AWSネットワークリソースの設定変更を Microsoft Teamsで複数ユーザーにメンション通知できるようにしてみた

AWSTemplateFormatVersion: "2010-09-09"
Description: "nwresource-notify-teams"

Parameters:
  SystemPrefix:
    Type: String
  EnvPrefix:
    Type: String
    AllowedValues:
      - prd
      - test
      - dev
      - poc
  WebhookURL:
    Type: String
  MentionedUsers:
    Type: String
    Default: "[{\"email\":\"user1@example.com\",\"name\":\"User1\"},{\"email\":\"user2@example.com\",\"name\":\"User2\"}]"
    Description: "JSON string of users to mention, e.g., '[{\"email\":\"user1@example.com\",\"name\":\"User1\"},{\"email\":\"user2@example.com\",\"name\":\"User2\"}]'"

Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: LambdaExecutionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*

  NotifyTeamsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${SystemPrefix}-${EnvPrefix}-notify-teams-function"
      RetentionInDays: 14
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain

  NotifyTeamsFunction:
    Type: AWS::Lambda::Function
    DependsOn: NotifyTeamsFunctionLogGroup
    Properties:
      FunctionName: !Sub "${SystemPrefix}-${EnvPrefix}-notify-teams-function"
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          import json
          import urllib.request
          import os

          def handler(event, context):
              webhook_url = os.environ['WEBHOOK_URL']
              mentioned_users = json.loads(os.environ['MENTIONED_USERS'])

              detail = event['detail']
              account = event['account']
              time = event['time']
              region = event['region']
              event_name = detail['eventName']

              resource_id = detail.get('requestParameters', {}).get('groupId') or \
                            detail.get('responseElements', {}).get('groupId') or \
                            detail.get('requestParameters', {}).get('networkAclId') or \
                            detail.get('responseElements', {}).get('networkAcl', {}).get('networkAclId') or \
                            detail.get('requestParameters', {}).get('routeTableId') or \
                            detail.get('responseElements', {}).get('routeTable', {}).get('routeTableId') or \
                            'N/A'

              resource_type = "セキュリティグループ" if "SecurityGroup" in event_name else \
                              "ネットワークACL" if "NetworkAcl" in event_name else \
                              "ルートテーブル" if "RouteTable" in event_name else \
                              "ネットワークリソース"

              mentions = [f"\u003cat\u003e{user['name']}\u003c/at\u003e" for user in mentioned_users]
              mentions_text = ", ".join(mentions)

              message = {
                  "type": "message",
                  "attachments": [
                      {
                          "contentType": "application/vnd.microsoft.card.adaptive",
                          "content": {
                              "type": "AdaptiveCard",
                              "body": [
                                  {
                                      "type": "TextBlock",
                                      "text": f"{mentions_text}\n\n# **{resource_type}変更通知**\n\n{resource_type} : {resource_id} が変更されました。\n\n詳細:\n- アカウントID: **{account}**\n- 発生時間: **{time} (UTC)**\n- 変更ユーザー名: **{detail['userIdentity']['sessionContext']['sessionIssuer']['userName']}**\n- {resource_type}ID: **{resource_id}**\n- 検知API: **{event_name}**\n\n**詳細は以下のリンクからご確認ください。（検知してからイベント履歴確認まで15分程度時間がかかります。）**\n\n[CloudTrailイベントの詳細を確認する](https://{region}.console.aws.amazon.com/cloudtrailv2/home?region={region}#/events/{detail['eventID']})"
                                  }
                              ],
                              "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
                              "version": "1.0",
                              "msteams": {
                                  "width": "full",
                                  "entities": [
                                      {
                                          "type": "mention",
                                          "text": f"\u003cat\u003e{user['name']}\u003c/at\u003e",
                                          "mentioned": {
                                              "id": user['email'],
                                              "name": user['name']
                                          }
                                      } for user in mentioned_users
                                  ]
                              }
                          }
                      }
                  ]
              }

              req = urllib.request.Request(webhook_url)
              req.add_header('Content-Type', 'application/json')
              jsondata = json.dumps(message)
              jsondataasbytes = jsondata.encode('utf-8')
              req.add_header('Content-Length', len(jsondataasbytes))
              response = urllib.request.urlopen(req, jsondataasbytes)

              return {
                  'statusCode': response.getcode(),
                  'body': response.read().decode('utf-8')
              }
      Runtime: python3.12
      Timeout: 30
      Environment:
        Variables:
          WEBHOOK_URL: !Ref WebhookURL
          MENTIONED_USERS: !Ref MentionedUsers

  EventBridgeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: InvokeLambdaFunction
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !GetAtt NotifyTeamsFunction.Arn

  EventsRuleSecurityGroup:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${SystemPrefix}-${EnvPrefix}-sg-notify-teams
      EventPattern:
        detail-type:
          - AWS API Call via CloudTrail
        source:
          - "aws.ec2"
        detail:
          eventSource: ["ec2.amazonaws.com"]
          eventName:
            - AuthorizeSecurityGroupIngress
            - AuthorizeSecurityGroupEgress
            - RevokeSecurityGroupIngress
            - RevokeSecurityGroupEgress
            - CreateSecurityGroup
            - DeleteSecurityGroup
            - ModifySecurityGroupRules
      State: ENABLED
      Targets:
        - Arn: !GetAtt NotifyTeamsFunction.Arn
          Id: EventsRuleSecurityGroup
      EventBusName: default

  EventsRuleNetworkACL:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${SystemPrefix}-${EnvPrefix}-nacl-notify-teams
      EventPattern:
        detail-type:
          - AWS API Call via CloudTrail
        source:
          - "aws.ec2"
        detail:
          eventSource: ["ec2.amazonaws.com"]
          eventName:
            - CreateNetworkAcl
            - DeleteNetworkAcl
            - ReplaceNetworkAclAssociation
            - CreateNetworkAclEntry
            - DeleteNetworkAclEntry
            - ReplaceNetworkAclEntry
      State: ENABLED
      Targets:
        - Arn: !GetAtt NotifyTeamsFunction.Arn
          Id: EventsRuleNetworkACL
      EventBusName: default

  EventsRuleRouteTable:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${SystemPrefix}-${EnvPrefix}-rt-notify-teams
      EventPattern:
        detail-type:
          - AWS API Call via CloudTrail
        source:
          - "aws.ec2"
        detail:
          eventSource: ["ec2.amazonaws.com"]
          eventName:
            - CreateRoute
            - DeleteRoute
            - ReplaceRoute
            - AssociateRouteTable
            - DisassociateRouteTable
            - ReplaceRouteTableAssociation
            - CreateRouteTable
            - DeleteRouteTable
            - EnableVgwRoutePropagation
            - DisableVgwRoutePropagation
            - EnableTransitGatewayRouteTablePropagation
            - DisableTransitGatewayRouteTablePropagation             
      State: ENABLED
      Targets:
        - Arn: !GetAtt NotifyTeamsFunction.Arn
          Id: EventsRuleRouteTable
      EventBusName: default

  LambdaPermissionSecurityGroup:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref NotifyTeamsFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EventsRuleSecurityGroup.Arn

  LambdaPermissionNetworkACL:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref NotifyTeamsFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EventsRuleNetworkACL.Arn

  LambdaPermissionRouteTable:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref NotifyTeamsFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EventsRuleRouteTable.Arn