ALBが自動確保するEIPにタグが付かない問題を、EventBridge + Lambdaで自動解決する

AWSTemplateFormatVersion: '2010-09-09'
Description: Auto-tag ALB-managed EIPs with specified tag from parent ALB
Parameters:
  TagKey:
    Type: String
    Default: Name
    Description: ALBからEIPにコピーするタグのキー名
Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EipAutoTagPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeAddresses
                  - ec2:DescribeNetworkInterfaces
                  - ec2:CreateTags
                Resource: '*'
              - Effect: Allow
                Action:
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeTags
                Resource: '*'
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
  TagEipFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: eip-auto-tag-from-alb
      Runtime: python3.12
      Handler: index.handler
      Timeout: 60
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          TAG_KEY: !Ref TagKey
      Code:
        ZipFile: |
          import boto3, time, os
          ec2 = boto3.client('ec2')
          elbv2 = boto3.client('elbv2')
          TAG_KEY = os.environ['TAG_KEY']
          def handler(event, context):
              alloc_id = event['detail']['responseElements']['allocationId']
              print(f"New EIP: {alloc_id}")
              for _ in range(6):
                  resp = ec2.describe_addresses(AllocationIds=[alloc_id])
                  addr = resp['Addresses'][0]
                  if addr.get('ServiceManaged') != 'alb':
                      print("Not ALB-managed, skipping")
                      return
                  if addr.get('NetworkInterfaceId'):
                      break
                  time.sleep(5)
              else:
                  raise RuntimeError("ALB-managed EIP is not yet associated; retrying")
              eni_id = addr['NetworkInterfaceId']
              eni = ec2.describe_network_interfaces(NetworkInterfaceIds=[eni_id])
              desc = eni['NetworkInterfaces'][0].get('Description', '')
              if not desc.startswith('ELB app/'):
                  print(f"ENI description not ALB pattern: {desc}")
                  return
              alb_name = desc.split('/')[1]
              albs = elbv2.describe_load_balancers(Names=[alb_name])
              alb_arn = albs['LoadBalancers'][0]['LoadBalancerArn']
              tags_resp = elbv2.describe_tags(ResourceArns=[alb_arn])
              tag_value = None
              for tag in tags_resp['TagDescriptions'][0]['Tags']:
                  if tag['Key'] == TAG_KEY:
                      tag_value = tag['Value']
                      break
              if not tag_value:
                  print(f"ALB {alb_name} has no {TAG_KEY} tag, skipping")
                  return
              ec2.create_tags(Resources=[alloc_id], Tags=[{'Key': TAG_KEY, 'Value': tag_value}])
              print(f"Tagged {alloc_id} with {TAG_KEY}={tag_value}")
  EventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: eip-allocate-detect
      State: ENABLED
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - ec2.amazonaws.com
          eventName:
            - AllocateAddress
      Targets:
        - Arn: !GetAtt TagEipFunction.Arn
          Id: TagEipLambda
  LambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref TagEipFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EventRule.Arn