マルチアカウント Transit Gateway 環境を1コマンドで棚卸ししてみる

#!/bin/bash

set -euo pipefail

TGW_ID=""
PROFILES=""
OUTPUT="tgw-inventory.md"
REGION="${AWS_DEFAULT_REGION:-ap-northeast-1}"

usage() {
  echo "Usage: $0 [--tgw TGW_ID] --profiles PROFILE1,PROFILE2 [--output FILE] [--region REGION]"
  echo ""
  echo "Options:"
  echo "  --tgw       Transit Gateway ID（省略時は自動検出）"
  echo "  --profiles  AWS CLI プロファイル（カンマ区切り）"
  echo "  --output    出力ファイル名（デフォルト: tgw-inventory.md）"
  echo "  --region    リージョン（デフォルト: ap-northeast-1）"
  exit 1
}

while [[ $# -gt 0 ]]; do
  case $1 in
    --tgw) TGW_ID="$2"; shift 2 ;;
    --profiles) PROFILES="$2"; shift 2 ;;
    --output) OUTPUT="$2"; shift 2 ;;
    --region) REGION="$2"; shift 2 ;;
    *) usage ;;
  esac
done

[[ -z "$PROFILES" ]] && usage

# プロファイルを配列化
IFS=',' read -ra PROFILE_LIST <<< "$PROFILES"
PRIMARY_PROFILE="${PROFILE_LIST[0]}"

aws_cmd() {
  local profile="$1"; shift
  aws --profile "$profile" --region "$REGION" "$@"
}

log() {
  echo "[$(date '+%H:%M:%S')] $*" >&2
}

# ===================== TGW 検出 =====================

if [[ -z "$TGW_ID" ]]; then
  log "TGW ID 未指定 — 自動検出中..."
  TGW_LIST=$(aws_cmd "$PRIMARY_PROFILE" ec2 describe-transit-gateways \
    --filters "Name=state,Values=available" \
    --query 'TransitGateways[*].[TransitGatewayId,Tags[?Key==`Name`].Value|[0]]' \
    --output text)

  TGW_COUNT=$(echo "$TGW_LIST" | wc -l | tr -d ' ')

  if [[ "$TGW_COUNT" -eq 0 ]]; then
    echo "ERROR: TGW が見つかりません" >&2; exit 1
  elif [[ "$TGW_COUNT" -eq 1 ]]; then
    TGW_ID=$(echo "$TGW_LIST" | awk '{print $1}')
    TGW_NAME=$(echo "$TGW_LIST" | awk '{print $2}')
    log "TGW 検出: $TGW_ID ($TGW_NAME)"
  else
    echo "複数の TGW が見つかりました。--tgw で指定してください:" >&2
    echo "$TGW_LIST" >&2
    exit 1
  fi
else
  TGW_NAME=$(aws_cmd "$PRIMARY_PROFILE" ec2 describe-transit-gateways \
    --transit-gateway-ids "$TGW_ID" \
    --query 'TransitGateways[0].Tags[?Key==`Name`].Value|[0]' \
    --output text 2>/dev/null || echo "N/A")
fi

# ===================== データ収集 =====================

log "=== 1/4: TGW アタッチメント取得 ==="

ATTACHMENTS_JSON=$(aws_cmd "$PRIMARY_PROFILE" ec2 describe-transit-gateway-attachments \
  --filters "Name=transit-gateway-id,Values=$TGW_ID" \
  --query 'TransitGatewayAttachments[*].{AttachmentId:TransitGatewayAttachmentId,ResourceId:ResourceId,ResourceType:ResourceType,OwnerId:ResourceOwnerId,State:State,Name:Tags[?Key==`Name`].Value|[0]}' \
  --output json)

log "=== 2/4: TGW ルートテーブル取得 ==="

TGW_RTS=$(aws_cmd "$PRIMARY_PROFILE" ec2 describe-transit-gateway-route-tables \
  --filters "Name=transit-gateway-id,Values=$TGW_ID" \
  --query 'TransitGatewayRouteTables[*].{RtId:TransitGatewayRouteTableId,Name:Tags[?Key==`Name`].Value|[0],Default:DefaultAssociationRouteTable}' \
  --output json)

# 各 RT のルートを取得
declare -A RT_ROUTES
for RT_ID in $(echo "$TGW_RTS" | jq -r '.[].RtId'); do
  log "  ルート取得: $RT_ID"
  RT_ROUTES[$RT_ID]=$(aws_cmd "$PRIMARY_PROFILE" ec2 search-transit-gateway-routes \
    --transit-gateway-route-table-id "$RT_ID" \
    --filters "Name=type,Values=static,propagated" \
    --output json)
done

log "=== 3/4: VPC ルートテーブル取得 ==="

# Attachment から VPC ID を抽出し、プロファイルごとに VPC RT を取得
declare -A VPC_ROUTES
declare -A VPC_NAMES

for PROFILE in "${PROFILE_LIST[@]}"; do
  ACCOUNT_ID=$(aws_cmd "$PROFILE" sts get-caller-identity --query Account --output text 2>/dev/null || echo "unknown")
  log "  プロファイル: $PROFILE (Account: $ACCOUNT_ID)"

  # このアカウントが所有する VPC Attachment を抽出
  VPC_IDS=$(echo "$ATTACHMENTS_JSON" | jq -r \
    --arg owner "$ACCOUNT_ID" \
    '.[] | select(.OwnerId == $owner and .ResourceType == "vpc") | .ResourceId')

  for VPC_ID in $VPC_IDS; do
    VPC_NAME=$(aws_cmd "$PROFILE" ec2 describe-vpcs --vpc-ids "$VPC_ID" \
      --query 'Vpcs[0].{Name:Tags[?Key==`Name`].Value|[0],Cidr:CidrBlock}' \
      --output json 2>/dev/null || echo '{"Name":"N/A","Cidr":"N/A"}')
    VPC_NAMES[$VPC_ID]="$VPC_NAME"

    RT_JSON=$(aws_cmd "$PROFILE" ec2 describe-route-tables \
      --filters "Name=vpc-id,Values=$VPC_ID" \
      --query 'RouteTables[*].{RtId:RouteTableId,Name:Tags[?Key==`Name`].Value|[0],DefaultRoute:Routes[?DestinationCidrBlock==`0.0.0.0/0`]|[0],TgwRoutes:Routes[?TransitGatewayId!=`null`]}' \
      --output json 2>/dev/null || echo '[]')
    VPC_ROUTES[$VPC_ID]="$RT_JSON"
  done
done

log "=== 4/4: セキュリティグループ取得 ==="

declare -A VPC_SGS

for PROFILE in "${PROFILE_LIST[@]}"; do
  ACCOUNT_ID=$(aws_cmd "$PROFILE" sts get-caller-identity --query Account --output text 2>/dev/null || echo "unknown")

  VPC_IDS=$(echo "$ATTACHMENTS_JSON" | jq -r \
    --arg owner "$ACCOUNT_ID" \
    '.[] | select(.OwnerId == $owner and .ResourceType == "vpc") | .ResourceId')

  for VPC_ID in $VPC_IDS; do
    SG_JSON=$(aws_cmd "$PROFILE" ec2 describe-security-groups \
      --filters "Name=vpc-id,Values=$VPC_ID" \
      --query 'SecurityGroups[?GroupName!=`default`].{SgId:GroupId,Name:GroupName,Ingress:IpPermissions[*].{Proto:IpProtocol,FromPort:FromPort,ToPort:ToPort,Cidrs:IpRanges[*].CidrIp},Egress:IpPermissionsEgress[*].{Proto:IpProtocol,FromPort:FromPort,ToPort:ToPort,Cidrs:IpRanges[*].CidrIp}}' \
      --output json 2>/dev/null || echo '[]')
    VPC_SGS[$VPC_ID]="$SG_JSON"
  done
done

# ===================== Markdown 生成 =====================

log "=== Markdown 生成中 ==="

{
  DATE=$(date '+%Y-%m-%d %H:%M')
  echo "# TGW 棚卸し台帳"
  echo ""
  echo "**生成日時**: $DATE  "
  echo "**TGW**: $TGW_ID ($TGW_NAME)  "
  echo "**リージョン**: $REGION  "
  echo "**プロファイル**: ${PROFILES}"
  echo ""
  echo "---"
  echo ""

  # --- 1. アタッチメント一覧 ---
  echo "## 1. TGW アタッチメント一覧"
  echo ""
  echo "| Attachment ID | リソース | 種別 | Owner Account | State | Name |"
  echo "|---|---|---|---|---|---|"

  echo "$ATTACHMENTS_JSON" | jq -r '.[] | "| \(.AttachmentId) | \(.ResourceId) | \(.ResourceType) | \(.OwnerId) | \(.State) | \(.Name // "—") |"'

  echo ""

  # --- 2. TGW ルートテーブル ---
  echo "## 2. TGW ルートテーブル"
  echo ""

  STATIC_COUNT=0
  BLACKHOLE_COUNT=0

  for RT_ID in $(echo "$TGW_RTS" | jq -r '.[].RtId'); do
    RT_NAME=$(echo "$TGW_RTS" | jq -r --arg id "$RT_ID" '.[] | select(.RtId == $id) | .Name // "—"')
    IS_DEFAULT=$(echo "$TGW_RTS" | jq -r --arg id "$RT_ID" '.[] | select(.RtId == $id) | .Default')

    echo "### $RT_ID ($RT_NAME)"
    [[ "$IS_DEFAULT" == "true" ]] && echo "> デフォルトルートテーブル"
    echo ""
    echo "| 宛先 CIDR | 種別 | 転送先 Attachment | State |"
    echo "|---|---|---|---|"

    ROUTES_DATA="${RT_ROUTES[$RT_ID]}"
    echo "$ROUTES_DATA" | jq -r '.Routes[] | "| \(.DestinationCidrBlock) | \(.Type) | \(.TransitGatewayAttachments[0].TransitGatewayAttachmentId // "—") | \(.State) |"' 2>/dev/null || true

    # static / blackhole カウント
    RT_STATIC=$(echo "$ROUTES_DATA" | jq '[.Routes[] | select(.Type == "static")] | length' 2>/dev/null || echo 0)
    RT_BLACKHOLE=$(echo "$ROUTES_DATA" | jq '[.Routes[] | select(.State == "blackhole")] | length' 2>/dev/null || echo 0)
    STATIC_COUNT=$((STATIC_COUNT + RT_STATIC))
    BLACKHOLE_COUNT=$((BLACKHOLE_COUNT + RT_BLACKHOLE))

    echo ""
  done

  if [[ $STATIC_COUNT -gt 0 || $BLACKHOLE_COUNT -gt 0 ]]; then
    echo "> **検出事項**:  "
    [[ $STATIC_COUNT -gt 0 ]] && echo "> - static ルート ${STATIC_COUNT} 件 — 手動追加されたルートです。用途を確認してください  "
    [[ $BLACKHOLE_COUNT -gt 0 ]] && echo "> - blackhole ルート ${BLACKHOLE_COUNT} 件 — 転送先が無効です。削除を検討してください  "
    echo ""
  fi

  # --- 3. VPC ルートテーブル ---
  echo "## 3. VPC ルートテーブル"
  echo ""
  echo "| VPC | VPC Name | CIDR | RT ID | 0.0.0.0/0 → | TGW 向けルート数 |"
  echo "|---|---|---|---|---|---|"

  for VPC_ID in $(echo "$ATTACHMENTS_JSON" | jq -r '.[] | select(.ResourceType == "vpc") | .ResourceId' | sort -u); do
    VPC_INFO="${VPC_NAMES[$VPC_ID]:-"{}"}"
    V_NAME=$(echo "$VPC_INFO" | jq -r '.Name // "—"')
    V_CIDR=$(echo "$VPC_INFO" | jq -r '.Cidr // "—"')

    RT_DATA="${VPC_ROUTES[$VPC_ID]:-[]}"
    if [[ "$RT_DATA" == "[]" || -z "$RT_DATA" ]]; then
      echo "| $VPC_ID | $V_NAME | $V_CIDR | — | ⚠ アクセス不可 | — |"
    else
      echo "$RT_DATA" | jq -r --arg vpc "$VPC_ID" --arg vname "$V_NAME" --arg vcidr "$V_CIDR" \
        '.[] | "| \($vpc) | \($vname) | \($vcidr) | \(.RtId) | \(if .DefaultRoute == null then "なし" else (.DefaultRoute.GatewayId // .DefaultRoute.NatGatewayId // .DefaultRoute.TransitGatewayId // "なし") end) | \(.TgwRoutes | length) |"' 2>/dev/null || true
    fi
  done

  echo ""

  # --- 4. SG 通信パターン ---
  echo "## 4. VPC 間通信パターン（SG Ingress / Egress）"
  echo ""
  echo "| 対象 VPC | SG 名 | 方向 | プロトコル | ポート | 相手 CIDR |"
  echo "|---|---|---|---|---|---|"

  for VPC_ID in $(echo "$ATTACHMENTS_JSON" | jq -r '.[] | select(.ResourceType == "vpc") | .ResourceId' | sort -u); do
    SG_DATA="${VPC_SGS[$VPC_ID]:-[]}"
    V_NAME=$(echo "${VPC_NAMES[$VPC_ID]:-"{}"}" | jq -r '.Name // "—"')

    if [[ "$SG_DATA" == "[]" || -z "$SG_DATA" ]]; then
      echo "| $V_NAME ($VPC_ID) | ⚠ アクセス不可 | — | — | — | — |"
    else
      echo "$SG_DATA" | jq -r --arg vname "$V_NAME" --arg vpc "$VPC_ID" '
        def proto: if . == "-1" then "all" else . end;
        def port: if . == null then "—" else tostring end;
        def portrange($f;$t):
          if $f == null and $t == null then "—"
          elif $f == $t then ($f | port)
          else "\($f | port)–\($t | port)" end;
        .[] | .Name as $sg | (
          (.Ingress[]? | "| \($vname) (\($vpc)) | \($sg) | ingress | \(.Proto | proto) | \(portrange(.FromPort;.ToPort)) | \(.Cidrs[]?) |"),
          (.Egress[]?  | "| \($vname) (\($vpc)) | \($sg) | egress  | \(.Proto | proto) | \(portrange(.FromPort;.ToPort)) | \(.Cidrs[]?) |")
        )' 2>/dev/null || true
    fi
  done

  echo ""
  echo "---"
  echo ""
  echo "*Generated by tgw-inventory.sh*"

} > "$OUTPUT"

log "=== 完了: $OUTPUT ==="
echo ""
echo "台帳を生成しました: $OUTPUT"
echo ""
echo "=== サマリー ==="
echo "  TGW:            $TGW_ID ($TGW_NAME)"
echo "  Attachments:    $(echo "$ATTACHMENTS_JSON" | jq length)"
echo "  Route Tables:   $(echo "$TGW_RTS" | jq length)"
echo "  Static Routes:  $STATIC_COUNT"
echo "  Blackholes:     $BLACKHOLE_COUNT"
echo "  VPCs surveyed:  ${#VPC_ROUTES[@]}"
echo "  SGs surveyed:   ${#VPC_SGS[@]}"