AWS Client VPN 高度機能ガイド - セキュアリモートアクセスの実装 ​

import json
import boto3
from datetime import datetime, timezone

def lambda_handler(event, context):
    """
    時間とユーザー属性に基づく動的アクセス制御
    """
    ec2_client = boto3.client('ec2')
    current_hour = datetime.now(timezone.utc).hour
    user_group = event['user_attributes']['memberOf']
    
    # 営業時間外は営業部門のアクセス制限
    if 'Sales' in user_group and (current_hour < 8 or current_hour > 18):
        response = ec2_client.revoke_client_vpn_authorization_rule(
            ClientVpnEndpointId='cvpn-endpoint-xxx',
            TargetNetworkCidr='10.2.10.0/24',
            AccessGroupId='Sales'
        )
        return {
            'statusCode': 200,
            'body': json.dumps('Sales access temporarily restricted')
        }
    
    return {
        'statusCode': 200,
        'body': json.dumps('Access control applied successfully')
    }

import boto3
import json
from datetime import datetime

def get_active_connections():
    # ここでアクティブな接続数を取得するロジックを実装します。
    # 例: return 10
    return 0

def put_custom_metrics(event, context):
    """
    Client VPN接続状況のカスタムメトリクス作成
    """
    cloudwatch = boto3.client('cloudwatch')
    
    # アクティブ接続数
    active_connections = get_active_connections()
    
    cloudwatch.put_metric_data(
        Namespace='AWS/ClientVPN/Custom',
        MetricData=[
            {
                'MetricName': 'ActiveConnections',
                'Value': active_connections,
                'Unit': 'Count',
                'Dimensions': [
                    {
                        'Name': 'EndpointId',
                        'Value': 'cvpn-endpoint-xxx'
                    }
                ]
            }
        ]
    )

import boto3
from datetime import datetime, timedelta, timezone

def send_renewal_alert(certificate_arn, days_until_expiry):
    # ここでアラートを送信するロジックを実装します。
    print(f"Certificate {certificate_arn} will expire in {days_until_expiry} days.")

def certificate_renewal_check():
    """
    証明書期限チェックと自動更新
    """
    acm_client = boto3.client('acm')
    
    # 証明書リスト取得
    certificates = acm_client.list_certificates()
    
    for cert in certificates['CertificateSummaryList']:
        cert_details = acm_client.describe_certificate(
            CertificateArn=cert['CertificateArn']
        )
        
        expiry_date = cert_details['Certificate']['NotAfter']
        days_until_expiry = (expiry_date - datetime.now(timezone.utc)).days
        
        # 30日前に更新アラート
        if days_until_expiry <= 30:
            send_renewal_alert(cert['CertificateArn'], days_until_expiry)