クロスアカウントフェデレーションサインインするための URL を発行する Lambda 関数を作成してみる

AWSTemplateFormatVersion: '2010-09-09'
Description: '---'
Resources:
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'CrossAccountFederationLambdaRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: 'lambda.amazonaws.com'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
        - PolicyName: 'AssumeTargetRolePolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'sts:AssumeRole'
                Resource: 'arn:aws:iam::*:role/CrossAccountTargetRole'
Outputs:
  LambdaExecutionRoleArn:
    Value: !GetAtt LambdaExecutionRole.Arn

AWSTemplateFormatVersion: '2010-09-09'
Description: '---'
Parameters:
  AccountAId:
    Type: String
  LambdaRoleName:
    Type: String
    Default: 'CrossAccountFederationLambdaRole'
Resources:
  CrossAccountTargetRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'CrossAccountTargetRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AccountAId}:role/${LambdaRoleName}'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/ReadOnlyAccess'
Outputs:
  CrossAccountTargetRoleArn:
    Value: !GetAtt CrossAccountTargetRole.Arn

% sam init -r nodejs20.x 
Which template source would you like to use?
        1 - AWS Quick Start Templates
        2 - Custom Template Location
Choice: 1

Choose an AWS Quick Start application template
        1 - Hello World Example
        2 - GraphQLApi Hello World Example
        3 - Hello World Example with Powertools for AWS Lambda
        4 - Multi-step workflow
        5 - Standalone function
        6 - Scheduled task
        7 - Data processing
        8 - Serverless API
        9 - Full Stack
        10 - Lambda Response Streaming
Template: 1

Based on your selections, the only Package type available is Zip.
We will proceed to selecting the Package type as Zip.

Based on your selections, the only dependency manager available is npm.
We will proceed copying the template using npm.

Select your starter template
        1 - Hello World Example
        2 - Hello World Example TypeScript
Template: 2

:

import { Handler } from 'aws-lambda';
import { 
  STSClient, 
  AssumeRoleCommand
} from '@aws-sdk/client-sts';

const ROLE_NAME = 'CrossAccountTargetRole';
const FEDERATION_ENDPOINT = 'https://signin.aws.amazon.com/federation';
const CONSOLE_URL = 'https://console.aws.amazon.com/';

interface EventInput {
  targetAccountId: string;
  roleSessionName: string;
}

export const handler: Handler = async (event: EventInput) => {
  try {
    if (!event.targetAccountId || !event.roleSessionName) {
      return {
        statusCode: 400,
        body: JSON.stringify({
          message: 'targetAccountId and roleSessionName are required'
        })
      };
    }

    //AssumeRole
    const roleArn = `arn:aws:iam::${event.targetAccountId}:role/${ROLE_NAME}`;
    const stsClient = new STSClient({ region: 'ap-northeast-1' });
    const assumeRoleResponse = await stsClient.send(
      new AssumeRoleCommand({
        RoleArn: roleArn,
        RoleSessionName: event.roleSessionName,
        DurationSeconds: 3600,
      })
    );
    if (!assumeRoleResponse.Credentials) {
      throw new Error('Failed to assume role');
    }

    //federatedSigninUrl
    const credentials = {
      sessionId: assumeRoleResponse.Credentials.AccessKeyId,
      sessionKey: assumeRoleResponse.Credentials.SecretAccessKey,
      sessionToken: assumeRoleResponse.Credentials.SessionToken
    };
    const signinTokenResponse = await fetch(
      `${FEDERATION_ENDPOINT}?${new URLSearchParams({
        Action: 'getSigninToken',
        SessionType: 'json',
        Session: JSON.stringify(credentials)
      }).toString()}`
    );
    const signinToken = await signinTokenResponse.json();
    const loginParams = new URLSearchParams({
      Action: 'login',
      Destination: CONSOLE_URL,
      SigninToken: signinToken.SigninToken
    });
    const federatedSigninUrl = `${FEDERATION_ENDPOINT}?${loginParams.toString()}`;

    return {
      statusCode: 200,
      body: JSON.stringify({
        signInUrl: federatedSigninUrl
      })
    };
  } catch (error) {
    console.error('Error:', error);
    return {
      statusCode: 500,
      body: JSON.stringify({
        message: 'Internal server error'
      })
    };
  }
};

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: ---
Globals:
  Function:
    Timeout: 3

Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: hello-world/
      Handler: app.handler
      Runtime: nodejs20.x
      Architectures:
        - x86_64
      Role: arn:aws:iam::123456789012:role/CrossAccountFederationLambdaRole
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints: 
        - app.ts

{
  "targetAccountId": "111122223333",
  "roleSessionName": "hogeiwasa1"
}

:
    // Account BのRoleにAssume Role
    const assumeRoleResponse = await stsClient.send(
      new AssumeRoleCommand({
        RoleArn: roleArn,
        RoleSessionName: event.roleSessionName,
        DurationSeconds: 43200, // 12時間
      })
    );
: