AWS踏み台サーバーに適用するIAMロール設計｜最小権限で制御するアクセス管理構成パターン

この記事のポイント

・踏み台EC2にはIAMユーザーのアクセスキーではなくIAMロールを割り当てるのが鉄則
・ロールのアクセス許可はSSM Session Manager最低限＋必要なポリシーのみに絞る
・MFA必須条件（aws:MultiFactorAuthPresent）でなりすましリスクを下げる
・CloudTrailで踏み台操作ログを残し、いつ誰が何をしたかを追跡可能にする

# 踏み台サーバー用IAMロールを作成する
aws iam create-role \
  --role-name BastionRole \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "ec2.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }'

$ aws iam get-role --role-name BastionRole

{
    "Role": {
        "Path": "/",
        "RoleName": "BastionRole",
        "RoleId": "AROAXXXXXXXXXXXXXXXXX",
        "Arn": "arn:aws:iam::123456789012:role/BastionRole",
        "CreateDate": "2026-10-10T05:00:00+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "MaxSessionDuration": 3600
    }
}

# SSMエージェント動作に必要なマネージドポリシーをアタッチ
aws iam attach-role-policy \
  --role-name BastionRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession"
      ],
      "Resource": [
        "arn:aws:ec2:ap-northeast-1:123456789012:instance/i-0abcdef1234567890",
        "arn:aws:ec2:ap-northeast-1:123456789012:instance/i-0fedcba9876543210"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:TerminateSession",
        "ssm:ResumeSession"
      ],
      "Resource": "arn:aws:ssm:*:*:session/${aws:username}-*"
    }
  ]
}

# インスタンスプロファイルを作成してロールを追加
aws iam create-instance-profile \
  --instance-profile-name BastionInstanceProfile

aws iam add-role-to-instance-profile \
  --instance-profile-name BastionInstanceProfile \
  --role-name BastionRole

# 実行中の踏み台EC2にアタッチ（インスタンスID例: i-0bastion12345）
aws ec2 associate-iam-instance-profile \
  --instance-id i-0bastion12345 \
  --iam-instance-profile Name=BastionInstanceProfile

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession",
        "ssm:DescribeSessions"
      ],
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.10/32"
        }
      }
    }
  ]
}

# CloudTrailの証跡設定を確認する
$ aws cloudtrail describe-trails --include-shadow-trails false

{
    "trailList": [
        {
            "Name": "management-events-trail",
            "S3BucketName": "cloudtrail-logs-123456789012",
            "IncludeGlobalServiceEvents": true,
            "IsMultiRegionTrail": true,
            "HomeRegion": "ap-northeast-1",
            "TrailARN": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail/management-events-trail",
            "LogFileValidationEnabled": true,
            "HasCustomEventSelectors": false,
            "IsOrganizationTrail": false
        }
    ]
}

# 踏み台EC2に割り当てられたロールとアカウント情報を確認
$ aws sts get-caller-identity

{
    "UserId": "AROAXXXXXXXXXXXXXXXXX:i-0bastion12345",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/BastionRole/i-0bastion12345"
}