{"id":19837,"date":"2021-07-08T15:15:37","date_gmt":"2021-07-08T06:15:37","guid":{"rendered":"https:\/\/www.skyarch.net\/blog\/?p=19837"},"modified":"2021-07-08T15:15:37","modified_gmt":"2021-07-08T06:15:37","slug":"ssm-session-manager%e3%81%ae%e8%a8%ad%e5%ae%9a%e3%83%ad%e3%82%ae%e3%83%b3%e3%82%b0%e3%81%aa%e3%81%a9%e3%82%92cloudformation%e3%81%a7%e8%a1%8c%e3%81%86","status":"publish","type":"post","link":"https:\/\/www.skyarch.net\/blog\/ssm-session-manager%e3%81%ae%e8%a8%ad%e5%ae%9a%e3%83%ad%e3%82%ae%e3%83%b3%e3%82%b0%e3%81%aa%e3%81%a9%e3%82%92cloudformation%e3%81%a7%e8%a1%8c%e3%81%86\/","title":{"rendered":"SSM Session Manager\u306e\u8a2d\u5b9a(\u30ed\u30ae\u30f3\u30b0\u306a\u3069)\u3092CloudFormation\u3067\u884c\u3046"},"content":{"rendered":"

\u6982\u8981<\/h2>\n

\u4ee5\u4e0b\u306e\u3088\u3046\u306aSession Manager\u306e\u8a2d\u5b9a\u3092CloudFormation\u3067\u884c\u3044\u307e\u3059\u3002
\n\u307e\u305f\u3001\u305d\u3082\u305d\u3082\u3069\u3046\u3084\u3063\u3066Session Manager\u306e\u8a2d\u5b9a\u3092API\u3067\u884c\u3046\u306e\uff1f\u3068\u3044\u3063\u305f\u70b9\u3082\u8aac\u660e\u3057\u307e\u3059\u3002
\n\"\"<\/a><\/p>\n

\u7d50\u8ad6\u306eCloudFormation\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8<\/h2>\n

\u4ee5\u4e0b\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3067Session Manager\u306e\u8a2d\u5b9a\u304c\u53ef\u80fd\u3067\u3059\u3002
\ncloudWatchLogGroupName<\/strong>\u306a\u3069\u306e\u9805\u76ee\u3092\u66f8\u304d\u63db\u3048\u3066\u5229\u7528\u3057\u307e\u3059\u3002
\nCloudFormation\u30b9\u30bf\u30c3\u30af\u3092\u66f4\u65b0\u3059\u308b\u3053\u3068\u3067Session Manager\u306e\u8a2d\u5b9a\u3082\u66f4\u65b0\u3067\u304d\u307e\u3059\u304c\u3001\u30b9\u30bf\u30c3\u30af\u3092\u524a\u9664\u3057\u305f\u6642\u306f\u4f55\u3082\u8d77\u3053\u308a\u307e\u305b\u3093\u3002(\u8a2d\u5b9a\u304c\u521d\u671f\u5024\u306b\u623b\u308b\u3001\u3068\u304b\u3082\u7121\u3044)<\/p>\n

\nAWSTemplateFormatVersion: \"2010-09-09\"\n\nResources:\n  SsmDocument:\n    Type: Custom::SsmDocument\n    Properties:\n      ServiceToken: !GetAtt Function.Arn\n      DocumentName: SSM-SessionManagerRunShell\n      DocumentType: Session\n      DocumentFormat: YAML\n      DocumentContent: |\n        schemaVersion: '1.0'\n        inputs:\n          cloudWatchEncryptionEnabled: false\n          s3EncryptionEnabled: false\n          runAsDefaultUser: ''\n          s3BucketName: ''\n          cloudWatchStreamingEnabled: true\n          kmsKeyId: ''\n          runAsEnabled: false\n          idleSessionTimeout: '15'\n          s3KeyPrefix: ''\n          shellProfile:\n            linux: ''\n            windows: ''\n          cloudWatchLogGroupName: \"\/aws\/ssm\/sessionlog\"\n        description: Document to hold regional settings for Session Manager\n        sessionType: Standard_Stream\n\n  Function:\n    Type: AWS::Lambda::Function\n    Properties:\n      Code:\n        ZipFile: |\n          import boto3\n          import cfnresponse\n          from botocore.exceptions import ClientError\n\n          ssm = boto3.client('ssm')\n\n          def lambda_handler(event, context):\n              try:\n                  document_params = {\n                      'Name': event['ResourceProperties']['DocumentName'],\n                      'Type': event['ResourceProperties']['DocumentType'],\n                      'Format': event['ResourceProperties']['DocumentFormat'],\n                      'Content': event['ResourceProperties']['DocumentContent'],\n                  }\n                  if event['RequestType'] in ['Create', 'Update']:\n                      if document_exists(document_params):\n                          update_document(document_params)\n                      else:\n                          create_document(document_params)\n                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {})\n              except:\n                  cfnresponse.send(event, context, cfnresponse.FAILED, {})\n\n          def document_exists(document_params:dict) -> bool:\n              document_identifiers = ssm.list_documents(\n                  Filters=[\n                      {\n                          'Key': 'Name',\n                          'Values': [\n                              document_params['Name'],\n                          ]\n                      },\n                      {\n                          'Key': 'Owner',\n                          'Values': [\n                              'Self',\n                          ]\n                      },\n                      {\n                          'Key': 'DocumentType',\n                          'Values': [\n                              document_params['Type'],\n                          ]\n                      },\n                  ],\n              )['DocumentIdentifiers']\n              if len(document_identifiers) == 1:\n                  return True\n              else:\n                  return False\n\n          def create_document(document_params:dict) -> None:\n              response = ssm.create_document(\n                  Content=document_params['Content'],\n                  Name=document_params['Name'],\n                  DocumentType=document_params['Type'],\n                  DocumentFormat=document_params['Format'],\n              )\n              print(response)\n\n          def update_document(document_params:dict) -> None:\n              try:\n                  updated_version = ssm.update_document(\n                      Content=document_params['Content'],\n                      Name=document_params['Name'],\n                      DocumentFormat=document_params['Format'],\n                      DocumentVersion='$LATEST',\n                  )['DocumentDescription']['DocumentVersion']\n              except ClientError as e:\n                  if e.response['Error']['Code'] == 'DuplicateDocumentContent':\n                      print('no update to the SSM document')\n                      return None\n              response = ssm.update_document_default_version(\n                  Name=document_params['Name'],\n                  DocumentVersion=updated_version\n              )\n              print(response)\n      Handler: index.lambda_handler\n      MemorySize: 128\n      Role: !GetAtt FunctionRole.Arn\n      Runtime: python3.7\n      Timeout: 120\n\n  FunctionRole:\n    Type: AWS::IAM::Role\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n        - Effect: Allow\n          Principal:\n            Service:\n            - lambda.amazonaws.com\n          Action:\n          - sts:AssumeRole\n      ManagedPolicyArns:\n        - arn:aws:iam::aws:policy\/service-role\/AWSLambdaBasicExecutionRole\n      Policies:\n        - PolicyName: delete-document\n          PolicyDocument:\n            Version: \"2012-10-17\"\n            Statement:\n              - Effect: Allow\n                Action:\n                   - ssm:ListDocuments\n                   - ssm:UpdateDocument\n                   - ssm:CreateDocument\n                   - ssm:UpdateDocumentDefaultVersion\n                Resource:\n                  - \"*\"\n<\/pre>\n
CloudFormation\u7d4c\u7531\u3067\u884c\u3046\u65b9\u6cd5\u3092\u6a21\u7d22<\/h2>\n
\u307e\u305aCloudFormation\u3067\u8a2d\u5b9a\u3092\u884c\u304a\u3046\u3068\u3057\u305f\u5834\u5408\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u898b\u3066\u3082\u305d\u308c\u3089\u3057\u304d\u30ea\u30bd\u30fc\u30b9\u304c\u898b\u5f53\u305f\u308a\u307e\u305b\u3093\u3002
\n\"\"<\/a><\/p>\n
\u305d\u3053\u3067\u30ab\u30b9\u30bf\u30e0\u30ea\u30bd\u30fc\u30b9\u3092\u8996\u91ce\u306b\u5165\u308c\u3066API\u7d4c\u7531\u3067\u8a2d\u5b9a\u3092\u884c\u3046\u65b9\u6cd5\u304c\u7121\u3044\u304b\u63a2\u3057\u3066\u307f\u308b\u3068\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u306b\u4ee5\u4e0b\u304c\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n
\n  \u30a2\u30ab\u30a6\u30f3\u30c8\u306b Session Manager \u3092\u8a2d\u5b9a\u3059\u308b\u3068\u3001Session \u30bf\u30a4\u30d7\u306e SSM \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8 SSM-SessionManagerRunShell \u304c\u4f5c\u6210\u3055\u308c\u307e\u3059\u3002
\n  \u3053\u306e SSM \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u306f\u3001\uff5e\u3059\u308b\u304b\u3069\u3046\u304b\u306a\u3069\u3001\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u8a2d\u5b9a\u304c\u4fdd\u5b58\u3055\u308c\u307e\u3059\u3002\n<\/p><\/blockquote>\n
\u3064\u307e\u308aSession Manager\u306e\u8a2d\u5b9a\u3092\u884c\u3046\u305f\u3081\u306b\u306fSSM-SessionManagerRunShell<\/strong>\u3068\u3044\u3046\u540d\u524d\u3067SSM\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3059\u308c\u3070\u3088\u3044\u3001\u3068\u3044\u3046\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n
CloudFormation\u3067AWS::SSM::Document\u30ea\u30bd\u30fc\u30b9\u3092\u4f5c\u6210\u3057\u3066\u307f\u308b<\/h3>\n
\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u3001AWS::SSM::Document<\/strong>\u3092\u5229\u7528\u3057\u3066SSM\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3059\u308b\u306e\u304c\u30b7\u30f3\u30d7\u30eb\u3067\u826f\u3044\u3068\u601d\u3063\u3066\u3044\u307e\u3057\u305f\u3002
\n\u5b9f\u969b\u3001CloudFormation\u30b9\u30bf\u30c3\u30af\u306e\u4f5c\u6210\uff1dSSM\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u4f5c\u6210\uff1dSession Manager\u306e\u521d\u56de\u8a2d\u5b9a\u307e\u3067\u306f\u3046\u307e\u304f\u3044\u304d\u307e\u3057\u305f\u3002<\/p>\n
\nAWSTemplateFormatVersion: \"2010-09-09\"\n\nResources:\n  SsmDocument:\n    Type: AWS::SSM::Document\n    Properties:\n      Name: SSM-SessionManagerRunShell\n      DocumentType: Session\n      Content:\n        schemaVersion: '1.0'\n        description: Document to hold regional settings for Session Manager\n        sessionType: Standard_Stream\n        inputs:\n          s3BucketName: ''\n          s3KeyPrefix: ''\n          s3EncryptionEnabled: false\n          cloudWatchLogGroupName: '\/aws\/ssm\/sessionlog'\n          cloudWatchEncryptionEnabled: false\n          idleSessionTimeout: '20'\n          cloudWatchStreamingEnabled: true\n          kmsKeyId: ''\n          runAsEnabled: false\n          runAsDefaultUser: ''\n          shellProfile:\n            windows: ''\n            linux: ''\n<\/pre>\n
\u305f\u3060\u3057\u3001Session Manager\u306e\u8a2d\u5b9a(cloudWatchLogGroupName\u306a\u3069)\u3092\u66f8\u304d\u63db\u3048\u3066\u30b9\u30bf\u30c3\u30af\u3092\u66f4\u65b0\u3059\u308b\u3068\u4ee5\u4e0b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3059\u3002<\/p>\n
\n  CloudFormation cannot update a stack when a custom-named resource requires replacing. Rename SSM-SessionManagerRunShell and update the stack again.\n<\/p><\/blockquote>\n
\u3053\u308c\u81ea\u4f53\u306f\u3088\u304f\u77e5\u3089\u308c\u305f(\uff1f)\u30a8\u30e9\u30fc\u3067\u3001\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306b\u3042\u308b\u901a\u308a SSM-SessionManagerRunShell \u3068\u3044\u3046\u540d\u524d\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u3067\u89e3\u6d88\u3055\u308c\u307e\u3059\u3002
\n\u305f\u3060\u3057\u300cSession Manager\u306e\u8a2d\u5b9a\u306f SSM-SessionManagerRunShell \u3068\u3044\u3046\u540d\u524d\u306eSSM\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u4fdd\u5b58\u3055\u308c\u308b\u300d\u3068\u3044\u3046\u4ed5\u69d8\u4e0a\u3001\u4eca\u56de\u306e\u5834\u5408\u306f\u540d\u524d\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u306f\u51fa\u6765\u307e\u305b\u3093\u3002
\n(\u5909\u66f4\u3059\u308b\u3068Session Manager\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3068\u3057\u3066\u306f\u5229\u304b\u306a\u304f\u306a\u3063\u3066\u3057\u307e\u3046)<\/p>\n
CloudFormation\u30ab\u30b9\u30bf\u30e0\u30ea\u30bd\u30fc\u30b9\u3067SSM\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3057\u3066\u307f\u308b<\/h3>\n
\u3068\u3044\u3046\u3053\u3068\u3067\u3001\u6700\u7d42\u7684\u306b\u3053\u306e\u5f62\u306b\u843d\u3061\u7740\u304d\u307e\u3057\u305f\u3002
\n\u30ab\u30b9\u30bf\u30e0\u30ea\u30bd\u30fc\u30b9(Lambda)\u306e\u51e6\u7406\u306e\u4e2d\u3067\u7279\u7b46\u3059\u3079\u304d\u70b9\u306f\u3001\u65e2\u306b\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u306e update_document \u3092\u5b9f\u884c\u3059\u308b\u90e8\u5206\u3067\u3059\u3002
\nupdate_document \u5b9f\u65bd\u5f8c\u306b update_document_default_version \u3092\u5b9f\u65bd\u3059\u308b\u3053\u3068\u3067\u6700\u65b0\u306e\u8a2d\u5b9a\u5185\u5bb9\u3092\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30d0\u30fc\u30b8\u30e7\u30f3\u3068\u3057\u3066\u767b\u9332\u3057\u307e\u3059\u3002<\/p>\n
\ndef update_document(document_params:dict) -> None:\n    try:\n        updated_version = ssm.update_document(\n            Content=document_params['Content'],\n            Name=document_params['Name'],\n            DocumentFormat=document_params['Format'],\n            DocumentVersion='$LATEST',\n        )['DocumentDescription']['DocumentVersion']\n    except ClientError as e:\n        if e.response['Error']['Code'] == 'DuplicateDocumentContent':\n            print('no update to the SSM document')\n            return None\n    response = ssm.update_document_default_version(\n        Name=document_params['Name'],\n        DocumentVersion=updated_version\n    )\n    print(response)\n<\/pre>\n
\u307b\u304b\u3001\u5468\u8fba\u77e5\u8b58<\/h2>\n
\u4eca\u56de\u8a2d\u5b9a\u3057\u305f\u306e\u306f\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u5229\u7528\u3057\u306a\u3044\u5834\u5408\u306e<\/strong>Session Manager\u306e\u8a2d\u5b9a\u3067\u3059\u3002<\/p>\n
Session Manager \u8a2d\u5b9a\u3092\u4f5c\u6210\u3059\u308b (\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3)<\/a><\/p>\n
\n  \u3053\u306e\u624b\u9806\u3092\u4f7f\u7528\u3057\u3066\u3001\u30a2\u30ab\u30a6\u30f3\u30c8\u30ec\u30d9\u30eb\u306e\u8a2d\u5b9a\u3092\u4e0a\u66f8\u304d\u3059\u308b Session Manager \u306e\u8a73\u7d30\u8a2d\u5b9a\u306e\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3067\u304d\u307e\u3059\u3002\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f5c\u6210\u3059\u308b\u3068\u304d\u306f\u3001name \u30d1\u30e9\u30e1\u30fc\u30bf\u306b SSM-SessionManagerRunShell \u4ee5\u5916\u306e\u5024\u3092\u6307\u5b9a\u3057\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066\u5165\u529b\u3092\u5909\u66f4\u3057\u307e\u3059\u3002\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3059\u308b\u306b\u306f\u3001AWS Command Line Interface (AWS CLI) \u304b\u3089\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u958b\u59cb\u3059\u308b\u3068\u304d\u306b\u3001--document-name \u30d1\u30e9\u30e1\u30fc\u30bf\u306b\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u540d\u524d\u3092\u6307\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u30b3\u30f3\u30bd\u30fc\u30eb\u304b\u3089\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u958b\u59cb\u3059\u308b\u5834\u5408\u3001\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u6307\u5b9a\u3059\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002<\/strong>\n<\/p><\/blockquote>\n
\u3064\u307e\u308a\u3001AWS\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b3\u30f3\u30bd\u30fc\u30eb\u304b\u3089Session Manager\u3092\u5229\u7528\u3059\u308b\u9650\u308a\u306b\u304a\u3044\u3066\u306f\u3001\u4eca\u56deCloudFormation\u3067\u7d44\u3093\u3060Session Manager\u306e\u8a2d\u5b9a\u304c\u5fc5\u305a\u6d3b\u304d\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u6982\u8981 \u4ee5\u4e0b\u306e\u3088\u3046\u306aSession Manager\u306e\u8a2d\u5b9a\u3092CloudFormation\u3067\u884c\u3044\u307e\u3059\u3002 \u307e\u305f\u3001\u305d\u3082\u305d\u3082\u3069\u3046\u3084\u3063\u3066Session Manager\u306e\u8a2d\u5b9a\u3092API\u3067\u884c\u3046\u306e\uff1f\u3068\u3044\u3063\u305f\u70b9\u3082\u8aac\u660e\u3057\u307e\u3059\u3002 \u7d50\u8ad6\u306eCloudF…<\/p>\n","protected":false},"author":60,"featured_media":18188,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"ja","_original_post":"https:\/\/www.skyarch.net\/blog\/?p=19837","footnotes":""},"categories":[20,830],"tags":[102,542],"class_list":{"0":"post-19837","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-aws","8":"category-systems-manager","9":"tag-aws","10":"tag-aws-cloudformation","11":"ja"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/19837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/users\/60"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/comments?post=19837"}],"version-history":[{"count":31,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/19837\/revisions"}],"predecessor-version":[{"id":19871,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/19837\/revisions\/19871"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media\/18188"}],"wp:attachment":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media?parent=19837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/categories?post=19837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/tags?post=19837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}