IAM Access Analyzerで権限の棚卸しと分析を行う

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# アカウントスコープのアナライザーを作成
aws accessanalyzer create-analyzer \
    --analyzer-name external-access-analyzer \
    --type ACCOUNT \
    --tags Environment=Production

# 組織スコープのアナライザーを作成（管理アカウントで実行）
aws accessanalyzer create-analyzer \
    --analyzer-name org-external-access-analyzer \
    --type ORGANIZATION \
    --tags Environment=Production

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 検出結果の一覧取得
aws accessanalyzer list-findings \
    --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/external-access-analyzer

# 特定のリソースタイプでフィルタリング
aws accessanalyzer list-findings \
    --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/external-access-analyzer \
    --filter '{"resourceType": {"eq": ["AWS::S3::Bucket"]}}'

# アクティブな検出結果のみ取得
aws accessanalyzer list-findings \
    --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/external-access-analyzer \
    --filter '{"status": {"eq": ["ACTIVE"]}}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

{
    "analyzedAt": "2026-01-25T10:30:00Z",
    "condition": {},
    "createdAt": "2026-01-25T10:30:00Z",
    "id": "finding-id-12345",
    "isPublic": false,
    "principal": {
        "AWS": "arn:aws:iam::999888777666:root"
    },
    "resource": "arn:aws:s3:::my-shared-bucket",
    "resourceOwnerAccount": "123456789012",
    "resourceType": "AWS::S3::Bucket",
    "status": "ACTIVE"
}

1
2
3
4
5

# 検出結果をアーカイブ（意図した設定の場合）
aws accessanalyzer update-findings \
    --analyzer-arn arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/external-access-analyzer \
    --ids finding-id-12345 \
    --status ARCHIVED

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# アカウントスコープの未使用アクセスアナライザーを作成
aws accessanalyzer create-analyzer \
    --analyzer-name unused-access-analyzer \
    --type ACCOUNT_UNUSED_ACCESS \
    --configuration '{
        "unusedAccess": {
            "unusedAccessAge": 90
        }
    }'

# 組織スコープの未使用アクセスアナライザーを作成
aws accessanalyzer create-analyzer \
    --analyzer-name org-unused-access-analyzer \
    --type ORGANIZATION_UNUSED_ACCESS \
    --configuration '{
        "unusedAccess": {
            "unusedAccessAge": 90
        }
    }'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

{
    "analyzedAt": "2026-01-25T10:30:00Z",
    "createdAt": "2026-01-25T10:30:00Z",
    "findingType": "UnusedPermission",
    "id": "unused-finding-67890",
    "resource": "arn:aws:iam::123456789012:role/MyAppRole",
    "resourceOwnerAccount": "123456789012",
    "resourceType": "AWS::IAM::Role",
    "status": "ACTIVE",
    "unusedPermissionDetails": {
        "serviceNamespace": "ec2",
        "actions": [
            "ec2:TerminateInstances",
            "ec2:DeleteVolume",
            "ec2:DeleteSnapshot"
        ],
        "lastAccessed": null
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# ファイルからポリシーを検証
aws accessanalyzer validate-policy \
    --policy-type IDENTITY_POLICY \
    --policy-document file://my-policy.json

# インラインでポリシーを検証
aws accessanalyzer validate-policy \
    --policy-type IDENTITY_POLICY \
    --policy-document '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "s3:*",
                "Resource": "*"
            }
        ]
    }'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

{
    "findings": [
        {
            "findingType": "SECURITY_WARNING",
            "issueCode": "PASS_ROLE_WITH_STAR_IN_RESOURCE",
            "learnMoreLink": "https://docs.aws.amazon.com/...",
            "locations": [
                {
                    "path": [
                        {"value": "Statement"},
                        {"index": 0},
                        {"value": "Resource"}
                    ],
                    "span": {
                        "start": {"line": 7, "column": 21, "offset": 156},
                        "end": {"line": 7, "column": 24, "offset": 159}
                    }
                }
            ],
            "findingDetails": "iam:PassRoleアクションにワイルドカード(*)を使用すると、任意のロールをパスできてしまいます。"
        },
        {
            "findingType": "WARNING",
            "issueCode": "MISSING_VERSION",
            "learnMoreLink": "https://docs.aws.amazon.com/...",
            "locations": [],
            "findingDetails": "ポリシーにVersionステートメントがありません。\"Version\": \"2012-10-17\"を追加することを推奨します。"
        }
    ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# GitHub Actionsでの検証例
name: Validate IAM Policies

on:
  pull_request:
    paths:
      - 'policies/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: ap-northeast-1
      
      - name: Validate IAM Policies
        run: |
          for policy in policies/*.json; do
            echo "Validating $policy..."
            result=$(aws accessanalyzer validate-policy \
              --policy-type IDENTITY_POLICY \
              --policy-document file://$policy \
              --output json)
            
            errors=$(echo $result | jq '[.findings[] | select(.findingType == "ERROR")] | length')
            warnings=$(echo $result | jq '[.findings[] | select(.findingType == "SECURITY_WARNING")] | length')
            
            if [ "$errors" -gt 0 ] || [ "$warnings" -gt 0 ]; then
              echo "Policy validation failed for $policy"
              echo $result | jq '.findings'
              exit 1
            fi
          done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# ポリシー生成ジョブの開始
aws accessanalyzer start-policy-generation \
    --policy-generation-details '{
        "principalArn": "arn:aws:iam::123456789012:role/MyAppRole"
    }' \
    --cloud-trail-details '{
        "trails": [
            {
                "cloudTrailArn": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail/management-trail",
                "regions": ["ap-northeast-1"],
                "allRegions": false
            }
        ],
        "startTime": "2025-10-25T00:00:00Z",
        "endTime": "2026-01-25T00:00:00Z",
        "accessRole": "arn:aws:iam::123456789012:role/AccessAnalyzerMonitorServiceRole"
    }'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:GetTrail",
                "cloudtrail:GetTrailStatus",
                "cloudtrail:LookupEvents"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::cloudtrail-bucket-name",
                "arn:aws:s3:::cloudtrail-bucket-name/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:ap-northeast-1:123456789012:key/key-id",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "s3.ap-northeast-1.amazonaws.com"
                }
            }
        }
    ]
}

1
2
3
4
5
6
7
8
9

# ポリシー生成ジョブの状態確認
aws accessanalyzer get-generated-policy \
    --job-id job-id-12345

# 生成されたポリシーの取得
aws accessanalyzer get-generated-policy \
    --job-id job-id-12345 \
    --include-resource-placeholders \
    --include-service-level-template

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ReadAccess",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-app-data-bucket",
                "arn:aws:s3:::my-app-data-bucket/*"
            ]
        },
        {
            "Sid": "DynamoDBAccess",
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetItem",
                "dynamodb:PutItem",
                "dynamodb:Query",
                "dynamodb:UpdateItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:ap-northeast-1:123456789012:table/MyAppTable"
            ]
        },
        {
            "Sid": "CloudWatchLogsAccess",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:ap-northeast-1:123456789012:log-group:/aws/lambda/my-function:*"
            ]
        }
    ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{
    "source": ["aws.access-analyzer"],
    "detail-type": ["Access Analyzer Finding"],
    "detail": {
        "status": ["ACTIVE"],
        "findingType": [
            {"prefix": "External"}
        ]
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

#!/bin/bash
# 権限監査レポート生成スクリプト

ANALYZER_ARN="arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/external-access-analyzer"
UNUSED_ANALYZER_ARN="arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/unused-access-analyzer"
REPORT_DATE=$(date +%Y-%m-%d)

echo "=== IAM Access Analyzer 権限監査レポート ===" > report-${REPORT_DATE}.txt
echo "レポート生成日: ${REPORT_DATE}" >> report-${REPORT_DATE}.txt
echo "" >> report-${REPORT_DATE}.txt

# 外部アクセス検出結果のサマリー
echo "## 外部アクセス検出結果" >> report-${REPORT_DATE}.txt
aws accessanalyzer list-findings \
    --analyzer-arn ${ANALYZER_ARN} \
    --filter '{"status": {"eq": ["ACTIVE"]}}' \
    --query 'findings | length(@)' \
    --output text | xargs -I {} echo "アクティブな検出結果: {} 件" >> report-${REPORT_DATE}.txt

# 未使用アクセス検出結果のサマリー
echo "" >> report-${REPORT_DATE}.txt
echo "## 未使用アクセス検出結果" >> report-${REPORT_DATE}.txt
aws accessanalyzer list-findings \
    --analyzer-arn ${UNUSED_ANALYZER_ARN} \
    --filter '{"status": {"eq": ["ACTIVE"]}}' \
    --query 'findings | length(@)' \
    --output text | xargs -I {} echo "アクティブな検出結果: {} 件" >> report-${REPORT_DATE}.txt

# 検出結果の詳細
echo "" >> report-${REPORT_DATE}.txt
echo "## 外部アクセス検出結果詳細" >> report-${REPORT_DATE}.txt
aws accessanalyzer list-findings \
    --analyzer-arn ${ANALYZER_ARN} \
    --filter '{"status": {"eq": ["ACTIVE"]}}' \
    --query 'findings[].{Resource: resource, Type: resourceType, Principal: principal}' \
    --output table >> report-${REPORT_DATE}.txt

echo "レポートを report-${REPORT_DATE}.txt に出力しました"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

import boto3
from datetime import datetime, timedelta

# Access Analyzerクライアントの作成
client = boto3.client('accessanalyzer', region_name='ap-northeast-1')

# アナライザーの作成
def create_analyzer(analyzer_name, analyzer_type='ACCOUNT'):
    response = client.create_analyzer(
        analyzerName=analyzer_name,
        type=analyzer_type,
        tags={
            'Environment': 'Production',
            'ManagedBy': 'SecurityTeam'
        }
    )
    return response['arn']

# アクティブな検出結果の取得
def get_active_findings(analyzer_arn):
    findings = []
    paginator = client.get_paginator('list_findings')
    
    for page in paginator.paginate(
        analyzerArn=analyzer_arn,
        filter={
            'status': {'eq': ['ACTIVE']}
        }
    ):
        findings.extend(page['findings'])
    
    return findings

# 検出結果のアーカイブ
def archive_findings(analyzer_arn, finding_ids):
    client.update_findings(
        analyzerArn=analyzer_arn,
        ids=finding_ids,
        status='ARCHIVED'
    )

# ポリシーの検証
def validate_policy(policy_document, policy_type='IDENTITY_POLICY'):
    response = client.validate_policy(
        policyType=policy_type,
        policyDocument=policy_document
    )
    return response['findings']

# 使用例
if __name__ == '__main__':
    analyzer_arn = 'arn:aws:access-analyzer:ap-northeast-1:123456789012:analyzer/my-analyzer'
    
    # アクティブな検出結果を取得して表示
    findings = get_active_findings(analyzer_arn)
    for finding in findings:
        print(f"Resource: {finding['resource']}")
        print(f"Type: {finding['resourceType']}")
        print(f"Status: {finding['status']}")
        print("---")