CloudTrail + Lambda를 활용하여 EC2 공인 IP 할당을 감지하고 통지해 봤습니다.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:ap-northeast-2:xxxxxxxxxx"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        }
    ]
}

import json
import boto3

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

SNS_TOPIC_ARN = 'arn:aws:sns:ap-northeast-2:xxxxxxxxxx'

def lambda_handler(event, context):
    print("Received event:", json.dumps(event))

    # 이벤트 정보 추출
    detail = event.get('detail', {})
    instance_id = detail.get('requestParameters', {}).get('instanceId')
    eni_id = detail.get('requestParameters', {}).get('networkInterfaceId')
    public_ip = detail.get('requestParameters', {}).get('publicIp')

    if not instance_id and not eni_id:
        print("No instanceId or networkInterfaceId in event")
        return {'statusCode': 400, 'body': 'Missing required parameters'}

    message_lines = []

    if instance_id:
        response = ec2.describe_instances(InstanceIds=[instance_id])
        for reservation in response['Reservations']:
            for instance in reservation['Instances']:
                for iface in instance['NetworkInterfaces']:
                    if iface.get('Association', {}).get('PublicIp'):
                        message_lines.append(
                            f"Instance {instance_id} has public IP: {iface['Association']['PublicIp']}"
                        )

    if eni_id:
        response = ec2.describe_network_interfaces(NetworkInterfaceIds=[eni_id])
        for iface in response['NetworkInterfaces']:
            if iface.get('Association', {}).get('PublicIp'):
                message_lines.append(
                    f"ENI {eni_id} has public IP: {iface['Association']['PublicIp']}"
                )

    if message_lines:
        message = "\n".join(message_lines)
        print("ALERT:", message)
        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject="⚠️ Public IP Attached to EC2/ENI",
            Message=message
        )
    else:
        print("No public IP associated")

    return {
        'statusCode': 200,
        'body': 'Inspection complete'
    }

{
  "source": ["aws.ec2"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventName": ["AssociateAddress", "ModifyNetworkInterfaceAttribute"]
  }
}