AWS Systems Manager State ManagerのEC2インスタンスへの関連付け成功/失敗イベントのメール通知を実装してみた

> tree
.
├── .gitignore
├── .npmignore
├── README.md
├── bin
│   └── app.ts
├── cdk.json
├── jest.config.js
├── lib
│   ├── ec2-instances-stack.ts         # EC2インスタンスと、SSM State Managerのログの出力先のS3バケットを作成するスタック
│   ├── email-notifications-stack.ts   # メール通知用のSNSトピック、SNSサブスクリプションを作成するスタック
│   └── lambda-functions-stack.ts      # SSM State ManagerのEC2インスタンスへの関連付け成功/失敗イベントのメール通知をするLambda関数とEventBridgeの設定をするスタック
├── package-lock.json
├── package.json
├── src
│   └── lambda
│       └── functions
│           └── email-nortifications.ts # メール通知用のLambda関数
├── test
│   └── app.test.ts
└── tsconfig.json

6 directories, 14 files

#!/usr/bin/env node
import "source-map-support/register";
import * as cdk from "@aws-cdk/core";
import { Ec2InstancesStack } from "../lib/ec2-instances-stack";
import { LambdaFunctionsStack } from "../lib/lambda-functions-stack";
import { EmailNotificationsStack } from "../lib/email-notifications-stack";

const app = new cdk.App();
const ec2InstancesStack = new Ec2InstancesStack(app, "Ec2InstancesStack");
const emailNotificationsStack = new EmailNotificationsStack(
  app,
  "EmailNotificationsStack"
);
const lambdaFunctionsStack = new LambdaFunctionsStack(
  app,
  "LambdaFunctionsStack",
  {
    emailSnsTopic: emailNotificationsStack.emailSnsTopic,
  }
);

import * as cdk from "@aws-cdk/core";
import * as s3 from "@aws-cdk/aws-s3";
import * as iam from "@aws-cdk/aws-iam";
import * as ec2 from "@aws-cdk/aws-ec2";

export class Ec2InstancesStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create S3 Bucket for State Manager log
    const stateManagerLogsBucket = new s3.Bucket(
      this,
      "StateManagerLogsBucket",
      {
        encryption: s3.BucketEncryption.S3_MANAGED,
        blockPublicAccess: new s3.BlockPublicAccess({
          blockPublicAcls: true,
          blockPublicPolicy: true,
          ignorePublicAcls: true,
          restrictPublicBuckets: true,
        }),
      }
    );

    // Create SSM IAM role
    const ssmIamRole = new iam.Role(this, "SsmIamRole", {
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "AmazonSSMManagedInstanceCore"
        ),
      ],
    });

    // Create IAM Policy for SSM State Manager Logs
    const exportStateManagerLogsBucketIamPolicy = new iam.Policy(
      this,
      "ExportStateManagerLogsBucketIamPolicy",
      {
        statements: [
          new iam.PolicyStatement({
            effect: iam.Effect.ALLOW,
            actions: ["s3:PutObject"],
            resources: [`${stateManagerLogsBucket.bucketArn}/*`],
          }),
          new iam.PolicyStatement({
            effect: iam.Effect.ALLOW,
            actions: ["s3:GetEncryptionConfiguration"],
            resources: [stateManagerLogsBucket.bucketArn],
          }),
        ],
      }
    );

    // Atach SSM State Manager Logs IAM Policy to SSM IAM Role
    ssmIamRole.attachInlinePolicy(exportStateManagerLogsBucketIamPolicy);

    // Create a VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      cidr: "10.0.0.0/24",
      enableDnsHostnames: true,
      enableDnsSupport: true,
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: "Public",
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 27,
        },
      ],
    });

    // Create EC2 instance
    // AmazonLinux 2
    vpc
      .selectSubnets({ subnetGroupName: "Public" })
      .subnets.forEach((subnet, index) => {
        new ec2.Instance(this, `Ec2Instance${index}`, {
          machineImage: ec2.MachineImage.latestAmazonLinux({
            generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
          }),
          instanceType: new ec2.InstanceType("t3.micro"),
          vpc: vpc,
          role: ssmIamRole,
          vpcSubnets: vpc.selectSubnets({
            subnetGroupName: "Public",
            availabilityZones: [vpc.availabilityZones[index]],
          }),
        });
      });
  }
}

import * as cdk from "@aws-cdk/core";
import * as sns from "@aws-cdk/aws-sns";
import * as snsSubscriptions from "@aws-cdk/aws-sns-subscriptions";

export class EmailNotificationsStack extends cdk.Stack {
  public readonly emailSnsTopic: sns.Topic;

  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    const emailAddress: string = this.node.tryGetContext("email-address");

    // Create SNS Topic for Email
    this.emailSnsTopic = new sns.Topic(this, "EmailSNS");
    this.emailSnsTopic.addSubscription(
      new snsSubscriptions.EmailSubscription(emailAddress)
    );
  }
}

import * as cdk from "@aws-cdk/core";
import * as iam from "@aws-cdk/aws-iam";
import * as lambda from "@aws-cdk/aws-lambda";
import * as nodejs from "@aws-cdk/aws-lambda-nodejs";
import * as sns from "@aws-cdk/aws-sns";
import * as events from "@aws-cdk/aws-events";
import * as eventsTargets from "@aws-cdk/aws-events-targets";

interface LambdaFunctionsStackProps extends cdk.StackProps {
  emailSnsTopic: sns.Topic;
}

export class LambdaFunctionsStack extends cdk.Stack {
  public readonly emailNortificationsFunction: nodejs.NodejsFunction;

  constructor(
    scope: cdk.Construct,
    id: string,
    props: LambdaFunctionsStackProps
  ) {
    super(scope, id, props);

    // Declare AWS account ID and region.
    const { accountId, region } = new cdk.ScopedAws(this);

    // Create IAM role for Lambda functions for email nortifications
    const emailNortificationsIamRole = new iam.Role(
      this,
      "EmailNortificationsIamRole",
      {
        assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
        managedPolicies: [
          iam.ManagedPolicy.fromAwsManagedPolicyName(
            "service-role/AWSLambdaBasicExecutionRole"
          ),
        ],
      }
    );

    // Create IAM Policy for sns publish
    const emailNortificationsIamPolicy = new iam.Policy(
      this,
      "EmailNortificationsIamPolicy",
      {
        statements: [
          new iam.PolicyStatement({
            effect: iam.Effect.ALLOW,
            actions: ["sns:Publish"],
            resources: [props.emailSnsTopic.topicArn],
          }),
        ],
      }
    );

    // Atach IAM Policy for sns publish to Lambda functions to email nortifications IAM Role
    emailNortificationsIamRole.attachInlinePolicy(emailNortificationsIamPolicy);

    // Lambda function for email nortifications
    const emailNortificationsFunction = new nodejs.NodejsFunction(
      this,
      "EmailNortificationsFunction",
      {
        entry: "src/lambda/functions/email-nortifications.ts",
        runtime: lambda.Runtime.NODEJS_14_X,
        bundling: {
          minify: true,
        },
        environment: {
          ACCOUNT_ID: accountId,
          REGION: region,
          SNS_TOPIC: props.emailSnsTopic.topicArn,
        },
        role: emailNortificationsIamRole,
      }
    );

    // Create EventBridge Rule
    new events.Rule(this, "EventBriedgeRule", {
      eventPattern: {
        source: ["aws.ssm"],
        detailType: ["EC2 State Manager Instance Association State Change"],
        detail: {
          status: ["Success", "Failed"],
        },
        resources: [
          `arn:aws:ssm:${region}:${accountId}:document/AWS-UpdateSSMAgent`,
        ],
      },
      targets: [
        new eventsTargets.LambdaFunction(emailNortificationsFunction, {
          retryAttempts: 3,
        }),
      ],
    });
  }
}

import {
  SNSClient,
  PublishCommand,
  PublishCommandInput,
} from "@aws-sdk/client-sns";
import { Context, Callback } from "aws-lambda";

// ref : https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-events.html
interface EventPattern {
  version: string;
  id: string;
  "detail-type": string;
  source: string;
  account: string;
  time: string;
  region: string;
  resources: string;
  detail: any;
}

const REGION = process.env.REGION;
const SNS_TOPIC = process.env.SNS_TOPIC;

const snsClient = new SNSClient({ region: REGION });

exports.handler = async (
  event: EventPattern,
  context: Context,
  callback: Callback
) => {
  const textParams: PublishCommandInput = {
    Subject: event["detail-type"],
    Message: JSON.stringify(event, null, 2),
    TargetArn: SNS_TOPIC,
  };
  await snsClient
    .send(new PublishCommand(textParams))
    .then(() => {
      console.log("Message sent");
      console.log(textParams);
    })
    .catch((error) => {
      console.log("Error, message not sent ", error);
    });
};

{
  "name": "app",
  "version": "0.1.0",
  "bin": {
    "app": "bin/app.js"
  },
  "scripts": {
    "build": "tsc",
    "watch": "tsc -w",
    "test": "jest",
    "cdk": "cdk"
  },
  "devDependencies": {
    "@aws-cdk/assert": "1.130.0",
    "@types/aws-lambda": "^8.10.85",
    "@types/jest": "^26.0.10",
    "@types/node": "10.17.27",
    "aws-cdk": "1.130.0",
    "jest": "^27.3.1",
    "ts-jest": "^27.0.7",
    "ts-node": "^9.0.0",
    "typescript": "~3.9.7"
  },
  "dependencies": {
    "@aws-cdk/aws-ec2": "^1.130.0",
    "@aws-cdk/aws-events": "^1.130.0",
    "@aws-cdk/aws-events-targets": "^1.130.0",
    "@aws-cdk/aws-iam": "^1.130.0",
    "@aws-cdk/aws-lambda-nodejs": "^1.130.0",
    "@aws-cdk/aws-s3": "^1.130.0",
    "@aws-cdk/aws-sns": "^1.130.0",
    "@aws-cdk/aws-sns-subscriptions": "^1.130.0",
    "@aws-cdk/core": "1.130.0",
    "@aws-sdk/client-sns": "^3.39.0",
    "aws-lambda": "^1.0.6",
    "source-map-support": "^0.5.16"
  }
}