サーバーレスでIAMユーザー申請ポータルを構築

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM User Request Portal - Phase 0: Foundation (SNS, DynamoDB, S3, IAM Group)'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: iam
  AdminEmailAddress:
    Type: String
    Description: Email address to subscribe to the administrator notification SNS topic
  PortalPasswordAdminEmailAddress:
    Type: String
    Description: Email address to subscribe to the portal password notification SNS topic
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      - Label:
          default: Notification Configuration
        Parameters:
          - AdminEmailAddress
          - PortalPasswordAdminEmailAddress
Resources:
  AdminNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-admin-notifications'
  PortalPasswordNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-portal-password-notifications'
  AdminEmailSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: !Ref AdminNotificationTopic
      Protocol: email
      Endpoint: !Ref AdminEmailAddress
  PortalPasswordEmailSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: !Ref PortalPasswordNotificationTopic
      Protocol: email
      Endpoint: !Ref PortalPasswordAdminEmailAddress
  RequestTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Delete
    Properties:
      TableName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-requests'
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: pk
          AttributeType: S
        - AttributeName: sk
          AttributeType: S
      KeySchema:
        - AttributeName: pk
          KeyType: HASH
        - AttributeName: sk
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: expiresAt
        Enabled: true
  PasswordBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::AccountId}-${AWS::Region}-${Environment}-${ProjectId}-${ProjectInfix}-credentials'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: DeleteTemporaryCredentials
            Status: Enabled
            ExpirationInDays: 3
  IamUserGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-users'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
Outputs:
  AdminNotificationTopicArn:
    Value: !Ref AdminNotificationTopic
    Export:
      Name: !Sub '${AWS::StackName}-AdminNotificationTopicArn'
  PortalPasswordNotificationTopicArn:
    Value: !Ref PortalPasswordNotificationTopic
    Export:
      Name: !Sub '${AWS::StackName}-PortalPasswordNotificationTopicArn'
  IamUserGroupName:
    Value: !Ref IamUserGroup
    Export:
      Name: !Sub '${AWS::StackName}-IamUserGroupName'
  PasswordBucketName:
    Value: !Ref PasswordBucket
    Export:
      Name: !Sub '${AWS::StackName}-PasswordBucketName'
  RequestTableName:
    Value: !Ref RequestTable
    Export:
      Name: !Sub '${AWS::StackName}-RequestTableName'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM User Request Portal - Phase 1: WAF WebACL for CloudFront (us-east-1)'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: iam
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
Resources:
  # --- AWS WAF WebACL（CloudFront 用 -- スコープ: CLOUDFRONT） ---
  # レートベースルール + AWS Managed Rules で不正リクエストを遮断
  WebAcl:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-web-acl'
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-web-acl'
      Rules:
        # レートベースルール: 同一 IP から 5 分間に 300 リクエスト超でブロック
        - Name: RateLimitRule
          Priority: 1
          Action:
            Block: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRule
          Statement:
            RateBasedStatement:
              Limit: 300
              AggregateKeyType: IP
        # AWS Managed Rules -- 既知の悪意あるリクエストパターン
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 2
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesCommonRuleSet
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
        # AWS Managed Rules -- 既知の不正入力パターン（SQLi など）
        - Name: AWSManagedRulesKnownBadInputsRuleSet
          Priority: 3
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesKnownBadInputsRuleSet
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesKnownBadInputsRuleSet
        # AWS Managed Rules -- Bot 対策
        - Name: AWSManagedRulesBotControlRuleSet
          Priority: 4
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesBotControlRuleSet
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesBotControlRuleSet
Outputs:
  WebAclArn:
    Description: WAF WebACL ARN for CloudFront association
    Value: !GetAtt WebAcl.Arn
    Export:
      Name: !Sub '${AWS::StackName}-WebAclArn'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM User Request Portal - Phase 2: Web Portal, API, Auth, EventBridge'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: iam
  LambdaLogRetentionInDays:
    Type: Number
    Default: 7
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653]
    Description: Number of days to retain Lambda function logs
  CustomDomainName:
    Type: String
    Description: Custom domain name (e.g. request.your-domain.link)
  AcmCertificateArn:
    Type: String
    Description: ACM certificate ARN issued in us-east-1
  HostedZoneId:
    Type: String
    Description: Route 53 hosted zone ID
  PortalLoginUsername:
    Type: String
    Default: persol-serverworks
    Description: Fixed login user name for the request portal
  PortalPasswordNotificationTopicArn:
    Type: String
    Description: Output value of phase 0
  AdminNotificationTopicArn:
    Type: String
    Description: Output value of phase 0 (admin notification SNS topic ARN)
  WafWebAclArn:
    Type: String
    Description: WAF WebACL ARN exported from stack-01-waf (us-east-1)
  LambdaArchitecture:
    Type: String
    Default: x86_64
    AllowedValues: [x86_64, arm64]
    Description: Lambda function architecture for Powertools layer
  LambdaPythonVersion:
    Type: String
    Default: python3.13
    AllowedValues: [python3.9, python3.10, python3.11, python3.12, python3.13, python3.14]
    Description: Python runtime version for Powertools layer
  FoundationStackName:
    Type: String
    Default: dev-001-iam-stack-00-foundation
    Description: Stack name of phase 0
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      - Label:
          default: Portal Configuration
        Parameters:
          - CustomDomainName
          - AcmCertificateArn
          - HostedZoneId
          - PortalLoginUsername
      - Label:
          default: Lambda Configuration
        Parameters:
          - LambdaLogRetentionInDays
          - LambdaArchitecture
          - LambdaPythonVersion
      - Label:
          default: Cross-Stack Configuration
        Parameters:
          - PortalPasswordNotificationTopicArn
          - AdminNotificationTopicArn
          - WafWebAclArn
          - FoundationStackName
Resources:
  # --- S3 bucket for web contents ---
  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::AccountId}-${AWS::Region}-${Environment}-${ProjectId}-${ProjectInfix}-web'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  # --- CloudFront OAC ---
  CloudFrontOAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-oac'
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4
  # --- CloudFront ---
  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        DefaultRootObject: index.html
        WebACLId: !Ref WafWebAclArn
        Aliases:
          - !Ref CustomDomainName
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt WebBucket.RegionalDomainName
            OriginAccessControlId: !Ref CloudFrontOAC
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
          AllowedMethods: [GET, HEAD]
        ViewerCertificate:
          AcmCertificateArn: !Ref AcmCertificateArn
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2021
  # --- Route 53 record ---
  DnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref CustomDomainName
      Type: A
      AliasTarget:
        HostedZoneId: Z2FDTNDATAQYW2
        DNSName: !GetAtt Distribution.DomainName
  # --- S3 bucket policy ---
  WebBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub '${WebBucket.Arn}/*'
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${Distribution}'
  # --- API Gateway (REST API only. Deployment and Stage are created in phase 4) ---
  RequestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-api'
  # Health check endpoint for the API root
  ApiRootMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RequestApi
      ResourceId: !GetAtt RequestApi.RootResourceId
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: MOCK
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        IntegrationResponses:
          - StatusCode: '200'
      MethodResponses:
        - StatusCode: '200'
  # --- /auth ---
  AuthResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RequestApi
      ParentId: !GetAtt RequestApi.RootResourceId
      PathPart: auth
  # --- /auth/login ---
  LoginResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RequestApi
      ParentId: !Ref AuthResource
      PathPart: login
  LoginPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RequestApi
      ResourceId: !Ref LoginResource
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthFunction.Arn}/invocations'
  LoginOptionsMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RequestApi
      ResourceId: !Ref LoginResource
      HttpMethod: OPTIONS
      AuthorizationType: NONE
      Integration:
        Type: MOCK
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: "'Content-Type'"
              method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
              method.response.header.Access-Control-Allow-Origin: !Sub "'https://${CustomDomainName}'"
              method.response.header.Access-Control-Allow-Credentials: "'true'"
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false
            method.response.header.Access-Control-Allow-Credentials: false
  # --- Auth Lambda ---
  AuthRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-auth-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AuthPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:GetItem, dynamodb:PutItem]
                Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${Environment}-${ProjectId}-${ProjectInfix}-requests'
              - Effect: Allow
                Action: [logs:CreateLogStream, logs:PutLogEvents]
                Resource: !GetAtt ErrorLogGroup.Arn
  AuthFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-auth'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt AuthRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          LOGIN_USERNAME: !Ref PortalLoginUsername
          CORS_ORIGIN: !Sub 'https://${CustomDomainName}'
          ERROR_LOG_GROUP_NAME: !Ref ErrorLogGroup
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-auth'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  AuthFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AuthFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  AuthFunctionApiPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref AuthFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${RequestApi}/*/POST/auth/login'
  # --- Monthly password update Lambda ---
  PasswordUpdateRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-password-update-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: PasswordUpdatePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:PutItem, dynamodb:UpdateItem, dynamodb:GetItem]
                Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${Environment}-${ProjectId}-${ProjectInfix}-requests'
              - Effect: Allow
                Action: [sns:Publish]
                Resource: !Ref PortalPasswordNotificationTopicArn
              - Effect: Allow
                Action: [logs:CreateLogStream, logs:PutLogEvents]
                Resource: !GetAtt ErrorLogGroup.Arn
  PasswordUpdateFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-password-update'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt PasswordUpdateRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          SNS_TOPIC_ARN: !Ref PortalPasswordNotificationTopicArn
          PORTAL_URL: !Sub 'https://${CustomDomainName}'
          LOGIN_USERNAME: !Ref PortalLoginUsername
          ERROR_LOG_GROUP_NAME: !Ref ErrorLogGroup
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-password-update'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  PasswordUpdateFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${PasswordUpdateFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  # --- EventBridge Scheduler ---
  SchedulerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-scheduler-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: scheduler.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: InvokeLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: !GetAtt PasswordUpdateFunction.Arn
  MonthlySchedule:
    Type: AWS::Scheduler::Schedule
    Properties:
      Name: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-monthly-password'
      ScheduleExpression: 'cron(0 0 1 * ? *)'
      ScheduleExpressionTimezone: 'Asia/Tokyo'
      State: ENABLED
      FlexibleTimeWindow:
        Mode: 'OFF'
      Target:
        Arn: !GetAtt PasswordUpdateFunction.Arn
        RoleArn: !GetAtt SchedulerRole.Arn
  # --- Error notification infrastructure ---
  ErrorLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/${Environment}/${ProjectId}/${ProjectInfix}/lambda-errors'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  ErrorNotificationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-error-notification-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: ErrorNotificationPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [sns:Publish]
                Resource: !Ref AdminNotificationTopicArn
  ErrorNotificationFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-error-notification'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt ErrorNotificationRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          SNS_TOPIC_ARN: !Ref AdminNotificationTopicArn
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-error-notification'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  ErrorNotificationFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${ErrorNotificationFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  ErrorLogSubscriptionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ErrorNotificationFunction
      Action: lambda:InvokeFunction
      Principal: logs.amazonaws.com
      SourceArn: !GetAtt ErrorLogGroup.Arn
  ErrorLogSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    DependsOn: ErrorLogSubscriptionPermission
    Properties:
      LogGroupName: !Ref ErrorLogGroup
      FilterPattern: '{ $.level = "ERROR" }'
      DestinationArn: !GetAtt ErrorNotificationFunction.Arn
Outputs:
  WebBucketName:
    Value: !Ref WebBucket
    Export:
      Name: !Sub '${AWS::StackName}-WebBucketName'
  CloudFrontDomainName:
    Value: !GetAtt Distribution.DomainName
    Export:
      Name: !Sub '${AWS::StackName}-CloudFrontDomainName'
  CustomDomainName:
    Value: !Ref CustomDomainName
    Export:
      Name: !Sub '${AWS::StackName}-CustomDomainName'
  RestApiId:
    Value: !Ref RequestApi
    Export:
      Name: !Sub '${AWS::StackName}-RestApiId'
  RootResourceId:
    Value: !GetAtt RequestApi.RootResourceId
    Export:
      Name: !Sub '${AWS::StackName}-RootResourceId'
  PortalLoginUsername:
    Value: !Ref PortalLoginUsername
    Export:
      Name: !Sub '${AWS::StackName}-PortalLoginUsername'
  ApiUrl:
    Description: API Gateway invoke URL. Available after phase 4 creates the v1 stage. Set this value to API_BASE in index.html and form.js
    Value: !Sub 'https://${RequestApi}.execute-api.${AWS::Region}.amazonaws.com/v1'
    Export:
      Name: !Sub '${AWS::StackName}-ApiUrl'
  ErrorLogGroupName:
    Value: !Ref ErrorLogGroup
    Export:
      Name: !Sub '${AWS::StackName}-ErrorLogGroupName'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM User Request Portal - Phase 3: SES, Form Token, Request Registration'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: iam
  LambdaLogRetentionInDays:
    Type: Number
    Default: 7
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653]
    Description: Number of days to retain Lambda function logs
  OrganizationDomain:
    Type: String
    Description: Organization domain allowed to submit requests (e.g. company.com)
  SesFromAddress:
    Type: String
    Description: SES verified sender e-mail address
  LambdaArchitecture:
    Type: String
    Default: x86_64
    AllowedValues: [x86_64, arm64]
    Description: Lambda function architecture for Powertools layer
  LambdaPythonVersion:
    Type: String
    Default: python3.13
    AllowedValues: [python3.9, python3.10, python3.11, python3.12, python3.13, python3.14]
    Description: Python runtime version for Powertools layer
  FoundationStackName:
    Type: String
    Default: dev-001-iam-stack-00-foundation
  PortalStackName:
    Type: String
    Default: dev-001-iam-stack-02-portal-auth
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      - Label:
          default: Lambda Configuration
        Parameters:
          - LambdaLogRetentionInDays
          - LambdaArchitecture
          - LambdaPythonVersion
      - Label:
          default: Form Request Configuration
        Parameters:
          - OrganizationDomain
          - SesFromAddress
      - Label:
          default: Cross-Stack Configuration
        Parameters:
          - FoundationStackName
          - PortalStackName
Resources:
  FormRequestRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-form-request-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: FormRequestPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [dynamodb:PutItem, dynamodb:UpdateItem, dynamodb:GetItem, dynamodb:Query]
                Resource:
                  Fn::Sub:
                    - 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}'
                    - TableName:
                        Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
              - Effect: Allow
                Action: [ses:SendEmail]
                Resource: '*'
              - Effect: Allow
                Action: [logs:CreateLogStream, logs:PutLogEvents]
                Resource:
                  Fn::Sub:
                    - 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${Environment}/${ProjectId}/${ProjectInfix}/lambda-errors:*'
                    - {}
  FormRequestFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-form-request'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt FormRequestRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          ORGANIZATION_DOMAIN: !Ref OrganizationDomain
          SES_FROM_ADDRESS: !Ref SesFromAddress
          PORTAL_URL:
            Fn::Sub:
              - 'https://${Domain}'
              - Domain:
                  Fn::ImportValue: !Sub '${PortalStackName}-CustomDomainName'
          CORS_ORIGIN:
            Fn::Sub:
              - 'https://${Domain}'
              - Domain:
                  Fn::ImportValue: !Sub '${PortalStackName}-CustomDomainName'
          ERROR_LOG_GROUP_NAME:
            Fn::ImportValue: !Sub '${PortalStackName}-ErrorLogGroupName'
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-form-request'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  FormRequestFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FormRequestFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  # --- /request (parent resource shared with phase 4) ---
  RequestResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ParentId:
        Fn::ImportValue: !Sub '${PortalStackName}-RootResourceId'
      PathPart: request
  # --- /request/send-form ---
  SendFormResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ParentId: !Ref RequestResource
      PathPart: send-form
  SendFormPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ResourceId: !Ref SendFormResource
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${FormRequestFunction.Arn}/invocations'
  SendFormOptionsMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ResourceId: !Ref SendFormResource
      HttpMethod: OPTIONS
      AuthorizationType: NONE
      Integration:
        Type: MOCK
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: "'Content-Type'"
              method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
              method.response.header.Access-Control-Allow-Origin:
                Fn::Sub:
                  - "'https://${Domain}'"
                  - Domain:
                      Fn::ImportValue: !Sub '${PortalStackName}-CustomDomainName'
              method.response.header.Access-Control-Allow-Credentials: "'true'"
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false
            method.response.header.Access-Control-Allow-Credentials: false
  FormRequestApiPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref FormRequestFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Sub:
          - 'arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/*/POST/request/send-form'
          - ApiId:
              Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
Outputs:
  FormRequestFunctionArn:
    Value: !GetAtt FormRequestFunction.Arn
    Export:
      Name: !Sub '${AWS::StackName}-FormRequestFunctionArn'
  RequestResourceId:
    Value: !Ref RequestResource
    Export:
      Name: !Sub '${AWS::StackName}-RequestResourceId'
  SesFromAddress:
    Value: !Ref SesFromAddress
    Export:
      Name: !Sub '${AWS::StackName}-SesFromAddress'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM User Request Portal - Phase 4: Step Functions, Approval API, IAM Operations'
Parameters:
  Environment:
    Type: String
    Default: dev
  ProjectId:
    Type: String
    Default: '001'
  ProjectInfix:
    Type: String
    Default: iam
  LambdaLogRetentionInDays:
    Type: Number
    Default: 7
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653]
    Description: Number of days to retain Lambda function logs
  AdminNotificationTopicArn:
    Type: String
    Description: Output value of phase 0
  IamUserGroupName:
    Type: String
    Description: Output value of phase 0
  PasswordBucketName:
    Type: String
    Description: Output value of phase 0
  FoundationStackName:
    Type: String
    Default: dev-001-iam-stack-00-foundation
  PortalStackName:
    Type: String
    Default: dev-001-iam-stack-02-portal-auth
  FormRequestStackName:
    Type: String
    Default: dev-001-iam-stack-03-form-request
  EnableConsoleAccess:
    Type: String
    Default: 'true'
    AllowedValues: ['true', 'false']
    Description: Whether to create an IAM login profile (console access)
  LambdaArchitecture:
    Type: String
    Default: x86_64
    AllowedValues: [x86_64, arm64]
    Description: Lambda function architecture for Powertools layer
  LambdaPythonVersion:
    Type: String
    Default: python3.13
    AllowedValues: [python3.9, python3.10, python3.11, python3.12, python3.13, python3.14]
    Description: Python runtime version for Powertools layer
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Stack Configuration
        Parameters:
          - Environment
          - ProjectId
          - ProjectInfix
      - Label:
          default: Lambda Configuration
        Parameters:
          - LambdaLogRetentionInDays
          - LambdaArchitecture
          - LambdaPythonVersion
      - Label:
          default: Workflow and IAM Configuration
        Parameters:
          - AdminNotificationTopicArn
          - IamUserGroupName
          - PasswordBucketName
          - EnableConsoleAccess
      - Label:
          default: Cross-Stack Configuration
        Parameters:
          - FoundationStackName
          - PortalStackName
          - FormRequestStackName
Resources:
  WorkflowRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-workflow-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com, states.amazonaws.com]
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: WorkflowPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: [iam:CreateUser, iam:DeleteUser, iam:AddUserToGroup, iam:RemoveUserFromGroup, iam:CreateLoginProfile, iam:UpdateLoginProfile, iam:DeleteLoginProfile, iam:GetUser, iam:GetLoginProfile, iam:ListAccessKeys, iam:DeleteAccessKey, iam:ListUserPolicies, iam:DeleteUserPolicy, iam:ListAttachedUserPolicies, iam:DetachUserPolicy, iam:ListGroupsForUser, iam:ListUserTags, iam:TagUser, iam:PutUserPolicy]
                Resource: '*'
              - Effect: Allow
                Action: [dynamodb:PutItem, dynamodb:UpdateItem, dynamodb:GetItem, dynamodb:Query]
                Resource:
                  Fn::Sub:
                    - 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}'
                    - TableName:
                        Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
              - Effect: Allow
                Action: [s3:PutObject, s3:GetObject]
                Resource: !Sub 'arn:aws:s3:::${PasswordBucketName}/*'
              - Effect: Allow
                Action: [sns:Publish]
                Resource: !Ref AdminNotificationTopicArn
              - Effect: Allow
                Action: [ses:SendEmail]
                Resource: '*'
              - Effect: Allow
                Action: [lambda:InvokeFunction]
                Resource: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-${ProjectId}-${ProjectInfix}-*'
              - Effect: Allow
                Action: [states:StartExecution]
                Resource: !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${Environment}-${ProjectId}-${ProjectInfix}-workflow'
              - Effect: Allow
                Action: [logs:CreateLogStream, logs:PutLogEvents]
                Resource:
                  Fn::Sub:
                    - 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${Environment}/${ProjectId}/${ProjectInfix}/lambda-errors:*'
                    - {}
  # --- IAM operation Lambda ---
  IamOperationFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-iam-operation'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt WorkflowRole.Arn
      Timeout: 60
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          BUCKET_NAME: !Ref PasswordBucketName
          SNS_TOPIC_ARN: !Ref AdminNotificationTopicArn
          IAM_GROUP_NAME: !Ref IamUserGroupName
          SES_FROM_ADDRESS:
            Fn::ImportValue: !Sub '${FormRequestStackName}-SesFromAddress'
          ENABLE_CONSOLE_ACCESS: !Ref EnableConsoleAccess
          ERROR_LOG_GROUP_NAME:
            Fn::ImportValue: !Sub '${PortalStackName}-ErrorLogGroupName'
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-iam-operation'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  IamOperationFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${IamOperationFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  # --- Step Functions state machine ---
  IamWorkflowStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-workflow'
      RoleArn: !GetAtt WorkflowRole.Arn
      DefinitionString: !Sub |
        {
          "StartAt": "SelectOperation",
          "States": {
            "SelectOperation": {
              "Type": "Choice",
              "Choices": [
                {"Variable": "$.operationType", "StringEquals": "CREATE_EXTEND_USER", "Next": "CreateUser"},
                {"Variable": "$.operationType", "StringEquals": "DELETE_USER", "Next": "DeleteUser"},
                {"Variable": "$.operationType", "StringEquals": "RESET_PASSWORD", "Next": "ResetPassword"}
              ],
              "Default": "Failed"
            },
            "CreateUser": {
              "Type": "Task",
              "Resource": "${IamOperationFunction.Arn}",
              "End": true
            },
            "DeleteUser": {
              "Type": "Task",
              "Resource": "${IamOperationFunction.Arn}",
              "End": true
            },
            "ResetPassword": {
              "Type": "Task",
              "Resource": "${IamOperationFunction.Arn}",
              "End": true
            },
            "Failed": {
              "Type": "Fail",
              "Cause": "Unknown operationType"
            }
          }
        }
  # --- Request submit Lambda ---
  RequestSubmitFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-request-submit'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt WorkflowRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          SNS_TOPIC_ARN: !Ref AdminNotificationTopicArn
          STATE_MACHINE_ARN: !Ref IamWorkflowStateMachine
          API_BASE:
            Fn::Sub:
              - 'https://${ApiId}.execute-api.${AWS::Region}.amazonaws.com/v1'
              - ApiId:
                  Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
          CORS_ORIGIN:
            Fn::Sub:
              - 'https://${Domain}'
              - Domain:
                  Fn::ImportValue: !Sub '${PortalStackName}-CustomDomainName'
          ERROR_LOG_GROUP_NAME:
            Fn::ImportValue: !Sub '${PortalStackName}-ErrorLogGroupName'
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-request-submit'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  RequestSubmitFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${RequestSubmitFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  # --- Request approve Lambda ---
  RequestApproveFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-request-approve'
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt WorkflowRole.Arn
      Timeout: 30
      Layers:
        - !Sub "{{resolve:ssm:/aws/service/powertools/python/${LambdaArchitecture}/${LambdaPythonVersion}/latest}}"
      Environment:
        Variables:
          TABLE_NAME:
            Fn::ImportValue: !Sub '${FoundationStackName}-RequestTableName'
          SNS_TOPIC_ARN: !Ref AdminNotificationTopicArn
          STATE_MACHINE_ARN: !Ref IamWorkflowStateMachine
          SES_FROM_ADDRESS:
            Fn::ImportValue: !Sub '${FormRequestStackName}-SesFromAddress'
          ERROR_LOG_GROUP_NAME:
            Fn::ImportValue: !Sub '${PortalStackName}-ErrorLogGroupName'
          POWERTOOLS_SERVICE_NAME: !Sub '${Environment}-${ProjectId}-${ProjectInfix}-request-approve'
      Code:
        ZipFile: |
          # Placeholder. The implementation is deployed separately.
          def lambda_handler(event, context):
              return {'statusCode': 200}
  RequestApproveFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${RequestApproveFunction}'
      RetentionInDays: !Ref LambdaLogRetentionInDays
  # --- /request/submit ---
  SubmitResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ParentId:
        Fn::ImportValue: !Sub '${FormRequestStackName}-RequestResourceId'
      PathPart: submit
  SubmitPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ResourceId: !Ref SubmitResource
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequestSubmitFunction.Arn}/invocations'
  SubmitOptionsMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ResourceId: !Ref SubmitResource
      HttpMethod: OPTIONS
      AuthorizationType: NONE
      Integration:
        Type: MOCK
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: "'Content-Type'"
              method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
              method.response.header.Access-Control-Allow-Origin:
                Fn::Sub:
                  - "'https://${Domain}'"
                  - Domain:
                      Fn::ImportValue: !Sub '${PortalStackName}-CustomDomainName'
              method.response.header.Access-Control-Allow-Credentials: "'true'"
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false
            method.response.header.Access-Control-Allow-Credentials: false
  SubmitApiPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref RequestSubmitFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Sub:
          - 'arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/*/POST/request/submit'
          - ApiId:
              Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
  # --- /request/approve ---
  ApproveResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ParentId:
        Fn::ImportValue: !Sub '${FormRequestStackName}-RequestResourceId'
      PathPart: approve
  ApproveGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      ResourceId: !Ref ApproveResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequestApproveFunction.Arn}/invocations'
  ApproveApiPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref RequestApproveFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Sub:
          - 'arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/*/GET/request/approve'
          - ApiId:
              Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
  # --- API Gateway Deployment and Stage (created after all methods exist) ---
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - SubmitPostMethod
      - SubmitOptionsMethod
      - ApproveGetMethod
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
  RequestApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId:
        Fn::ImportValue: !Sub '${PortalStackName}-RestApiId'
      StageName: v1
      DeploymentId: !Ref ApiDeployment
Outputs:
  StateMachineArn:
    Value: !Ref IamWorkflowStateMachine
    Export:
      Name: !Sub '${AWS::StackName}-StateMachineArn'
  ApiStageName:
    Description: Deployed API Gateway stage name
    Value: !Ref RequestApiStage

import json
import os
import hashlib
import secrets
import time
import traceback
import boto3
from aws_lambda_powertools import Logger
logger = Logger()
dynamodb = boto3.resource('dynamodb')
sns = boto3.client('sns')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
PORTAL_URL = os.environ.get('PORTAL_URL', '')
LOGIN_USERNAME = 'persol-serverworks'
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        table = dynamodb.Table(TABLE_NAME)
        # ランダムパスワード生成（16文字）
        password = secrets.token_urlsafe(16)
        # PBKDF2 でハッシュ化
        salt = secrets.token_hex(16)
        password_hash = hashlib.pbkdf2_hmac(
            'sha256', password.encode(), salt.encode(), 100000
        ).hex()
        # DynamoDB に保存
        version = str(int(time.time()))
        table.put_item(Item={
            'pk': 'PORTAL_CONFIG',
            'sk': 'CURRENT',
            'passwordHash': password_hash,
            'salt': salt,
            'passwordVersion': version,
            'updatedAt': int(time.time())
        })
        # SNS で管理者に通知
        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject='【通知】月次パスワード 更新通知',
            Message=(
                'IAM ユーザー申請ポータルの月次パスワードが更新されました。\n\n'
                f'ログイン URL: {PORTAL_URL}\n'
                f'ユーザー名: {LOGIN_USERNAME}\n'
                f'パスワード: {password}\n\n'
                'このパスワードは次回更新（毎月1日）まで有効です。'
            )
        )
        return {'statusCode': 200, 'body': 'Password updated'}
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context)
        raise
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import hashlib
import secrets
import time
import traceback
import boto3
from aws_lambda_powertools import Logger
logger = Logger()
dynamodb = boto3.resource('dynamodb')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
LOGIN_USERNAME = os.environ.get('LOGIN_USERNAME', 'persol-serverworks')
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
CORS_ORIGIN = os.environ.get('CORS_ORIGIN', '*')
CORS_HEADERS = {
    'Access-Control-Allow-Origin': CORS_ORIGIN,
    'Access-Control-Allow-Credentials': 'true',
    'Content-Type': 'application/json'
}
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        table = dynamodb.Table(TABLE_NAME)
        body = json.loads(event.get('body', '{}'))
        username = body.get('username', '')
        password = body.get('password', '')
        # ユーザー名照合
        if username != LOGIN_USERNAME:
            return response(401, {'message': 'ユーザー名またはパスワードが正しくありません'})
        # 現在のポータル設定を取得
        resp = table.get_item(Key={'pk': 'PORTAL_CONFIG', 'sk': 'CURRENT'})
        config = resp.get('Item')
        if not config:
            return response(401, {'message': 'ポータルが初期化されていません'})
        # パスワード照合
        password_hash = hashlib.pbkdf2_hmac(
            'sha256', password.encode(), config['salt'].encode(), 100000
        ).hex()
        if password_hash != config['passwordHash']:
            return response(401, {'message': 'ユーザー名またはパスワードが正しくありません'})
        # セッション発行
        session_token = secrets.token_urlsafe(32)
        session_hash = hashlib.sha256(session_token.encode()).hexdigest()
        table.put_item(Item={
            'pk': f'SESSION#{session_hash}',
            'sk': 'SESSION',
            'passwordVersion': config['passwordVersion'],
            'createdAt': int(time.time()),
            'expiresAt': int(time.time()) + 3600
        })
        headers = dict(CORS_HEADERS)
        headers['Set-Cookie'] = f'session={session_token}; HttpOnly; Secure; SameSite=Lax; Max-Age=3600'
        return {
            'statusCode': 200,
            'headers': headers,
            'body': json.dumps({'message': 'OK'})
        }
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context)
        raise
def response(status, body):
    return {
        'statusCode': status,
        'headers': CORS_HEADERS,
        'body': json.dumps(body)
    }
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import hashlib
import secrets
import time
import traceback
import boto3
from aws_lambda_powertools import Logger
logger = Logger()
dynamodb = boto3.resource('dynamodb')
ses = boto3.client('ses')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
ORGANIZATION_DOMAIN = os.environ['ORGANIZATION_DOMAIN']
SES_FROM_ADDRESS = os.environ['SES_FROM_ADDRESS']
PORTAL_URL = os.environ['PORTAL_URL']
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
CORS_ORIGIN = os.environ.get('CORS_ORIGIN', '*')
CORS_HEADERS = {
    'Access-Control-Allow-Origin': CORS_ORIGIN,
    'Access-Control-Allow-Credentials': 'true',
    'Content-Type': 'application/json'
}
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        table = dynamodb.Table(TABLE_NAME)
        body = json.loads(event.get('body', '{}'))
        email = body.get('email', '').strip().lower()
        operation_type = body.get('operationType', '')
        # メールアドレス形式・組織ドメインのチェック
        if not email or '@' not in email:
            return response(400, {'message': 'メールアドレスの形式が正しくありません'})
        domain = email.split('@')[1]
        if not (domain == ORGANIZATION_DOMAIN or domain.endswith(f'.{ORGANIZATION_DOMAIN}')):
            return response(400, {'message': '組織のメールアドレスを入力してください'})
        # 申請種別の検証
        allowed = ['CREATE_EXTEND_USER', 'DELETE_USER', 'RESET_PASSWORD']
        if operation_type not in allowed:
            return response(400, {'message': '申請種別が正しくありません'})
        # トークン生成
        token = secrets.token_urlsafe(32)
        token_hash = hashlib.sha256(token.encode()).hexdigest()
        # DynamoDB に保存（TTL 15分）
        table.put_item(Item={
            'pk': f'FORM_TOKEN#{token_hash}',
            'sk': 'FORM_TOKEN',
            'email': email,
            'operationType': operation_type,
            'createdAt': int(time.time()),
            'expiresAt': int(time.time()) + 7200,
            'used': False
        })
        # フォーム URL 決定
        form_paths = {
            'CREATE_EXTEND_USER': '/form/create.html',
            'DELETE_USER': '/form/delete.html',
            'RESET_PASSWORD': '/form/reset-password.html'
        }
        form_url = f'{PORTAL_URL}{form_paths[operation_type]}?token={token}'
        # SES でメール送信
        ses.send_email(
            Source=SES_FROM_ADDRESS,
            Destination={'ToAddresses': [email]},
            Message={
                'Subject': {'Data': '【IAM申請】申請フォーム案内'},
                'Body': {'Text': {'Data': f'以下の URL から申請フォームにアクセスしてください。\n\n{form_url}\n\nこの URL は120分間有効です。'}}
            }
        )
        return response(200, {'message': 'メールを送信しました'})
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context)
        raise
def response(status, body):
    return {
        'statusCode': status,
        'headers': CORS_HEADERS,
        'body': json.dumps(body)
    }
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import hashlib
import secrets
import string
import random
import time
import traceback
import boto3
from botocore.exceptions import ClientError
from aws_lambda_powertools import Logger
logger = Logger()
iam = boto3.client('iam')
dynamodb = boto3.resource('dynamodb')
s3 = boto3.client('s3')
sns = boto3.client('sns')
ses = boto3.client('ses')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
BUCKET_NAME = os.environ['BUCKET_NAME']
SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
IAM_GROUP_NAME = os.environ['IAM_GROUP_NAME']
SES_FROM_ADDRESS = os.environ.get('SES_FROM_ADDRESS', '')
ENABLE_CONSOLE_ACCESS = os.environ.get('ENABLE_CONSOLE_ACCESS', 'false').lower() == 'true'
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        operation = event.get('operationType')
        if operation == 'CREATE_EXTEND_USER':
            return handle_create_extend(event)
        elif operation == 'DELETE_USER':
            return handle_delete(event)
        elif operation == 'RESET_PASSWORD':
            return handle_reset_password(event)
        else:
            return {'statusCode': 400, 'body': 'Unknown operationType'}
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context, extra={'event': event})
        raise
def handle_create_extend(event):
    people = event.get('people', [])
    requested_by = event.get('requestedBy', '')
    results = []
    for person in people:
        email = person['email'].strip().lower()
        username = generate_username(email)
        try:
            iam.get_user(UserName=username)
            result = extend_user(username, person, email, requested_by)
        except ClientError as e:
            if e.response['Error']['Code'] == 'NoSuchEntity':
                result = create_user(username, person, email, requested_by)
            else:
                raise
        results.append(result)
    return {'statusCode': 200, 'results': results}
def create_user(username, person, email, requested_by):
    # IAM ユーザー作成
    iam.create_user(UserName=username, Tags=[
        {'Key': 'Email', 'Value': email},
        {'Key': 'Name', 'Value': person.get('name', '')},
        {'Key': 'StartDate', 'Value': person.get('startDate', '')},
        {'Key': 'EndDate', 'Value': person.get('endDate', '')}
    ])
    iam.add_user_to_group(GroupName=IAM_GROUP_NAME, UserName=username)
    # カスタムパスワード（12桁乱数）を常に発行
    password = generate_password_12()
    # コンソールアクセスが有効な場合のみ IAM にパスワードを設定
    if ENABLE_CONSOLE_ACCESS:
        iam.create_login_profile(
            UserName=username, Password=password, PasswordResetRequired=True
        )
    # S3 に認証情報を保存
    key = f'iam-credentials/{username}-{int(time.time())}.txt'
    if ENABLE_CONSOLE_ACCESS:
        body_text = (
            f'IAM ユーザー作成完了\n'
            f'========================================\n\n'
            f'IAM ユーザー名: {username}\n'
            f'初期パスワード: {password}\n\n'
            f'初回ログイン時にパスワード変更が必要です。\n'
        )
    else:
        body_text = (
            f'IAM ユーザー作成完了\n'
            f'========================================\n\n'
            f'IAM ユーザー名: {username}\n'
            f'※ マネジメントコンソールへの利用が許可されていないため、パスワードは未設定です。\n'
        )
    s3.put_object(Bucket=BUCKET_NAME, Key=key, Body=body_text.encode('utf-8'), ContentType='text/plain; charset=utf-8')
    # 48時間有効の署名付き URL
    url = s3.generate_presigned_url(
        'get_object', Params={'Bucket': BUCKET_NAME, 'Key': key}, ExpiresIn=172800
    )
    # 利用者に SES で通知
    if SES_FROM_ADDRESS and email:
        try:
            ses.send_email(
                Source=SES_FROM_ADDRESS,
                Destination={'ToAddresses': [email]},
                Message={
                    'Subject': {'Data': '【完了】IAM ユーザー作成 完了通知'},
                    'Body': {'Text': {'Data': (
                        f'ご申請いただいた IAM ユーザーの作成が完了しました。\n\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n'
                        f'IAM ユーザー名: {username}\n'
                        f'マネジメントコンソール: https://{get_account_id()}.signin.aws.amazon.com/console\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n\n'
                        f'メール受信から 48時間以内に、以下の URL へアクセスし認証情報を控えてください。\n'
                        f'時間経過後は URL にアクセスできなくなりますので、ご注意ください。\n\n'
                        f'認証情報の取得 URL:\n{url}\n'
                    )}}
                }
            )
        except ClientError as e:
            print(f"SES send error: {e}")
    # 管理者に作成完了を通知
    sns.publish(
        TopicArn=SNS_TOPIC_ARN,
        Subject='【管理者向け】IAM ユーザー作成 完了通知',
        Message=(
            f'IAM ユーザーを作成しました。\n\n'
            f'IAM ユーザー名: {username}\n'
            f'申請者メール: {requested_by}\n'
            f'氏名: {person.get("name", "")}\n'
            f'利用期間: {person.get("startDate")} 〜 {person.get("endDate")}\n\n'
            f'利用者へ認証情報を直接通知済みです。'
        )
    )
    return {'username': username, 'status': 'CREATED'}
def extend_user(username, person, email, requested_by):
    end_date = person.get('endDate', '')
    tags_resp = iam.list_user_tags(UserName=username)
    current_end = ''
    for tag in tags_resp.get('Tags', []):
        if tag['Key'] == 'EndDate':
            current_end = tag['Value']
    if current_end and end_date <= current_end:
        # 申請した利用期間が現在の利用期限より短い場合、処理を中止する
        # 管理者に SNS で通知
        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject='【管理者向け】利用期間延長 処理中止通知',
            Message=(
                f'IAM ユーザーの延長申請を受けましたが、申請された利用終了日が'
                f'現在の利用期限以前のため、処理を中止しました。\n\n'
                f'対象 IAM ユーザー: {username}\n'
                f'申請者メール: {requested_by}\n'
                f'現在の利用期限: {current_end}\n'
                f'申請された利用終了日: {end_date}\n\n'
                f'延長が必要な場合は、現在の利用期限より後の日付で再申請してください。'
            )
        )
        # 申請者に SES で通知
        if SES_FROM_ADDRESS and requested_by:
            try:
                ses.send_email(
                    Source=SES_FROM_ADDRESS,
                    Destination={'ToAddresses': [requested_by]},
                    Message={
                        'Subject': {'Data': '【通知】利用期間延長 処理中止通知'},
                        'Body': {'Text': {'Data': (
                            f'IAM ユーザーの延長申請を処理しましたが、申請された利用終了日が'
                            f'現在の利用期限以前のため、処理を中止しました。\n\n'
                            f'対象 IAM ユーザー: {username}\n'
                            f'現在の利用期限: {current_end}\n'
                            f'申請された利用終了日: {end_date}\n\n'
                            f'延長が必要な場合は、現在の利用期限より後の日付で再申請してください。'
                        )}}
                    }
                )
            except ClientError as e:
                print(f"SES send error: {e}")
        return {'username': username, 'status': 'NO_EXTENSION_NEEDED', 'currentEndDate': current_end}
    iam.tag_user(UserName=username, Tags=[{'Key': 'EndDate', 'Value': end_date}])
    if SES_FROM_ADDRESS and email:
        try:
            ses.send_email(
                Source=SES_FROM_ADDRESS,
                Destination={'ToAddresses': [email]},
                Message={
                    'Subject': {'Data': '【完了】利用期間延長 完了通知'},
                    'Body': {'Text': {'Data': (
                        f'利用期間が延長されました。\n\n'
                        f'IAM ユーザー: {username}\n'
                        f'新しい利用期限: {end_date}'
                    )}}
                }
            )
        except ClientError as e:
            print(f"SES send error: {e}")
    sns.publish(
        TopicArn=SNS_TOPIC_ARN,
        Subject='【管理者向け】利用期間延長 完了通知',
        Message=f'IAM ユーザー: {username}\n申請者メール: {requested_by}\n新しい利用期限: {end_date}'
    )
    return {'username': username, 'status': 'EXTENDED', 'newEndDate': end_date}
def handle_delete(event):
    target_email = event.get('targetEmail', '').strip().lower() or event.get('targetUsername', '').strip().lower()
    requested_by = event.get('requestedBy', '')
    username = generate_username(target_email)
    try:
        iam.get_user(UserName=username)
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchEntity':
            # 管理者に SNS で通知
            sns.publish(
                TopicArn=SNS_TOPIC_ARN,
                Subject='【管理者向け】対象 IAM ユーザーが見つかりません 処理中止通知',
                Message=(
                    f'IAM ユーザーの削除申請を処理しましたが、'
                    f'対象ユーザーが存在しないため処理を中止しました。\n\n'
                    f'対象 IAM ユーザー: {username}\n'
                    f'申請者メール: {requested_by}'
                )
            )
            # 申請者に SES で通知
            if SES_FROM_ADDRESS and requested_by:
                try:
                    ses.send_email(
                        Source=SES_FROM_ADDRESS,
                        Destination={'ToAddresses': [requested_by]},
                        Message={
                            'Subject': {'Data': '【通知】IAM ユーザー削除 処理中止通知'},
                            'Body': {'Text': {'Data': (
                                f'IAM ユーザーの削除申請を処理しましたが、'
                                f'対象ユーザーが存在しないため処理を中止しました。\n\n'
                                f'対象 IAM ユーザー: {username}\n\n'
                                f'IAM ユーザー名に誤りがないかご確認のうえ、'
                                f'必要に応じて再申請してください。'
                            )}}
                        }
                    )
                except ClientError as ses_err:
                    print(f"SES send error: {ses_err}")
            return {'username': username, 'status': 'TARGET_NOT_FOUND'}
        raise
    keys = iam.list_access_keys(UserName=username).get('AccessKeyMetadata', [])
    for k in keys:
        iam.delete_access_key(UserName=username, AccessKeyId=k['AccessKeyId'])
    try:
        iam.delete_login_profile(UserName=username)
    except ClientError:
        pass
    policies = iam.list_user_policies(UserName=username).get('PolicyNames', [])
    for p in policies:
        iam.delete_user_policy(UserName=username, PolicyName=p)
    attached = iam.list_attached_user_policies(UserName=username).get('AttachedPolicies', [])
    for p in attached:
        iam.detach_user_policy(UserName=username, PolicyArn=p['PolicyArn'])
    groups = iam.list_groups_for_user(UserName=username).get('Groups', [])
    for g in groups:
        iam.remove_user_from_group(GroupName=g['GroupName'], UserName=username)
    # 利用者にSESで削除完了通知を送信
    if SES_FROM_ADDRESS and target_email:
        try:
            ses.send_email(
                Source=SES_FROM_ADDRESS,
                Destination={'ToAddresses': [target_email]},
                Message={
                    'Subject': {'Data': '【完了】IAM ユーザー削除 完了通知'},
                    'Body': {'Text': {'Data': (
                        f'IAM ユーザー の削除が完了しました。\n\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n'
                        f'IAM ユーザー名: {username}\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n\n'
                        f'ご不明な点がございましたら管理者にお問い合わせください。\n'
                    )}}
                }
            )
        except ClientError as e:
            print(f"SES send error: {e}")
    iam.delete_user(UserName=username)
    sns.publish(
        TopicArn=SNS_TOPIC_ARN,
        Subject='【管理者向け】IAM ユーザー削除 完了通知',
        Message=f'IAM ユーザー: {username}\n申請者メール: {requested_by}\n\n利用者へ認証情報を直接通知済みです。'
    )
    return {'username': username, 'status': 'DELETE_COMPLETED'}
def handle_reset_password(event):
    target_email = event.get('targetEmail', '').strip().lower()
    requested_by = event.get('requestedBy', '')
    username = generate_username(target_email)
    # コンソールアクセスが無効の場合、パスワードリセットは不要
    if not ENABLE_CONSOLE_ACCESS:
        # 管理者に SNS で通知
        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject='【管理者向け】パスワードリセット 処理中止通知',
            Message=(
                f'パスワードリセット申請を受けましたが、コンソールアクセスが'
                f'無効のため処理を中止しました。\n\n'
                f'対象 IAM ユーザー: {username}\n'
                f'申請者メール: {requested_by}'
            )
        )
        # 申請者に SES で通知
        if SES_FROM_ADDRESS and requested_by:
            try:
                ses.send_email(
                    Source=SES_FROM_ADDRESS,
                    Destination={'ToAddresses': [requested_by]},
                    Message={
                        'Subject': {'Data': '【通知】パスワードリセット 処理中止通知'},
                        'Body': {'Text': {'Data': (
                            f'パスワードリセット申請を受けましたが、コンソールアクセスが'
                            f'無効のため処理を中止しました。\n\n'
                            f'対象 IAM ユーザー: {username}\n\n'
                            f'管理者にお問い合わせください。'
                        )}}
                    }
                )
            except ClientError as ses_err:
                print(f"SES send error: {ses_err}")
        return {'username': username, 'status': 'CONSOLE_ACCESS_DISABLED'}
    try:
        iam.get_user(UserName=username)
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchEntity':
            # 管理者に SNS で通知
            sns.publish(
                TopicArn=SNS_TOPIC_ARN,
                Subject='【管理者向け】対象 IAM ユーザーが見つかりません 処理中止通知',
                Message=(
                    f'パスワードリセット申請を処理しましたが、'
                    f'対象ユーザーが存在しないため処理を中止しました。\n\n'
                    f'対象 IAM ユーザー: {username}\n'
                    f'申請者メール: {requested_by}'
                )
            )
            # 申請者に SES で通知
            if SES_FROM_ADDRESS and requested_by:
                try:
                    ses.send_email(
                        Source=SES_FROM_ADDRESS,
                        Destination={'ToAddresses': [requested_by]},
                        Message={
                            'Subject': {'Data': '【通知】パスワードリセット 処理中止通知'},
                            'Body': {'Text': {'Data': (
                                f'パスワードリセット申請を処理しましたが、'
                                f'対象ユーザーが存在しないため処理を中止しました。\n\n'
                                f'対象 IAM ユーザー: {username}\n\n'
                                f'メールアドレスに誤りがないかご確認のうえ、'
                                f'必要に応じて再申請してください。'
                            )}}
                        }
                    )
                except ClientError as ses_err:
                    print(f"SES send error: {ses_err}")
            return {'username': username, 'status': 'TARGET_NOT_FOUND'}
        raise
    # カスタムパスワード（12桁乱数）を常に発行
    password = generate_password_12()
    # IAM にパスワードを設定（ENABLE_CONSOLE_ACCESS=false は早期リターン済み）
    try:
        iam.update_login_profile(
            UserName=username, Password=password, PasswordResetRequired=True
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchEntity':
            # LoginProfile が存在しない場合は作成
            iam.create_login_profile(
                UserName=username, Password=password, PasswordResetRequired=True
            )
        else:
            raise
    # S3 に保存
    key = f'iam-password-reset/{username}-{int(time.time())}.txt'
    body_text = (
        f'パスワードリセット完了\n'
        f'========================================\n\n'
        f'IAM ユーザー名: {username}\n'
        f'新しいパスワード: {password}\n\n'
        f'ログイン時にパスワード変更が必要です。\n'
    )
    s3.put_object(Bucket=BUCKET_NAME, Key=key, Body=body_text.encode('utf-8'), ContentType='text/plain; charset=utf-8')
    # 48時間有効の署名付き URL
    url = s3.generate_presigned_url(
        'get_object', Params={'Bucket': BUCKET_NAME, 'Key': key}, ExpiresIn=172800
    )
    # 利用者に通知
    if SES_FROM_ADDRESS and target_email:
        try:
            ses.send_email(
                Source=SES_FROM_ADDRESS,
                Destination={'ToAddresses': [target_email]},
                Message={
                    'Subject': {'Data': '【完了】パスワードリセット 完了通知'},
                    'Body': {'Text': {'Data': (
                        f'IAMユーザー のパスワードリセットが完了しました。\n\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n'
                        f'IAM ユーザー名: {username}\n'
                        f'━━━━━━━━━━━━━━━━━━━━━━━━\n\n'
                        f'メール受信から 48時間以内に、以下の URL へアクセスし認証情報を控えてください。\n'
                        f'時間経過後は URL にアクセスできなくなりますので、ご注意ください。\n\n'
                        f'認証情報の取得 URL:\n{url}\n'
                    )}}
                }
            )
        except ClientError as e:
            print(f"SES send error: {e}")
    sns.publish(
        TopicArn=SNS_TOPIC_ARN,
        Subject='【管理者向け】パスワードリセット 完了通知',
        Message=f'IAM ユーザー: {username}\n申請者メール: {requested_by}\n\n利用者へ認証情報を直接通知済みです。'
    )
    return {'username': username, 'status': 'PASSWORD_RESET_COMPLETED'}
def generate_username(email):
    """メールアドレスをそのままIAMユーザー名として使用"""
    return email
def get_account_id():
    """AWSアカウントIDを取得"""
    sts_client = boto3.client('sts')
    return sts_client.get_caller_identity()['Account']
def generate_password_12():
    """12桁のカスタムパスワードを生成（大文字・小文字・数字・記号を含む）"""
    upper = random.choice(string.ascii_uppercase)
    lower = random.choice(string.ascii_lowercase)
    digit = random.choice(string.digits)
    symbol = random.choice('!@#$%^&*')
    # 残り8文字をランダムに
    all_chars = string.ascii_letters + string.digits + '!@#$%^&*'
    rest = ''.join(random.choices(all_chars, k=8))
    password_list = list(upper + lower + digit + symbol + rest)
    random.shuffle(password_list)
    return ''.join(password_list)
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import hashlib
import time
import uuid
import traceback
import boto3
from botocore.exceptions import ClientError
from aws_lambda_powertools import Logger
logger = Logger()
dynamodb = boto3.resource('dynamodb')
sns = boto3.client('sns')
sfn = boto3.client('stepfunctions')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
STATE_MACHINE_ARN = os.environ['STATE_MACHINE_ARN']
API_BASE = os.environ.get('API_BASE', '')
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
CORS_ORIGIN = os.environ.get('CORS_ORIGIN', '*')
CORS_HEADERS = {
    'Access-Control-Allow-Origin': CORS_ORIGIN,
    'Access-Control-Allow-Credentials': 'true',
    'Content-Type': 'application/json'
}
OPERATION_LABELS = {
    'CREATE_EXTEND_USER': 'ユーザー作成/延長',
    'DELETE_USER': 'ユーザー削除',
    'RESET_PASSWORD': 'パスワードリセット'
}
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        table = dynamodb.Table(TABLE_NAME)
        body = json.loads(event.get('body', '{}'))
        token = body.get('token', '')
        if not token:
            return response(400, {'message': 'トークンが必要です'})
        # トークン検証
        token_hash = hashlib.sha256(token.encode()).hexdigest()
        try:
            resp = table.get_item(Key={'pk': f'FORM_TOKEN#{token_hash}', 'sk': 'FORM_TOKEN'})
        except ClientError:
            return response(500, {'message': 'サーバーエラー'})
        item = resp.get('Item')
        if not item:
            return response(400, {'message': 'トークンが無効または期限切れです'})
        # 有効期限チェック
        if item.get('expiresAt', 0) < int(time.time()):
            return response(400, {'message': 'トークンが期限切れです'})
        # 使用済みチェック
        if item.get('used', False):
            return response(400, {'message': 'このトークンは既に使用されています'})
        # トークンを使用済みにする
        table.update_item(
            Key={'pk': f'FORM_TOKEN#{token_hash}', 'sk': 'FORM_TOKEN'},
            UpdateExpression='SET used = :t',
            ExpressionAttributeValues={':t': True}
        )
        operation_type = item['operationType']
        email = item['email']
        if operation_type == 'CREATE_EXTEND_USER':
            # ユーザー作成/延長: 1人ずつ個別に承認メールを送信
            people = body.get('people', [])
            for person in people:
                sfn_input = {
                    'operationType': operation_type,
                    'requestedBy': email,
                    'requestedAt': int(time.time()),
                    'people': [person]  # 1人分のみ
                }
                send_approval_request(table, operation_type, email, sfn_input, person)
        else:
            # 削除/リセット: 1件なのでそのまま
            sfn_input = {
                'operationType': operation_type,
                'requestedBy': email,
                'requestedAt': int(time.time()),
                'targetEmail': body.get('targetEmail', email),
                'reason': body.get('reason', '')
            }
            send_approval_request(table, operation_type, email, sfn_input, None)
        return response(200, {'message': '申請を受け付けました'})
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context)
        raise
def send_approval_request(table, operation_type, email, sfn_input, person):
    """1件分の承認リクエストを作成し、管理者に通知する"""
    # 承認用トークンを生成
    approval_token = str(uuid.uuid4())
    approval_hash = hashlib.sha256(approval_token.encode()).hexdigest()
    # 承認情報を DynamoDB に保存
    table.put_item(Item={
        'pk': f'APPROVAL#{approval_hash}',
        'sk': 'APPROVAL',
        'sfnInput': json.dumps(sfn_input),
        'status': 'PENDING',
        'createdAt': int(time.time()),
        'expiresAt': int(time.time()) + 604800  # 1週間有効
    })
    # 承認/拒否 URL
    approve_url = f'{API_BASE}/request/approve?token={approval_token}&action=approve'
    reject_url = f'{API_BASE}/request/approve?token={approval_token}&action=reject'
    # 読みやすいメール本文を作成
    message_body = build_notification_message(operation_type, email, sfn_input, person, approve_url, reject_url)
    # 管理者に承認依頼を通知
    operation_label = OPERATION_LABELS.get(operation_type, operation_type)
    if person:
        subject = f'【管理者向け】{operation_label} 承認依頼 - {person.get("name", "")}（{person.get("email", "")}）'
    else:
        subject = f'【管理者向け】{operation_label} 承認依頼'
    sns.publish(
        TopicArn=SNS_TOPIC_ARN,
        Subject=subject,
        Message=message_body
    )
def build_notification_message(operation_type, email, sfn_input, person, approve_url, reject_url):
    operation_label = OPERATION_LABELS.get(operation_type, operation_type)
    lines = []
    lines.append('以下の申請が届きました。内容を確認し、承認または拒否してください。')
    lines.append('')
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append(f'申請種別: {operation_label}')
    lines.append(f'申請者メール: {email}')
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append('')
    if operation_type == 'CREATE_EXTEND_USER' and person:
        purpose_labels = {
            'development': '開発', 'operation': '運用',
            'verification': '検証', 'other': 'その他'
        }
        purpose = purpose_labels.get(person.get('purposeType', ''), person.get('purposeType', ''))
        lines.append('【対象ユーザー】')
        lines.append(f'  氏名: {person.get("name", "")}')
        lines.append(f'  対象者メール: {person.get("email", "")}')
        lines.append(f'  利用目的: {purpose}')
        lines.append(f'  利用開始日: {person.get("startDate", "")}')
        lines.append(f'  利用終了日: {person.get("endDate", "")}')
        lines.append('')
    elif operation_type == 'DELETE_USER':
        lines.append(f'対象 IAM ユーザー: {sfn_input.get("targetEmail", "")}')
        lines.append(f'削除理由: {sfn_input.get("reason", "")}')
        lines.append('')
    elif operation_type == 'RESET_PASSWORD':
        lines.append(f'対象 IAM ユーザー: {sfn_input.get("targetEmail", "")}')
        lines.append(f'リセット理由: {sfn_input.get("reason", "")}')
        lines.append('')
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append('')
    lines.append('▼ 承認する場合は以下のURLをクリック:')
    lines.append(approve_url)
    lines.append('')
    lines.append('▼ 拒否する場合は以下のURLをクリック:')
    lines.append(reject_url)
    lines.append('')
    lines.append('※ このリンクは1週間有効です。')
    return '\n'.join(lines)
def response(status, body):
    return {
        'statusCode': status,
        'headers': CORS_HEADERS,
        'body': json.dumps(body)
    }
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import hashlib
import time
import traceback
import boto3
from html import escape
from botocore.exceptions import ClientError
from aws_lambda_powertools import Logger
logger = Logger()
dynamodb = boto3.resource('dynamodb')
sfn = boto3.client('stepfunctions')
sns = boto3.client('sns')
ses = boto3.client('ses')
logs_client = boto3.client('logs')
TABLE_NAME = os.environ['TABLE_NAME']
STATE_MACHINE_ARN = os.environ['STATE_MACHINE_ARN']
SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
SES_FROM_ADDRESS = os.environ.get('SES_FROM_ADDRESS', '')
ERROR_LOG_GROUP_NAME = os.environ.get('ERROR_LOG_GROUP_NAME', '')
OPERATION_LABELS = {
    'CREATE_EXTEND_USER': 'ユーザー作成/延長',
    'DELETE_USER': 'ユーザー削除',
    'RESET_PASSWORD': 'パスワードリセット'
}
@logger.inject_lambda_context
def lambda_handler(event, context):
    try:
        # API Gateway から GET パラメータを取得
        qs = event.get('queryStringParameters') or {}
        token = qs.get('token', '')
        action = qs.get('action', '')
        if not token or action not in ('approve', 'reject'):
            return html_response(400, '無効なリクエストです。')
        table = dynamodb.Table(TABLE_NAME)
        token_hash = hashlib.sha256(token.encode()).hexdigest()
        try:
            resp = table.get_item(Key={'pk': f'APPROVAL#{token_hash}', 'sk': 'APPROVAL'})
        except ClientError:
            return html_response(500, 'サーバーエラーが発生しました。')
        item = resp.get('Item')
        if not item:
            return html_response(400, '承認トークンが無効または期限切れです。')
        if item.get('expiresAt', 0) < int(time.time()):
            return html_response(400, '承認トークンが期限切れです。')
        if item.get('status') != 'PENDING':
            return html_response(400, f'この申請は既に処理済みです（ステータス: {item.get("status")}）。')
        sfn_input = json.loads(item['sfnInput'])
        operation_type = sfn_input.get('operationType', '')
        operation_label = OPERATION_LABELS.get(operation_type, operation_type)
        if action == 'approve':
            # ステータスを更新
            table.update_item(
                Key={'pk': f'APPROVAL#{token_hash}', 'sk': 'APPROVAL'},
                UpdateExpression='SET #s = :s, approvedAt = :t',
                ExpressionAttributeNames={'#s': 'status'},
                ExpressionAttributeValues={':s': 'APPROVED', ':t': int(time.time())}
            )
            # Step Functions を起動
            sfn.start_execution(
                stateMachineArn=STATE_MACHINE_ARN,
                input=json.dumps(sfn_input)
            )
            return html_response(200, f'✅ 承認しました。\n\n{operation_label}の処理を開始します。')
        elif action == 'reject':
            # ステータスを更新
            table.update_item(
                Key={'pk': f'APPROVAL#{token_hash}', 'sk': 'APPROVAL'},
                UpdateExpression='SET #s = :s, rejectedAt = :t',
                ExpressionAttributeNames={'#s': 'status'},
                ExpressionAttributeValues={':s': 'REJECTED', ':t': int(time.time())}
            )
            # 管理者SNSに拒否通知
            # 対象 IAM ユーザーを特定
            if operation_type == 'CREATE_EXTEND_USER':
                people = sfn_input.get('people', [])
                target_user = people[0].get('email', '') if people else ''
            else:
                target_user = sfn_input.get('targetEmail', '')
            sns.publish(
                TopicArn=SNS_TOPIC_ARN,
                Subject=f'【管理者向け】{operation_label} 申請拒否通知',
                Message=(
                    f'{operation_label}の申請が拒否されました。\n\n'
                    f'対象 IAM ユーザー: {target_user}\n'
                    f'申請者メール: {sfn_input.get("requestedBy", "")}'
                )
            )
            # 利用者にSESで拒否通知を送信
            applicant_email = sfn_input.get('requestedBy', '') or sfn_input.get('targetEmail', '')
            if SES_FROM_ADDRESS and applicant_email:
                try:
                    ses.send_email(
                        Source=SES_FROM_ADDRESS,
                        Destination={'ToAddresses': [applicant_email]},
                        Message={
                            'Subject': {'Data': '【通知】申請拒否通知'},
                            'Body': {'Text': {'Data': (
                                f'{operation_label}の申請は拒否されました。管理者にお問い合わせください。\n\n'
                                f'対象 IAM ユーザー: {target_user}\n'
                                f'申請種別: {operation_label}\n'
                                f'申請者メール: {applicant_email}'
                            )}}
                        }
                    )
                except ClientError as e:
                    print(f"SES send error: {e}")
            return html_response(200, f'❌ 拒否しました。\n\n{operation_label}の申請を拒否しました。')
    except Exception as e:
        logger.exception('Unhandled exception occurred')
        write_error_to_dedicated_log_group(e, context)
        raise
def html_response(status, message):
    # 承認結果をカード型で表示するブラウザ用HTMLを生成
    color = '#28a745' if status == 200 else '#dc3545'
    safe_message = escape(message).replace('\n', '<br>')
    html = f'''<!DOCTYPE html>
<html lang="ja">
<head><meta charset="UTF-8"><title>申請処理結果</title></head>
<body>
<div style="font-family:sans-serif;max-width:480px;margin:60px auto;padding:16px;text-align:center">
  <div style="padding:24px;border-radius:8px;background:#f8f9fa;border:2px solid {color};font-size:18px;line-height:1.6">{safe_message}</div>
</div>
</body>
</html>'''
    return {
        'statusCode': status,
        'headers': {
            'Content-Type': 'text/html; charset=UTF-8',
            'Cache-Control': 'no-store',
            'X-Content-Type-Options': 'nosniff'
        },
        'isBase64Encoded': False,
        'body': html
    }
def write_error_to_dedicated_log_group(error, context, extra=None):
    """例外情報をエラー専用ロググループに構造化ログとして書き込む"""
    if not ERROR_LOG_GROUP_NAME:
        return
    function_name = os.environ.get('AWS_LAMBDA_FUNCTION_NAME', 'unknown')
    stream_name = f'{function_name}/{int(time.time() * 1000)}'
    try:
        logs_client.create_log_stream(logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name)
    except logs_client.exceptions.ResourceAlreadyExistsException:
        pass
    log_event = {
        'level': 'ERROR',
        'service': os.environ.get('POWERTOOLS_SERVICE_NAME', function_name),
        'function_name': function_name,
        'request_id': getattr(context, 'aws_request_id', 'N/A'),
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%S%z'),
        'message': str(error),
        'exception_type': type(error).__name__,
        'stacktrace': traceback.format_exc()
    }
    if extra:
        log_event['extra'] = extra
    logs_client.put_log_events(
        logGroupName=ERROR_LOG_GROUP_NAME, logStreamName=stream_name,
        logEvents=[{'timestamp': int(time.time() * 1000), 'message': json.dumps(log_event, ensure_ascii=False)}]
    )

import json
import os
import base64
import gzip
import boto3
from aws_lambda_powertools import Logger
logger = Logger()
sns = boto3.client('sns')
SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
@logger.inject_lambda_context
def lambda_handler(event, context):
    """
    CloudWatch Logs サブスクリプションフィルターから呼び出される。
    エラー用ロググループに書き込まれた構造化ログをパースし、
    可読性の高い通知メッセージを作成して SNS に publish する。
    """
    # サブスクリプションフィルターからのデータをデコード
    compressed = base64.b64decode(event['awslogs']['data'])
    log_data = json.loads(gzip.decompress(compressed).decode('utf-8'))
    log_group = log_data.get('logGroup', '')
    log_stream = log_data.get('logStream', '')
    log_events = log_data.get('logEvents', [])
    for log_event in log_events:
        message_raw = log_event.get('message', '')
        error_detail = parse_error_message(message_raw)
        # 可読性の高い通知メッセージを構築
        notification = build_notification(error_detail, log_group, log_stream)
        # SNS で管理者に通知
        subject = build_subject(error_detail)
        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject=subject[:100],  # SNS Subject は100文字制限
            Message=notification
        )
        logger.info('Error notification sent', extra={
            'function_name': error_detail.get('function_name'),
            'exception_type': error_detail.get('exception_type')
        })
    return {'statusCode': 200, 'body': f'Processed {len(log_events)} error event(s)'}
def parse_error_message(message_raw: str) -> dict:
    """構造化ログメッセージを解析する"""
    try:
        return json.loads(message_raw)
    except (json.JSONDecodeError, TypeError):
        return {
            'level': 'ERROR',
            'service': 'unknown',
            'function_name': 'unknown',
            'request_id': 'N/A',
            'timestamp': 'N/A',
            'message': message_raw,
            'exception_type': 'UnknownError',
            'stacktrace': ''
        }
def build_subject(error_detail: dict) -> str:
    """SNS 通知の件名を作成"""
    service = error_detail.get('service', 'unknown')
    exception_type = error_detail.get('exception_type', 'Error')
    return f'【Lambda エラー】{service} - {exception_type}'
def build_notification(error_detail: dict, log_group: str, log_stream: str) -> str:
    """可読性の高い通知メッセージを構築"""
    lines = []
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append('  Lambda 関数でエラーが発生しました')
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append('')
    lines.append('【基本情報】')
    lines.append(f'  サービス名    : {error_detail.get("service", "N/A")}')
    lines.append(f'  関数名        : {error_detail.get("function_name", "N/A")}')
    lines.append(f'  リクエストID  : {error_detail.get("request_id", "N/A")}')
    lines.append(f'  発生日時      : {error_detail.get("timestamp", "N/A")}')
    lines.append('')
    lines.append('【エラー内容】')
    lines.append(f'  例外タイプ    : {error_detail.get("exception_type", "N/A")}')
    lines.append(f'  メッセージ    : {error_detail.get("message", "N/A")}')
    lines.append('')
    # スタックトレース
    stacktrace = error_detail.get('stacktrace', '')
    if stacktrace:
        lines.append('【スタックトレース】')
        # 長すぎる場合は先頭1000文字に制限
        if len(stacktrace) > 1000:
            stacktrace = stacktrace[:1000] + '\n... (truncated)'
        lines.append(stacktrace)
        lines.append('')
    # 追加コンテキスト
    extra = error_detail.get('extra', {})
    if extra:
        lines.append('【追加コンテキスト】')
        extra_str = json.dumps(extra, ensure_ascii=False, indent=2)
        if len(extra_str) > 500:
            extra_str = extra_str[:500] + '\n... (truncated)'
        lines.append(extra_str)
        lines.append('')
    lines.append('【ログ情報】')
    lines.append(f'  ロググループ  : {log_group}')
    lines.append(f'  ログストリーム: {log_stream}')
    lines.append('')
    lines.append('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
    lines.append('※ マネジメントコンソールにて、CloudWatch Logs を開き、詳細を確認してください。')
    return '\n'.join(lines)

<!DOCTYPE html>
<html lang="ja">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>IAM ユーザー申請ポータル</title>
  <style>
    body { font-family: sans-serif; max-width: 480px; margin: 40px auto; padding: 0 16px; }
    label { display: block; margin-top: 16px; }
    input, select, button { width: 100%; padding: 8px; margin-top: 4px; box-sizing: border-box; }
    input[type="radio"] { width: auto; margin-right: 8px; }
    fieldset label { display: flex; align-items: center; margin-top: 12px; }
    button { margin-top: 24px; cursor: pointer; }
    fieldset { margin-top: 16px; }
    .error { color: red; margin-top: 8px; }
    .hidden { display: none; }
  </style>
</head>
<body>
  <h1>IAM ユーザー申請ポータル</h1>
  <!-- ログインフォーム -->
  <div id="login-section">
    <label>ユーザー名
      <input type="text" id="portal-username" required>
    </label>
    <label>パスワード
      <input type="password" id="portal-password" required>
    </label>
    <button id="login-btn">ログイン</button>
    <p id="login-error" class="error hidden"></p>
  </div>
  <!-- 申請種別選択フォーム -->
  <div id="request-section" class="hidden">
    <label>メールアドレス
      <input type="email" id="email" required placeholder="user@example.com">
    </label>
    <fieldset>
      <legend>申請種別</legend>
      <label><input type="radio" name="operationType" value="CREATE_EXTEND_USER" required> ユーザー作成/延長</label>
      <label><input type="radio" name="operationType" value="DELETE_USER"> ユーザー削除</label>
      <label><input type="radio" name="operationType" value="RESET_PASSWORD"> パスワードリセット</label>
    </fieldset>
    <button id="submit-btn">申請フォームを送信</button>
    <p id="request-error" class="error hidden"></p>
    <p id="request-success" class="hidden" style="color:green"></p>
  </div>
  <script>
    const API_BASE = ''; // 手順 8-1 で控えた Amazon API Gateway の URL を設定
    document.getElementById('login-btn').addEventListener('click', async () => {
      const username = document.getElementById('portal-username').value;
      const password = document.getElementById('portal-password').value;
      try {
        const res = await fetch(API_BASE + '/auth/login', {
          method: 'POST', headers: {'Content-Type':'application/json'},
          body: JSON.stringify({ username, password }), credentials: 'include'
        });
        if (res.ok) {
          document.getElementById('login-section').classList.add('hidden');
          document.getElementById('request-section').classList.remove('hidden');
        } else {
          document.getElementById('login-error').textContent = 'パスワードが正しくありません';
          document.getElementById('login-error').classList.remove('hidden');
        }
      } catch(e) { alert('通信エラー'); }
    });
    document.getElementById('submit-btn').addEventListener('click', async () => {
      const email = document.getElementById('email').value;
      const opType = document.querySelector('input[name="operationType"]:checked');
      if (!email || !opType) { alert('すべて入力してください'); return; }
      try {
        const res = await fetch(API_BASE + '/request/send-form', {
          method: 'POST', headers: {'Content-Type':'application/json'},
          body: JSON.stringify({ email, operationType: opType.value }), credentials: 'include'
        });
        const data = await res.json();
        if (res.ok) {
          document.getElementById('request-success').textContent = 'メールを送信しました。受信トレイを確認してください。';
          document.getElementById('request-success').classList.remove('hidden');
          document.getElementById('request-error').classList.add('hidden');
          alert('メールを送信しました。受信トレイを確認してください。\n\nブラウザにてこのタブを閉じてください。');
        } else {
          document.getElementById('request-error').textContent = data.message || 'エラーが発生しました';
          document.getElementById('request-error').classList.remove('hidden');
        }
      } catch(e) { alert('通信エラー'); }
    });
  </script>
</body>
</html>

// Amazon API Gateway の URL を設定してください
const API_BASE = ''; // 手順 8-1 で控えた Amazon API Gateway の URL
// URL からトークンを取得
const params = new URLSearchParams(window.location.search);
const token = params.get('token');
// 対象メールアドレスの自動設定（削除・リセット用）
const targetEmailEl = document.getElementById('targetEmail');
const targetUsernameEl = document.getElementById('targetUsername');
if (targetEmailEl && token) {
  // トークン検証 API から対象メールを取得
  fetch(API_BASE + '/request/verify-token?token=' + token, { mode: 'cors' })
    .then(r => r.json())
    .then(data => { if (data.email) targetEmailEl.value = data.email; });
}
// 送信前バリデーション関数
function validateForm() {
  const path = window.location.pathname;
  const errors = [];
  if (path.includes('create')) {
    const rows = document.querySelectorAll('.person-row');
    rows.forEach((row, i) => {
      const name = row.querySelector('[name="name"]').value.trim();
      const email = row.querySelector('[name="email"]').value.trim();
      const startDate = row.querySelector('[name="startDate"]').value;
      const endDate = row.querySelector('[name="endDate"]').value;
      if (!name) errors.push(`行${i+1}: 氏名を入力してください`);
      if (!email) errors.push(`行${i+1}: メールアドレスを入力してください`);
      if (!startDate) errors.push(`行${i+1}: 利用開始日を入力してください`);
      if (!endDate) errors.push(`行${i+1}: 利用終了日を入力してください`);
      if (startDate && endDate && startDate > endDate) errors.push(`行${i+1}: 利用終了日は開始日以降にしてください`);
    });
  } else if (path.includes('delete')) {
    const target = (targetUsernameEl || targetEmailEl);
    if (target && !target.value.trim()) errors.push('対象 IAM ユーザー名を入力してください');
    const reason = document.getElementById('reason');
    if (reason && !reason.value) errors.push('削除理由を選択してください');
    const confirm = document.getElementById('confirmDelete');
    if (confirm && !confirm.checked) errors.push('削除確認にチェックを入れてください');
  } else if (path.includes('reset-password')) {
    if (targetEmailEl && !targetEmailEl.value.trim()) errors.push('対象メールアドレスを入力してください');
    const reason = document.getElementById('reason');
    if (reason && !reason.value.trim()) errors.push('リセット理由を入力してください');
    const notify = document.getElementById('notifyUser');
    if (notify && !notify.checked) errors.push('確認にチェックを入れてください');
  }
  return errors;
}
// 送信ボタン
const submitBtn = document.getElementById('submit-btn');
if (submitBtn) {
  submitBtn.addEventListener('click', async () => {
    // バリデーション
    const errors = validateForm();
    if (errors.length > 0) {
      alert('入力内容に不備があります:\n\n' + errors.join('\n'));
      return;
    }
    // 確認ポップアップ
    if (!confirm('この内容で申請を送信してよろしいですか？')) return;
    // ページのパスから申請種別を判定
    const path = window.location.pathname;
    let payload = { token };
    if (path.includes('create')) {
      const rows = document.querySelectorAll('.person-row');
      const people = [];
      rows.forEach(row => {
        people.push({
          name: row.querySelector('[name="name"]').value,
          email: row.querySelector('[name="email"]').value,
          purposeType: row.querySelector('[name="purposeType"]').value,
          startDate: row.querySelector('[name="startDate"]').value,
          endDate: row.querySelector('[name="endDate"]').value
        });
      });
      payload.people = people;
    } else if (path.includes('delete')) {
      payload.targetEmail = targetUsernameEl ? targetUsernameEl.value : (targetEmailEl ? targetEmailEl.value : '');
      const reasonEl = document.getElementById('reason');
      const detailEl = document.getElementById('reasonDetail');
      payload.reason = reasonEl ? reasonEl.value : '';
      if (detailEl && detailEl.value.trim()) payload.reasonDetail = detailEl.value;
    } else if (path.includes('reset-password')) {
      payload.targetEmail = document.getElementById('targetEmail').value;
      payload.reason = document.getElementById('reason').value;
    }
    try {
      const res = await fetch(API_BASE + '/request/submit', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        mode: 'cors',
        body: JSON.stringify(payload)
      });
      if (res.ok) {
        alert('申請を受け付けました。管理者の承認をお待ちください。\n\nブラウザにてこのタブを閉じてください。');
      } else {
        const data = await res.json();
        alert(data.message || 'エラーが発生しました');
      }
    } catch (e) { alert('通信エラー'); }
  });
}
// 申請者追加ボタン（create.html 用）-- 行削除ボタン付き
const addBtn = document.getElementById('add-person');
if (addBtn) {
  let count = 1;
  addBtn.addEventListener('click', () => {
    if (count >= 20) { alert('最大20人までです'); return; }
    count++;
    const tmpl = document.getElementById('person-1').cloneNode(true);
    tmpl.id = 'person-' + count;
    tmpl.querySelectorAll('input, select').forEach(el => el.value = '');
    // 行削除ボタンを追加
    const removeBtn = document.createElement('button');
    removeBtn.textContent = 'この行を削除';
    removeBtn.type = 'button';
    removeBtn.style.marginTop = '8px';
    removeBtn.style.background = '#dc3545';
    removeBtn.style.color = '#fff';
    removeBtn.style.border = 'none';
    removeBtn.style.padding = '6px 12px';
    removeBtn.style.cursor = 'pointer';
    removeBtn.addEventListener('click', () => { tmpl.remove(); count--; });
    tmpl.appendChild(removeBtn);
    // カレンダー制限を適用
    if (typeof applyDateConstraints === 'function') applyDateConstraints(tmpl);
    document.getElementById('form-area').appendChild(tmpl);
  });
}

<!DOCTYPE html>
<html lang="ja">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>IAM ユーザー作成/延長申請</title>
  <style>body{font-family:sans-serif;max-width:560px;margin:40px auto;padding:0 16px}label{display:block;margin-top:12px}input,select,textarea,button{width:100%;padding:8px;margin-top:4px;box-sizing:border-box}button{margin-top:24px;cursor:pointer}.person-row{border:1px solid #ccc;padding:12px;margin-top:12px}</style>
</head>
<body>
  <h1>IAM ユーザー作成/延長申請</h1>
  <div id="form-area">
    <div class="person-row" id="person-1">
      <label>氏名 <input name="name" required maxlength="100" placeholder="山田 太郎"></label>
      <label>メールアドレス <input name="email" type="email" required placeholder="user@example.com"></label>
      <label>利用目的
        <select name="purposeType" required>
          <option value="development">開発</option>
          <option value="operation">運用</option>
          <option value="verification">検証</option>
          <option value="other">その他</option>
        </select>
      </label>
      <label>利用開始日 <input name="startDate" type="date" required></label>
      <label>利用終了日 <input name="endDate" type="date" required></label>
    </div>
  </div>
  <button id="add-person">申請者を追加</button>
  <button id="submit-btn">確認して送信</button>
  <script>
    // カレンダー制限: 利用終了日は年度末まで（3月は翌年度末まで選択可能）
    function getFiscalYearEnd() {
      const now = new Date();
      const month = now.getMonth(); // 0=1月, 1=2月, 2=3月, ...
      if (month === 2) {
        // 3月: 年度切り替え時期のため、翌年度末（来年の3月31日）まで選択可能
        return (now.getFullYear() + 1) + '-03-31';
      } else if (month < 2) {
        // 1月・2月: 今年度末（今年の3月31日）
        return now.getFullYear() + '-03-31';
      } else {
        // 4月〜12月: 翌年度末（翌年の3月31日）
        return (now.getFullYear() + 1) + '-03-31';
      }
    }
    function applyDateConstraints(row) {
      const today = new Date().toISOString().split('T')[0];
      const endMax = getFiscalYearEnd();
      row.querySelector('[name="startDate"]').setAttribute('min', today);
      row.querySelector('[name="endDate"]').setAttribute('min', today);
      row.querySelector('[name="endDate"]').setAttribute('max', endMax);
    }
    applyDateConstraints(document.getElementById('person-1'));
  </script>
  <script src="form.js"></script>
</body>
</html>

<!DOCTYPE html>
<html lang="ja">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>IAM ユーザー削除申請</title>
  <style>
    body{font-family:sans-serif;max-width:480px;margin:40px auto;padding:0 16px}
    label{display:block;margin-top:12px}
    input,textarea,select,button{width:100%;padding:8px;margin-top:4px;box-sizing:border-box}
    input[type="checkbox"]{width:auto;margin-right:8px}
    .checkbox-label{display:flex;align-items:flex-start;margin-top:16px}
    button{margin-top:24px;cursor:pointer}
  </style>
</head>
<body>
  <h1>IAM ユーザー削除申請</h1>
  <label>対象 IAM ユーザー名 <input id="targetUsername" type="text" required placeholder="user@example.com"></label>
  <label>削除理由
    <select id="reason" required>
      <option value="">-- 選択してください --</option>
      <option value="project_end">プロジェクト終了</option>
      <option value="transfer">異動・退職</option>
      <option value="consolidation">アカウント統合</option>
      <option value="security">セキュリティ上の理由</option>
      <option value="other">その他</option>
    </select>
  </label>
  <label id="reason-detail-label" style="display:none">詳細理由 <textarea id="reasonDetail" maxlength="500"></textarea></label>
  <label class="checkbox-label"><input type="checkbox" id="confirmDelete" required> 対象 IAM ユーザーを削除することを確認しました</label>
  <button id="submit-btn">削除申請を確認</button>
  <script>
    document.getElementById('reason').addEventListener('change', function() {
      document.getElementById('reason-detail-label').style.display = this.value === 'other' ? 'block' : 'none';
    });
  </script>
  <script src="form.js"></script>
</body>
</html>

<!DOCTYPE html>
<html lang="ja">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>パスワードリセット申請</title>
  <style>
    body{font-family:sans-serif;max-width:480px;margin:40px auto;padding:0 16px}
    label{display:block;margin-top:12px}
    input,textarea,button{width:100%;padding:8px;margin-top:4px;box-sizing:border-box}
    input[type="checkbox"]{width:auto;margin-right:8px}
    .checkbox-label{display:flex;align-items:flex-start;margin-top:16px}
    button{margin-top:24px;cursor:pointer}
  </style>
</head>
<body>
  <h1>パスワードリセット申請</h1>
  <label>対象メールアドレス <input id="targetEmail" type="email" required placeholder="user@example.com"></label>
  <label>リセット理由 <textarea id="reason" required maxlength="500"></textarea></label>
  <label class="checkbox-label"><input type="checkbox" id="notifyUser" required> パスワードリセット後、利用者に新しい認証情報の取得 URL が届くことを確認しました</label>
  <button id="submit-btn">パスワードリセット申請を確認</button>
  <script src="form.js"></script>
</body>
</html>