Spamhaus に登録されてしまったら通知する仕組みをAWS サーバレス構成で作ってみよう(後編)

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'Spamhaus SBL Monitor - Serverless monitoring system for IP addresses on Spamhaus Blocklist using SAM with automatic dependency packaging'

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Monitoring Configuration"
        Parameters:
          - IPAddresses
          - MonitoringInterval
      - Label:
          default: "Notification Configuration"
        Parameters:
          - NotificationEmail
      - Label:
          default: "Resource Configuration"
        Parameters:
          - ResourceNamePrefix
          - CostAllocationTag
    ParameterLabels:
      IPAddresses:
        default: "IP Addresses to Monitor"
      MonitoringInterval:
        default: "Monitoring Interval (hours)"
      NotificationEmail:
        default: "Email Address for Notifications"
      ResourceNamePrefix:
        default: "Resource Name Prefix"
      CostAllocationTag:
        default: "Cost Allocation Tag Name"

Parameters:
  IPAddresses:
    Type: String
    Description: 'Comma-separated list of IP addresses to monitor for SBL registration'
    AllowedPattern: '^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(,\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*$'
    ConstraintDescription: 'Must be valid IPv4 addresses separated by commas (e.g., 192.168.1.1,10.0.0.1)'
    Default: '192.168.1.1'
  MonitoringInterval:
    Type: Number
    Description: 'Interval in hours between SBL checks (1-24 hours)'
    MinValue: 1
    MaxValue: 24
    Default: 1
    ConstraintDescription: 'Must be between 1 and 24 hours'
  NotificationEmail:
    Type: String
    Description: 'Email address to receive SBL detection notifications'
    AllowedPattern: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    ConstraintDescription: 'Must be a valid email address'
  ResourceNamePrefix:
    Type: String
    Description: 'Prefix for all resource names (maximum 10 characters)'
    MaxLength: 10
    MinLength: 1
    AllowedPattern: '^[a-zA-Z][a-zA-Z0-9-]*$'
    ConstraintDescription: 'Must start with a letter and contain only alphanumeric characters and hyphens'
    Default: 'sbl'
  CostAllocationTag:
    Type: String
    Description: 'Value for the Cost allocation tag applied to all resources'
    MinLength: 1
    MaxLength: 256
    AllowedPattern: '^([\p{L}\p{Z}\p{N}_.:\/=+\-@]*)$'
    ConstraintDescription: 'Must contain only alphanumeric characters, spaces, periods, colons, slashes, equals, plus, hyphens, underscores, and at symbols'
    Default: 'spamhaus-monitor'

Globals:
  Function:
    Runtime: python3.13
    MemorySize: 256
    Timeout: 300
    Environment:
      Variables:
        LOG_LEVEL: INFO
    Tags:
      Cost: !Ref CostAllocationTag
      Application: 'Spamhaus-SBL-Monitor'
    Tracing: Active
    ReservedConcurrentExecutions: 5
    AutoPublishAlias: live
    DeploymentPreference:
      Type: AllAtOnce

# Stack-level tags applied to all resources (moved to Metadata section for SAM compatibility)
Conditions:
  IsSingleHour: !Equals [!Ref MonitoringInterval, 1]

Resources:
  # IAM Role for Lambda Function (Least Privilege)
  SBLMonitorFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${ResourceNamePrefix}-lambda-execution-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess
      Policies:
        - PolicyName: SBLMonitorPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref DQSSecret
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref SBLNotificationTopic
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${ResourceNamePrefix}-sbl-monitor:*'
      Tags:
        - Key: Cost
          Value: !Ref CostAllocationTag
        - Key: Application
          Value: 'Spamhaus-SBL-Monitor'
        - Key: Component
          Value: 'IAM-Role'

  # Lambda Function for SBL Monitoring
  SBLMonitorFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub '${ResourceNamePrefix}-sbl-monitor'
      CodeUri: src/
      Handler: lambda_function.lambda_handler
      Runtime: python3.13
      Role: !GetAtt SBLMonitorFunctionRole.Arn
      Description: 'Monitors IP addresses for Spamhaus SBL registration and sends notifications with automatic dependency packaging'
      Environment:
        Variables:
          IP_ADDRESSES: !Ref IPAddresses
          DQS_SECRET_NAME: !Ref DQSSecret
          SNS_TOPIC_ARN: !Ref SBLNotificationTopic
      Events:
        ScheduledMonitoring:
          Type: Schedule
          Properties:
            Schedule: !If
              - IsSingleHour
              - 'rate(1 hour)'
              - !Sub 'rate(${MonitoringInterval} hours)'
            Name: !Sub '${ResourceNamePrefix}-sbl-monitor-schedule'
            Description: 'Scheduled trigger for Spamhaus SBL monitoring with retry and error handling'
            Enabled: true
            RetryPolicy:
              MaximumRetryAttempts: 3
            DeadLetterConfig:
              Arn: !GetAtt SBLMonitorDLQ.Arn
      Tags:
        Component: 'Lambda-Function'

  # Dead Letter Queue for failed EventBridge executions
  SBLMonitorDLQ:
    Type: AWS::SQS::Queue
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      QueueName: !Sub '${ResourceNamePrefix}-sbl-monitor-dlq'
      MessageRetentionPeriod: 1209600  # 14 days
      Tags:
        - Key: Cost
          Value: !Ref CostAllocationTag
        - Key: Application
          Value: 'Spamhaus-SBL-Monitor'
        - Key: Component
          Value: 'SQS-DLQ'

  # SNS Topic for SBL Notifications
  SBLNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${ResourceNamePrefix}-sbl-notifications'
      DisplayName: 'Spamhaus SBL Detection Alerts'
      KmsMasterKeyId: alias/aws/sns
      DeliveryStatusLogging:
        - Protocol: http/s
          SuccessFeedbackRoleArn: !GetAtt SNSLoggingRole.Arn
          FailureFeedbackRoleArn: !GetAtt SNSLoggingRole.Arn
      Tags:
        - Key: Cost
          Value: !Ref CostAllocationTag
        - Key: Application
          Value: 'Spamhaus-SBL-Monitor'
        - Key: Component
          Value: 'SNS-Topic'

  # IAM Role for SNS Delivery Status Logging
  SNSLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${ResourceNamePrefix}-sns-logging-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: sns.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: SNSLogsDeliveryRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:PutMetricFilter
                  - logs:PutRetentionPolicy
                Resource: '*'
      Tags:
        - Key: Cost
          Value: !Ref CostAllocationTag
        - Key: Application
          Value: 'Spamhaus-SBL-Monitor'
        - Key: Component
          Value: 'IAM-Role'

  # Email Subscription to SNS Topic
  SBLNotificationSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: !Ref SBLNotificationTopic
      Protocol: email
      Endpoint: !Ref NotificationEmail
      FilterPolicy:
        severity:
          - CRITICAL
          - WARNING
      FilterPolicyScope: MessageAttributes
      DeliveryPolicy:
        healthyRetryPolicy:
          numRetries: 3
          minDelayTarget: 20
          maxDelayTarget: 20
          numMinDelayRetries: 0
          numMaxDelayRetries: 0
          numNoDelayRetries: 0
          backoffFunction: linear

  # Secrets Manager Secret for DQS Key
  DQSSecret:
    Type: AWS::SecretsManager::Secret
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      Name: !Sub '${ResourceNamePrefix}-dqs-key'
      Description: 'Spamhaus Data Query Service (DQS) authentication key with encryption and access policies'
      SecretString: |
        {
          "DQS_KEY": "CHANGE-YOUR-DQS-KEY-LATER"
        }
      KmsKeyId: alias/aws/secretsmanager
      ReplicaRegions: []
      Tags:
        - Key: Cost
          Value: !Ref CostAllocationTag
        - Key: Application
          Value: 'Spamhaus-SBL-Monitor'
        - Key: Component
          Value: 'Secrets-Manager'

  # Resource Policy for DQS Secret (Least Privilege Access)
  DQSSecretResourcePolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Properties:
      SecretId: !Ref DQSSecret
      ResourcePolicy:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaAccess
            Effect: Allow
            Principal:
              AWS: !GetAtt SBLMonitorFunctionRole.Arn
            Action:
              - secretsmanager:GetSecretValue
            Resource: '*'
            Condition:
              StringEquals:
                'secretsmanager:ResourceTag/Application': 'Spamhaus-SBL-Monitor'

Outputs:
  LambdaFunctionArn:
    Description: 'ARN of the SBL Monitor Lambda function'
    Value: !GetAtt SBLMonitorFunction.Arn
    Export:
      Name: !Sub '${AWS::StackName}-LambdaFunctionArn'
  SNSTopicArn:
    Description: 'ARN of the SBL Notification SNS topic'
    Value: !Ref SBLNotificationTopic
    Export:
      Name: !Sub '${AWS::StackName}-SNSTopicArn'
  SecretsManagerArn:
    Description: 'ARN of the DQS Key secret in Secrets Manager'
    Value: !Ref DQSSecret
    Export:
      Name: !Sub '${AWS::StackName}-SecretsManagerArn'
  DeadLetterQueueUrl:
    Description: 'URL of the Dead Letter Queue for failed executions'
    Value: !Ref SBLMonitorDLQ
    Export:
      Name: !Sub '${AWS::StackName}-DeadLetterQueueUrl'
  MonitoringConfiguration:
    Description: 'Summary of monitoring configuration'
    Value: !Sub 'Monitoring ${IPAddresses} every ${MonitoringInterval} hours, notifications to ${NotificationEmail}'