AWS Secrets Manager統合したAmazon FSx for Windows File Server環境をAWS CLIとCloudFormationで作成してみた

# KMSキー作成 : my-fsx-windows
kms_key_id=$(aws kms create-key --description 'Key for FSx for Windows File Server' \
    --key-usage 'ENCRYPT_DECRYPT' \
    --origin 'AWS_KMS' \
    --no-multi-region \
    --query 'KeyMetadata.KeyId' \
    --output text)
echo $kms_key_id 
# エイリアスの割り当て
aws kms create-alias --alias-name 'alias/my-fsx-windows' \
    --target-key-id $kms_key_id

#
# ※ポリシーの内容は環境に合わせて適宜変更が必要です
#

# 権限の追加 : 東京リージョン向け
# ref: https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD.html#bp-store-ad-creds-using-secret-manager-windows
aws_account_id=$(aws sts get-caller-identity --query 'Account' --output text)
key_policy=$(cat << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::$aws_account_id:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow FSx to use the KMS key",
      "Effect": "Allow",
      "Principal": {
        "Service": "fsx.amazonaws.com"
      },
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:ap-northeast-1:$aws_account_id:key/*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "secretsmanager.ap-northeast-1.amazonaws.com",
          "aws:SourceAccount": "$aws_account_id"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:fsx:ap-northeast-1:$aws_account_id:file-system/*"
        }
      }
    }
  ]
}
EOF
)
aws kms put-key-policy --key-id $kms_key_id --policy "$key_policy"

# Secrets Manager シークレット作成
secret_arn=$(aws secretsmanager create-secret \
    --name "my-fsx-for-windows-service-account" \
    --description "Secrets for FSx for Windows File Server service account." \
    --secret-string "{\"CUSTOMER_MANAGED_ACTIVE_DIRECTORY_USERNAME\":\"FSxServiceAccount\",\"CUSTOMER_MANAGED_ACTIVE_DIRECTORY_PASSWORD\":\"P@ssw0rd\"}" \
    --kms-key-id $kms_key_id \
    --query 'ARN' \
    --output text)
echo $secret_arn

# シークレットのリソースポリシー更新
aws_account_id=$(aws sts get-caller-identity --query 'Account' --output text)
resource_policy=$(cat << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "fsx.amazonaws.com"
      },
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ],
      "Resource": "$secret_arn",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "$aws_account_id"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:fsx:ap-northeast-1:$aws_account_id:file-system/*"
        }
      }
    }
  ]
}
EOF
)
aws secretsmanager put-resource-policy --secret-id $secret_arn --resource-policy "$resource_policy"

"SelfManagedActiveDirectoryConfiguration": {
  "DomainName": "corp.contoso.com",
  "OrganizationalUnitDistinguishedName": "OU=FSxForWin,DC=corp,DC=contoso,DC=com",
  "FileSystemAdministratorsGroup": "FSxAdminGroup",
  "DnsIps": [
    "xx.xx.xx.xx"
  ],
  "DomainJoinServiceAccountSecret": "<シークレットのARN>"
},

#
# 各種パラメーター指定は必要に応じて変更してください
#

secret_arn=$(aws secretsmanager list-secrets --filter Key="name",Values="my-fsx-for-windows-service-account" --query "SecretList[].ARN" --output text)
aws_account_id=$(aws sts get-caller-identity --query 'Account' --output text)
params=$(cat << EOF
{
  "FileSystemType": "WINDOWS",
  "StorageCapacity": 32,
  "StorageType": "SSD",
  "SubnetIds": [
    "subnet-xxxxxxxxxxxxxxxxxx"
  ],
  "SecurityGroupIds": [
    "sg-xxxxxxxxxxxxxxxxx"
  ],
  "KmsKeyId": "arn:aws:kms:ap-northeast-1:$aws_account_id:key/$(aws kms list-aliases --query "Aliases[?AliasName==\`alias/aws/fsx\`].TargetKeyId" --output text)",
  "WindowsConfiguration": {
    "SelfManagedActiveDirectoryConfiguration": {
      "DomainName": "corp.contoso.com",
      "OrganizationalUnitDistinguishedName": "OU=FSxForWin,DC=corp,DC=contoso,DC=com",
      "FileSystemAdministratorsGroup": "FSxAdminGroup",
      "DnsIps": [
        "10.0.1.77"
      ],
      "DomainJoinServiceAccountSecret": "$secret_arn"
    },
    "DeploymentType": "SINGLE_AZ_2",
    "ThroughputCapacity": 32,
    "AutomaticBackupRetentionDays": 1,
    "AuditLogConfiguration": {
      "FileAccessAuditLogLevel": "DISABLED",
      "FileShareAccessAuditLogLevel": "DISABLED"
    },
    "DiskIopsConfiguration": {
      "Mode": "AUTOMATIC"
    }
  },
  "NetworkType": "IPV4"
}
EOF
)
aws fsx create-file-system --cli-input-json "$params"

SelfManagedActiveDirectoryConfiguration:
  DomainName: "corp.contoso.com"
  OrganizationalUnitDistinguishedName: "OU=FSxForWin,DC=corp,DC=contoso,DC=com"
  FileSystemAdministratorsGroup: "FSxAdminGroup"
  DnsIps:
    - "xx.xx.xx.xx"
  DomainJoinServiceAccountSecret: <シークレットのARN>

AWSTemplateFormatVersion: 2010-09-09
Description: My FSx for Windows File Server
Parameters:
  SecretARN:
    Description: "Secrets Manager Secret ARN"
    Type: String
    Default: arn:aws:secretsmanager:ap-northeast-1:xxxxxxxxxxxx:secret:my-fsx-for-windows-service-account-xxxxxx
Resources:
  MyFSxW:
    Type: AWS::FSx::FileSystem
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      FileSystemType: "WINDOWS"
      StorageCapacity: 32
      StorageType: "SSD"
      SubnetIds:
        - "subnet-xxxxxxxxxxxxxxxxx"
      SecurityGroupIds:
        - "sg-xxxxxxxxxxxxxxxxx"
      KmsKeyId: "alias/aws/fsx"
      WindowsConfiguration:
        SelfManagedActiveDirectoryConfiguration:
          DomainName: "corp.contoso.com"
          OrganizationalUnitDistinguishedName: "OU=FSxForWin,DC=corp,DC=contoso,DC=com"
          FileSystemAdministratorsGroup: "FSxAdminGroup"
          DnsIps:
            - "10.0.1.77"
          DomainJoinServiceAccountSecret:
            Ref: SecretARN
        DeploymentType: SINGLE_AZ_2
        ThroughputCapacity: 32
        AutomaticBackupRetentionDays: 1
        AuditLogConfiguration:
          FileAccessAuditLogLevel: "DISABLED"
          FileShareAccessAuditLogLevel: "DISABLED"
        DiskIopsConfiguration:
          Mode: "AUTOMATIC"
      NetworkType: "IPV4"
      Tags:
        - Key: Name
          Value: "my-fsxw-cfn"