AWS Systems Manager Automation を使用して複数のアカウントとリージョンにある AWS リソースを管理する

---
description: "Automation Document for Central CloudTrail logging YAML Template"
schemaVersion: "0.3"
assumeRole: "{{ AutomationAssumeRole }}"
parameters:
  S3Bucket:
    type: "String"
    description: "(Required) Central Amazon S3 bucket for storing copies of all AWS CloudTrail from multiple accounts in all Regions"
  S3KeyPrefix:
    type: "String"
    description: "(Optional) Central Bucket Key prefix"
    default: ""
  TrailName:
    type: "String"
    description: "(Optional) Name to be assigned to this trail"
    default: "Multi-Account-Trail"

  MultiRegionTrail:
    type: "Boolean"
    description: 
    default: True
  AutomationAssumeRole:
    type: "String"
    description: "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf."
    default: ""

mainSteps:

- name: CreateTrail
  action: aws:executeAwsApi
  inputs:
    Service: cloudtrail
    Api: CreateTrail
    Name: "{{TrailName}}"
    IsMultiRegionTrail: True
    S3BucketName: "{{ S3Bucket }}"
    S3KeyPrefix: "{{ S3KeyPrefix }}"

- name: StartLogging
  action: aws:executeAwsApi
  inputs:
    Service: cloudtrail
    Api: StartLogging
    Name: "{{TrailName}}"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck20150319",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::{BUCKETNAME}"
        },
        {
            "Sid": "AWSCloudTrailWrite20150319",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::{BUCKETNAME}/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

aws ssm start-automation-execution —document-name Centralized-cloudtrail —parameters AutomationAssumeRole=arn:aws:iam::<Master_ACCOUNTID>:role/AWS-SystemsManager-AutomationAdministrationRole,S3Bucket=<Central_S3_Bucket_Name> —target-locations Accounts=<Target_AccountIDs>,Regions=us-west-2,ExecutionRoleName=AWS-SystemsManager-AutomationExecutionRole —target-parameter-name TrailName —targets Key=ParameterValues,Values=Multi-Account-Trail Values —region us-west-2

aws ssm start-automation-execution --document-name AWS-StartEC2Instance --parameters AutomationAssumeRole=arn:aws:iam::<Master_ACCOUNTID>:role/AWS-SystemsManager-AutomationAdministrationRole --target-locations Accounts=<Target_AccountIDs>,Regions=us-west-2,ExecutionRoleName=AWS-SystemsManager-AutomationExecutionRole --target-parameter-name InstanceId --targets Key=tag:Name,Values=Non-Prod --region us-west-2

aws ssm start-automation-execution --document-name AWS-StopEC2Instance --parameters AutomationAssumeRole=arn:aws:iam::<Master_ACCOUNTID>:role/AWS-SystemsManager-AutomationAdministrationRole --target-locations Accounts=<Target_AccountIDs>,Regions=us-west-2,ExecutionRoleName=AWS-SystemsManager-AutomationExecutionRole --target-parameter-name InstanceId --targets Key=tag:Name,Values=Non-Prod --region us-west-2