Amazon SNS の IP アドレスの範囲を教えてください

const express = require('express');
const SNSMessageValidator = require('./sns-validator');

const app = express();
const validator = new SNSMessageValidator();

// JSONパースのミドルウェア
app.use(express.json({ type: '*/*' }));

app.get('/', async (req, res) => {
  res.status(200).send('hello');
});

// SNSエンドポイント
app.post('/sns-endpoint', async (req, res) => {
  try {
    const message = req.body;

    console.log('Received SNS message:', message);

    // 署名検証
    const isValid = await validator.validateMessage(message);

    if (!isValid) {
      console.error('Invalid message signature');
      return res.status(400).send('Invalid signature');
    }

    console.log('Message signature validated successfully');

    // メッセージタイプに応じた処理
    switch (message.Type) {
      case 'SubscriptionConfirmation':
        await handleSubscriptionConfirmation(message);
        break;

      case 'Notification':
        await handleNotification(message);
        break;

      case 'UnsubscribeConfirmation':
        await handleUnsubscribeConfirmation(message);
        break;

      default:
        console.log('Unknown message type:', message.Type);
    }

    res.status(200).send('OK');

  } catch (error) {
    console.error('Error processing SNS message:', error);
    res.status(500).send('Internal Server Error');
  }
});

/**
 * サブスクリプション確認の処理
 */
async function handleSubscriptionConfirmation(message) {
  console.log('Handling subscription confirmation');

  // SubscribeURLにアクセスして確認を完了
  if (message.SubscribeURL) {
    try {
      const response = await fetch(message.SubscribeURL);
      console.log('Subscription confirmed:', response.status);
    } catch (error) {
      console.error('Failed to confirm subscription:', error);
    }
  }
}

/**
 * 通知メッセージの処理
 */
async function handleNotification(message) {
  console.log('Handling notification');
  console.log('Subject:', message.Subject);
  console.log('Message:', message.Message);

  // ここでビジネスロジックを実装
  // 例：データベースへの保存、他のサービスへの転送など
}

/**
 * サブスクリプション解除確認の処理
 */
async function handleUnsubscribeConfirmation(message) {
  console.log('Handling unsubscribe confirmation');
  // 必要に応じて処理を実装
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

const crypto = require('crypto');
const https = require('https');

class SNSMessageValidator {
  constructor() {
    this.certCache = new Map();
  }

  /**
   * SNSメッセージの署名を検証
   * @param {Object} message - SNSから受信したメッセージ
   * @returns {Promise<boolean>} - 検証結果
   */
  async validateMessage(message) {
    try {
      // 必要なフィールドの存在確認
      if (!this.hasRequiredFields(message)) {
        console.error('Required fields are missing');
        return false;
      }

      // 証明書の取得
      const cert = await this.getCertificate(message.SigningCertURL);

      // 署名文字列の構築
      const stringToSign = this.buildStringToSign(message);

      // 署名の検証
      return this.verifySignature(stringToSign, message.Signature, cert);

    } catch (error) {
      console.error('Signature validation failed:', error);
      return false;
    }
  }

  /**
   * 必要なフィールドの存在確認
   */
  hasRequiredFields(message) {
    const requiredFields = ['Message', 'MessageId', 'Timestamp', 'TopicArn', 'Type', 'Signature', 'SigningCertURL', 'SignatureVersion'];
    return requiredFields.every(field => message.hasOwnProperty(field));
  }

  /**
   * 証明書の取得（キャッシュ機能付き）
   */
  async getCertificate(certUrl) {
    // URLの検証（セキュリティ対策）
    if (!this.isValidCertUrl(certUrl)) {
      throw new Error('Invalid certificate URL');
    }

    // キャッシュから取得を試行
    if (this.certCache.has(certUrl)) {
      return this.certCache.get(certUrl);
    }

    // 証明書をダウンロード
    const cert = await this.downloadCertificate(certUrl);

    // キャッシュに保存
    this.certCache.set(certUrl, cert);

    return cert;
  }

  /**
   * 証明書URLの妥当性確認
   */
  isValidCertUrl(url) {
    try {
      const parsedUrl = new URL(url);
      return parsedUrl.protocol === 'https:' && 
             parsedUrl.hostname.endsWith('.amazonaws.com');
    } catch {
      return false;
    }
  }

  /**
   * 証明書のダウンロード
   */
  downloadCertificate(certUrl) {
    return new Promise((resolve, reject) => {
      https.get(certUrl, (response) => {
        let data = '';

        response.on('data', (chunk) => {
          data += chunk;
        });

        response.on('end', () => {
          resolve(data);
        });

      }).on('error', (error) => {
        reject(error);
      });
    });
  }

  /**
   * 署名対象文字列の構築
   */
  buildStringToSign(message) {
    const fields = [];

    // メッセージタイプに応じてフィールドを選択
    if (message.Type === 'Notification') {
      const notificationFields = [
        'Message', 'MessageId', 'Subject', 'Timestamp', 'TopicArn', 'Type'
      ];

      notificationFields.forEach(field => {
        if (message[field] !== undefined) {
          fields.push(`${field}\n${message[field]}\n`);
        }
      });

    } else if (message.Type === 'SubscriptionConfirmation' || message.Type === 'UnsubscribeConfirmation') {
      const confirmationFields = [
        'Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'
      ];

      confirmationFields.forEach(field => {
        if (message[field] !== undefined) {
          fields.push(`${field}\n${message[field]}\n`);
        }
      });
    }

    return fields.join('');
  }

  /**
   * 署名の検証
   */
  verifySignature(stringToSign, signature, certificate) {
    try {
      const verifier = crypto.createVerify('RSA-SHA1');
      verifier.update(stringToSign, 'utf8');

      return verifier.verify(certificate, signature, 'base64');
    } catch (error) {
      console.error('Signature verification error:', error);
      return false;
    }
  }
}

module.exports = SNSMessageValidator;

node index.js
Server running on port 3000
Received SNS message: {
  Type: 'Notification',
  MessageId: 'd26bceb7-a085-52b3-a401-************',
  TopicArn: 'arn:aws:sns:ap-northeast-1:111111111111:hoge-topic',
  Subject: 'sample message',
  Message: 'hello, this is sample message.',
  Timestamp: '2025-05-30T05:29:17.090Z',
  SignatureVersion: '1',
  Signature: '************',
  SigningCertURL: 'https://sns.ap-northeast-1.amazonaws.com/SimpleNotificationService-**********.pem',
  UnsubscribeURL: 'https://sns.ap-northeast-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:ap-northeast-1:111111111111:hoge-topic:285477e2-e0d3-4888-ab3a-************'
}
Message signature validated successfully
Handling notification
Subject: sample message
Message: hello, this is sample message.