[小ネタ] EventBridge と Lambda で新規作成された ENI に自動でタグを付与してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Lambda function to automatically tag ENIs when created'

Parameters:
  TagKey:
    Type: String
    Default: 'hato_key'
    Description: 'Tag key to apply to ENIs'

  TagValue:
    Type: String
    Default: 'hato_value'
    Description: 'Tag value to apply to ENIs'

Resources:
  ENITaggingLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-eni-tagging-lambda-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: ENITaggingPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                  - ec2:DescribeNetworkInterfaces
                Resource: '*'

  ENITaggingLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${AWS::StackName}-eni-auto-tagging'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt ENITaggingLambdaRole.Arn
      Timeout: 60
      Environment:
        Variables:
          TAG_KEY: !Ref TagKey
          TAG_VALUE: !Ref TagValue
      Code:
        ZipFile: |
          import json
          import boto3
          import os
          import logging

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)
          ec2_client = boto3.client('ec2')

          def lambda_handler(event, context):
              try:
                  logger.info(f"Received event: {json.dumps(event)}")

                  # CloudTrail イベントから ENI ID を取得
                  detail = event.get('detail', {})
                  response_elements = detail.get('responseElements', {})
                  network_interface = response_elements.get('networkInterface', {})
                  eni_id = network_interface.get('networkInterfaceId')

                  if not eni_id:
                      logger.error("ENI ID not found in event")
                      return {
                          'statusCode': 400,
                          'body': json.dumps('ENI ID not found')
                      }

                  logger.info(f"Processing ENI: {eni_id}")

                  # 環境変数からタグ情報を取得
                  tag_key = os.environ.get('TAG_KEY', 'AutoTagged')
                  tag_value = os.environ.get('TAG_VALUE', 'true')

                  # 付与するタグ
                  tags = [
                      {
                          'Key': tag_key,
                          'Value': tag_value
                      },
                      {
                          'Key': 'ManagedBy',
                          'Value': 'Lambda-AutoTagging'
                      }
                  ]

                  # ENI にタグを付与
                  response = ec2_client.create_tags(
                      Resources=[eni_id],
                      Tags=tags
                  )

                  logger.info(f"Successfully tagged ENI {eni_id} with tags: {tags}")

                  return {
                      'statusCode': 200,
                      'body': json.dumps({
                          'message': f'Successfully tagged ENI {eni_id}',
                          'tags': tags
                      })
                  }

              except Exception as e:
                  logger.error(f"Error processing event: {str(e)}")
                  return {
                      'statusCode': 500,
                      'body': json.dumps(f'Error: {str(e)}')
                  }

  ENICreationEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub '${AWS::StackName}-eni-creation-rule'
      Description: 'Trigger Lambda when ENI is created'
      EventPattern:
        source:
          - 'aws.ec2'
        detail-type:
          - 'AWS API Call via CloudTrail'
        detail:
          eventSource:
            - 'ec2.amazonaws.com'
          eventName:
            - 'CreateNetworkInterface'
          errorCode:
            - exists: false
      State: ENABLED
      Targets:
        - Arn: !GetAtt ENITaggingLambda.Arn
          Id: 'ENITaggingLambdaTarget'

  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ENITaggingLambda
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ENICreationEventRule.Arn