DevinのAWSエンジニア化計画 権限設計編

# 0. 環境準備
export TESTUSERNAME="mfa-cli-********"
export PASSWORD="****************"

# 仮想MFAのシード値からOTPを取得するoathtoolコマンドをインストール
brew install oath-toolkit

# IAMユーザーの作成
aws iam create-user --user-name $TESTUSERNAME

# パスワードの設定
aws iam create-login-profile \
    --user-name $TESTUSERNAME \
    --password $PASSWORD \
    --password-reset-required

# 仮想MFAデバイスの作成とTESTUSERNAME_secret.txtに仮想MFAのシード値を保存
export MFA_RESPONSE=$(aws iam create-virtual-mfa-device \
    --virtual-mfa-device-name ${TESTUSERNAME}_mfa \
    --outfile ${TESTUSERNAME}_secret.txt \
    --bootstrap-method Base32StringSeed)

# シークレットキーを取得してoath-toolkitで2つのコードを生成
export SECRET_KEY=$(cat ${TESTUSERNAME}_secret.txt)

# 1,2つ目のコードを生成
export CODE1=$(oathtool --totp -b "$SECRET_KEY") \
    && sleep 30 \
    && export CODE2=$(oathtool --totp -b "$SECRET_KEY")

# MFAデバイスの有効化
aws iam enable-mfa-device \
    --user-name $TESTUSERNAME \
    --serial-number $MFA_ARN \
    --authentication-code1 $CODE1 \
    --authentication-code2 $CODE2

# アクセスキー/シークレットキーの作成
aws iam create-access-key \
    --user-name $TESTUSERNAME

# trust-policy.json として保存
# アカウントIDとTESTUSERNAMEは適宜変更
cat << EOF > trust-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/TESTUSERNAME"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF

# ロールの作成
aws iam create-role \
    --role-name ReadOnlyRole \
    --assume-role-policy-document file://trust-policy.json

# ReadOnlyAccessポリシーの付与
aws iam attach-role-policy \
    --role-name ReadOnlyRole \
    --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# IAMユーザからスイッチできるよう権限を付与
cat << EOF > assume-role-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::123456789012:role/ReadOnlyRole"
            ],
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "iam:ResourceTag/aws-cdk:bootstrap-role": [
                        "image-publishing",
                        "file-publishing",
                        "deploy",
                        "lookup"
                    ]
                },
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }
    ]
}
EOF

# カスタムポリシーの作成
aws iam create-policy \
    --policy-name AssumeRolePolicy \
    --policy-document file://assume-role-policy.json

# IAMユーザにアタッチ
aws iam attach-user-policy \
    --user-name $TESTUSERNAME \
    --policy-arn arn:aws:iam::123456789012:policy/AssumeRolePolicy

# アクセスキー/シークレットキーをセット
export AWS_ACCESS_KEY_ID="****"
export AWS_SECRET_ACCESS_KEY="****"

# ReadOnlyRoleにAssumeRoleできるかテスト
export CREDENTIALS=$(aws sts assume-role \
    --role-arn arn:aws:iam::123456789012:role/ReadOnlyRole \
    --role-session-name MyReadOnlySession)

export AWS_ACCESS_KEY_ID=$(echo $CREDENTIALS | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $CREDENTIALS | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $CREDENTIALS | jq -r '.Credentials.SessionToken')

# 権限の確認
aws s3 ls

# DeploymentActionRoleにAssumeRoleできるかテスト
# 再度元のアクセスキーとシークレットキーをセット。AWS_SESSION_TOKENは削除
export AWS_ACCESS_KEY_ID="****"
export AWS_SECRET_ACCESS_KEY="****"
unset AWS_SESSION_TOKEN

export AWS_ACCESS_KEY_ID=$(echo $CREDENTIALS | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $CREDENTIALS | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $CREDENTIALS | jq -r '.Credentials.SessionToken')

# 権限の確認
aws cloudformation describe-stacks --stack-name CDKToolkit

cat << EOF > cdk-permissions-boundary-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AdministratorAccess",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        },
        {
            "Sid": "DenyIAMUserSelfManagement",
            "Effect": "Deny",
            "Action": [
                "iam:CreateAccessKey",
                "iam:DeleteAccessKey",
                "iam:UpdateAccessKey",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:UpdateLoginProfile",
                "iam:ChangePassword"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "DenyIAMUserAndPolicyManagement",
            "Effect": "Deny",
            "Action": [
                "iam:CreateUser",
                "iam:DeleteUser",
                "iam:AttachUserPolicy",
                "iam:DetachUserPolicy",
                "iam:PutUserPolicy",
                "iam:DeleteUserPolicy"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DenyCDKBootstrapModification",
            "Effect": "Deny",
            "Action": [
                "iam:*"
            ],
            "Resource": [
                "arn:aws:iam::*:role/cdk-*",
                "arn:aws:iam::*:policy/cdk-*"
            ]
        },
        {
            "Sid": "DenyExpensiveServices",
            "Effect": "Deny",
            "Action": [
                "savingsplans:*",
                "ec2:PurchaseReservedInstancesOffering",
                "ec2:PurchaseScheduledInstances",
                "ec2:CreateCapacityReservation",
                "elasticache:PurchaseReservedCacheNodesOffering",
                "es:PurchaseReservedInstanceOffering",
                "redshift:PurchaseReservedNodeOffering",
                "rds:PurchaseReservedDBInstancesOffering",
                "memorydb:PurchaseReservedNodesOffering",
                "dynamodb:PurchaseReservedCapacityOfferings",
                "codebuild:CreateFleet",
                "medialive:PurchaseOffering",
                "cloudfront:CreateSavingsPlan",
                "shield:*",
                "aws-marketplace:Subscribe",
                "aws-marketplace:Unsubscribe"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DenyExpensiveEC2Instances",
            "Effect": "Deny",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                        "t3.nano",
                        "t3.micro",
                        "t3.small",
                        "t3a.nano",
                        "t3a.micro",
                        "t3a.small"
                    ]
                }
            }
        }
    ]
}
EOF

# ポリシーとして作成
aws iam create-policy \
    --policy-name CdkPermissionsBoundaryPolicy \
    --policy-document file://cdk-permissions-boundary-policy.json

# cdk bootstrapのオプションでPermissionsBoundaryをCloudFormationExecutionRoleに付与
# (CDKプロジェクトを展開しているディレクトリで行う)
npx cdk bootstrap aws://123456789012/ap-northeast-1 --custom-permissions-boundary CdkPermissionsBoundaryPolicy
npx cdk bootstrap aws://123456789012/us-east-1 --custom-permissions-boundary CdkPermissionsBoundaryPolicy

otpauth://totp/Amazon%20Web%20Services:{IAM Usename}@{Account ID}?secret={Secret Value}

- When accessing AWS accounts, please use AWS_CREDENTIALS and AWS_MFA_SEED from Devin secrets
- Instead of using access keys/secret keys directly, obtain temporary access key/secret key/session token using aws sts get-session-token with serial-number and OTP
- When creating/updating/deleting resources in AWS accounts, please use CDK
- When checking resources in AWS accounts, assume the ReadOnlyRole using aws sts assumerole
- When creating/updating AWS resources, be careful not to exceed $10 in monthly usage fees
  - If unsure about the cost estimation, please consult with the user
- Do not upload any content stored in Devin Secrets to the internet

AWSアカウント123456789012にReadOnlyRoleで接続して、S3バケットの一覧を取得してください

- packages/iacでcdk deployを実行してAWSアカウント123456789012にデプロイしてください
- デプロイ前にbin/parameters.tsのcommonParameter.projectNameの値はicasu-cdk-serverless-api-hogeに書き換えてください
- OTPにはDevin secretsのAWS_MFA_SEEDを使ってください