特定のセキュリティグループ・ポートが変更されたことをカスタマイズした日本語メールで通知してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: "create Security group change notification"

# ------------------------------------------------------------#
# Input Parameters
# ------------------------------------------------------------# 
Parameters:
  PJPrefix:
    Type: String

  SNSTopicName:
    Type: String
    Default: SecurityGroup_Change_Alarm

  Email:
    Type: String
    Default: email_address

  TargetSecurityGroupIds:
    Type: CommaDelimitedList
    Description: If there are multiple target security groups, please enter them separated by [,]
    Default: sg-1234567890abcdef0

Resources:
# ------------------------------------------------------------#
# SNS Topic
# ------------------------------------------------------------# 
  SNSTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      TopicName: !Ref SNSTopicName
      Tags: 
      - 
        Key: "Name"
        Value: !Sub ${PJPrefix}-${SNSTopicName}

# ------------------------------------------------------------#
# SNS Subscription
# ------------------------------------------------------------# 
  Subscription:
    Type: "AWS::SNS::Subscription"
    Properties:
      TopicArn: !Ref SNSTopic
      Endpoint: !Ref Email
      Protocol: "email"

# ------------------------------------------------------------#
# SNS TopicPolicy
# ------------------------------------------------------------# 
  EventTopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: 'sns:Publish'
            Resource: '*'
      Topics:
        - !Ref SNSTopic

# ------------------------------------------------------------#
# StepFunction メール本文カスタマイズ用
# ------------------------------------------------------------# 
  SNSStateMachine:
    Type: "AWS::StepFunctions::StateMachine"
    Properties:
      DefinitionString: !Sub |-
            {
              "StartAt": "PublishSns",
              "States": {
                "PublishSns": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::sns:publish",
                  "Parameters": {
                    "TopicArn": "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${SNSTopicName}",
                    "Message.$": "$.message",
                    "Subject.$": "$.subject"
                  },
                  "End": true
                }
              }
            }
      RoleArn: !GetAtt PublishRole.Arn

# ------------------------------------------------------------#
# IAMロール　（StepFunction用）
# ------------------------------------------------------------# 
  PublishRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - states.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: SNSPublish
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource:
                  - !Ref SNSTopic
                Action:
                  - sns:Publish

  StateMachineExecuteRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - events.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: StateMachineExecute
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource:
                  - !Ref SNSStateMachine
                Action:
                  - states:StartExecution

# ------------------------------------------------------------#
# EventBridge Rule
# ------------------------------------------------------------# 
  EventBridgeRule:
    Type: AWS::Events::Rule
    DependsOn: SNSTopic
    Properties: 
      Description: !Ref SNSTopicName
      EventBusName: default
      EventPattern: 
        Fn::Sub:
          - |-
            {
              "source": ["aws.ec2"],
              "detail-type": ["AWS API Call via CloudTrail"],
              "detail": {
                "eventSource": ["ec2.amazonaws.com"],
                "eventName": ["AuthorizeSecurityGroupIngress", "AuthorizeSecurityGroupEgress", "RevokeSecurityGroupIngress", "RevokeSecurityGroupEgress"],
                "requestParameters": {
                  "groupId": ${SGIds},
                  "ipPermissions": {
                    "items": {
                      "fromPort": [22, 3389]
                    }
                  }
                }
              }
            }
          - SGIds: !Join
              - ''
              - - '["'
                - !Join
                  - '","'
                  - !Ref TargetSecurityGroupIds
                - '"]'
      Name: !Ref SNSTopicName
      Targets: 
        - Arn: !Ref SNSStateMachine
          Id: step-function
          RoleArn: !GetAtt StateMachineExecuteRole.Arn
          InputTransformer:
            InputPathsMap:
              "Account" : "$.account"
              "SecuritygroupId" : "$.detail.requestParameters.groupId"
              "eventId" : "$.detail.eventID"
              "time" : "$.time"
              "userName" : "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
              "value" : "$.detail"
            InputTemplate: |
              {
                "subject": "セキュリティグループのRDP/SSH変更通知",
                "message": "セキュリティグループ \"<SecuritygroupId>\" が変更されたことを検知しました。 \n詳細は次のとおりです。 \nAccount ID : \"<Account>\" \n発生時間 : \"<time> \"（UTC） \n変更ユーザー名 : \"<userName>\" \nセキュリティグループID : \"<SecuritygroupId>\" \nCloudTrailイベントID : \"<eventId>\" \n\nセキュリティグループの確認方法 \nEC2コンソール画面の左メニュータグより「セキュリティグループ」を選択します。\n検索ウィンドウで「セキュリティグループID」を入力し、セキュリティグループが正しいことを確認してください。 \n\nCloudTrailイベント履歴の確認方法 \nCloudTrailコンソール画面の左メニュータグより「イベント履歴」を選択します。 \n検索ウィンドウで[イベントID]を選択し、「CloudTrailイベントID」入力します。イベント詳細が確認できます。"
              }