CloudFormationテンプレート(JSON) - AWS Config 設定

#1. 概要
* CloudFormation で AWS Config を設定する。
* 作成するリソース
 * S3 Bucket + Bucket Policy
 * SNS Topic + Subscription
 * IAM Role + Inline Policy
 * ConfigurationRecorder
 * DeliveryChannel
* 参考<br />
https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml

#2. 各リソースメモ
* S3 Bucket
 * バッケット名：awsconfig-AWSアカウントID
 * 参考<br />
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html<br />
https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/s3-bucket-policy.html
* SNS Topic + Subscription
 * トピック名：awsconfig
 * プロトコル：email
 * エンドポイント：test@example.com
 * 参考<br />
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html<br />
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-sns-subscription.html
* IAM Role + Inline Policy
 * ロール名：awsconfig
 * インラインポリシー名:awsconfig
 * 参考<br />
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html<br />
https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/iamrole-permissions.html<br />
https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/sns-topic-policy.html<br />
* ConfigurationRecorder
 * 名前：awsconfig-AWSアカウントID
* DeliveryChannel
  * 名前：awsconfig-AWSアカウントID

#3. JSONテンプレート
```AWSConfig.json

{
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Description" : "AWS Config",
    "Resources" : {
        "S3Bucket" : {
            "Type" : "AWS::S3::Bucket",
            "Properties" : {
                "BucketName" : { "Fn::Join" : [ "", [ "awsconfig-", { "Ref" : "AWS::AccountId" } ] ] }
            }
        },
        "S3BucketPolicy" : {
            "Type" : "AWS::S3::BucketPolicy",
            "Properties" : {
                "Bucket" : { "Ref": "S3Bucket"},
                "PolicyDocument" : {
                    "Version" : "2012-10-17",
                    "Statement" : [
                        {
                            "Sid" : "AWSConfigBucketPermissionsCheck",
                            "Effect" : "Allow",
                            "Principal" : {
                                "Service" : [
                                    "config.amazonaws.com"
                                ]
                            },
                            "Action" : "s3:GetBucketAcl",
                            "Resource" : { "Fn::Join" : [ "", [ "arn:aws:s3:::awsconfig-", { "Ref" : "AWS::AccountId" } ] ] }
                        },
                        {
                            "Sid" : " AWSConfigBucketDelivery",
                            "Effect" : "Allow",
                            "Principal" : {
                                "Service" : [
                                    "config.amazonaws.com"
                                ]
                            },
                            "Action" : "s3:PutObject",
                            "Resource" : { "Fn::Join" : [ "", [ "arn:aws:s3:::awsconfig-", { "Ref" : "AWS::AccountId" }, "/AWSLogs/", { "Ref" : "AWS::AccountId" }, "/Config/*" ] ] },
                            "Condition" : {
                                "StringEquals" : {
                                    "s3:x-amz-acl" : "bucket-owner-full-control"
                                }
                            }
                        }
                    ]
                }
            }
        },
        "SNSTopic" : {
            "Type" : "AWS::SNS::Topic",
            "Properties" : {
                "DisplayName" : "AWS Config Notification Topic",
                "TopicName" : "awsconfig"
            }
        },
        "SNSSubscription" : {
            "Type" : "AWS::SNS::Subscription",
            "Properties" : {
                "Endpoint" : "test@example.com",
                "Protocol" : "email",
                "TopicArn" : { "Ref" : "SNSTopic"}
            }
        },
        "IAMRole" : {
            "Type" : "AWS::IAM::Role",
            "Properties" : {
                "AssumeRolePolicyDocument" : {
                    "Version" : "2012-10-17",
                    "Statement" : [
                        {
                            "Sid" : "",
                            "Effect" : "Allow",
                            "Principal" : {
                                "Service" : "config.amazonaws.com"
                            },
                            "Action" : "sts:AssumeRole"
                        }
                    ]
                },
                "ManagedPolicyArns" : [ "arn:aws:iam::aws:policy/service-role/AWSConfigRole" ],
                "Path" : "/",
                "Policies" : [
                    {
                        "PolicyName" : "awsconfig",
                        "PolicyDocument" : {
                            "Version" : "2012-10-17",
                            "Statement" : [
                                {
                                    "Effect" : "Allow",
                                    "Action" : [
                                        "s3:PutObject*"
                                    ],
                                    "Resource" : { "Fn::Join" : [ "", [ "arn:aws:s3:::awsconfig-", { "Ref" : "AWS::AccountId" }, "/AWSLogs/", { "Ref" : "AWS::AccountId" }, "/*" ] ] },
                                    "Condition" : {
                                        "StringLike" : {
                                            "s3:x-amz-acl" : "bucket-owner-full-control"
                                        }
                                    }
                                },
                                {
                                    "Effect" : "Allow",
                                    "Action" : [ "s3:GetBucketAcl" ],
                                    "Resource" : { "Fn::Join" : [ "", [ "arn:aws:s3:::awsconfig-", { "Ref" : "AWS::AccountId" } ] ] }
                                },
                                {
                                    "Effect" : "Allow",
                                    "Action" : "sns:Publish",
                                    "Resource" : "arn:aws:sns:ap-northeast-1:777813037810:awsconfig",
                                    "Resource" : { "Fn::Join" : [ "", [ "arn:aws:sns:ap-northeast-1:", { "Ref" : "AWS::AccountId" }, ":", { "Fn::GetAtt" : [ "SNSTopic", "TopicName" ] } ] ] }
                                }
                            ]
                        }
                    }
                ],
                "RoleName" : "awsconfig"
            }
        },
        "ConfigConfigurationRecorder" : {
            "Type" : "AWS::Config::ConfigurationRecorder",
            "DependsOn" : [ "S3Bucket", "SNSTopic" ],
            "Properties" : {
                "Name" : { "Fn::Join" : [ "", [ "awsconfig-", { "Ref" : "AWS::AccountId" } ] ] },
                "RecordingGroup" : {
                    "AllSupported" : true,
                    "ResourceTypes" : [],
                    "IncludeGlobalResourceTypes" : true
                },
                "RoleARN" : { "Fn::GetAtt" : [ "IAMRole", "Arn" ] }
            }
        },
        "ConfigDeliveryChannel" : {
            "Type" : "AWS::Config::DeliveryChannel",
            "DependsOn" : [ "S3Bucket", "SNSTopic" ],
            "Properties" : {
                "Name" : { "Fn::Join" : [ "", [ "awsconfig-", { "Ref" : "AWS::AccountId" } ] ] },
                "S3BucketName" : { "Ref" : "S3Bucket" },
                "SnsTopicARN" : { "Ref" : "SNSTopic" }
          }
        }
    },
    "Outputs" : {
        "S3Bucket" : {
            "Description" : "S3 Bucket Name",
            "Value" : { "Ref" : S3Bucket }
        },
        "SNSTopic" : {
            "Description" : "SNS Topic Name",
            "Value" : { "Fn::GetAtt" : [ "SNSTopic", "TopicName" ] }
        },
        "IAMRole" : {
            "Description" : "IAM Role Name",
            "Value" : { "Ref" : IAMRole }
        },
        "ConfigConfigurationRecorder" : {
            "Description" : "Config ConfigurationRecorder Name",
            "Value" : { "Ref" : ConfigConfigurationRecorder }
        },
        "ConfigDeliveryChannel" : {
            "Description" : "Config DeliveryChannel Name",
            "Value" : { "Ref" : ConfigDeliveryChannel }
        }
    }
}

```