AWS Config Rule 実装と運用してみた

チェックしたい内容は？
│
├─ リソースの設定値のみをチェック
│  （例：暗号化が有効か、タグが存在するか）
│  │
│  └─ ✅ Guard を使用
│     - シンプルで保守しやすい
│     - コストが低い
│     - 実装が早い
│
└─ 外部リソースの情報が必要
   （例：CloudWatchアラームの存在、他のリソースとの関連）
   │
   └─ ✅ Lambda を使用
      - 柔軟な実装が可能
      - 複雑なロジックに対応

# S3バケットの暗号化とバージョニングをチェック
rule s3_bucket_compliance {
  # S3バケットのみを対象
  AWS::S3::Bucket {
    # サーバーサイド暗号化が有効であること
    Properties.BucketEncryption exists
    Properties.BucketEncryption.ServerSideEncryptionConfiguration[*] {
      Rules[*].ServerSideEncryptionByDefault.SSEAlgorithm in ["AES256", "aws:kms"]
    }

    # バージョニングが有効であること
    Properties.VersioningConfiguration exists
    Properties.VersioningConfiguration.Status == "Enabled"

    # パブリックアクセスブロックが有効であること
    Properties.PublicAccessBlockConfiguration exists
    Properties.PublicAccessBlockConfiguration {
      BlockPublicAcls == true
      BlockPublicPolicy == true
      IgnorePublicAcls == true
      RestrictPublicBuckets == true
    }
  }
}

# Guardルールファイルをアップロード
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-compliance-guard",
  "Description": "S3バケットの暗号化とバージョニングをチェック",
  "Source": {
    "Owner": "CUSTOM_POLICY",
    "SourceDetails": [
      {
        "EventSource": "aws.config",
        "MessageType": "ConfigurationItemChangeNotification"
      }
    ],
    "CustomPolicyDetails": {
      "PolicyRuntime": "guard-2.x.x",
      "PolicyText": "$(cat s3-bucket-compliance.guard)"
    }
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::S3::Bucket"]
  }
}'

# cfn-guardをインストール
cargo install cfn-guard

# ルールをテスト
cfn-guard validate \
  --rules s3-bucket-compliance.guard \
  --data test-s3-bucket.json

# conformance-pack-example.yaml
Resources:
  # EC2インスタンスの暗号化チェック
  EC2VolumeEncryptionCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ec2-volume-encryption-check
      Source:
        Owner: AWS
        SourceIdentifier: ENCRYPTED_VOLUMES
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Volume

  # S3バケットのパブリックアクセスブロック
  S3BucketPublicReadProhibited:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # RDSの暗号化チェック
  RDSStorageEncrypted:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: rds-storage-encrypted
      Source:
        Owner: AWS
        SourceIdentifier: RDS_STORAGE_ENCRYPTED
      Scope:
        ComplianceResourceTypes:
          - AWS::RDS::DBInstance

Parameters:
  # パラメータを使って柔軟に設定可能
  RequiredTagKey:
    Type: String
    Default: "Environment"
    Description: "必須タグのキー名"

# 適合パックをデプロイ
aws configservice put-conformance-pack \
  --conformance-pack-name my-security-pack \
  --template-body file://conformance-pack-example.yaml \
  --delivery-s3-bucket my-config-bucket

# デプロイ状況を確認
aws configservice describe-conformance-pack-status \
  --conformance-pack-names my-security-pack

aws configservice put-configuration-aggregator \
  --configuration-aggregator-name my-account-aggregator \
  --account-aggregation-sources '[
    {
      "AccountIds": ["111111111111", "222222222222"],
      "AllAwsRegions": true
    }
  ]'

aws configservice put-configuration-aggregator \
  --configuration-aggregator-name my-org-aggregator \
  --organization-aggregation-source '{
    "RoleArn": "arn:aws:iam::123456789012:role/aws-service-role/organizations.amazonaws.com/AWSServiceRoleForOrganizations",
    "AllAwsRegions": true
  }'

aws configservice put-aggregation-authorization \
  --authorized-account-id 123456789012 \
  --authorized-aws-region ap-northeast-1

aws configservice put-configuration-aggregator \
  --configuration-aggregator-name central-aggregator \
  --account-aggregation-sources '[
    {
      "AccountIds": ["111111111111", "222222222222", "333333333333"],
      "AllAwsRegions": true
    }
  ]'

# 集約されたコンプライアンス状況を確認
aws configservice describe-aggregate-compliance-by-config-rules \
  --configuration-aggregator-name central-aggregator \
  --filters '{
    "ComplianceType": "NON_COMPLIANT"
  }'

import boto3

config_client = boto3.client('config')

# 非準拠リソースの数を取得
response = config_client.get_aggregate_compliance_details_by_config_rule(
    ConfigurationAggregatorName='central-aggregator',
    ConfigRuleName='required-tags',
    ComplianceType='NON_COMPLIANT'
)

non_compliant_count = len(response['AggregateEvaluationResults'])
print(f'非準拠リソース数: {non_compliant_count}')

{
  "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": {
    "configRuleName": ["required-tags"],
    "newEvaluationResult": {
      "complianceType": ["NON_COMPLIANT"]
    }
  }
}

{
  "Scope": {
    "ComplianceResourceTypes": ["AWS::EC2::Instance"],
    "TagKey": "Environment",
    "TagValue": "Production"
  }
}

aws configservice put-remediation-configurations \
  --remediation-configurations '[
    {
      "ConfigRuleName": "s3-bucket-public-read-prohibited",
      "TargetType": "SSM_DOCUMENT",
      "TargetIdentifier": "AWS-PublishSNSNotification",
      "TargetVersion": "1",
      "Parameters": {
        "AutomationAssumeRole": {
          "StaticValue": {
            "Values": ["arn:aws:iam::123456789012:role/ConfigRemediationRole"]
          }
        },
        "TopicArn": {
          "StaticValue": {
            "Values": ["arn:aws:sns:ap-northeast-1:123456789012:config-alerts"]
          }
        }
      },
      "Automatic": true,
      "MaximumAutomaticAttempts": 3,
      "RetryAttemptSeconds": 60
    }
  ]'

try:
    # 評価ロジック
    compliance_type = 'COMPLIANT'
except Exception as e:
    compliance_type = 'NON_COMPLIANT'
    annotation = f'Error: {str(e)}'
finally:
    # 必ず評価結果を返す
    config_client.put_evaluations(
        Evaluations=[...],
        ResultToken=event['resultToken']
    )