Dockerイメージのスキャンを追加

[yutaro-sakamoto]

概要

CIでDockerイメージのスキャンを追加

変更点

変更点や修正箇所を箇条書きで記載する

• TrivyによるDockerイメージのスキャンを追加

影響範囲

なし

テスト

なし

関連Issue

なし

関連Pull Request

なし

その他

なし

[github-actions]

cdk diffの結果

Stack StartCDKStack
IAM Statement Changes
┌───┬────────────────────────────────────────────────────────────────────────────────────────────────────────┬────────┬───────────────────────────────────┬────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/ExecutionRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/TaskRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/web/LogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${ECS/Service/TaskDef/ExecutionRole} │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${Network/VpcFlowLogGroupRole} │ │
│ │ │ │ logs:DescribeLogStreams │ │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ sts:AssumeRole │ Service:vpc-flow-logs.amazonaws.com │ │
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ iam:PassRole │ AWS:${Network/VpcFlowLogGroupRole} │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:ec2:ap-northeast-1:${AWS::AccountId}:security-group/${NetworkVpc7FB7348F.DefaultSecurityGroup} │ Allow │ ec2:AuthorizeSecurityGroupEgress │ AWS:${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ │
│ │ │ │ ec2:AuthorizeSecurityGroupIngress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupEgress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupIngress │ │ │
└───┴────────────────────────────────────────────────────────────────────────────────────────────────────────┴────────┴───────────────────────────────────┴────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ {"Fn::Sub":"arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"} │
└───┴────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬──────────────────────────────────────────────┬─────┬────────────┬──────────────────────────────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ In │ TCP 80 │ Everyone (IPv4) │
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ Out │ TCP 8080 │ ${ECS/Service/Service/SecurityGroup.GroupId} │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ In │ TCP 8080 │ ${ECS/Service/LB/SecurityGroup.GroupId} │
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴──────────────────────────────────────────────┴─────┴────────────┴──────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See aws/aws-cdk#1299)

Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}

Resources
[+] AWS::EC2::VPC Network/Vpc NetworkVpc7FB7348F
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet1/Subnet NetworkVpcPublicSubnet1Subnet36933139
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet1/RouteTable NetworkVpcPublicSubnet1RouteTable30235CE2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet1/RouteTableAssociation NetworkVpcPublicSubnet1RouteTableAssociation643926C7
[+] AWS::EC2::Route Network/Vpc/PublicSubnet1/DefaultRoute NetworkVpcPublicSubnet1DefaultRoute31EC04EC
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet1/EIP NetworkVpcPublicSubnet1EIPE0D52090
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet1/NATGateway NetworkVpcPublicSubnet1NATGateway64781A21
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet2/Subnet NetworkVpcPublicSubnet2SubnetC427CCE0
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet2/RouteTable NetworkVpcPublicSubnet2RouteTable0FACEBB2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet2/RouteTableAssociation NetworkVpcPublicSubnet2RouteTableAssociationC662643B
[+] AWS::EC2::Route Network/Vpc/PublicSubnet2/DefaultRoute NetworkVpcPublicSubnet2DefaultRoute0CF082AB
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet2/EIP NetworkVpcPublicSubnet2EIP24F41572
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet2/NATGateway NetworkVpcPublicSubnet2NATGateway42CB86F5
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet1/Subnet NetworkVpcPrivateSubnet1Subnet6DD86AE6
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet1/RouteTable NetworkVpcPrivateSubnet1RouteTable7D7AA3CD
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet1/RouteTableAssociation NetworkVpcPrivateSubnet1RouteTableAssociation327CA62F
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet1/DefaultRoute NetworkVpcPrivateSubnet1DefaultRoute08635105
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet2/Subnet NetworkVpcPrivateSubnet2Subnet1BDBE877
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet2/RouteTable NetworkVpcPrivateSubnet2RouteTableC48862D1
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet2/RouteTableAssociation NetworkVpcPrivateSubnet2RouteTableAssociation89A2F1E8
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet2/DefaultRoute NetworkVpcPrivateSubnet2DefaultRouteA15DC6D5
[+] AWS::EC2::InternetGateway Network/Vpc/IGW NetworkVpcIGW6BEA7B02
[+] AWS::EC2::VPCGatewayAttachment Network/Vpc/VPCGW NetworkVpcVPCGW8F3799B5
[+] Custom::VpcRestrictDefaultSG Network/Vpc/RestrictDefaultSecurityGroupCustomResource NetworkVpcRestrictDefaultSecurityGroupCustomResource491E144D
[+] AWS::EC2::VPCEndpoint Network/S3Endpoint NetworkS3EndpointDED08CEB
[+] AWS::Logs::LogGroup Network/VpcFlowLogGroup NetworkVpcFlowLogGroup782DD453
[+] AWS::IAM::Role Network/VpcFlowLogGroupRole NetworkVpcFlowLogGroupRoleF6875B51
[+] AWS::IAM::Policy Network/VpcFlowLogGroupRole/DefaultPolicy NetworkVpcFlowLogGroupRoleDefaultPolicyDA3C2D9D
[+] AWS::EC2::FlowLog Network/FlowLog/FlowLog NetworkFlowLog0C7D188B
[+] AWS::IAM::Role Custom::VpcRestrictDefaultSGCustomResourceProvider/Role CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0
[+] AWS::Lambda::Function Custom::VpcRestrictDefaultSGCustomResourceProvider/Handler CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E
[+] AWS::ECS::Cluster ECS/EcsCluster ECSEcsCluster331AD70F
[+] AWS::ElasticLoadBalancingV2::LoadBalancer ECS/Service/LB ECSServiceLBB8C98433
[+] AWS::EC2::SecurityGroup ECS/Service/LB/SecurityGroup ECSServiceLBSecurityGroup338826B7
[+] AWS::EC2::SecurityGroupEgress ECS/Service/LB/SecurityGroup/to StartCDKStackECSServiceSecurityGroupC4ABAEC6:8080 ECSServiceLBSecurityGrouptoStartCDKStackECSServiceSecurityGroupC4ABAEC680808D82A131
[+] AWS::ElasticLoadBalancingV2::Listener ECS/Service/LB/PublicListener ECSServiceLBPublicListener0D5AFD27
[+] AWS::ElasticLoadBalancingV2::TargetGroup ECS/Service/LB/PublicListener/ECSGroup ECSServiceLBPublicListenerECSGroupAE0D8C7E
[+] AWS::IAM::Role ECS/Service/TaskDef/TaskRole ECSServiceTaskDefTaskRoleDA8C6EA9
[+] AWS::ECS::TaskDefinition ECS/Service/TaskDef ECSServiceTaskDef79F7AD53
[+] AWS::Logs::LogGroup ECS/Service/TaskDef/web/LogGroup ECSServiceTaskDefwebLogGroup715C1949
[+] AWS::IAM::Role ECS/Service/TaskDef/ExecutionRole ECSServiceTaskDefExecutionRole4BF55744
[+] AWS::IAM::Policy ECS/Service/TaskDef/ExecutionRole/DefaultPolicy ECSServiceTaskDefExecutionRoleDefaultPolicyFA35610E
[+] AWS::ECS::Service ECS/Service/Service/Service ECSService8D71BA38
[+] AWS::EC2::SecurityGroup ECS/Service/Service/SecurityGroup ECSServiceSecurityGroup28D36F43
[+] AWS::EC2::SecurityGroupIngress ECS/Service/Service/SecurityGroup/from StartCDKStackECSServiceLBSecurityGroup32837B8B:8080 ECSServiceSecurityGroupfromStartCDKStackECSServiceLBSecurityGroup32837B8B80801802154D

Outputs
[+] Output ECS/Service/LoadBalancerDNS ECSServiceLoadBalancerDNS9E417FBD: {"Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}
[+] Output ECS/Service/ServiceURL ECSServiceServiceURL4F9DCC59: {"Value":{"Fn::Join":["",["http://",{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}]]}}
[+] Output LoadBalancerDNS LoadBalancerDNS: {"Description":"The DNS name of the ALB","Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}

✨ Number of stacks with differences: 1

[github-actions]

cdk diffの結果

Stack StartCDKStack
IAM Statement Changes
┌───┬────────────────────────────────────────────────────────────────────────────────────────────────────────┬────────┬───────────────────────────────────┬────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/ExecutionRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/TaskRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/web/LogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${ECS/Service/TaskDef/ExecutionRole} │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${Network/VpcFlowLogGroupRole} │ │
│ │ │ │ logs:DescribeLogStreams │ │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ sts:AssumeRole │ Service:vpc-flow-logs.amazonaws.com │ │
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ iam:PassRole │ AWS:${Network/VpcFlowLogGroupRole} │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:ec2:ap-northeast-1:${AWS::AccountId}:security-group/${NetworkVpc7FB7348F.DefaultSecurityGroup} │ Allow │ ec2:AuthorizeSecurityGroupEgress │ AWS:${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ │
│ │ │ │ ec2:AuthorizeSecurityGroupIngress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupEgress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupIngress │ │ │
└───┴────────────────────────────────────────────────────────────────────────────────────────────────────────┴────────┴───────────────────────────────────┴────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ {"Fn::Sub":"arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"} │
└───┴────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬──────────────────────────────────────────────┬─────┬────────────┬──────────────────────────────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ In │ TCP 80 │ Everyone (IPv4) │
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ Out │ TCP 8080 │ ${ECS/Service/Service/SecurityGroup.GroupId} │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ In │ TCP 8080 │ ${ECS/Service/LB/SecurityGroup.GroupId} │
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴──────────────────────────────────────────────┴─────┴────────────┴──────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See aws/aws-cdk#1299)

Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}

Resources
[+] AWS::EC2::VPC Network/Vpc NetworkVpc7FB7348F
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet1/Subnet NetworkVpcPublicSubnet1Subnet36933139
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet1/RouteTable NetworkVpcPublicSubnet1RouteTable30235CE2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet1/RouteTableAssociation NetworkVpcPublicSubnet1RouteTableAssociation643926C7
[+] AWS::EC2::Route Network/Vpc/PublicSubnet1/DefaultRoute NetworkVpcPublicSubnet1DefaultRoute31EC04EC
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet1/EIP NetworkVpcPublicSubnet1EIPE0D52090
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet1/NATGateway NetworkVpcPublicSubnet1NATGateway64781A21
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet2/Subnet NetworkVpcPublicSubnet2SubnetC427CCE0
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet2/RouteTable NetworkVpcPublicSubnet2RouteTable0FACEBB2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet2/RouteTableAssociation NetworkVpcPublicSubnet2RouteTableAssociationC662643B
[+] AWS::EC2::Route Network/Vpc/PublicSubnet2/DefaultRoute NetworkVpcPublicSubnet2DefaultRoute0CF082AB
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet2/EIP NetworkVpcPublicSubnet2EIP24F41572
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet2/NATGateway NetworkVpcPublicSubnet2NATGateway42CB86F5
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet1/Subnet NetworkVpcPrivateSubnet1Subnet6DD86AE6
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet1/RouteTable NetworkVpcPrivateSubnet1RouteTable7D7AA3CD
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet1/RouteTableAssociation NetworkVpcPrivateSubnet1RouteTableAssociation327CA62F
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet1/DefaultRoute NetworkVpcPrivateSubnet1DefaultRoute08635105
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet2/Subnet NetworkVpcPrivateSubnet2Subnet1BDBE877
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet2/RouteTable NetworkVpcPrivateSubnet2RouteTableC48862D1
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet2/RouteTableAssociation NetworkVpcPrivateSubnet2RouteTableAssociation89A2F1E8
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet2/DefaultRoute NetworkVpcPrivateSubnet2DefaultRouteA15DC6D5
[+] AWS::EC2::InternetGateway Network/Vpc/IGW NetworkVpcIGW6BEA7B02
[+] AWS::EC2::VPCGatewayAttachment Network/Vpc/VPCGW NetworkVpcVPCGW8F3799B5
[+] Custom::VpcRestrictDefaultSG Network/Vpc/RestrictDefaultSecurityGroupCustomResource NetworkVpcRestrictDefaultSecurityGroupCustomResource491E144D
[+] AWS::EC2::VPCEndpoint Network/S3Endpoint NetworkS3EndpointDED08CEB
[+] AWS::Logs::LogGroup Network/VpcFlowLogGroup NetworkVpcFlowLogGroup782DD453
[+] AWS::IAM::Role Network/VpcFlowLogGroupRole NetworkVpcFlowLogGroupRoleF6875B51
[+] AWS::IAM::Policy Network/VpcFlowLogGroupRole/DefaultPolicy NetworkVpcFlowLogGroupRoleDefaultPolicyDA3C2D9D
[+] AWS::EC2::FlowLog Network/FlowLog/FlowLog NetworkFlowLog0C7D188B
[+] AWS::IAM::Role Custom::VpcRestrictDefaultSGCustomResourceProvider/Role CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0
[+] AWS::Lambda::Function Custom::VpcRestrictDefaultSGCustomResourceProvider/Handler CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E
[+] AWS::ECS::Cluster ECS/EcsCluster ECSEcsCluster331AD70F
[+] AWS::ElasticLoadBalancingV2::LoadBalancer ECS/Service/LB ECSServiceLBB8C98433
[+] AWS::EC2::SecurityGroup ECS/Service/LB/SecurityGroup ECSServiceLBSecurityGroup338826B7
[+] AWS::EC2::SecurityGroupEgress ECS/Service/LB/SecurityGroup/to StartCDKStackECSServiceSecurityGroupC4ABAEC6:8080 ECSServiceLBSecurityGrouptoStartCDKStackECSServiceSecurityGroupC4ABAEC680808D82A131
[+] AWS::ElasticLoadBalancingV2::Listener ECS/Service/LB/PublicListener ECSServiceLBPublicListener0D5AFD27
[+] AWS::ElasticLoadBalancingV2::TargetGroup ECS/Service/LB/PublicListener/ECSGroup ECSServiceLBPublicListenerECSGroupAE0D8C7E
[+] AWS::IAM::Role ECS/Service/TaskDef/TaskRole ECSServiceTaskDefTaskRoleDA8C6EA9
[+] AWS::ECS::TaskDefinition ECS/Service/TaskDef ECSServiceTaskDef79F7AD53
[+] AWS::Logs::LogGroup ECS/Service/TaskDef/web/LogGroup ECSServiceTaskDefwebLogGroup715C1949
[+] AWS::IAM::Role ECS/Service/TaskDef/ExecutionRole ECSServiceTaskDefExecutionRole4BF55744
[+] AWS::IAM::Policy ECS/Service/TaskDef/ExecutionRole/DefaultPolicy ECSServiceTaskDefExecutionRoleDefaultPolicyFA35610E
[+] AWS::ECS::Service ECS/Service/Service/Service ECSService8D71BA38
[+] AWS::EC2::SecurityGroup ECS/Service/Service/SecurityGroup ECSServiceSecurityGroup28D36F43
[+] AWS::EC2::SecurityGroupIngress ECS/Service/Service/SecurityGroup/from StartCDKStackECSServiceLBSecurityGroup32837B8B:8080 ECSServiceSecurityGroupfromStartCDKStackECSServiceLBSecurityGroup32837B8B80801802154D

Outputs
[+] Output ECS/Service/LoadBalancerDNS ECSServiceLoadBalancerDNS9E417FBD: {"Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}
[+] Output ECS/Service/ServiceURL ECSServiceServiceURL4F9DCC59: {"Value":{"Fn::Join":["",["http://",{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}]]}}
[+] Output LoadBalancerDNS LoadBalancerDNS: {"Description":"The DNS name of the ALB","Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}

✨ Number of stacks with differences: 1

[github-actions]

cdk diffの結果

Stack StartCDKStack
IAM Statement Changes
┌───┬────────────────────────────────────────────────────────────────────────────────────────────────────────┬────────┬───────────────────────────────────┬────────────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/ExecutionRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/TaskRole.Arn} │ Allow │ sts:AssumeRole │ Service:ecs-tasks.amazonaws.com │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${ECS/Service/TaskDef/web/LogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${ECS/Service/TaskDef/ExecutionRole} │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroup.Arn} │ Allow │ logs:CreateLogStream │ AWS:${Network/VpcFlowLogGroupRole} │ │
│ │ │ │ logs:DescribeLogStreams │ │ │
│ │ │ │ logs:PutLogEvents │ │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ sts:AssumeRole │ Service:vpc-flow-logs.amazonaws.com │ │
│ + │ ${Network/VpcFlowLogGroupRole.Arn} │ Allow │ iam:PassRole │ AWS:${Network/VpcFlowLogGroupRole} │ │
├───┼────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────┼────────────────────────────────────────────────────────────────┼───────────┤
│ + │ arn:aws:ec2:ap-northeast-1:${AWS::AccountId}:security-group/${NetworkVpc7FB7348F.DefaultSecurityGroup} │ Allow │ ec2:AuthorizeSecurityGroupEgress │ AWS:${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ │
│ │ │ │ ec2:AuthorizeSecurityGroupIngress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupEgress │ │ │
│ │ │ │ ec2:RevokeSecurityGroupIngress │ │ │
└───┴────────────────────────────────────────────────────────────────────────────────────────────────────────┴────────┴───────────────────────────────────┴────────────────────────────────────────────────────────────────┴───────────┘
IAM Policy Changes
┌───┬────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Resource │ Managed Policy ARN │
├───┼────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┤
│ + │ ${Custom::VpcRestrictDefaultSGCustomResourceProvider/Role} │ {"Fn::Sub":"arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"} │
└───┴────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────┘
Security Group Changes
┌───┬──────────────────────────────────────────────┬─────┬────────────┬──────────────────────────────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ In │ TCP 80 │ Everyone (IPv4) │
│ + │ ${ECS/Service/LB/SecurityGroup.GroupId} │ Out │ TCP 8080 │ ${ECS/Service/Service/SecurityGroup.GroupId} │
├───┼──────────────────────────────────────────────┼─────┼────────────┼──────────────────────────────────────────────┤
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ In │ TCP 8080 │ ${ECS/Service/LB/SecurityGroup.GroupId} │
│ + │ ${ECS/Service/Service/SecurityGroup.GroupId} │ Out │ Everything │ Everyone (IPv4) │
└───┴──────────────────────────────────────────────┴─────┴────────────┴──────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See aws/aws-cdk#1299)

Parameters
[+] Parameter BootstrapVersion BootstrapVersion: {"Type":"AWS::SSM::Parameter::Value","Default":"/cdk-bootstrap/hnb659fds/version","Description":"Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"}

Resources
[+] AWS::EC2::VPC Network/Vpc NetworkVpc7FB7348F
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet1/Subnet NetworkVpcPublicSubnet1Subnet36933139
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet1/RouteTable NetworkVpcPublicSubnet1RouteTable30235CE2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet1/RouteTableAssociation NetworkVpcPublicSubnet1RouteTableAssociation643926C7
[+] AWS::EC2::Route Network/Vpc/PublicSubnet1/DefaultRoute NetworkVpcPublicSubnet1DefaultRoute31EC04EC
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet1/EIP NetworkVpcPublicSubnet1EIPE0D52090
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet1/NATGateway NetworkVpcPublicSubnet1NATGateway64781A21
[+] AWS::EC2::Subnet Network/Vpc/PublicSubnet2/Subnet NetworkVpcPublicSubnet2SubnetC427CCE0
[+] AWS::EC2::RouteTable Network/Vpc/PublicSubnet2/RouteTable NetworkVpcPublicSubnet2RouteTable0FACEBB2
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PublicSubnet2/RouteTableAssociation NetworkVpcPublicSubnet2RouteTableAssociationC662643B
[+] AWS::EC2::Route Network/Vpc/PublicSubnet2/DefaultRoute NetworkVpcPublicSubnet2DefaultRoute0CF082AB
[+] AWS::EC2::EIP Network/Vpc/PublicSubnet2/EIP NetworkVpcPublicSubnet2EIP24F41572
[+] AWS::EC2::NatGateway Network/Vpc/PublicSubnet2/NATGateway NetworkVpcPublicSubnet2NATGateway42CB86F5
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet1/Subnet NetworkVpcPrivateSubnet1Subnet6DD86AE6
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet1/RouteTable NetworkVpcPrivateSubnet1RouteTable7D7AA3CD
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet1/RouteTableAssociation NetworkVpcPrivateSubnet1RouteTableAssociation327CA62F
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet1/DefaultRoute NetworkVpcPrivateSubnet1DefaultRoute08635105
[+] AWS::EC2::Subnet Network/Vpc/PrivateSubnet2/Subnet NetworkVpcPrivateSubnet2Subnet1BDBE877
[+] AWS::EC2::RouteTable Network/Vpc/PrivateSubnet2/RouteTable NetworkVpcPrivateSubnet2RouteTableC48862D1
[+] AWS::EC2::SubnetRouteTableAssociation Network/Vpc/PrivateSubnet2/RouteTableAssociation NetworkVpcPrivateSubnet2RouteTableAssociation89A2F1E8
[+] AWS::EC2::Route Network/Vpc/PrivateSubnet2/DefaultRoute NetworkVpcPrivateSubnet2DefaultRouteA15DC6D5
[+] AWS::EC2::InternetGateway Network/Vpc/IGW NetworkVpcIGW6BEA7B02
[+] AWS::EC2::VPCGatewayAttachment Network/Vpc/VPCGW NetworkVpcVPCGW8F3799B5
[+] Custom::VpcRestrictDefaultSG Network/Vpc/RestrictDefaultSecurityGroupCustomResource NetworkVpcRestrictDefaultSecurityGroupCustomResource491E144D
[+] AWS::EC2::VPCEndpoint Network/S3Endpoint NetworkS3EndpointDED08CEB
[+] AWS::Logs::LogGroup Network/VpcFlowLogGroup NetworkVpcFlowLogGroup782DD453
[+] AWS::IAM::Role Network/VpcFlowLogGroupRole NetworkVpcFlowLogGroupRoleF6875B51
[+] AWS::IAM::Policy Network/VpcFlowLogGroupRole/DefaultPolicy NetworkVpcFlowLogGroupRoleDefaultPolicyDA3C2D9D
[+] AWS::EC2::FlowLog Network/FlowLog/FlowLog NetworkFlowLog0C7D188B
[+] AWS::IAM::Role Custom::VpcRestrictDefaultSGCustomResourceProvider/Role CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0
[+] AWS::Lambda::Function Custom::VpcRestrictDefaultSGCustomResourceProvider/Handler CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E
[+] AWS::ECS::Cluster ECS/EcsCluster ECSEcsCluster331AD70F
[+] AWS::ElasticLoadBalancingV2::LoadBalancer ECS/Service/LB ECSServiceLBB8C98433
[+] AWS::EC2::SecurityGroup ECS/Service/LB/SecurityGroup ECSServiceLBSecurityGroup338826B7
[+] AWS::EC2::SecurityGroupEgress ECS/Service/LB/SecurityGroup/to StartCDKStackECSServiceSecurityGroupC4ABAEC6:8080 ECSServiceLBSecurityGrouptoStartCDKStackECSServiceSecurityGroupC4ABAEC680808D82A131
[+] AWS::ElasticLoadBalancingV2::Listener ECS/Service/LB/PublicListener ECSServiceLBPublicListener0D5AFD27
[+] AWS::ElasticLoadBalancingV2::TargetGroup ECS/Service/LB/PublicListener/ECSGroup ECSServiceLBPublicListenerECSGroupAE0D8C7E
[+] AWS::IAM::Role ECS/Service/TaskDef/TaskRole ECSServiceTaskDefTaskRoleDA8C6EA9
[+] AWS::ECS::TaskDefinition ECS/Service/TaskDef ECSServiceTaskDef79F7AD53
[+] AWS::Logs::LogGroup ECS/Service/TaskDef/web/LogGroup ECSServiceTaskDefwebLogGroup715C1949
[+] AWS::IAM::Role ECS/Service/TaskDef/ExecutionRole ECSServiceTaskDefExecutionRole4BF55744
[+] AWS::IAM::Policy ECS/Service/TaskDef/ExecutionRole/DefaultPolicy ECSServiceTaskDefExecutionRoleDefaultPolicyFA35610E
[+] AWS::ECS::Service ECS/Service/Service/Service ECSService8D71BA38
[+] AWS::EC2::SecurityGroup ECS/Service/Service/SecurityGroup ECSServiceSecurityGroup28D36F43
[+] AWS::EC2::SecurityGroupIngress ECS/Service/Service/SecurityGroup/from StartCDKStackECSServiceLBSecurityGroup32837B8B:8080 ECSServiceSecurityGroupfromStartCDKStackECSServiceLBSecurityGroup32837B8B80801802154D

Outputs
[+] Output ECS/Service/LoadBalancerDNS ECSServiceLoadBalancerDNS9E417FBD: {"Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}
[+] Output ECS/Service/ServiceURL ECSServiceServiceURL4F9DCC59: {"Value":{"Fn::Join":["",["http://",{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}]]}}
[+] Output LoadBalancerDNS LoadBalancerDNS: {"Description":"The DNS name of the ALB","Value":{"Fn::GetAtt":["ECSServiceLBB8C98433","DNSName"]}}

✨ Number of stacks with differences: 1