ソフトウェアの「手の内化」を推し進めるサステナブルな学習環境を内製化してみた

cmd="""
docker run -v `pwd`/Challenges:/Challenges \
    --env RootUserId={} \
    --env AWS_ACCESS_KEY_ID=`echo {} | cut -d , -f 3` \
    --env AWS_SECRET_ACCESS_KEY=`echo {} | cut -d , -f 4` \
    --env AWS_AccountId=`echo {} | cut -d , -f 5` \
    --env RandomString=`echo {} | cut -d , -f 6 | tr -d '\r'` \
    --env ChallengeTitle=`echo {} | cut -d , -f 1` \
    --env LabId=`echo {} | cut -d , -f 2` \
    --env AWS_DEFAULT_REGION=`echo {} | cut -d , -f 3 | tr -d '\r'` \
    createstack &
"""
while True:
    proc = subprocess.Popen("free -m | grep Mem | awk '{print $4}'", stdout=subprocess.PIPE, shell=True)
    (out, err) = proc.communicate()
    if int(out) > 100:
        break
    else:
        time.sleep(5)
        print("Free Mem:", int(out), "MB")
cmd=(cmd.format(
    RootUserId,
    CredentialsItems_list[CredentialsItemIndex_int]['Access key ID'],
    CredentialsItems_list[CredentialsItemIndex_int]['Secret access key'],
    CredentialsItems_list[CredentialsItemIndex_int]['AWS Account Id'],
    CredentialsItems_list[CredentialsItemIndex_int]['RandomString'],
    ChallengesItems_list[ChallengesItemIndex_int]['Title'],
    ChallengesItems_list[ChallengesItemIndex_int]['ChallengeId'],
    ChallengesItems_list[ChallengesItemIndex_int]['Region']
))
os.system(cmd)

 LabUserPermissionsBoundary:
    Type: AWS::IAM::Policy
    Properties: 
      PolicyName: LabUserPermissionsBoundary-000ff9fd-b3ddb-s
      Roles: 
        - !Ref LabUserRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          # グローバルサービス以外のStackを作成したリージョン以外のアクセスを禁止する
          - Effect: Deny
            NotAction: 
              - a4b:*
              - acm:*
              - aws-marketplace-management:*
              - aws-marketplace:*
              - aws-portal:*
              - budgets:*
              - ce:*
              - chime:*
              - cloudfront:*
              - config:*
              - cur:*
              - directconnect:*
              - ec2:DescribeRegions
              - ec2:DescribeTransitGateways
              - ec2:DescribeVpnGateways
              - fms:*
              - globalaccelerator:*
              - health:*
              - iam:*
              - importexport:*
              - kms:*
              - mobileanalytics:*
              - networkmanager:*
              - organizations:*
              - pricing:*
              - route53:*
              - route53domains:*
              - s3:GetAccountPublic
              - s3:ListAllMyBuckets
              - s3:PutAccountPublic
              - shield:*
              - sts:*
              - support:*
              - trustedadvisor:*
              - waf-regional:*
              - waf:*
              - wafv2:*
              - wellarchitected:*
            Resource: '*'
            Condition:
              StringNotEquals:
                'aws:RequestedRegion':
                  - !Sub '${AWS::Region}'
          # LabUserPermissionsBoundary に対するアクセスを禁止する
          - Effect: Deny
            Action:
              - iam:RemoveUserFromGroup
              - iam:DeleteGroup
              - iam:UpdateGroup
              - iam:DeletePolicy
              - iam:DetachGroupPolicy
              - iam:DeleteUserPermissionsBoundary
              - iam:DeleteGroupPolicy
            Resource:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/*LabUserPermissionsBoundary*'
  LabUserRole:
    Type: AWS::IAM::Role
    Properties:
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${RootUserId}:root'
            Action: sts:AssumeRole
      Path: /
      Policies:
        # 課題を進めるために必要な許可する
        - PolicyName: labuserpolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListAllMyBuckets
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub 'arn:aws:s3:::${ProductBucket}/*'
                  - !Sub 'arn:aws:s3:::${ProductBucket}'
        # 課題を壊すアクセスを禁止する
        - PolicyName: labbasepolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Deny
                Action:
                  - lambda:*
                Resource:
                  !GetAtt 'CopyFilesFunction.Arn'
              - Effect: Deny
                Action:
                  - logs:*
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:*'
              # このStackに対するアクセスを禁止する
              - Effect: Deny
                Action:
                  - cloudformation:DescribeStackEvents
                  - cloudformation:GetTemplate
                  - cloudformation:DescribeStackResource
                  - cloudformation:ListStackResources
                Resource:
                  - !Sub '${AWS::StackId}'
              PolicySimulatorへのアクセス許可
              - Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:GetRolePolicy
                  - iam:ListRolePolicies
                  - iam:ListAttachedRolePolicies
                Resource: 
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*LabUserRole*'
              - Effect: Allow
                Action:
                  - iam:ListRoles
                  - iam:GetPolicy
                  - iam:GetPolicyVersion
                Resource: '*'

FROM amazonlinux:2

ENV LANG=en_US.SJIS
ENV PYTHONIOENCODING=utf-8
WORKDIR /

# aws cli install
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \
    && yum install -y unzip \
    && unzip awscliv2.zip \
    && ./aws/install \
    && amazon-linux-extras install python3.8 -y \
    && python3.8 -m pip install pillow==8.3.2 \
    && yum install -y less
    
RUN yum install -y wget tar gzip expect

# aws-nuke のダウンロード
RUN wget https://github.com/rebuy-de/aws-nuke/releases/download/v2.16.0/aws-nuke-v2.16.0-linux-amd64.tar.gz \
    && tar -zxvf aws-nuke-v2.16.0-linux-amd64.tar.gz

# nuke-config.yaml と実行スクリプトをコンテナに配置する
COPY nuke-config.yaml /
COPY Run-nuke.sh /

RUN chmod +x Run-nuke.sh

CMD ["/bin/sh", "Run-nuke.sh"]

#!/bin/bash -ex
INI_FILE=conf.ini
INI_SECTION=Organizer_Account

# ini parser
eval `sed -e 's/[[:space:]]*\=[[:space:]]*/=/g' \
    -e 's/;.*$//' \
    -e 's/[[:space:]]*$//' \
    -e 's/^[[:space:]]*//' \
    -e "s/^\(.*\)=\([^\"']*\)$/\1=\"\2\"/" \
   < $INI_FILE \
    | sed -n -e "/^\[$INI_SECTION\]/,/^\s*\[/{/^[^;].*\=.*/p;}"`
    
OrganizationAccountId=${AccountId}

CREDENTIALS_FILE_NAME='Credentials.csv'
WORK_CREDENTIALS_FILE_NAME='./w_'$CREDENTIALS_FILE_NAME
cp $CREDENTIALS_FILE_NAME $WORK_CREDENTIALS_FILE_NAME
HEADER=`head -n 1 $WORK_CREDENTIALS_FILE_NAME`
sed -i -e '1d' $WORK_CREDENTIALS_FILE_NAME

while read credential; do
    echo "AWS_AccountId:" `echo ${credential} | cut -d , -f 5`
    
    while true; do
        FreeMemMB=`free -m | grep Mem | awk '{print $4}'`
        if [ $FreeMemMB -gt 100 ]; then
            break
        else
            echo "FreeMemMB" $FreeMemMB
            sleep 5
        fi
    done
    
    docker run -v `pwd`/AllDelete:/AllDelete \
        --env RootUserId=${OrganizationAccountId} \
        --env AWS_ACCESS_KEY_ID=`echo ${credential} | cut -d , -f 3` \
        --env AWS_SECRET_ACCESS_KEY=`echo ${credential} | cut -d , -f 4` \
        --env AWS_AccountId=`echo ${credential} | cut -d , -f 5` \
        nuke &
done < $WORK_CREDENTIALS_FILE_NAME

regions:
- us-west-1
- us-west-2
- us-east-2
- ap-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ca-central-1
- eu-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- sa-east-1
- me-south-1
- ap-southeast-3
- af-south-1
- ap-east-1
- global

account-blocklist:
- "BlockID" # production

resource-types:
  excludes:
  - IAMRole
  - IAMRolePolicy
  - IAMRolePolicyAttachment
  - IAMUser
  - IAMUserAccessKey
  - IAMUserGroupAttachment
  - IAMLoginProfile
  - IAMGroup
  - IAMGroupPolicyAttachment
 
accounts:
  "TargetID": {} # aws-nuke-example

#!/bin/bash -eu

mkdir -p AllDelete/${AWS_AccountId}

# 運営用アカウントを削除しないよう、nuke-config.yaml にaccount-blocklist を設定する
echo ${RootUserId}
sed -i -e "s/BlockID/${RootUserId}/" nuke-config.yaml
sed -i -e "s/TargetID/${AWS_AccountId}/" nuke-config.yaml

aws iam create-account-alias --account-alias ${AWS_AccountId}-test

script="""
    set timeout -1
    spawn bash -c \"./aws-nuke-v2.16.0-linux-amd64 -c ./nuke-config.yaml --access-key-id ${AWS_ACCESS_KEY_ID} --secret-access-key ${AWS_SECRET_ACCESS_KEY} --no-dry-run\"
    expect \"Do you want to continue? Enter account alias to continue.\"
    send -- \"${AWS_AccountId}-test\r\"
    expect \"Do you want to continue? Enter account alias to continue.\"
    send -- \"${AWS_AccountId}-test\r\"
    expect \"Nuke complete\"
    exit 0
"""

expect -c "$script" 2>&1 | tee /AllDelete/${AWS_AccountId}-log.txt

REPORT RequestId: c518157a-0c9c-4f77-a087-f9f0593bbbea Duration: 913.43 ms Billed Duration: 914 ms Memory Size: 512 MB Max Memory Used: 71 MB

XRAY TraceId: 1-61b2acad-5422ef6d7eed5deb52e3d981 SegmentId: 6ccf50315b9740a5 Sampled: true