Inspector + EventBridge + Systems Manager Automationで脆弱性自動パッチ適用してみた

### Provider
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

### Data sources
data "aws_caller_identity" "current" {}

### Resources
# CloudWatch Log Group for EventBridge
resource "aws_cloudwatch_log_group" "eventbridge_logs" {
  name              = "/aws/eventbridge/inspector-automation"
  retention_in_days = 7
  tags = {
    Name = "EventBridge-Inspector-Logs"
  }
}
# Set resource policy to allow EventBridge to write logs
resource "aws_cloudwatch_log_resource_policy" "eventbridge_logs_policy" {
  policy_name = "EventBridgeLogsPolicy"
  policy_document = templatefile("${path.module}/policies/cloudwatch-logs-resource-policy.json", {
    log_group_arn = aws_cloudwatch_log_group.eventbridge_logs.arn
  })
}

# IAM Role for EventBridge Automation Target
resource "aws_iam_role" "eventbridge_ssm_role" {
  name = "EventBridgeSSMRole"
  assume_role_policy = file("${path.module}/policies/eventbridge-assume-role-policy.json")
}
resource "aws_iam_role_policy" "eventbridge_ssm_policy" {
  name = "EventBridgeSSMPolicy"
  role = aws_iam_role.eventbridge_ssm_role.id
  policy = templatefile("${path.module}/policies/eventbridge-ssm-policy.json", {
    account_id = data.aws_caller_identity.current.account_id
    dlq_arn    = aws_sqs_queue.eventbridge_automation_dlq.arn
  })
}

# IAM Role for Automation
resource "aws_iam_role" "automation_role" {
  name = "AutomationRole"
  assume_role_policy = file("${path.module}/policies/automation-assume-role-policy.json")
}
resource "aws_iam_role_policy_attachment" "automation_role_policy" {
  role       = aws_iam_role.automation_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole"
}
resource "aws_iam_role_policy" "automation_additional_policy" {
  name = "AutomationAdditionalPolicy"
  role = aws_iam_role.automation_role.id
  policy = file("${path.module}/policies/automation-additional-policy.json")
}

# IAM Role for EC2
resource "aws_iam_role" "ec2_ssm_role" {
  name = "EC2-SSM-Role"
  assume_role_policy = file("${path.module}/policies/ec2-ssm-assume-role-policy.json")
}
resource "aws_iam_role_policy_attachment" "ec2_ssm_policy" {
  role       = aws_iam_role.ec2_ssm_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# Inspector2用の追加権限
resource "aws_iam_role_policy" "ec2_inspector2_policy" {
  name = "EC2Inspector2Policy"
  role = aws_iam_role.ec2_ssm_role.id
  policy = file("${path.module}/policies/ec2-inspector2-policy.json")
}

resource "aws_iam_instance_profile" "ec2_ssm_profile" {
  name = "EC2-SSM-Profile"
  role = aws_iam_role.ec2_ssm_role.name
}

# Patch Baseline
resource "aws_ssm_patch_baseline" "security_baseline" {
  name             = "SecurityPatchBaseline"
  description      = "Security patches for Ubuntu"
  operating_system = "UBUNTU"
  approval_rule {
    approve_after_days = 0
    patch_filter {
      key    = "PRIORITY"
      values = ["Required", "Important"]
    }
  }
  tags = {
    Name = "SecurityPatchBaseline"
  }
}

# Patch Group Registration
resource "aws_ssm_patch_group" "security_patch_group" {
  baseline_id = aws_ssm_patch_baseline.security_baseline.id
  patch_group = "SecurityPatching"
}

# Automation Document
resource "aws_ssm_document" "process_inspector_finding" {
  name            = "ProcessInspectorFinding"
  document_type   = "Automation"
  document_format = "YAML"
  content = yamlencode({
    schemaVersion = "0.3"
    description   = "Process Inspector findings and apply security patches"
    assumeRole    = "{{ AutomationAssumeRole }}"
    parameters = {
      InstanceId = {
        type        = "String"
        description = "EC2 Instance ID from Inspector finding"
      }
      Severity = {
        type        = "String"
        description = "Severity of the finding"
      }
      AutomationAssumeRole = {
        type        = "String"
        description = "IAM role for automation"
        default     = aws_iam_role.automation_role.arn
      }
    }
    mainSteps = [
      {
        name   = "ApplySecurityPatches"
        action = "aws:runCommand"
        inputs = {
          DocumentName = "AWS-RunPatchBaseline"
          InstanceIds  = ["{{ InstanceId }}"]
          Parameters = {
            Operation = "Install"
            RebootOption = "RebootIfNeeded"
          }
        }
        isEnd = true
      }
    ]
  })
  tags = {
    Name = "ProcessInspectorFinding"
  }
}

# EventBridge Rule
resource "aws_cloudwatch_event_rule" "inspector_to_automation" {
  name        = "InspectorToAutomation"
  description = "Trigger automation when Inspector finds vulnerabilities"
  event_pattern = jsonencode({
    source      = ["aws.inspector2"]
    detail-type = ["Inspector2 Finding"]
    detail = {
      status = ["ACTIVE"]
      severity = ["HIGH", "CRITICAL"]
      type     = ["PACKAGE_VULNERABILITY"]
    }
  })
  tags = {
    Name = "InspectorToAutomation"
  }
}

# EventBridge Target
## Automation
resource "aws_cloudwatch_event_target" "automation_target" {
  rule     = aws_cloudwatch_event_rule.inspector_to_automation.name
  arn      = aws_ssm_document.process_inspector_finding.arn
  role_arn = aws_iam_role.eventbridge_ssm_role.arn
  dead_letter_config {
    arn = aws_sqs_queue.eventbridge_automation_dlq.arn
  }
  input_transformer {
    input_paths = {
      instanceId = "$.detail.resources[0].id"
      severity   = "$.detail.severity"
    }
    input_template = <<EOF
{
  "AutomationAssumeRole": ["${aws_iam_role.automation_role.arn}"],
  "InstanceId": ["<instanceId>"],
  "Severity": ["<severity>"]
}
EOF
  }
}
## CloudWatch Logs
resource "aws_cloudwatch_event_target" "log_target" {
  rule = aws_cloudwatch_event_rule.inspector_to_automation.name
  arn  = aws_cloudwatch_log_group.eventbridge_logs.arn
}

# SQS Dead Letter Queue for EventBridge
resource "aws_sqs_queue" "eventbridge_automation_dlq" {
  name = "eventbridge-automation-dlq"
}

# Inspector2 Enable
resource "aws_inspector2_enabler" "inspector_enable" {
  account_ids    = [data.aws_caller_identity.current.account_id]
  resource_types = ["EC2"]
}