CloudMapperを使ってAWS環境を可視化する。 ref: https://qiita.com/kooohei/items/58b6d8654a89c911a2e9

CloudMapperの取得

$ git clone git@github.com:duo-labs/cloudmapper.git

config.json

$ cat config.json
{  "accounts":
    [
        {"id": "xxxxxxxxxxxx", "name": "hogehoge", "default": true}
    ],
    "cidrs":
    {
        "1.2.3.4/32": {"name": "Tokyo Office"},
        "4.3.2.1/32": {"name": "Osaka Office"}
    }
}

credentials

[cloudmapper]
aws_access_key_id = AKIxxxxxxxxxxxxxxxxx
aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
output = json
region = ap-northeast-1

file12.txt

$ cat config.json
{  "accounts":
    [
        {"id": "xxxxxxxxxxxx", "name": "hogehoge", "default": true}
    ],
    "cidrs":
    {
        "1.2.3.4/32": {"name": "Tokyo Office"},
        "4.3.2.1/32": {"name": "Osaka Office"}
    }
}

webサーバー起動

$ python cloudmapper.py serve
CloudMapper serving on 127.0.0.1:8000

アクセスキー作成

$ aws iam create-access-key --user-name cloudmapper
{
    "AccessKey": {
        "UserName": "cloudmapper",
        "AccessKeyId": "AKIxxxxxxxxxxxxxxxxx",
        "Status": "Active",
        "SecretAccessKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "CreateDate": "2018-04-25T15:32:24.676Z"
    }
}

コピー

$ cp config.json.demo config.json

サンプル

$ python cloudmapper.py prepare --config config.json.demo --account demo
Building data for account demo (123456789012)
- 0 nodes built in region ap-south-1
- 0 nodes built in region eu-west-2
- 0 nodes built in region eu-west-1
- 0 nodes built in region ap-northeast-2
- 0 nodes built in region ap-northeast-1
- 0 nodes built in region sa-east-1
- 0 nodes built in region ca-central-1
- 0 nodes built in region ap-southeast-1
- 0 nodes built in region ap-southeast-2
- 0 nodes built in region eu-central-1
- 8 nodes built in region us-east-1
- 0 nodes built in region us-east-2
- 0 nodes built in region us-west-1
- 0 nodes built in region us-west-2
- 3 external CIDRs built
- 17 connections built
Complete

$ python cloudmapper.py webserver
CloudMapper serving on 127.0.0.1:8000

データ収集

$ ./collect_data.sh --account hogehoge --profile cloudmapper
* Startup checks
* Getting region names
* Getting VPC info
* Getting AZ info
* Getting subnet info
* Getting EC2 info
* Getting RDS info
* Getting ELB info
* Getting ALB info
* Getting security group info
* Getting network interface info
* Getting VPC peering info

データ変換

$ python cloudmapper.py prepare --account hogehoge
Building data for account hogehoge (xxxxxxxxxxxx)
- 0 nodes built in region ap-south-1
- 0 nodes built in region eu-west-3
- 0 nodes built in region eu-west-2
- 0 nodes built in region eu-west-1
- 0 nodes built in region ap-northeast-2
- 10 nodes built in region ap-northeast-1
- 0 nodes built in region sa-east-1
- 0 nodes built in region ca-central-1
- 0 nodes built in region ap-southeast-1
- 0 nodes built in region ap-southeast-2
- 0 nodes built in region eu-central-1
- 0 nodes built in region us-east-1
- 0 nodes built in region us-east-2
- 0 nodes built in region us-west-1
- 0 nodes built in region us-west-2
- 14 external CIDRs built
- 28 connections built
Complete

ポリシー設定

$ aws iam put-user-policy --user-name cloudmapper --policy-name cloudmapper_readonly_policy --policy-document '{
   "Version": "2012-10-17",
   "Statement": [
     {
       "Effect": "Allow",
       "Resource": "*",
       "Action": [
         "ec2:DescribeRegions",
         "ec2:DescribeAvailabilityZones",
         "ec2:DescribeVpcs",
         "ec2:DescribeSubnets",
         "ec2:DescribeSecurityGroups",
         "ec2:DescribeVpcPeeringConnections",
         "ec2:DescribeInstances",
         "ec2:DescribeNetworkInterfaces",
         "rds:DescribeDBInstances",
         "elasticloadbalancing:DescribeLoadBalancers"
       ]
     }
   ]
 }'

ユーザー作成

$ aws iam create-user --user-name cloudmapper
{
    "User": {
        "Path": "/",
        "UserName": "cloudmapper",
        "UserId": "xxxxxxxxxxxxxxxxxxxx",
        "Arn": "arn:aws:iam::xxxxxxxxxxxx:user/cloudmapper",
        "CreateDate": "2018-04-25T15:26:05.024Z"
    }
}

準備

$ brew install autoconf automake libtool jq
$ cd cloudmapper/
$ virtualenv venv
$ source venv/bin/activate
$ pip install -r requirements.txt