Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策
Search
a_zara_n
June 12, 2021
6
3.6k
"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策
モブセキュリティで話した内容です。
https://mob-security.connpass.com/event/209884/
情報の倫理的な取り扱いをお願いします。
a_zara_n
June 12, 2021
Tweet
Share
More Decks by a_zara_n
See All by a_zara_n
セキュリティ・キャンプ全国大会 2021 オンライン B3 分散アーキテクチャ時代におけるWebシステムの開発と運用 事前資料 クラウドシステムをセキュアに開発運用する勘所
azara
4
3.7k
Serverless applicationとセキュリティ~Cognito編~
azara
2
4.1k
Featured
See All Featured
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
47
9.6k
BBQ
matthewcrist
89
9.7k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
667
120k
GraphQLとの向き合い方2022年版
quramy
49
14k
Intergalactic Javascript Robots from Outer Space
tanoku
271
27k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
50k
Building Adaptive Systems
keathley
43
2.7k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Producing Creativity
orderedlist
PRO
346
40k
The Straight Up "How To Draw Better" Workshop
denniskardys
235
140k
For a Future-Friendly Web
brad_frost
179
9.8k
Transcript
lͬ͘͟Γz͢ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํͱରࡦ ϞϒηΩϡϦςΟ ୈճ-5େձ NPC@TFDVSJUZ "[BSB !B@[BSB@O
ࣗݾհ ໊લ"[BSB 5XJUUFS!B@[BSB@O "CPVU ηΩϡϦςΟؔͷࣄΛ͍ͯ͠Δ৽ଔΤϯδχΞͰ͢ ηΩϡϦςΟͱ8FCͱΫϥυ "84 ͕͖Ͱ͢ ࠷ۙ"84440ͱ$POUSPM5PXFSͱٔΕͯ·ͨ͠ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
༨ஊ ࠓͷؾ࣋ͪ • ؇ͦ͘͏ͱࢥͬͯ-5ʹొͨ͠ ࣮ࡢ·ͰΕͯͨʜ ͋ͱࢀՃऀଟ͍ʜ • ϏΫϏΫ͍ͯ͠·͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ࠓ͢͜ͱ • "84 *". ͬͯͳʹ • "84*".ͷಛݖঢ֨ • ͳΜͱͳ͘Θ͔Δఔʹ͢ •
ͯ͢ͷݸผࣄྫ͞ͳ͍ • ରࡦͲ͏͢ΜͶΜ • ূͷอશͲ͏͢ΜͶΜ "84*".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
͢༰ • कΔଆ߈ܸऀ͕͢Δ߈ܸͷݪཧΛ ͓ͬͯ͘ͱରࡦ͍͢͠ΑͶͱ͍͏ؾ࣋ͪͰॻ͍ͯ·͢ • ରࡦํ๏ईͷ্͍ؔͰ͕ྃ͢͝ঝΛ • ݸʑͷࣄʹ͍ͭͯৄ͘͢͠Θ͚Ͱ͋Γ·ͤΜ • lͳΜͱͳ͘Θ͔ͬͨzͱ͍͏ͱ͜Ζ·Ͱ͠·͢
• ֤αʔϏεͷৄ͍͠ར༻ํ๏ʹؔͯ͠ ެࣜυΩϡϝϯτΛࢀরͯ͠Լ͍͞ • ࠓޙͲ͔͜ͰύϫʔΞοϓ൛Λ͔͢͠Ε·ͤΜ͕ ࠓճ͕͍࣌ؒͷͰ zͬ͘͟Γzόʔδϣϯ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ҙࣄ߲ • ߈ܸʹར༻Ͱ͖ΔΛ͠·͢ • ྙཧ؍Λ࣋ͬͯฉ͍ͯ͘ΕΔͱ͏Ε͍͠Ͱ͢ • ຊ൪ڥ࣮ڥʹհͨ͠߈ܸͳͲΛ ڐՄͳ͘ʹ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞ɻ • ࡞ͬͯͨΒ͘ͳͬͯ͠·ͬͨͷͰૣޱ͔͠Ε·ͤΜ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ
͢͜ͱ • "84*".ͱ • lͬ͘͟ΓzΘ͔Δ "84*". • *". 1PMJDZ •
*".6TFS • *".3PMF • *".(SPVQ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ͱ ˞͜ͷεϥΠυͰ "84*".͕ఏڙ͢Δ6TFS3PMFΛҰׅΓʹ͢Δࡍʹ l"84*".zͱදه͠·͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84ެࣜͷ *".ͷհϖʔδ ͜ͷεϥΠυͷొਓ
lͬ͘͟ΓzΘ͔Δ "84*". *".1PMJDZ • *".ͷج൫ • ͜ͷϙϦγʔʹݖݶΛॻ͘ • ར༻Ͱ͖Δ݅ڋ൱ʹ͔͚ؔͯ͠Δ •
ݖݶʹ l zΛ͚ͭΔͱϫΠϧυΧʔυʹͳΔ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ ͜Μͳײ͡ʹهड़͢Δ Πϝʔδ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS • "84Λ࢝ΊΔͱΈΜͳ͏ • ίϯιʔϧʹ$-*ʹରԠ͍ͯ͠Δ • ࿙ΕΔͱΊΜͲ͍͘͞ •
࿙ΕΔέʔε • ਓҝతϛεͰ࿙Εͯ͠·͏ • ΫϥΠΞϯτϚγϯ͕৵ೖ͞Ε౪·ΕΔ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ϙϦγʔΛΞλονޙड़ͷάϧʔϓʹ Ճͯ͠ݖݶΛ༩͢Δ *".6TFSΞΫηεʹؔ͢Δ ೝূใఏڙ͍ͯ͠·͢
lͬ͘͟ΓzΘ͔Δ "84*". *".3PMF • Ұ࣌తͳೝূใΛ༩ͯ͘͠ΕΔ • ผΞΧϯτʹ༩Ͱ͖ΔΑ ΫϩεΞΧϯτ • αʔϏεʹΞλον͢Δ͜ͱͰ
ͦͷαʔϏε͔Βͷૢ࡞ʹར༻Ͱ͖Δ Ұ࣌తͳೝূใΛ͍ग़͢Α • &$-BNCEBɺ$PEF#VJMEͳͲͳͲ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ *".6TFSͷΑ͏ʹQPMJDZΛΞλονͯ͠ ݖݶΛ༩͢Δ *". 3PMFΛར༻Ͱ͖ΔϦιʔε ΞΧϯτͳͲʹ৴པؔΛઃఆ͠·͢
&$Ͱ͍͍ͨ࣌͜Μͳײ͡ Πϝʔδ
lͬ͘͟ΓzΘ͔Δ "84*". *".(SPVQ • *". 6TFSΛ·ͱΊͯ͘ΕΔ • ͜ΕʹϙϦγʔΛΞλον͢Δͱάϧʔϓʹ ଐ͍ͯ͠Δ*".6TFS͕ΈΜͳڧ͘ͳΔ •
*".6TFS͕૿͑Δͱׂͱ͏ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつら
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ϢʔβʔΛՃͯ͠·ͱΊͯ ϙϦγʔΛ༩Ͱ͖Δ *".6TFS3PMFಉ༷ ϙϦγʔʹΑΔݖݶΛΞλον͢Δ
*".ͷzͬ͘͟Γz·ͱΊ *".1PMJDZ • ݖݶΛهड़͢Δ • 3PMF6TFSɺ(SPVQʹΞλονΛͯ͠ݖݶΛ༩Ͱ͖Δ *". 6TFS • 6TFSͷར༻͢ΔೝূใͳͲΛఏڙͰ͖Δ
*". 3PMF • αʔϏεผΞΧϯτʹҰ࣌తͳݖݶΛ༩Ͱ͖Δ *". (SPVQ • *".6TFSΛ·ͱΊͯཧͰ͖Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ ରࡦূͷอશ "84*".ͷ ಛݖঢ֨ͷߟ͑ํ
͢͜ͱ • "84*".ʹ͓͚Δಛݖঢ֨ͱ • ߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨ • ख๏ʹ͍ͭͯ • lͬ͘͟Γzख๏Λେผ͢Δͱ •
"84*".ʹతͳมߋૢ࡞Λߦ͏ • طଘͷͷΛѱ༻͢Δ • FUD !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ʹ͓͚Δಛݖঢ֨ͱ • "846TFS 3PMF͕ʹ༩͞ΕͨݖݶΛ ΑΓڧྗ·ͨ༗༻ͳݖݶʹΞοϓάϨʔυ͢Δߦҝ • ΞοϓάϨʔυͷख๏ • ݖݶͷॻ͖͑มߋ •
ଞͰར༻͞Ε͍ͯΔผͷೝূใͷऔಘ • *". 3PMFϙϦγʔͷ͛͢ସ͑ • FUD !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨ • ߈ܸऀ͕ "84Λૂ͏ཧ༝ • ଞਓͷ&$Ϧιʔε͍͍ͨͥ • 3%4ͱ͔ͷใൈ͖औΓ͍ͨͥ • SPPUݖݶऔͬͯΈ͍ͨͥ
• FUD ʜ • ͱ͔͘ѱ༻ͷͨΊʹ ͍ΖΜͳ͜ͱΛͯ͘͠Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ೝূใΛऔಘ ͲͷΑ͏ͳݖݶ͕ ༩͞Ε͍ͯΔ͔ ୳ࡧ ಛݖঢ֨ ѱ༻ ͋͘·Ͱ Πϝʔδ
lͬ͘͟Γz ख๏Λେผ͢Δ • "84*". ʹతͳมߋૢ࡞Λߦ͏ • ྫ • *".QPMJDZͷతͳมߋ •
*".3PMFͷϙϦγʔΞλον • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ • ྫ • -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘ • ϋΠϒϦοτ • ྫ • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον • ͦͷଞ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
lͬ͘͟Γz ख๏Λେผ͢Δ • "84*". ʹతͳมߋૢ࡞Λߦ͏ ܰ͘৮Ε·͢ • ྫ • *".QPMJDZͷతͳมߋ
• *".3PMFͷϙϦγʔΞλον • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ ͬͪ͜Λ͠·͢ • ྫ • -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘ • ϋΠϒϦοτ • ྫ • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον • ͦͷଞ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*". ʹతͳมߋૢ࡞Λߦ͏ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔ • *".6TFSͷ࡞ • طଘͷ*".6TFS͔ΒݤΛ࡞ •
*". 1PMJDZͷ࡞มߋ • *".3PMFʹ*".1PMJDZͷΞλον ͳͲ ༩͞Εͨ "84*".ͷݖݶΛར༻͠ ࣗͷཉ͍ͯ͠ΔݖݶΛऔಘઃఆ͢Δ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔ • طଘͷ-BNCEBͷίʔυΛมߋ • $MPVE'PSNBUJPOʹ*". 3PMFΛ༩ • &$ʹ*".3PMFΛ༩
ͳͲ Ϧιʔεʹ༩͞ΕΔҰ࣌తͳೝূใΛ ͳΜΒ͔ͷख๏Ͱऔಘ͠ར༻͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ 例: Lambdaから取得する場合の ⼤体のイメージ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ొ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ˞ ຊղઆʹ͓͍ͯ߈ܸऀࣄલʹ*".3PMF໊ΛѲ͍ͯ͠Δલఏͱ͢Δ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ طଘͷϦιʔεΛ࣮ߦ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ طଘͷϦιʔεΛߋ৽͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ৽نͰϦιʔεΛ্ཱͪ͛3PMFΛड͚͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ
ରࡦ • औಘΛ·્ͣࢭ͢Δ • HJUTFDSFUͷಋೖͰ HJUͷೝূใࠞೖΛ͙ • ͨΒʹೝূใΛڞ༗͠ͳ͍૿͞ͳ͍ • FUD
• ࠷খݖݶͷݪଇΛकΓ *".ͷϙϦγʔΛ࡞ • Θ͔Βͳ͍߹*"."DDFTT"OBMZ[FSͳͲΛ༻͍Δ • ݖݶ͚ͩͰͳ͘ར༻Ͱ͖ΔϦιʔεͳͲΛ੍ݶ͢Δ • 4FDVSJUZ)VCΛ༻͍ͯΞΧϯτͷڴҖใΛऩू • ΞΧϯτͰར༻͠ͳ͍ݖݶ 4$1 4FSWJDF$POUSPM1PMJDZ Ͱ੍ݶ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ূͷऔಘͱอશ ূͷऔಘ • $MPVE5SBJMͳͲΛ"1*ͷར༻ϩάΛऔಘ • ΞϓϦέʔγϣϯͷϩάͳͲ$MPVE 8BUDI-PHTΛ༻͍ͯऔಘ ূͷอଘ • 4ΫϩεΞΧϯτઌͷ4ʹอଘ
ূͷอશ • আͤ͞ͳ͍ͨΊʹ • 4ͷόʔδϣχϯάΛ༗ޮԽ • .'" EFMFUFͷ༗ޮԽ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ·ͱΊ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূڌͷอશ
·ͱΊ ͜ͷ-5Ͱͬ͘͟Γͱͨ͠ݖݶঢ֨ͷϑϩʔʹ͍ͭͯ৮Ε·ͨ͠ • "84*". ʹతͳมߋͳͲʹΑΓѱ༻͢Δͷ • طଘͷͷΛѱ༻͢Δͷ • ೋͭΛ߹ΘͤͨϋΠϒϦοτ "84ͳͲͷΫϥυαʔϏεʹରͯ͠ɺ߈ܸऀৗʹΛޫΒͤ
͍ͯ·͢ɻ ར༻ऀͱͯ͠ɺࢲͨͪͰ͖ΔݶΓͷରࡦͱূڌΛूΊམͪண͍ͨ ΫϥυϥΠϑΛա͝͠·͠ΐ͏ɻ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
͓͠·͍ 4QFDJBMUIBOLT*$000/.0/0 IUUQTJDPPPONPOPDPN !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ͓·͚ ֶशʹ͍ͭͯ
ֶशؔ࿈ • "84ެࣜυΩϡϝϯτͱᛀΊͬ͜ • ࣮ڥͰࢼͯ͠ΈΔ • ࠷ॳ GMBXTDMPVE ͱ͔Ͱ͍͍͔ •
4FSWFSMFTTपΓͩͱಈ͘ͷগͳ͍ • ҰԠհ • 08"41%74" • 08"414FSWFSMFTT(PBU !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ https://github.com/RhinoSecurityLabs/cloudgoat
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ https://rhinosecuritylabs.com/blog/?category=cloud-security