【運用自動化】AWS Config 適合パック (Conformance Packs) を使って AWS 組織内の VPC Flow Logs 無効化設定を検知・自動修復してみた

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "delivery.logs.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::<s3-bucket-name>/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } }, { "Effect": "Allow", "Principal": { "Service": "delivery.logs.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::<s3-bucket-name>" } ] } 

AWSTemplateFormatVersion: '2010-09-09' Description: | IAM Role for SSM Automation to enable VPC Flow Logs across organization accounts. This template is deployed via CloudFormation StackSets with service-managed permissions. Features: - Least privilege IAM permissions for VPC Flow Logs management - Cross-account S3 write access for centralized logging - Secure trust relationship with Systems Manager Automation Metadata: AWS::CloudFormation::Interface: ParameterGroups: - Label: default: "Logging Configuration" Parameters: - LogArchiveBucket - LogArchiveAccountId - Label: default: "Role Configuration" Parameters: - RoleName ParameterLabels: LogArchiveBucket: default: "Centralized Log Archive S3 Bucket Name" LogArchiveAccountId: default: "Log Archive Account ID" RoleName: default: "IAM Role Name" Parameters: LogArchiveBucket: Type: String Description: Name of the centralized S3 bucket for VPC Flow Logs (in Log Archive Account) AllowedPattern: '^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$' ConstraintDescription: Must be a valid S3 bucket name (lowercase, hyphens allowed) LogArchiveAccountId: Type: String Description: AWS Account ID of the Log Archive Account AllowedPattern: '^\d{12}$' ConstraintDescription: Must be a 12-digit AWS Account ID RoleName: Type: String Default: VPCFlowLogsAutomationRole Description: Name of the IAM Role for SSM Automation AllowedPattern: '^[\w+=,.@-]{1,64}$' ConstraintDescription: Must be a valid IAM role name Resources: # SSM Automation Execution Role VPCFlowLogsAutomationRole: Type: AWS::IAM::Role Properties: RoleName: !Ref RoleName Description: | IAM Role for Systems Manager Automation to enable and manage VPC Flow Logs. Provides least privilege permissions for VPC Flow Logs creation and S3 access. AssumeRolePolicyDocument: Version: '2012-10-17' Statement: # Allow SSM Automation service to assume this role - Effect: Allow Principal: Service: - ssm.amazonaws.com Action: - 'sts:AssumeRole' Condition: StringEquals: 'aws:SourceAccount': !Ref 'AWS::AccountId' ArnLike: 'aws:SourceArn': !Sub 'arn:${AWS::Partition}:ssm:*:${AWS::AccountId}:automation-execution/*' # Allow AWS Config service to assume this role for remediation - Effect: Allow Principal: Service: - config.amazonaws.com Action: - 'sts:AssumeRole' ManagedPolicyArns: [] Policies: - PolicyName: VPCFlowLogsManagement PolicyDocument: Version: '2012-10-17' Statement: # CloudWatch Logs permissions for Flow Logs delivery - Sid: CloudWatchLogsPermissions Effect: Allow Action: - 'logs:CreateLogDelivery' - 'logs:DeleteLogDelivery' - 'logs:CreateLogGroup' Resource: '*' # EC2 VPC Flow Logs Creation - Sid: VPCFlowLogsCreation Effect: Allow Action: - 'ec2:CreateFlowLogs' Resource: '*' # SSM Automation passrole permission - Sid: PassRoleForAutomation Effect: Allow Action: - 'iam:PassRole' Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${RoleName}' Condition: StringEquals: 'iam:PassedToService': - 'ec2.amazonaws.com' - 'logs.amazonaws.com' - 'vpc-flow-logs.amazonaws.com' Tags: - Key: Name Value: !Ref RoleName - Key: ManagedBy Value: CloudFormation-StackSets - Key: Purpose Value: VPCFlowLogsAutomation Outputs: AutomationRoleArn: Description: ARN of the SSM Automation execution role Value: !GetAtt VPCFlowLogsAutomationRole.Arn Export: Name: !Sub '${AWS::StackName}-AutomationRoleArn' AutomationRoleName: Description: Name of the SSM Automation execution role Value: !Ref VPCFlowLogsAutomationRole Export: Name: !Sub '${AWS::StackName}-AutomationRoleName' LogArchiveBucketName: Description: Centralized S3 bucket name for VPC Flow Logs Value: !Ref LogArchiveBucket Export: Name: !Sub '${AWS::StackName}-LogArchiveBucket' 

Resources: VpcFlowLogsEnabledRule: Type: AWS::Config::ConfigRule Properties: ConfigRuleName: vpc-flow-logs-enabled Description: | Checks whether Amazon VPC Flow Logs are found and enabled for all VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one VPC. # Scope: Apply to all VPCs Scope: ComplianceResourceTypes: - AWS::EC2::VPC # Input Parameters for the Rule InputParameters: trafficType: ALL # Rule Source: AWS Managed Rule Source: Owner: AWS SourceIdentifier: VPC_FLOW_LOGS_ENABLED # Evaluation Frequency MaximumExecutionFrequency: TwentyFour_Hours # Note: Remediation configuration is separate (see below) ############################################################################# # Automatic Remediation Configuration ############################################################################# VpcFlowLogsRemediation: Type: AWS::Config::RemediationConfiguration Properties: # Link to the Config Rule ConfigRuleName: vpc-flow-logs-enabled # Target SSM Automation Document - AWS Managed (no runtime management required) TargetType: SSM_DOCUMENT TargetId: AWS-EnableVPCFlowLogs TargetVersion: "1" # Resource Type ResourceType: AWS::EC2::VPC # Automatic Remediation Settings Automatic: true MaximumAutomaticAttempts: 5 RetryAttemptSeconds: 60 # IAM Role for SSM Automation Execution ExecutionControls: SsmControls: ConcurrentExecutionRatePercentage: 10 ErrorPercentage: 10 # Parameters passed to SSM Automation Parameters: # Automation Execution Role AutomationAssumeRole: StaticValue: Values: - arn:aws:iam::<AWSアカウントID>:role/VPCFlowLogsAutomationRole # VPC IDs from Config Rule evaluation VPCIds: ResourceValue: Value: RESOURCE_ID # S3 destination type LogDestinationType: StaticValue: Values: - s3 # S3 bucket ARN for centralized logging LogDestinationArn: StaticValue: Values: - arn:aws:s3:::<S3バケット名> # Traffic type to log TrafficType: StaticValue: Values: - ALL 

aws configservice put-organization-conformance-pack \ --organization-conformance-pack-name="EnableVPCFlowLogsConformancePack" \ --template-body="file://vpc-flowlogs-conformance-pack.yaml" 

$ aws configservice describe-organization-conformance-packs --organization-conformance-pack-name=EnableVPCFlowLogsConformancePack { "OrganizationConformancePacks": [ { "OrganizationConformancePackName": "EnableVPCFlowLogsConformancePack", "OrganizationConformancePackArn": "arn:aws:config:ap-northeast-1:<AWSアカウントID>:organization-conformance-pack/EnableVPCFlowLogsConformancePack-g5hniluq", "ConformancePackInputParameters": [], "ExcludedAccounts": [], "LastUpdateTime": "2025-12-11T04:33:20.268000+00:00" } ] } 

$ aws configservice describe-organization-conformance-pack-statuses --organization-conformance-pack-name=EnableVPCFlowLogsConformancePack { "OrganizationConformancePackStatuses": [ { "OrganizationConformancePackName": "EnableVPCFlowLogsConformancePack", "Status": "CREATE_IN_PROGRESS", "LastUpdateTime": "2025-12-11T04:37:31.152000+00:00" } ] } 

$ aws configservice get-organization-conformance-pack-detailed-status --organization-conformance-pack-name=EnableVPCFlowLogsConformancePack { "OrganizationConformancePackDetailedStatuses": [ { "AccountId": "111111111111", "ConformancePackName": "OrgConformsPack-EnableVPCFlowLogsConformancePack-g5hniluq", "Status": "CREATE_SUCCESSFUL", "LastUpdateTime": "2025-12-11T04:35:24.445000+00:00" }, { "AccountId": "222222222222", "ConformancePackName": "OrgConformsPack-EnableVPCFlowLogsConformancePack-g5hniluq", "Status": "CREATE_SUCCESSFUL", "LastUpdateTime": "2025-12-11T04:35:24.897000+00:00" } ] } 

sh-5.2$ curl https://classmethod.jp/ 

<S3バケット名>/AWSLogs/<AWSアカウントID>/vpcflowlogs/<リージョン>/YYYY/MM/DD/ファイル 

$ aws configservice delete-organization-conformance-pack --organization-conformance-pack-name "EnableVPCFlowLogsConformancePack"