🔐 IAM Roles Anywhere

# ========================================
# STEP 1: Private CAの作成
# ========================================

# 1-1. Private CAを作成
aws acm-pca create-certificate-authority \
  --certificate-authority-configuration '{
    "KeyAlgorithm": "RSA_2048",
    "SigningAlgorithm": "SHA256WITHRSA",
    "Subject": {
      "Country": "JP",
      "Organization": "MyCompany",
      "OrganizationalUnit": "IT",
      "State": "Tokyo",
      "CommonName": "MyCompany Root CA"
    }
  }' \
  --certificate-authority-type "ROOT" \
  --idempotency-token "12345"

# 出力されたCA ARNを保存
export CA_ARN="arn:aws:acm-pca:ap-northeast-1:123456789012:certificate-authority/xxxxx"

# 1-2. CA証明書を取得（自己署名）
aws acm-pca get-certificate-authority-csr \
  --certificate-authority-arn $CA_ARN \
  --output text > ca.csr

# 1-3. CA証明書を発行（自己署名ルートCA）
aws acm-pca issue-certificate \
  --certificate-authority-arn $CA_ARN \
  --csr fileb://ca.csr \
  --signing-algorithm "SHA256WITHRSA" \
  --template-arn arn:aws:acm-pca:::template/RootCACertificate/V1 \
  --validity Value=10,Type="YEARS"

# 証明書ARNを保存
export CERT_ARN="arn:aws:acm-pca:ap-northeast-1:123456789012:certificate-authority/xxxxx/certificate/yyyyy"

# 1-4. CA証明書を取得
aws acm-pca get-certificate \
  --certificate-authority-arn $CA_ARN \
  --certificate-arn $CERT_ARN \
  --output text > ca-certificate.pem

# 1-5. CAをインポートして有効化
aws acm-pca import-certificate-authority-certificate \
  --certificate-authority-arn $CA_ARN \
  --certificate fileb://ca-certificate.pem

# ========================================
# STEP 2: Trust Anchorの作成
# ========================================

# Private CAをソースとしてTrust Anchorを作成
aws rolesanywhere create-trust-anchor \
  --name "MyCompany-Private-CA-Trust" \
  --source '{
    "sourceType": "AWS_ACM_PCA",
    "sourceData": {
      "acmPcaArn": "'$CA_ARN'"
    }
  }' \
  --enabled

# Trust Anchor ARNを保存
export TRUST_ANCHOR_ARN="arn:aws:rolesanywhere:ap-northeast-1:123456789012:trust-anchor/zzzzz"

# ========================================
# STEP 3: IAMロールの作成
# ========================================

# 3-1. 信頼ポリシーを作成
cat > trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "rolesanywhere.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession",
        "sts:SetSourceIdentity"
      ]
    }
  ]
}
EOF

# 3-2. IAMロールを作成
aws iam create-role \
  --role-name RolesAnywhereS3Access \
  --assume-role-policy-document file://trust-policy.json

# 3-3. 権限ポリシーをアタッチ（例: S3読み取り専用）
aws iam attach-role-policy \
  --role-name RolesAnywhereS3Access \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Role ARNを保存
export ROLE_ARN="arn:aws:iam::123456789012:role/RolesAnywhereS3Access"

# ========================================
# STEP 4: Profileの作成
# ========================================

aws rolesanywhere create-profile \
  --name "OnPremise-S3-Access-Profile" \
  --role-arns "$ROLE_ARN" \
  --duration-seconds 3600 \
  --enabled

# Profile ARNを保存
export PROFILE_ARN="arn:aws:rolesanywhere:ap-northeast-1:123456789012:profile/aaaaa"

# ========================================
# STEP 5: 証明書の発行（クライアント用）
# ========================================

# 5-1. 秘密鍵を生成
openssl genrsa -out client-private-key.pem 2048

# 5-2. CSR（証明書署名要求）を作成
openssl req -new -key client-private-key.pem -out client.csr \
  -subj "/C=JP/ST=Tokyo/O=MyCompany/OU=IT/CN=onpremise-server-01"

# 5-3. Private CAで証明書を発行
aws acm-pca issue-certificate \
  --certificate-authority-arn $CA_ARN \
  --csr fileb://client.csr \
  --signing-algorithm "SHA256WITHRSA" \
  --validity Value=365,Type="DAYS" \
  --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1

# 証明書ARNを保存
export CLIENT_CERT_ARN="arn:aws:acm-pca:ap-northeast-1:123456789012:certificate-authority/xxxxx/certificate/bbbbb"

# 5-4. 発行された証明書を取得
aws acm-pca get-certificate \
  --certificate-authority-arn $CA_ARN \
  --certificate-arn $CLIENT_CERT_ARN \
  --output text > client-certificate.pem

# ========================================
# STEP 6: クライアント設定
# ========================================

# 6-1. aws_signing_helperをダウンロード
wget https://rolesanywhere.amazonaws.com/releases/1.0.5/X86_64/Linux/aws_signing_helper
chmod +x aws_signing_helper
sudo mv aws_signing_helper /usr/local/bin/

# 6-2. 証明書と秘密鍵を安全な場所に配置
sudo mkdir -p /etc/aws-rolesanywhere/
sudo mv client-certificate.pem /etc/aws-rolesanywhere/
sudo mv client-private-key.pem /etc/aws-rolesanywhere/
sudo chmod 600 /etc/aws-rolesanywhere/client-private-key.pem

# 6-3. AWS CLIの設定（~/.aws/config）
cat >> ~/.aws/config << EOF

[profile onpremise]
credential_process = /usr/local/bin/aws_signing_helper credential-process \
  --certificate /etc/aws-rolesanywhere/client-certificate.pem \
  --private-key /etc/aws-rolesanywhere/client-private-key.pem \
  --trust-anchor-arn $TRUST_ANCHOR_ARN \
  --profile-arn $PROFILE_ARN \
  --role-arn $ROLE_ARN
EOF

# ========================================
# STEP 7: テスト
# ========================================

# S3バケットのリストを取得
aws s3 ls --profile onpremise

# 特定のバケットの内容を確認
aws s3 ls s3://my-bucket/ --profile onpremise

# CloudTrailでアクセスログを確認
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=onpremise-server-01 \
  --max-results 10

# ========================================
# オプション: 証明書の失効
# ========================================

# 証明書を失効させる（緊急時）
aws acm-pca revoke-certificate \
  --certificate-authority-arn $CA_ARN \
  --certificate-serial "証明書のシリアル番号" \
  --revocation-reason "KEY_COMPROMISE"

#!/bin/bash
# 新しいサーバー用の証明書を自動発行するスクリプト

set -e

# パラメータ
SERVER_NAME="$1"
CA_ARN="$2"

if [ -z "$SERVER_NAME" ] || [ -z "$CA_ARN" ]; then
  echo "Usage: $0  "
  exit 1
fi

echo "🔐 Generating certificate for: $SERVER_NAME"

# 1. 秘密鍵生成
echo "📝 Step 1: Generating private key..."
openssl genrsa -out "${SERVER_NAME}-key.pem" 2048

# 2. CSR作成
echo "📝 Step 2: Creating CSR..."
openssl req -new \
  -key "${SERVER_NAME}-key.pem" \
  -out "${SERVER_NAME}.csr" \
  -subj "/C=JP/ST=Tokyo/O=MyCompany/OU=IT/CN=${SERVER_NAME}"

# 3. 証明書発行
echo "📝 Step 3: Issuing certificate from Private CA..."
CERT_ARN=$(aws acm-pca issue-certificate \
  --certificate-authority-arn "$CA_ARN" \
  --csr fileb://"${SERVER_NAME}.csr" \
  --signing-algorithm "SHA256WITHRSA" \
  --validity Value=365,Type="DAYS" \
  --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1 \
  --query "CertificateArn" \
  --output text)

echo "⏳ Waiting for certificate issuance..."
sleep 3

# 4. 証明書取得
echo "📝 Step 4: Retrieving certificate..."
aws acm-pca get-certificate \
  --certificate-authority-arn "$CA_ARN" \
  --certificate-arn "$CERT_ARN" \
  --output text > "${SERVER_NAME}-cert.pem"

# 5. 証明書情報表示
echo "✅ Certificate issued successfully!"
echo "📄 Certificate: ${SERVER_NAME}-cert.pem"
echo "🔑 Private Key: ${SERVER_NAME}-key.pem"
echo ""
echo "📊 Certificate Details:"
openssl x509 -in "${SERVER_NAME}-cert.pem" -noout -subject -dates

# 6. セキュリティ推奨
echo ""
echo "🔒 Security Recommendations:"
echo "  1. Store private key in a secure location"
echo "  2. Set appropriate file permissions (600)"
echo "  3. Never commit to version control"
echo "  4. Rotate certificate before expiration"

# CSRを削除（不要）
rm "${SERVER_NAME}.csr"