規制報告 / 監査証跡データレイク（監査・規制報告）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as kms from "aws-cdk-lib/aws-kms";
import * as cloudtrail from "aws-cdk-lib/aws-cloudtrail";
import * as glue from "aws-cdk-lib/aws-glue";
import * as athena from "aws-cdk-lib/aws-athena";

// 監査証跡の集約：S3 Object Lock(WORM) + KMS、CloudTrail(組織証跡)、Glue/Athena で分析。
export class AuditLakeStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const key = new kms.Key(this, "AuditKey", { enableKeyRotation: true });

    // 改ざん耐性（WORM）: Object Lock + バージョニング + コンプライアンスモード
    const archive = new s3.Bucket(this, "AuditArchive", {
      objectLockEnabled: true,
      versioned: true,
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: key,
      enforceSSL: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      objectLockDefaultRetention: s3.ObjectLockRetention.compliance(cdk.Duration.days(3650)),
    });

    new cloudtrail.Trail(this, "OrgTrail", {
      bucket: archive,
      encryptionKey: key,
      isOrganizationTrail: true,
      includeGlobalServiceEvents: true,
      managementEvents: cloudtrail.ReadWriteType.ALL,
    });

    const db = new glue.CfnDatabase(this, "GlueDb", {
      catalogId: cdk.Aws.ACCOUNT_ID,
      databaseInput: { name: "regulatory-reporting-audit-lake_audit" },
    });

    new athena.CfnWorkGroup(this, "AuditWg", {
      name: "regulatory-reporting-audit-lake-audit",
      workGroupConfiguration: {
        resultConfiguration: { outputLocation: `s3://${archive.bucketName}/athena-results/` },
        enforceWorkGroupConfiguration: true,
      },
    });
    void db;
    // NOTE: AWS Config（Recorder/DeliveryChannel）と Security Hub は組織レベルで有効化し、所見をこのレイクへ集約します。
  }
}