AWS Sustainability Scanner を利用してサステナビリティやコスト最適化を意識してみた

pip3 install sustainability-scanner
susscanner --version

curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh
export PATH=~/.guard/bin:$PATH
cfn-guard --version

~ $ pip3 install sustainability-scanner
Defaulting to user installation because normal site-packages is not writeable
Collecting sustainability-scanner
  Downloading sustainability-scanner-1.3.0.tar.gz (23 kB)
  Preparing metadata (setup.py) ... done
Collecting typer==0.12.4
  Downloading typer-0.12.4-py3-none-any.whl (47 kB)
     |████████████████████████████████| 47 kB 2.7 MB/s
Requirement already satisfied: click>=8.0.0 in /usr/local/lib/python3.9/site-packages (from typer==0.12.4->sustainability-scanner) (8.1.7)
Requirement already satisfied: rich>=10.11.0 in /usr/local/lib/python3.9/site-packages (from typer==0.12.4->sustainability-scanner) (13.9.4)
Collecting shellingham>=1.3.0
  Downloading shellingham-1.5.4-py2.py3-none-any.whl (9.8 kB)
Requirement already satisfied: typing-extensions>=3.7.4.3 in /usr/local/lib/python3.9/site-packages (from typer==0.12.4->sustainability-scanner) (4.12.2)
Requirement already satisfied: markdown-it-py>=2.2.0 in /usr/local/lib/python3.9/site-packages (from rich>=10.11.0->typer==0.12.4->sustainability-scanner) (3.0.0)
Requirement already satisfied: pygments<3.0.0,>=2.13.0 in /usr/local/lib/python3.9/site-packages (from rich>=10.11.0->typer==0.12.4->sustainability-scanner) (2.18.0)
Requirement already satisfied: mdurl~=0.1 in /usr/local/lib/python3.9/site-packages (from markdown-it-py>=2.2.0->rich>=10.11.0->typer==0.12.4->sustainability-scanner) (0.1.2)
Building wheels for collected packages: sustainability-scanner
  Building wheel for sustainability-scanner (setup.py) ... done
  Created wheel for sustainability-scanner: filename=sustainability_scanner-1.3.0-py3-none-any.whl size=26089 sha256=07ffd46d40421068986966f9d98ee68e61fd3e2173e78ecfa4b36d54d751af53
  Stored in directory: /home/cloudshell-user/.cache/pip/wheels/3e/6b/f2/25a81b154844b20021c7847a9a97599de63ce71ac832bf65c8
Successfully built sustainability-scanner
Installing collected packages: shellingham, typer, sustainability-scanner
Successfully installed shellingham-1.5.4 sustainability-scanner-1.3.0 typer-0.12.4
~ $ susscanner --version
susscanner v1.3.0
~ $
~ $ curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh
Installing cfn-guard version '3.1.2'...
Guard is a general-purpose tool that provides a simple declarative syntax to define
policy-as-code as rules to validate against any structured hierarchical data (like JSON/YAML).
Rules are composed of clauses expressed using Conjunctive Normal Form
(fancy way of saying it is a logical AND of OR clauses). Guard has deep
integration with CloudFormation templates for evaluation but is a general tool
that equally works for any JSON- and YAML- data.

Usage: cfn-guard <COMMAND>

Commands:
  validate     Evaluates rules against the data files to determine success or failure.
                   You can point rules flag to a rules directory and point data flag to a data directory.
                   When pointed to a directory it will read all rules in the directory file and evaluate
                   them against the data files found in the directory. The command can also point to a
                   single file and it would work as well.
                   Note - When pointing the command to a directory, the directory may not contain a mix of
                   rules and data files. The directory being pointed to must contain only data files,
                   or rules files.

  test         Built in unit testing capability to validate a Guard rules file against
                   unit tests specified in YAML format to determine each individual rule's success
                   or failure testing.

  parse-tree   Prints out the parse tree for the rules defined in the file.
  rulegen      Autogenerate rules from an existing JSON- or YAML- formatted data. (Currently works with only CloudFormation templates)
  completions  Generate auto-completions for all the sub-commands in shell.
  help         Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version
Remember to SET PATH include PATH=${PATH}:~/.guard/bin
~ $ export PATH=~/.guard/bin:$PATH
~ $ cfn-guard --version
cfn-guard 3.1.2
~ $

#!/bin/bash

# スタック一覧を配列として取得
stacks=($(aws cloudformation describe-stacks --query 'Stacks[].StackName[]' --output text))

# 配列の各要素に対してループ処理
for stack_name in "${stacks[@]}"; do
    echo "Processing stack: $stack_name"

    # テンプレートを一時ファイルに保存
    temp_file="${stack_name}.template"
    aws cloudformation get-template --stack-name "$stack_name" --query TemplateBody --output text > "$temp_file"

    # susscanner で解析
    echo "Scanning template for $stack_name..."
    susscanner "$temp_file"

    # 一時ファイルを削除（必要に応じて）
    rm "$temp_file"

    echo "----------------------------------------"
done

~ $ sh susscanner.sh
----------------------------------------
Processing stack: pcs-blog
Scanning template for pcs-blog...
{
    "title": "Sustainability Scanner Report",
    "file": "pcs-blog.template",
    "version": "1.3.0",
    "sustainability_score": 2,
    "failed_rules": [
        {
            "rule_name": "check_graviton_architecture_usage_in_lambda",
            "severity": "MEDIUM",
            "message": "Use AWS Graviton for Lambda functions, if possible, to take advantage of energy efficiency improvements.",
            "links": [
                "https://docs.aws.amazon.com/wellarchitected/latest/sustainability-pillar/sus_sus_hardware_a3.html",
                "https://aws.amazon.com/blogs/aws/aws-lambda-functions-powered-by-aws-graviton2-processor-run-your-functions-on-arm-and-get-up-to-34-better-price-performance/"
            ],
            "resources": [
                {
                    "name": "/Resources/GetAZLambdaFunction/Properties",
                    "line": "508"
                }
            ]
        }
    ]
}
----------------------------------------
Processing stack: aws-sam-cli-managed-default

'str' object has no attribute 'items'
Scanning template for aws-sam-cli-managed-default...
Error occurred Parser Error when parsing `Error encountered while parsing data file: /home/cloudshell-user/aws-sam-cli-managed-default.template, data beginning with
2010-09-09      Managed Stack for AWS SAM CLI
SAMCLIINFO      f860202e-7e45-47ad-bc4f-27c0add960f5    1.126.0
VAL
 ...`
{
    "title": "Sustainability Scanner Report",
    "file": "aws-sam-cli-managed-default.template",
    "version": "1.3.0",
    "sustainability_score": 0,
    "failed_rules": []
}
----------------------------------------
Processing stack: CDKToolkit
Scanning template for CDKToolkit...
{
    "title": "Sustainability Scanner Report",
    "file": "CDKToolkit.template",
    "version": "1.3.0",
    "sustainability_score": 0,
    "failed_rules": []
}