🔐 SAML証明書ローテーション完全ガイド

# AWS CLI でメタデータを更新する
aws iam update-saml-provider \
    --saml-provider-arn "arn:aws:iam::123456789012:saml-provider/MyIdP" \
    --saml-metadata-document file://new-metadata.xml

# メタデータの内容を確認する
aws iam get-saml-provider \
    --saml-provider-arn "arn:aws:iam::123456789012:saml-provider/MyIdP"

# CloudFormation での定義例
Resources:
  MySAMLProvider:
    Type: AWS::IAM::SAMLProvider
    Properties:
      Name: MyIdP
      SamlMetadataDocument: |
        
        
          
        

import boto3
import xml.etree.ElementTree as ET
from datetime import datetime, timedelta
from cryptography import x509

def check_saml_certificate_expiry(event, context):
    iam = boto3.client('iam')
    sns = boto3.client('sns')
    
    # IAM IDプロバイダーの一覧を取得
    providers = iam.list_saml_providers()['SAMLProviderList']
    
    for provider in providers:
        arn = provider['Arn']
        metadata = iam.get_saml_provider(SAMLProviderArn=arn)
        
        # メタデータから証明書を抽出
        root = ET.fromstring(metadata['SAMLMetadataDocument'])
        certs = root.findall('.//{http://www.w3.org/2000/09/xmldsig#}X509Certificate')
        
        for cert_elem in certs:
            cert_data = cert_elem.text
            cert = x509.load_pem_x509_certificate(
                f"-----BEGIN CERTIFICATE-----\n{cert_data}\n-----END CERTIFICATE-----".encode()
            )
            
            # 有効期限を確認（60日前にアラート）
            days_until_expiry = (cert.not_valid_after - datetime.utcnow()).days
            
            if days_until_expiry < 60:
                sns.publish(
                    TopicArn='arn:aws:sns:ap-northeast-1:123456789012:alerts',
                    Subject=f'⚠️ SAML証明書が{days_until_expiry}日後に期限切れ',
                    Message=f'Provider: {arn}\n期限: {cert.not_valid_after}'
                )