RDS 퍼블릭 액세스 설정을 감지하고 이메일로 통지

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:ap-northeast-2:xxxxxxxxxx"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        }
    ]
}

import json
import boto3

sns = boto3.client('sns')
rds = boto3.client('rds')

SNS_TOPIC_ARN = 'arn:aws:sns:ap-northeast-2:xxxxxxxxxx'

def lambda_handler(event, context):
    print("Received event:", json.dumps(event))

    detail = event.get('detail', {})
    request_params = detail.get('requestParameters', {})

    db_instance_id = request_params.get('dBInstanceIdentifier', 'unknown')
    public_access = request_params.get('publiclyAccessible', False)

    print(f"DBInstanceIdentifier: {db_instance_id}, PubliclyAccessible: {public_access}")

    if public_access:
        subject = "⚠️ RDS 퍼블릭 액세스 설정 감지"
        message = f"""
🔒 보안 경고: RDS 인스턴스가 퍼블릭하게 설정되었습니다.

- DB 인스턴스 ID: {db_instance_id}
- 퍼블릭 액세스: {public_access}
- 이벤트 이름: {detail.get('eventName')}
- 호출자: {detail.get('userIdentity', {}).get('arn')}
- 리전: {event.get('region')}
- 시간: {event.get('time')}

보안을 위해 즉시 설정을 확인하세요.
"""

        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject=subject,
            Message=message
        )

    return {
        'statusCode': 200,
        'body': f"Checked RDS instance {db_instance_id}, public access: {public_access}"
    }

{
  "source": ["aws.rds"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventName": ["CreateDBInstance", "ModifyDBInstance"]
  }
}