Day 16：Lambda セキュリティ実務（IAM / KMS / Secrets / EOL）

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::mybucket"
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBucketPrefixOnly",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::mybucket",
      "Condition": {
        "StringLike": { "s3:prefix": ["app-prefix/*"] }
      }
    },
    {
      "Sid": "ObjectRWInPrefix",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::mybucket/app-prefix/*"
    }
  ]
}

import boto3, json, os

sm = boto3.client("secretsmanager")

def get_db_password() -> str:
    secret_id = os.environ["DB_SECRET_ID"]  # "prod/db" など（値は入れない）
    resp = sm.get_secret_value(SecretId=secret_id)
    secret = json.loads(resp["SecretString"])
    return secret["password"]

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Day16 Appendix - Minimal Security SAM (IAM / KMS / Secrets) with Params & Conditions

Parameters:
  AppName:
    Type: String
    Default: sample-secure-lambda
    Description: Logical app name used for resource naming

  EnvName:
    Type: String
    Default: STAGING
    AllowedValues: [STAGING, PROD]
    Description: Deployment environment name

  DataBucketName:
    Type: String
    Description: S3 bucket name used by the function

  DataPrefix:
    Type: String
    Default: app-prefix
    Description: S3 prefix under the bucket (no leading slash). Example: app-prefix

  DBSecretArn:
    Type: String
    Description: Secrets Manager secret ARN (store the actual credentials in Secrets Manager)

  UseCustomerManagedKms:
    Type: String
    Default: "false"
    AllowedValues: ["true", "false"]
    Description: If true, create & use a customer managed KMS key for Lambda env var encryption

Conditions:
  IsProd: !Equals [!Ref EnvName, "PROD"]
  UseCMK: !Equals [!Ref UseCustomerManagedKms, "true"]

Globals:
  Function:
    Runtime: python3.12
    Timeout: 30
    MemorySize: 256
    Tracing: Active
    Environment:
      Variables:
        ENV_NAME: !Ref EnvName
        DATA_BUCKET: !Ref DataBucketName
        DATA_PREFIX: !Ref DataPrefix
        DB_SECRET_ARN: !Ref DBSecretArn  # 値は入れない（ARN/名前のみ）

Resources:
  # （任意）環境変数の暗号化を “CMK” にしたい場合だけ作る
  LambdaEnvKmsKey:
    Type: AWS::KMS::Key
    Condition: UseCMK
    Properties:
      Description: !Sub "${AppName}-${EnvName} Lambda env var encryption key"
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          # まずはアカウント管理者にフル権限（ここから IAM ポリシーで利用権限を委譲する設計）
          - Sid: AllowAccountRootFullAccess
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*"

  LambdaEnvKmsAlias:
    Type: AWS::KMS::Alias
    Condition: UseCMK
    Properties:
      AliasName: !Sub "alias/${AppName}-${EnvName}-lambda-env"
      TargetKeyId: !Ref LambdaEnvKmsKey

  AppFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AppName}-${EnvName}-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AppName}-${EnvName}-least-priv"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # CloudWatch Logs（最低限）
              - Sid: LogsWrite
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"

              # S3：ListBucket はバケットARN、Object操作は object ARN（prefix配下）に限定
              - Sid: S3ListPrefixOnly
                Effect: Allow
                Action: s3:ListBucket
                Resource: !Sub "arn:aws:s3:::${DataBucketName}"
                Condition:
                  StringLike:
                    s3:prefix:
                      - !Sub "${DataPrefix}/*"

              - Sid: S3ObjectRWInPrefix
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource: !Sub "arn:aws:s3:::${DataBucketName}/${DataPrefix}/*"

              # Secrets Manager：対象 Secret だけ GetSecretValue
              - Sid: SecretsReadOnly
                Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref DBSecretArn

              # CMK を使う場合：Lambda が起動時に環境変数を復号するため kms:Decrypt が必要
              - Sid: KmsDecryptForEnvVars
                Effect: Allow
                Action:
                  - kms:Decrypt
                Resource: !If [UseCMK, !GetAtt LambdaEnvKmsKey.Arn, !Ref "AWS::NoValue"]

  AppFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub "${AppName}-${EnvName}"
      CodeUri: src/
      Handler: app.lambda_function.lambda_handler
      Role: !GetAtt AppFunctionRole.Arn
      # CMK を使う場合だけ設定（環境変数の暗号化キー）
      KmsKeyArn: !If [UseCMK, !GetAtt LambdaEnvKmsKey.Arn, !Ref "AWS::NoValue"]

      # 例：PROD だけ “保守的” にする差分（必要に応じて拡張）
      ReservedConcurrentExecutions: !If [IsProd, 10, !Ref "AWS::NoValue"]

Outputs:
  FunctionName:
    Value: !Ref AppFunction
  FunctionRoleArn:
    Value: !GetAtt AppFunctionRole.Arn
  EnvKmsKeyArn:
    Value: !If [UseCMK, !GetAtt LambdaEnvKmsKey.Arn, ""]

# STAGING（CMKなし：AWS管理の暗号化に寄せる）
sam deploy \
  --stack-name sample-secure-lambda-stg \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides \
    AppName=sample-secure-lambda \
    EnvName=STAGING \
    DataBucketName=my-bucket \
    DataPrefix=app-prefix \
    DBSecretArn=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/db-xxxx \
    UseCustomerManagedKms=false

# PROD（CMKあり：環境変数暗号化を CMK に切替）
sam deploy \
  --stack-name sample-secure-lambda-prod \
  --capabilities CAPABILITY_IAM \
  --parameter-overrides \
    AppName=sample-secure-lambda \
    EnvName=PROD \
    DataBucketName=my-bucket \
    DataPrefix=app-prefix \
    DBSecretArn=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/db-xxxx \
    UseCustomerManagedKms=true

import os, boto3, json

sm = boto3.client("secretsmanager")

def lambda_handler(event, context):
    secret_arn = os.environ["DB_SECRET_ARN"]
    resp = sm.get_secret_value(SecretId=secret_arn)
    secret = json.loads(resp["SecretString"])
    # secret["username"], secret["password"] を使う
    return {"ok": True}