AWS Control Tower運用のベストプラクティスとトラブルシューティング

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# ランディングゾーンの状態確認
aws controltower get-landing-zone-status

# ガードレールの準拠状態確認
aws controltower list-enabled-controls \
    --target-identifier "arn:aws:organizations::123456789012:ou/o-example/ou-1234-5678"

# ドリフト状態の確認
aws controltower get-landing-zone-operation \
    --operation-identifier "op-1234567890abcdef0"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import boto3
import json

def check_control_tower_status():
    """Control Towerの状態を確認し、異常があれば通知"""
    ct_client = boto3.client('controltower')
    
    # ランディングゾーン状態の取得
    response = ct_client.list_landing_zones()
    
    for lz in response.get('landingZones', []):
        lz_arn = lz['arn']
        
        # 詳細情報の取得
        lz_detail = ct_client.get_landing_zone(landingZoneIdentifier=lz_arn)
        status = lz_detail['landingZone']['status']
        drift_status = lz_detail['landingZone'].get('driftStatus', {})
        
        print(f"Landing Zone Status: {status}")
        print(f"Drift Status: {drift_status}")
        
        # ドリフト検出時のアラート
        if drift_status.get('status') == 'DRIFTED':
            send_alert(f"Control Tower drift detected: {lz_arn}")
    
    return response

def send_alert(message):
    """SNSを使用してアラート送信"""
    sns = boto3.client('sns')
    sns.publish(
        TopicArn='arn:aws:sns:ap-northeast-1:123456789012:ControlTowerAlerts',
        Message=message,
        Subject='Control Tower Alert'
    )

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

{
    "source": ["aws.organizations", "aws.cloudtrail", "aws.config"],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail": {
        "eventSource": ["organizations.amazonaws.com", "cloudtrail.amazonaws.com", "config.amazonaws.com"],
        "eventName": [
            "UpdatePolicy",
            "DeletePolicy",
            "AttachPolicy",
            "DetachPolicy",
            "MoveAccount",
            "StopLogging",
            "DeleteTrail",
            "StopConfigurationRecorder",
            "DeleteConfigurationRecorder"
        ]
    }
}

1
2
3

# ランディングゾーンのドリフト詳細を確認
aws controltower get-landing-zone \
    --landing-zone-identifier "arn:aws:controltower:ap-northeast-1:123456789012:landingzone/ABCD1234"

1
2
3

# ランディングゾーンのリセット（修復）
aws controltower reset-landing-zone \
    --landing-zone-identifier "arn:aws:controltower:ap-northeast-1:123456789012:landingzone/ABCD1234"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PreventControlTowerDrift",
            "Effect": "Deny",
            "Action": [
                "organizations:UpdatePolicy",
                "organizations:DeletePolicy",
                "organizations:DetachPolicy",
                "cloudtrail:StopLogging",
                "cloudtrail:DeleteTrail",
                "cloudtrail:UpdateTrail",
                "config:StopConfigurationRecorder",
                "config:DeleteConfigurationRecorder"
            ],
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        "arn:aws:iam::*:role/AWSControlTowerExecution",
                        "arn:aws:iam::*:role/AWSReservedSSO_AWSAdministratorAccess_*"
                    ]
                }
            }
        }
    ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 1. 現在のバージョン確認
aws controltower get-landing-zone \
    --landing-zone-identifier $LANDING_ZONE_ARN \
    --query 'landingZone.version'

# 2. ドリフト状態の確認
aws controltower get-landing-zone \
    --landing-zone-identifier $LANDING_ZONE_ARN \
    --query 'landingZone.driftStatus'

# 3. 進行中のオペレーションがないか確認
aws controltower list-landing-zone-operations \
    --query 'landingZoneOperations[?status==`IN_PROGRESS`]'

1
2
3
4
5
6
7
8

# CloudFormation StackSetsの状態を記録
aws cloudformation list-stack-sets \
    --status ACTIVE \
    > stacksets-backup.json

# Service Catalogポートフォリオの状態を記録
aws servicecatalog search-products-as-admin \
    > service-catalog-backup.json

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# CLIでのアップデート実行
aws controltower update-landing-zone \
    --landing-zone-identifier $LANDING_ZONE_ARN \
    --version "3.3"  # 新しいバージョンを指定

# オペレーションIDを取得
OPERATION_ID=$(aws controltower update-landing-zone \
    --landing-zone-identifier $LANDING_ZONE_ARN \
    --version "3.3" \
    --query 'operationIdentifier' \
    --output text)

# 進行状況の監視
aws controltower get-landing-zone-operation \
    --operation-identifier $OPERATION_ID

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# 1. バージョン確認
aws controltower get-landing-zone \
    --landing-zone-identifier $LANDING_ZONE_ARN \
    --query 'landingZone.version'

# 2. ガードレール状態確認
aws controltower list-enabled-controls \
    --target-identifier $PRODUCTION_OU_ARN

# 3. Account Factory動作確認
aws servicecatalog search-provisioned-products

# 4. コンプライアンス状態確認
aws configservice get-compliance-summary-by-config-rule

1
2
3
4
5
6
7

# プロビジョニング状態の確認
aws servicecatalog describe-provisioned-product \
    --id pp-1234567890

# エラー詳細の確認
aws servicecatalog describe-record \
    --id rec-1234567890

1
2
3
4
5
6
7
8
9

# Config Ruleの評価結果詳細を確認
aws configservice get-compliance-details-by-config-rule \
    --config-rule-name "AWSControlTower_AWS-GR_ENCRYPTED_VOLUMES" \
    --compliance-types NON_COMPLIANT

# リソースの実際の設定を確認
aws ec2 describe-volumes \
    --volume-ids vol-0123456789abcdef0 \
    --query 'Volumes[].Encrypted'

1
2
3
4
5
6

# 権限セットの再プロビジョニング
aws sso-admin provision-permission-set \
    --instance-arn arn:aws:sso:::instance/ssoins-1234567890 \
    --permission-set-arn arn:aws:sso:::permissionSet/ssoins-1234567890/ps-1234567890 \
    --target-type AWS_ACCOUNT \
    --target-id 123456789012

1
2
3
4
5
6
7

# CloudTrailの状態確認
aws cloudtrail get-trail-status \
    --name aws-controltower-BaselineCloudTrail

# S3バケットポリシーの確認
aws s3api get-bucket-policy \
    --bucket aws-controltower-logs-123456789012-ap-northeast-1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# 管理アカウント用のカスタムガードレール実装

# 1. AWS Configルールの手動設定
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "management-account-mfa-enabled",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"
        }
    }'

# 2. CloudWatch Alarmsの設定
aws cloudwatch put-metric-alarm \
    --alarm-name "RootAccountUsage" \
    --metric-name "RootAccountUsageCount" \
    --namespace "CloudTrailMetrics" \
    --statistic Sum \
    --period 300 \
    --threshold 1 \
    --comparison-operator GreaterThanOrEqualToThreshold \
    --evaluation-periods 1 \
    --alarm-actions arn:aws:sns:ap-northeast-1:123456789012:SecurityAlerts

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

import json
import urllib.request
import os

SLACK_WEBHOOK_URL = os.environ['SLACK_WEBHOOK_URL']

def lambda_handler(event, context):
    # イベント内容の解析
    detail = event.get('detail', {})
    event_name = detail.get('eventName', 'Unknown')
    event_source = detail.get('eventSource', 'Unknown')
    
    # Slackメッセージの構築
    message = {
        "blocks": [
            {
                "type": "header",
                "text": {
                    "type": "plain_text",
                    "text": "Control Tower Alert"
                }
            },
            {
                "type": "section",
                "fields": [
                    {"type": "mrkdwn", "text": f"*Event:* {event_name}"},
                    {"type": "mrkdwn", "text": f"*Source:* {event_source}"}
                ]
            }
        ]
    }
    
    # Slack送信
    req = urllib.request.Request(
        SLACK_WEBHOOK_URL,
        data=json.dumps(message).encode('utf-8'),
        headers={'Content-Type': 'application/json'}
    )
    urllib.request.urlopen(req)
    
    return {'statusCode': 200}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

import boto3
from datetime import datetime

def generate_compliance_report():
    """コンプライアンス状態の定期レポートを生成"""
    config = boto3.client('config')
    ct = boto3.client('controltower')
    
    report = {
        'generated_at': datetime.utcnow().isoformat(),
        'compliance_summary': {},
        'non_compliant_resources': []
    }
    
    # コンプライアンスサマリーの取得
    summary = config.get_compliance_summary_by_config_rule()
    report['compliance_summary'] = {
        'compliant': summary['ComplianceSummary']['CompliantResourceCount']['CappedCount'],
        'non_compliant': summary['ComplianceSummary']['NonCompliantResourceCount']['CappedCount']
    }
    
    # 非準拠リソースの詳細取得
    non_compliant = config.describe_compliance_by_config_rule(
        ComplianceTypes=['NON_COMPLIANT']
    )
    
    for rule in non_compliant['ComplianceByConfigRules']:
        details = config.get_compliance_details_by_config_rule(
            ConfigRuleName=rule['ConfigRuleName'],
            ComplianceTypes=['NON_COMPLIANT'],
            Limit=10
        )
        for result in details['EvaluationResults']:
            report['non_compliant_resources'].append({
                'rule': rule['ConfigRuleName'],
                'resource_type': result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceType'],
                'resource_id': result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
            })
    
    return report

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# control-tower-config.yaml
# Customizations for Control Tower (CfCT) 設定例

region: ap-northeast-1
version: 2021-03-15

organizational_units:
  - name: Security
    accounts:
      - name: Log Archive
        email: log-archive@example.com
      - name: Audit
        email: audit@example.com
  
  - name: Production
    core_ou: true
    guardrails:
      - identifier: AWS-GR_ENCRYPTED_VOLUMES
        enable: true
      - identifier: AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK
        enable: true

  - name: Development
    guardrails:
      - identifier: AWS-GR_ENCRYPTED_VOLUMES
        enable: true

service_control_policies:
  - name: DenyRootUser
    policy_file: policies/deny-root-user.json
    targets:
      - Production
      - Development