【DevOps Agent】クロスリージョンでのインシデント解決を試してみる

~ $ aws iam get-role --role-name devops-test-role
{
    "Role": {
        "Path": "/",
        "RoleName": "devops-test-role",
        "RoleId": "AROAXXXXXXXXXXXXXX",
        "Arn": "arn:aws:iam::XXXXXXXXXX:role/devops-test-role",
        "CreateDate": "2026-01-26T12:54:39+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Description": "Allows Lambda functions to call AWS services on your behalf.",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {
            "LastUsedDate": "2026-01-26T13:34:58+00:00",
            "Region": "ap-northeast-1"
        }
    }
}
~ $ 
~ $ aws iam list-attached-role-policies --role-name devops-test-role
{
    "AttachedPolicies": [
        {
            "PolicyName": "AWSLambdaBasicExecutionRole",
            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        }
    ]
}
~ $ 
~ $ aws iam list-role-policies --role-name devops-test-role
{
    "PolicyNames": []
}
~ $ aws iam get-role-policy --role-name devops-test-role --policy-name S3ReadAccessPolicy
An error occurred (NoSuchEntity) when calling the GetRolePolicy operation: The role policy with name S3ReadAccessPolicy cannot be found.
~ $ 
~ $ aws s3api head-bucket --bucket devops-test-s3bucket-XXXXXXXXXXX --region ap-northeast-1
{
    "BucketArn": "arn:aws:s3:::devops-test-s3bucket-XXXXXXXXXXX",
    "BucketRegion": "ap-northeast-1",
    "AccessPointAlias": false
}
~ $ 
~ $ aws lambda get-function --function-name devops-test-function --region ap-northeast-1
{
    "Configuration": {
        "FunctionName": "devops-test-function",
        "FunctionArn": "arn:aws:lambda:ap-northeast-1:XXXXXXXXXX:function:devops-test-function",
        "Runtime": "python3.14",
        "Role": "arn:aws:iam::XXXXXXXXXXX:role/devops-test-role",
        "Handler": "lambda_function.lambda_handler",
        "CodeSize": 1049,
        "Description": "",
        "Timeout": 3,
        "MemorySize": 128,
        "LastModified": "2026-01-26T13:34:46.000+0000",
        "CodeSha256": "XXXXXXXXXXXXXX",
        "Version": "$LATEST",
        "TracingConfig": {
            "Mode": "PassThrough"
        },
        "RevisionId": "XXXXXXXXXXXXXX",
        "State": "Active",
        "LastUpdateStatus": "Successful",
        "PackageType": "Zip",
        "Architectures": [
            "x86_64"
        ],
        "EphemeralStorage": {
            "Size": 512
        },
        "SnapStart": {
            "ApplyOn": "None",
            "OptimizationStatus": "Off"
        },
        "RuntimeVersionConfig": {
            "RuntimeVersionArn": "arn:aws:lambda:ap-northeast-1::runtime:XXXXXXXXXXXXXX"
        },
        "LoggingConfig": {
            "LogFormat": "Text",
            "LogGroup": "/aws/lambda/devops-test-function"
        }
    },
    "Code": {
        "RepositoryType": "S3",
        "Location": "https://awslambda-ap-ne-1-tasks.s3.ap-northeast-1.amazonaws.com/snapshots/XXXXXXXXXX/devops-test-function-XXXXXXXXXXXXXX?versionId=XXXXXXXXXXXXXX&X-Amz-Security-Token=XXXXXXXXXXXXXX&X-Amz-Algorithm=XXXXXXXXXXXXXX&X-Amz-Date=20260126T141938Z&X-Amz-SignedHeaders=XXXXXXXXXXXXXX&X-Amz-Expires=600&X-Amz-Credential=XXXXXXXXXXXXXXFap-northeast-1%2Fs3%2Faws4_request&X-Amz-Signature=XXXXXXXXXXXXXX"
    }
}
~ $ aws iam list-attached-role-policies --role-name devops-test-role
{
    "AttachedPolicies": [
        {
            "PolicyName": "AWSLambdaBasicExecutionRole",
            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        }
    ]
}
~ $ 
~ $ aws iam put-role-policy --role-name devops-test-role --policy-name S3ReadAccessPolicy --policy-document '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::devops-test-s3bucket-XXXXXXXXXXX", "arn:aws:s3:::devops-test-s3bucket-XXXXXXXXXXX/*"]}]}'
~ $ 
~ $ aws iam list-role-policies --role-name devops-test-role
{
    "PolicyNames": [
        "S3ReadAccessPolicy"
    ]
}
~ $ aws iam get-role-policy --role-name devops-test-role --policy-name S3ReadAccessPolicy
{
    "RoleName": "devops-test-role",
    "PolicyName": "S3ReadAccessPolicy",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::devops-test-s3bucket-XXXXXXXXXXX",
                    "arn:aws:s3:::devops-test-s3bucket-XXXXXXXXXXX/*"
                ]
            }
        ]
    }
}
~ $ aws lambda invoke --function-name devops-test-function --invocation-type RequestResponse --region ap-northeast-1 response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}
~ $