はじめに

aws iam create-policy \
  --policy-name CloudPeek \
  --policy-document file://cloudpeek-policy.json

aws iam create-user --user-name cloudpeek

aws iam attach-user-policy \
  --user-name cloudpeek \
  --policy-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):policy/CloudPeek"

aws iam create-access-key --user-name cloudpeek

Resources:
  # The CloudWatch actions CloudPeek reads with (ListMetrics finds your metrics for presets and AI widgets),
  # bedrock:InvokeModel for writing AI widgets in Amazon Bedrock, billed to the account, and
  # organizations:ListAccounts for the names of the accounts in charges per linked account (only an
  # organisation's management account can list them). The CloudWatch and Organizations actions
  # don't support resource-level permissions for this use, so the resource is "*". To allow only
  # CloudPeek's model in Bedrock, see https://cloudpeek.app/docs/ai-widgets.html#regions
  Policy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Ref PolicyName
      Description: Access for the CloudPeek app to CloudWatch dashboards, metric data and alarms, and to Amazon Bedrock for AI widgets.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: CloudPeek
            Effect: Allow
            Action:
              - cloudwatch:ListDashboards
              - cloudwatch:GetDashboard
              - cloudwatch:GetMetricData
              - cloudwatch:ListMetrics
              - cloudwatch:DescribeAlarms
              - bedrock:InvokeModel
              - organizations:ListAccounts
            Resource: "*"

  User:
    Type: AWS::IAM::User
    Condition: ShouldCreateUser
    Properties:
      UserName: !Ref UserName
      ManagedPolicyArns:
        - !Ref Policy

aws cloudformation deploy \
  --stack-name CloudPeek-Access \
  --template-file cloudpeek-access.yaml \
  --capabilities CAPABILITY_NAMED_IAM

aws iam create-access-key --user-name cloudpeek

# The CloudWatch actions CloudPeek reads with (ListMetrics finds your metrics for presets and AI widgets),
# bedrock:InvokeModel for writing AI widgets in Amazon Bedrock, billed to the account, and
# organizations:ListAccounts for the names of the accounts in charges per linked account (only an
# organisation's management account can list them). The CloudWatch and Organizations actions
# don't support resource-level permissions for this use, so the resource is "*". To allow only
# CloudPeek's model in Bedrock, see https://cloudpeek.app/docs/ai-widgets.html#regions
data "aws_iam_policy_document" "cloudpeek" {
  statement {
    sid    = "CloudPeek"
    effect = "Allow"
    actions = [
      "cloudwatch:ListDashboards",
      "cloudwatch:GetDashboard",
      "cloudwatch:GetMetricData",
      "cloudwatch:ListMetrics",
      "cloudwatch:DescribeAlarms",
      "bedrock:InvokeModel",
      "organizations:ListAccounts",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "cloudpeek" {
  name        = var.policy_name
  description = "Access for the CloudPeek app to CloudWatch dashboards, metric data and alarms, and to Amazon Bedrock for AI widgets."
  policy      = data.aws_iam_policy_document.cloudpeek.json
}

resource "aws_iam_user" "cloudpeek" {
  count = var.create_user ? 1 : 0
  name  = var.user_name
}

resource "aws_iam_user_policy_attachment" "cloudpeek" {
  count      = var.create_user ? 1 : 0
  user       = aws_iam_user.cloudpeek[0].name
  policy_arn = aws_iam_policy.cloudpeek.arn
}

terraform init
terraform apply

aws iam create-access-key --user-name cloudpeek

INSTANCE_ARN=$(aws sso-admin list-instances --query 'Instances[0].InstanceArn' --output text)
STORE_ID=$(aws sso-admin list-instances --query 'Instances[0].IdentityStoreId' --output text)

PERMISSION_SET_ARN=$(aws sso-admin create-permission-set \
  --instance-arn "$INSTANCE_ARN" \
  --name CloudPeek \
  --description "CloudWatch and Amazon Bedrock access for the CloudPeek app" \
  --query 'PermissionSet.PermissionSetArn' --output text)

aws sso-admin put-inline-policy-to-permission-set \
  --instance-arn "$INSTANCE_ARN" \
  --permission-set-arn "$PERMISSION_SET_ARN" \
  --inline-policy file://cloudpeek-policy.json

GROUP_ID=$(aws identitystore get-group-id \
  --identity-store-id "$STORE_ID" \
  --alternate-identifier '{"UniqueAttribute": {"AttributePath": "displayName", "AttributeValue": "Engineering"}}' \
  --query GroupId --output text)

aws sso-admin create-account-assignment \
  --instance-arn "$INSTANCE_ARN" \
  --permission-set-arn "$PERMISSION_SET_ARN" \
  --principal-type GROUP --principal-id "$GROUP_ID" \
  --target-type AWS_ACCOUNT --target-id 123456789012

AWSTemplateFormatVersion: "2010-09-09"
Description: A CloudPeek permission set, assigned to one group in one account.

Parameters:
  InstanceArn:
    Type: String
    Description: Your IAM Identity Center instance, such as arn:aws:sso:::instance/ssoins-1234567890abcdef
  GroupId:
    Type: String
    Description: The ID of the group whose members will use CloudPeek
  AccountId:
    Type: String
    Description: The AWS account with your dashboards

Resources:
  PermissionSet:
    Type: AWS::SSO::PermissionSet
    Properties:
      InstanceArn: !Ref InstanceArn
      Name: CloudPeek
      Description: CloudWatch and Amazon Bedrock access for the CloudPeek app
      InlinePolicy:
        Version: "2012-10-17"
        Statement:
          - Sid: CloudPeek
            Effect: Allow
            Action:
              - cloudwatch:ListDashboards
              - cloudwatch:GetDashboard
              - cloudwatch:GetMetricData
              - cloudwatch:ListMetrics
              - cloudwatch:DescribeAlarms
              - bedrock:InvokeModel
              - organizations:ListAccounts
            Resource: "*"

  Assignment:
    Type: AWS::SSO::Assignment
    Properties:
      InstanceArn: !Ref InstanceArn
      PermissionSetArn: !GetAtt PermissionSet.PermissionSetArn
      PrincipalType: GROUP
      PrincipalId: !Ref GroupId
      TargetType: AWS_ACCOUNT
      TargetId: !Ref AccountId

data "aws_ssoadmin_instances" "this" {}

locals {
  sso_instance_arn  = tolist(data.aws_ssoadmin_instances.this.arns)[0]
  identity_store_id = tolist(data.aws_ssoadmin_instances.this.identity_store_ids)[0]
}

resource "aws_ssoadmin_permission_set" "cloudpeek" {
  name         = "CloudPeek"
  description  = "CloudWatch and Amazon Bedrock access for the CloudPeek app"
  instance_arn = local.sso_instance_arn
}

resource "aws_ssoadmin_permission_set_inline_policy" "cloudpeek" {
  instance_arn       = local.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.cloudpeek.arn
  inline_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "CloudPeek"
      Effect = "Allow"
      Action = [
        "cloudwatch:ListDashboards",
        "cloudwatch:GetDashboard",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "cloudwatch:DescribeAlarms",
        "bedrock:InvokeModel",
        "organizations:ListAccounts",
      ]
      Resource = "*"
    }]
  })
}

# The group whose members will use CloudPeek.
data "aws_identitystore_group" "engineering" {
  identity_store_id = local.identity_store_id

  alternate_identifier {
    unique_attribute {
      attribute_path  = "DisplayName"
      attribute_value = "Engineering"
    }
  }
}

resource "aws_ssoadmin_account_assignment" "cloudpeek" {
  instance_arn       = local.sso_instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.cloudpeek.arn
  principal_type     = "GROUP"
  principal_id       = data.aws_identitystore_group.engineering.group_id
  target_type        = "AWS_ACCOUNT"
  target_id          = "123456789012" # the account with your dashboards
}