# 1. SNS Topic 생성
aws sns create-topic --name oooo-SecurityNotices

# 2. 이메일 구독 추가 (이메일로 확인 링크 발송됨)
aws sns subscribe \
  --topic-arn arn:aws:sns:ap-northeast-2:123456789012:oooo-SecurityNotices \
  --protocol email \
  --notification-endpoint your-email@example.com

# 3. 구독 확인 (이메일에서 Confirm subscription 클릭 후)
aws sns list-subscriptions-by-topic \
  --topic-arn arn:aws:sns:ap-northeast-2:123456789012:oooo-SecurityNotices

# EC2 CPU 사용률 기반 경보 생성
aws cloudwatch put-metric-alarm \
  --alarm-name oooo-bastion-cpu-util \
  --alarm-description "Bastion server CPU utilization exceeds 60%" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 \
  --threshold 60 \
  --comparison-operator GreaterThanThreshold \
  --dimensions Name=InstanceId,Value=i-0instanceid \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:ap-northeast-2:123456789012:oooo-SecurityNotices \
  --treat-missing-data notBreaching

# 경보 상태 확인
aws cloudwatch describe-alarms --alarm-names oooo-bastion-cpu-util

# EC2 인스턴스에 접속 후 stress 패키지 설치
sudo yum -y install stress

# 600초(10분) 동안 CPU 부하 발생
sudo stress --timeout 600 --cpu 1

# 더 높은 부하가 필요한 경우
sudo stress --timeout 60 --cpu 4 --vm 4 --vm-bytes 1024m --hdd 1 --hdd-bytes 1024m

# Root 로그인 탐지 메트릭 필터 생성
aws logs put-metric-filter \
  --log-group-name CloudTrail/logs \
  --filter-name RootAccountUsage \
  --filter-pattern '{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }' \
  --metric-transformations \
    metricName=RootAccountUsageCount,metricNamespace=SecurityMetrics,metricValue=1

# 메트릭 기반 경보 생성
aws cloudwatch put-metric-alarm \
  --alarm-name RootAccountUsageAlarm \
  --metric-name RootAccountUsageCount \
  --namespace SecurityMetrics \
  --statistic Sum \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:ap-northeast-2:123456789012:oooo-SecurityNotices

# Session Manager로 EC2 접속 (SSH 키 불필요)
aws ssm start-session --target i-0instanceid

# 명령 실행 (Run Command)
aws ssm send-command \
  --instance-ids i-0instanceid \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["df -h","free -m"]'

# Parameter Store에 민감 정보 저장
aws ssm put-parameter \
  --name "/myapp/database/password" \
  --value "MySecurePassword123" \
  --type SecureString

# Parameter Store에서 값 조회
aws ssm get-parameter \
  --name "/myapp/database/password" \
  --with-decryption

-- 최근 24시간 Root 계정 활동 조회
SELECT eventTime, eventName, sourceIPAddress, userAgent
FROM cloudtrail_logs
WHERE userIdentity.type = 'Root'
  AND eventTime > date_add('hour', -24, now())
ORDER BY eventTime DESC;

-- 특정 S3 버킷 접근 기록 조회
SELECT eventTime, userIdentity.userName, eventName, requestParameters
FROM cloudtrail_logs
WHERE eventSource = 's3.amazonaws.com'
  AND requestParameters LIKE '%bucket-name%'
ORDER BY eventTime DESC
LIMIT 100;

-- 실패한 API 호출 조회
SELECT eventTime, eventName, errorCode, errorMessage, userIdentity.userName
FROM cloudtrail_logs
WHERE errorCode IS NOT NULL
ORDER BY eventTime DESC
LIMIT 50;