三歩あるけば物も忘れる

管理アカウント/全てのメンバアカウント共通で実施する項目を記載します。

#強力なパスワードポリシーを設定する
aws iam update-account-password-policy \
  --minimum-password-length 14 \
  --require-symbols \
  --require-numbers \
  --require-uppercase-characters \
  --require-lowercase-characters \
  --allow-users-to-change-password \
  --max-password-age 90

#アカウントのS3パブリックアクセスを無効化する
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
JSON='{
    "BlockPublicAcls": true,
    "IgnorePublicAcls": true,
    "BlockPublicPolicy": true,
    "RestrictPublicBuckets": true
}'

aws s3control put-public-access-block --account-id ${ACCOUNT_ID} --public-access-block-configuration "${JSON}"

#全てのリージョンでEBSのデフォルト暗号化を有効にする
aws ec2 describe-regions --query "Regions[].[RegionName]" --output text \
| while read region; do
    echo "## ebs encryption in ${region}"
aws --region ${region} ec2 enable-ebs-encryption-by-default

done

#全てのリージョンでデフォルトVPCを削除する
aws ec2 describe-regions --query "Regions[].[RegionName]" --output text \
| while read region; do
  aws --region ${region} --output text \
    ec2 describe-vpcs --query "Vpcs[?IsDefault].[VpcId]" \
  | while read vpc; do
    echo "## deleting vpc: ${vpc} in ${region}"
   
    ### IGW
    aws --region ${region} --output text \
      ec2 describe-internet-gateways --filters Name=attachment.vpc-id,Values=${vpc} \
      --query "InternetGateways[].[InternetGatewayId]" \
    | while read igw; do
      echo "## deleting igw: ${igw} in ${vpc}, ${region}"
      echo "--> detatching"
      aws --region ${region} --output json \
        ec2 detach-internet-gateway --internet-gateway-id ${igw} --vpc-id ${vpc}
      echo "--> deleteing"
      aws --region ${region} --output json \
        ec2 delete-internet-gateway --internet-gateway-id ${igw}
    done
   
    ### Subnet
    aws --region ${region} --output text \
      ec2 describe-subnets  --filters Name=vpc-id,Values=${vpc} \
      --query "Subnets[].[SubnetId]" \
    | while read subnet; do
      echo "## deleting subnet: ${subnet} in ${vpc}, ${region}"
      aws --region ${region} --output json \
        ec2 delete-subnet --subnet-id ${subnet}
    done
   
    ### VPC
    echo "## finally, deleting vpc: ${vpc} in ${region}"
    aws --region ${region} --output json \
      ec2 delete-vpc --vpc-id ${vpc}  
  done
done