto3
          import json
          import os
          from datetime import datetime
          def lambda_handler(event, context):
            iam_user = event['iam_user']
            timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
            iam = boto3.client('iam')
            sns = boto3.client('sns')
            # IAM ユーザーが既に 2 つのアクセスキーを持っているかどうかを確認する
            response = iam.list_access_keys(UserName=iam_user)
            access_keys = response['AccessKeyMetadata']
            if len(access_keys) >= 2:
                # 管理者にエラー通知を送信する
                message = f"IAM ユーザ「 {iam_user} 」のアクセスキー発行のリクエストに失敗しました.\r\n アクセスキーが既に 2 つ発行されています."
                sns.publish(
                    TopicArn=os.environ['NOTIFICATION_TOPIC'],
                    Message=message,
                    Subject='Access Key Request Failed'
                )
                return {
                    'status': 'error',
                    'message': 'IAM user already has 2 access keys'
                }
            # IAM ユーザーのアクセスキーを作成する
            response = iam.create_access_key(UserName=iam_user)
            access_key = response['AccessKey']
            # AccessKey オブジェクトから必要な属性を抽出する
            access_key_data = {
              'AccessKeyId': access_key['AccessKeyId'],
              'SecretAccessKey': access_key['SecretAccessKey']
            }
            # アクセスキーデータを階層的な命名規則で Secrets Manager に保存する
            secrets_manager = boto3.client('secretsmanager')
            secret_name = f"{iam_user}/access-key-{timestamp}"
            secrets_manager.create_secret(
              Name=secret_name,
              SecretString=json.dumps(access_key_data)
            )
            # 管理者に承認通知を送信する
            message = f"IAM ユーザ「 {iam_user} 」のアクセスキー発行のリクエストが承認されました.\r\n アクセスキーは Secrets Manager「 {secret_name} 」に保存されました."
            sns.publish(
              TopicArn=os.environ['NOTIFICATION_TOPIC'],
              Message=message,
              Subject='Access Key Created'
            )
            return {
              'status': 'created',
              'secret_name': secret_name
            }
      Handler: index.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: python3.12
      Timeout: 60
      Environment:
        Variables:
          NOTIFICATION_TOPIC: !Ref NotificationTopic

  # アクセスキー申請処理用 SSM ドキュメント
  AccessKeyRequestAutomation:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Content:
        schemaVersion: '0.3'
        description: Automate IAM access key requests
        parameters:
          IamUser:
            type: String
            description: IAM user for which access key is requested
          RequestReason:
            type: String
        mainSteps:
          - name: ApprovalStep
            action: aws:approve
            timeoutSeconds: 86400
            onFailure: Abort
            inputs:
              NotificationArn: !Ref NotificationTopic
              Message: IAM ユーザ「 {{ IamUser }} 」のアクセスキー発行をリクエストします. 申請理由は、「{{ RequestReason }}」
              MinRequiredApprovals: 1
              Approvers:
                - !Sub arn:aws:iam::${AWS::AccountId}:user/${ApprovalUser}
          - name: CreateAccessKey
            action: aws:invokeLambdaFunction
            timeoutSeconds: 300
            maxAttempts: 1
            onFailure: Abort
            inputs:
              FunctionName: !Ref AccessKeyRequestFunction
              Payload: !Sub |
                {
                  "iam_user": "{{IamUser}}"
                }

  # 通知用 SNS トピック
  NotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: !Ref AdminEmail
          Protocol: email