管理アカウントからSSM Automationを使用して、複数のメンバーアカウントのEC2インスタンスに特定のコマンドを実行してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: "Configure the AWS-SystemsManager-AutomationAdministrationRole to allow multi-region and multi-account automations for your organization."
Resources:
  MasterAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ssm.amazonaws.com
          Action: sts:AssumeRole
          Condition:
            ArnLike:
              aws:SourceArn: 
                Fn::Sub: arn:${AWS::Partition}:ssm:*:*:automation-execution/*
      Path: "/"
      RoleName: AWS-SystemsManager-AutomationAdministrationRole
      Policies:
        - PolicyName: 'AssumeRole-AWSSystemsManagerAutomationExecutionRole'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action: sts:AssumeRole
              Resource: 
                Fn::Sub: arn:${AWS::Partition}:iam::*:role/AWS-SystemsManager-AutomationExecutionRole
            - Effect: Allow
              Action: 
              - organizations:ListAccountsForParent
              - organizations:ListChildren
              Resource: '*'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Configure the AWS-SystemsManager-AutomationExecutionRole.'
Parameters:
  AdminAccountId:
    Type: String
    Description: "The ID of the primary account from which automations will be initiated for your organization."
    MaxLength: 12
    MinLength: 12
  OrganizationID:
    Type: String
    Description: AWS Organizations ID.
    AllowedPattern: "^o-[a-z0-9]{10,32}$"
Resources:
  AWSSystemsManagerAutomationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWS-SystemsManager-AutomationExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS:
              Fn::Sub:
              - arn:${AWS::Partition}:iam::${AdminAccountId}:role/AWS-SystemsManager-AutomationAdministrationRole
              - AdminAccountId:
                  Ref: AdminAccountId
          Action: sts:AssumeRole
          Condition:
            StringEquals:
              aws:PrincipalOrgID:
                Ref: OrganizationID
        - Effect: Allow
          Principal:
            Service: ssm.amazonaws.com
          Action:
          - sts:AssumeRole
          Condition:
            StringEquals:
              aws:SourceAccount: 
                Fn::Sub: ${AWS::AccountId}
            ArnLike:
              aws:SourceArn: 
                Fn::Sub: arn:${AWS::Partition}:ssm:*:${AWS::AccountId}:automation-execution/*
      ManagedPolicyArns:
      - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonSSMAutomationRole
      Path: "/"
      Policies:
      - PolicyName: ExecutionPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - resource-groups:ListGroupResources
            - tag:GetResources
            - ec2:DescribeInstances
            Resource: "*"
          - Effect: Allow
            Action:
            - iam:PassRole
            Resource:
              Fn::Sub: arn:${AWS::Partition}:iam::${AWS::AccountId}:role/AWS-SystemsManager-AutomationExecutionRole

schemaVersion: '0.3'
description: Check OS settings using SSM Automation.
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  AutomationAssumeRole:
    type: String
    description: (Optional) The ARN of the role that allows Automation to perform the actions on your behalf.
  InstanceId:
    type: String
    description: The ID of the EC2 instance to check.
  CheckHostname:
    type: String
    default: check
    description: Check hostname or skip.
    allowedValues:
      - check
      - skip
  CheckTimezone:
    type: String
    default: check
    description: Check timezone or skip.
    allowedValues:
      - check
      - skip
  CheckLocale:
    type: String
    default: check
    description: Check locale or skip.
    allowedValues:
      - check
      - skip
  CheckUpdate:
    type: String
    default: check
    description: Check yum updates or skip.
    allowedValues:
      - check
      - skip
  CheckNTP:
    type: String
    default: check
    description: Check NTP status or skip.
    allowedValues:
      - check
      - skip
mainSteps:
  - name: CheckHostname
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10
    nextStep: CheckTimezone
    isEnd: false
    onFailure: Continue
    inputs:
      DocumentName: AWS-RunShellScript
      Parameters:
        commands:
          - if [[ "{{ CheckHostname }}" == "check" ]]; then hostname; else echo "Skipping hostname check"; fi
      InstanceIds:
        - '{{ InstanceId }}'
    outputs:
      - Name: HostnameOutput
        Selector: $.CommandPlugins[0].Output
        Type: String
  - name: CheckTimezone
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10
    nextStep: CheckLocale
    isEnd: false
    onFailure: Continue
    inputs:
      DocumentName: AWS-RunShellScript
      Parameters:
        commands:
          - if [[ "{{ CheckTimezone }}" == "check" ]]; then timedatectl status; else echo "Skipping timezone check"; fi
      InstanceIds:
        - '{{ InstanceId }}'
    outputs:
      - Name: TimezoneOutput
        Selector: $.CommandPlugins[0].Output
        Type: String
  - name: CheckLocale
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10
    nextStep: CheckUpdate
    isEnd: false
    onFailure: Continue
    inputs:
      DocumentName: AWS-RunShellScript
      Parameters:
        commands:
          - if [[ "{{ CheckLocale }}" == "check" ]]; then localectl status; else echo "Skipping locale check"; fi
      InstanceIds:
        - '{{ InstanceId }}'
    outputs:
      - Name: LocaleOutput
        Selector: $.CommandPlugins[0].Output
        Type: String
  - name: CheckUpdate
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10
    nextStep: CheckNTP
    isEnd: false
    onFailure: Continue
    inputs:
      DocumentName: AWS-RunShellScript
      Parameters:
        commands:
          - if [[ "{{ CheckUpdate }}" == "check" ]]; then yum check-update; else echo "Skipping update check"; fi
      InstanceIds:
        - '{{ InstanceId }}'
    outputs:
      - Name: UpdateOutput
        Selector: $.CommandPlugins[0].Output
        Type: String
  - name: CheckNTP
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10
    isEnd: true
    onFailure: Continue
    inputs:
      DocumentName: AWS-RunShellScript
      Parameters:
        commands:
          - if [[ "{{ CheckNTP }}" == "check" ]]; then chronyc sources; else echo "Skipping NTP check"; fi
      InstanceIds:
        - '{{ InstanceId }}'
    outputs:
      - Name: NTPOutput
        Selector: $.CommandPlugins[0].Output
        Type: String

mainSteps:
  - name: CheckHostname
    action: aws:runCommand
    maxAttempts: 1
    timeoutSeconds: 10

aws ssm start-automation-execution \
    --document-name "check-os" \
    --parameters AutomationAssumeRole=arn:aws:iam::管理アカウントID:role/AWS-SystemsManager-AutomationAdministrationRole,CheckHostname=check,CheckTimezone=check,CheckLocale=check,CheckUpdate=check,CheckNTP=check \
    --target-parameter-name InstanceId \
    --targets Key=tag:ssm-automation,Values=true \
    --target-locations '[{
        "Accounts": ["ou-o2pk-xxxxxxxx"],
        "IncludeChildOrganizationUnits": true,
        "Regions": ["ap-northeast-1"],
        "ExecutionRoleName": "AWS-SystemsManager-AutomationExecutionRole"
    }]'

{
    "AutomationExecutionId": "xxxxxxxx"
}

aws ssm start-automation-execution \
    --document-name "check-os" \
    --document-version "6" \
    --parameters AutomationAssumeRole=arn:aws:iam::管理アカウントID:role/AWS-SystemsManager-AutomationAdministrationRole,CheckHostname=check,CheckTimezone=check,CheckLocale=check,CheckUpdate=check,CheckNTP=check \
    --target-parameter-name InstanceId \
    --targets Key=tag:ssm-automation,Values=true \
    --target-locations '[{
        "Accounts": ["ou-o2pk-xxxxxxxx"],
        "IncludeChildOrganizationUnits": true,
        "Regions": ["ap-northeast-1"],
        "ExecutionRoleName": "AWS-SystemsManager-AutomationExecutionRole"
    }]'

aws ssm start-automation-execution \
    --document-name "check-os" \
    --parameters AutomationAssumeRole=arn:aws:iam::管理アカウントID:role/AWS-SystemsManager-AutomationAdministrationRole,CheckHostname=check,CheckTimezone=check,CheckLocale=check,CheckUpdate=check,CheckNTP=check \
    --target-parameter-name InstanceId \
    --targets Key=AWS::EC2::Instance,Values=* \
    --target-locations '[{
        "Accounts": ["ou-o2pk-xxxxxxxx"],
        "IncludeChildOrganizationUnits": true,
        "Regions": ["ap-northeast-1"],
        "ExecutionRoleName": "AWS-SystemsManager-AutomationExecutionRole"
    }]'

  - name: xxxx
    action: aws:runCommand
    inputs:
      DocumentName: AWS-RunPowerShellScript
      Parameters:
        commands:
          - chcp 65001
          - # ここに特定のWindowsコマンドを記述

aws ssm start-automation-execution \
    --document-name "check-os" \
    --parameters AutomationAssumeRole=arn:aws:iam::111111111111:role/AWS-SystemsManager-AutomationAdministrationRole,CheckHostname=check,CheckTimezone=check,CheckLocale=check,CheckUpdate=check,CheckNTP=check \
    --target-parameter-name InstanceId \
    --targets Key=tag:ssm-automation,Values=true \
    --target-locations '[{
        "Accounts": ["r-o2pk"],
        "IncludeChildOrganizationUnits": true,
        "Regions": ["ap-northeast-1"],
        "ExecutionRoleName": "AWS-SystemsManager-AutomationExecutionRole"
    }]'

aws ssm start-automation-execution \
    --document-name "check-os" \
    --parameters AutomationAssumeRole=arn:aws:iam::111111111111:role/AWS-SystemsManager-AutomationAdministrationRole,CheckHostname=check,CheckTimezone=check,CheckLocale=check,CheckUpdate=check,CheckNTP=check \
    --target-parameter-name InstanceId \
    --targets Key=tag:ssm-automation,Values=true \
    --target-locations '[{
        "Accounts": ["r-o2pk"],
        "IncludeChildOrganizationUnits": true,
        "Regions": ["ap-northeast-1"],
        "ExecutionRoleName": "AWS-SystemsManager-AutomationExecutionRole"
    }]'