Claude CodeでAWS Budgetsと異常検知をTerraformで入れ、SNS権限まで検査

data "aws_caller_identity" "current" {}
 
resource "aws_sns_topic" "cost_alerts" {
  name = "cost-alerts"
}
 
data "aws_iam_policy_document" "cost_alerts" {
  statement {
    sid       = "AWSBudgetsSNSPublishingPermissions"
    actions   = ["SNS:Publish"]
    resources = [aws_sns_topic.cost_alerts.arn]
 
    principals {
      type        = "Service"
      identifiers = ["budgets.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:budgets::${data.aws_caller_identity.current.account_id}:*"]
    }
  }
 
  statement {
    sid       = "AWSAnomalyDetectionSNSPublishingPermissions"
    actions   = ["SNS:Publish"]
    resources = [aws_sns_topic.cost_alerts.arn]
 
    principals {
      type        = "Service"
      identifiers = ["costalerts.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }
}
 
resource "aws_sns_topic_policy" "cost_alerts" {
  arn    = aws_sns_topic.cost_alerts.arn
  policy = data.aws_iam_policy_document.cost_alerts.json
}

resource "aws_budgets_budget" "monthly" {
  name         = "monthly-cost"
  budget_type  = "COST"
  time_unit    = "MONTHLY"
  limit_amount = var.monthly_limit_usd
  limit_unit   = "USD"
 
  notification {
    comparison_operator       = "GREATER_THAN"
    threshold                 = 80
    threshold_type            = "PERCENTAGE"
    notification_type         = "FORECASTED"
    subscriber_sns_topic_arns = [aws_sns_topic.cost_alerts.arn]
  }
 
  notification {
    comparison_operator       = "GREATER_THAN"
    threshold                 = 100
    threshold_type            = "PERCENTAGE"
    notification_type         = "ACTUAL"
    subscriber_sns_topic_arns = [aws_sns_topic.cost_alerts.arn]
  }
 
  depends_on = [aws_sns_topic_policy.cost_alerts]
}

resource "aws_ce_anomaly_monitor" "service" {
  name              = "service-monitor"
  monitor_type      = "DIMENSIONAL"
  monitor_dimension = "SERVICE"
}
 
resource "aws_ce_anomaly_subscription" "realtime" {
  name      = "realtime-anomaly"
  frequency = "IMMEDIATE"
 
  monitor_arn_list = [aws_ce_anomaly_monitor.service.arn]
 
  subscriber {
    type    = "SNS"
    address = aws_sns_topic.cost_alerts.arn
  }
 
  threshold_expression {
    dimension {
      key           = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
      match_options = ["GREATER_THAN_OR_EQUAL"]
      values        = ["100"]
    }
  }
 
  depends_on = [aws_sns_topic_policy.cost_alerts]
}

resource "aws_sns_topic_subscription" "email" {
  topic_arn = aws_sns_topic.cost_alerts.arn
  protocol  = "email"
  endpoint  = var.alert_email
}

#!/bin/bash
# PostToolUse(Edit|Write): .tf を書いた直後に、通知先 SNS トピックの権限不足を検査する
FILE=$(jq -r '.tool_input.file_path // empty')
case "$FILE" in *.tf) ;; *) exit 0 ;; esac
DIR=$(dirname "$FILE")
ALL=$(cat "$DIR"/*.tf)
ERRORS=""
 
# 予算の通知先に SNS を指定しているのに、budgets.amazonaws.com の許可が無い
if grep -q 'subscriber_sns_topic_arns' <<<"$ALL" \
   && ! grep -q 'budgets.amazonaws.com' <<<"$ALL"; then
  ERRORS+="- aws_budgets_budget が SNS を通知先にしていますが、トピックポリシーに budgets.amazonaws.com の SNS:Publish がありません"$'\n'
fi
 
# 異常検知の購読先に SNS を指定しているのに、costalerts.amazonaws.com の許可が無い
if grep -A3 'subscriber {' <<<"$ALL" | grep -q 'type *= *"SNS"' \
   && ! grep -q 'costalerts.amazonaws.com' <<<"$ALL"; then
  ERRORS+="- aws_ce_anomaly_subscription が SNS を購読先にしていますが、トピックポリシーに costalerts.amazonaws.com の SNS:Publish がありません"$'\n'
fi
 
if [ -n "$ERRORS" ]; then
  printf '通知先の権限が不足しています。\n%s' "$ERRORS" >&2
  exit 2
fi
exit 0

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/check-cost-alerts.sh",
            "args": []
          }
        ]
      }
    ]
  }
}

通知先の権限が不足しています。
- aws_budgets_budget が SNS を通知先にしていますが、トピックポリシーに budgets.amazonaws.com の SNS:Publish がありません
- aws_ce_anomaly_subscription が SNS を購読先にしていますが、トピックポリシーに costalerts.amazonaws.com の SNS:Publish がありません
exit=2

resource "aws_budgets_budget" "ec2" {
  name         = "ec2-monthly"
  budget_type  = "COST"
  time_unit    = "MONTHLY"
  limit_amount = var.ec2_limit_usd
  limit_unit   = "USD"
 
  cost_filter {
    name   = "Service"
    values = ["Amazon Elastic Compute Cloud - Compute"]
  }
}

{
  "permissions": {
    "allow": [
      "Bash(terraform fmt *)",
      "Bash(terraform validate *)",
      "Bash(terraform plan *)",
      "Bash(aws sns get-topic-attributes *)",
      "Bash(aws sns list-subscriptions-by-topic *)"
    ],
    "ask": [
      "Bash(terraform apply *)"
    ],
    "deny": [
      "Bash(terraform destroy *)",
      "Bash(aws sns delete-topic *)"
    ]
  }
}

## コスト通知のTerraform
- 予算は aws_budgets_budget、異常検知は aws_ce_anomaly_monitor と
  aws_ce_anomaly_subscription に分けて書く
- SNSを通知先にするときは、同じ変更の中で aws_sns_topic_policy を書き、
  budgets.amazonaws.com と costalerts.amazonaws.com の許可を入れる
- 予算としきい値の金額は変数にし、値を勝手に決めない
- フックが「通知先の権限が不足」と返したら、まずポリシーの文を直す