Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策
Search
a_zara_n
June 12, 2021
6
3.5k
"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策
モブセキュリティで話した内容です。
https://mob-security.connpass.com/event/209884/
情報の倫理的な取り扱いをお願いします。
a_zara_n
June 12, 2021
Tweet
Share
More Decks by a_zara_n
See All by a_zara_n
セキュリティ・キャンプ全国大会 2021 オンライン B3 分散アーキテクチャ時代におけるWebシステムの開発と運用 事前資料 クラウドシステムをセキュアに開発運用する勘所
azara
4
3.5k
Serverless applicationとセキュリティ~Cognito編~
azara
2
4k
Featured
See All Featured
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.7k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
4
380
GraphQLとの向き合い方2022年版
quramy
44
14k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
33
2.1k
How to Think Like a Performance Engineer
csswizardry
22
1.4k
Typedesign – Prime Four
hannesfritz
40
2.5k
The Power of CSS Pseudo Elements
geoffreycrofte
75
5.5k
Writing Fast Ruby
sferik
628
61k
Being A Developer After 40
akosma
89
590k
A Philosophy of Restraint
colly
203
16k
Automating Front-end Workflow
addyosmani
1368
200k
Speed Design
sergeychernyshev
27
810
Transcript
lͬ͘͟Γz͢ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํͱରࡦ ϞϒηΩϡϦςΟ ୈճ-5େձ NPC@TFDVSJUZ "[BSB !B@[BSB@O
ࣗݾհ ໊લ"[BSB 5XJUUFS!B@[BSB@O "CPVU ηΩϡϦςΟؔͷࣄΛ͍ͯ͠Δ৽ଔΤϯδχΞͰ͢ ηΩϡϦςΟͱ8FCͱΫϥυ "84 ͕͖Ͱ͢ ࠷ۙ"84440ͱ$POUSPM5PXFSͱٔΕͯ·ͨ͠ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
༨ஊ ࠓͷؾ࣋ͪ • ؇ͦ͘͏ͱࢥͬͯ-5ʹొͨ͠ ࣮ࡢ·ͰΕͯͨʜ ͋ͱࢀՃऀଟ͍ʜ • ϏΫϏΫ͍ͯ͠·͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ࠓ͢͜ͱ • "84 *". ͬͯͳʹ • "84*".ͷಛݖঢ֨ • ͳΜͱͳ͘Θ͔Δఔʹ͢ •
ͯ͢ͷݸผࣄྫ͞ͳ͍ • ରࡦͲ͏͢ΜͶΜ • ূͷอશͲ͏͢ΜͶΜ "84*".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
͢༰ • कΔଆ߈ܸऀ͕͢Δ߈ܸͷݪཧΛ ͓ͬͯ͘ͱରࡦ͍͢͠ΑͶͱ͍͏ؾ࣋ͪͰॻ͍ͯ·͢ • ରࡦํ๏ईͷ্͍ؔͰ͕ྃ͢͝ঝΛ • ݸʑͷࣄʹ͍ͭͯৄ͘͢͠Θ͚Ͱ͋Γ·ͤΜ • lͳΜͱͳ͘Θ͔ͬͨzͱ͍͏ͱ͜Ζ·Ͱ͠·͢
• ֤αʔϏεͷৄ͍͠ར༻ํ๏ʹؔͯ͠ ެࣜυΩϡϝϯτΛࢀরͯ͠Լ͍͞ • ࠓޙͲ͔͜ͰύϫʔΞοϓ൛Λ͔͢͠Ε·ͤΜ͕ ࠓճ͕͍࣌ؒͷͰ zͬ͘͟Γzόʔδϣϯ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ҙࣄ߲ • ߈ܸʹར༻Ͱ͖ΔΛ͠·͢ • ྙཧ؍Λ࣋ͬͯฉ͍ͯ͘ΕΔͱ͏Ε͍͠Ͱ͢ • ຊ൪ڥ࣮ڥʹհͨ͠߈ܸͳͲΛ ڐՄͳ͘ʹ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞ɻ • ࡞ͬͯͨΒ͘ͳͬͯ͠·ͬͨͷͰૣޱ͔͠Ε·ͤΜ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ
͢͜ͱ • "84*".ͱ • lͬ͘͟ΓzΘ͔Δ "84*". • *". 1PMJDZ •
*".6TFS • *".3PMF • *".(SPVQ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ͱ ˞͜ͷεϥΠυͰ "84*".͕ఏڙ͢Δ6TFS3PMFΛҰׅΓʹ͢Δࡍʹ l"84*".zͱදه͠·͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84ެࣜͷ *".ͷհϖʔδ ͜ͷεϥΠυͷొਓ
lͬ͘͟ΓzΘ͔Δ "84*". *".1PMJDZ • *".ͷج൫ • ͜ͷϙϦγʔʹݖݶΛॻ͘ • ར༻Ͱ͖Δ݅ڋ൱ʹ͔͚ؔͯ͠Δ •
ݖݶʹ l zΛ͚ͭΔͱϫΠϧυΧʔυʹͳΔ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ ͜Μͳײ͡ʹهड़͢Δ Πϝʔδ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS • "84Λ࢝ΊΔͱΈΜͳ͏ • ίϯιʔϧʹ$-*ʹରԠ͍ͯ͠Δ • ࿙ΕΔͱΊΜͲ͍͘͞ •
࿙ΕΔέʔε • ਓҝతϛεͰ࿙Εͯ͠·͏ • ΫϥΠΞϯτϚγϯ͕৵ೖ͞Ε౪·ΕΔ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ϙϦγʔΛΞλονޙड़ͷάϧʔϓʹ Ճͯ͠ݖݶΛ༩͢Δ *".6TFSΞΫηεʹؔ͢Δ ೝূใఏڙ͍ͯ͠·͢
lͬ͘͟ΓzΘ͔Δ "84*". *".3PMF • Ұ࣌తͳೝূใΛ༩ͯ͘͠ΕΔ • ผΞΧϯτʹ༩Ͱ͖ΔΑ ΫϩεΞΧϯτ • αʔϏεʹΞλον͢Δ͜ͱͰ
ͦͷαʔϏε͔Βͷૢ࡞ʹར༻Ͱ͖Δ Ұ࣌తͳೝূใΛ͍ग़͢Α • &$-BNCEBɺ$PEF#VJMEͳͲͳͲ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつ
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ *".6TFSͷΑ͏ʹQPMJDZΛΞλονͯ͠ ݖݶΛ༩͢Δ *". 3PMFΛར༻Ͱ͖ΔϦιʔε ΞΧϯτͳͲʹ৴པؔΛઃఆ͠·͢
&$Ͱ͍͍ͨ࣌͜Μͳײ͡ Πϝʔδ
lͬ͘͟ΓzΘ͔Δ "84*". *".(SPVQ • *". 6TFSΛ·ͱΊͯ͘ΕΔ • ͜ΕʹϙϦγʔΛΞλον͢Δͱάϧʔϓʹ ଐ͍ͯ͠Δ*".6TFS͕ΈΜͳڧ͘ͳΔ •
*".6TFS͕૿͑Δͱׂͱ͏ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ こいつら
lͬ͘͟ΓzΘ͔Δ "84*". *".6TFS !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ϢʔβʔΛՃͯ͠·ͱΊͯ ϙϦγʔΛ༩Ͱ͖Δ *".6TFS3PMFಉ༷ ϙϦγʔʹΑΔݖݶΛΞλον͢Δ
*".ͷzͬ͘͟Γz·ͱΊ *".1PMJDZ • ݖݶΛهड़͢Δ • 3PMF6TFSɺ(SPVQʹΞλονΛͯ͠ݖݶΛ༩Ͱ͖Δ *". 6TFS • 6TFSͷར༻͢ΔೝূใͳͲΛఏڙͰ͖Δ
*". 3PMF • αʔϏεผΞΧϯτʹҰ࣌తͳݖݶΛ༩Ͱ͖Δ *". (SPVQ • *".6TFSΛ·ͱΊͯཧͰ͖Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ ରࡦূͷอશ "84*".ͷ ಛݖঢ֨ͷߟ͑ํ
͢͜ͱ • "84*".ʹ͓͚Δಛݖঢ֨ͱ • ߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨ • ख๏ʹ͍ͭͯ • lͬ͘͟Γzख๏Λେผ͢Δͱ •
"84*".ʹతͳมߋૢ࡞Λߦ͏ • طଘͷͷΛѱ༻͢Δ • FUD !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ʹ͓͚Δಛݖঢ֨ͱ • "846TFS 3PMF͕ʹ༩͞ΕͨݖݶΛ ΑΓڧྗ·ͨ༗༻ͳݖݶʹΞοϓάϨʔυ͢Δߦҝ • ΞοϓάϨʔυͷख๏ • ݖݶͷॻ͖͑มߋ •
ଞͰར༻͞Ε͍ͯΔผͷೝূใͷऔಘ • *". 3PMFϙϦγʔͷ͛͢ସ͑ • FUD !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨ • ߈ܸऀ͕ "84Λૂ͏ཧ༝ • ଞਓͷ&$Ϧιʔε͍͍ͨͥ • 3%4ͱ͔ͷใൈ͖औΓ͍ͨͥ • SPPUݖݶऔͬͯΈ͍ͨͥ
• FUD ʜ • ͱ͔͘ѱ༻ͷͨΊʹ ͍ΖΜͳ͜ͱΛͯ͘͠Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ೝূใΛऔಘ ͲͷΑ͏ͳݖݶ͕ ༩͞Ε͍ͯΔ͔ ୳ࡧ ಛݖঢ֨ ѱ༻ ͋͘·Ͱ Πϝʔδ
lͬ͘͟Γz ख๏Λେผ͢Δ • "84*". ʹతͳมߋૢ࡞Λߦ͏ • ྫ • *".QPMJDZͷతͳมߋ •
*".3PMFͷϙϦγʔΞλον • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ • ྫ • -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘ • ϋΠϒϦοτ • ྫ • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον • ͦͷଞ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
lͬ͘͟Γz ख๏Λେผ͢Δ • "84*". ʹతͳมߋૢ࡞Λߦ͏ ܰ͘৮Ε·͢ • ྫ • *".QPMJDZͷతͳมߋ
• *".3PMFͷϙϦγʔΞλον • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ ͬͪ͜Λ͠·͢ • ྫ • -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘ • ϋΠϒϦοτ • ྫ • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον • ͦͷଞ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*". ʹతͳมߋૢ࡞Λߦ͏ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔ • *".6TFSͷ࡞ • طଘͷ*".6TFS͔ΒݤΛ࡞ •
*". 1PMJDZͷ࡞มߋ • *".3PMFʹ*".1PMJDZͷΞλον ͳͲ ༩͞Εͨ "84*".ͷݖݶΛར༻͠ ࣗͷཉ͍ͯ͠ΔݖݶΛऔಘઃఆ͢Δ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔ • طଘͷ-BNCEBͷίʔυΛมߋ • $MPVE'PSNBUJPOʹ*". 3PMFΛ༩ • &$ʹ*".3PMFΛ༩
ͳͲ Ϧιʔεʹ༩͞ΕΔҰ࣌తͳೝূใΛ ͳΜΒ͔ͷख๏Ͱऔಘ͠ར༻͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ 例: Lambdaから取得する場合の ⼤体のイメージ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ొ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ˞ ຊղઆʹ͓͍ͯ߈ܸऀࣄલʹ*".3PMF໊ΛѲ͍ͯ͠Δલఏͱ͢Δ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ طଘͷϦιʔεΛ࣮ߦ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ طଘͷϦιʔεΛߋ৽͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϦιʔεΛܦ༝ͯ͠ طଘͷ*".3PMF͔Βऔಘ ৽نͰϦιʔεΛ্ཱͪ͛3PMFΛड͚͢ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ
ରࡦ • औಘΛ·્ͣࢭ͢Δ • HJUTFDSFUͷಋೖͰ HJUͷೝূใࠞೖΛ͙ • ͨΒʹೝূใΛڞ༗͠ͳ͍૿͞ͳ͍ • FUD
• ࠷খݖݶͷݪଇΛकΓ *".ͷϙϦγʔΛ࡞ • Θ͔Βͳ͍߹*"."DDFTT"OBMZ[FSͳͲΛ༻͍Δ • ݖݶ͚ͩͰͳ͘ར༻Ͱ͖ΔϦιʔεͳͲΛ੍ݶ͢Δ • 4FDVSJUZ)VCΛ༻͍ͯΞΧϯτͷڴҖใΛऩू • ΞΧϯτͰར༻͠ͳ͍ݖݶ 4$1 4FSWJDF$POUSPM1PMJDZ Ͱ੍ݶ͢Δ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ূͷऔಘͱอશ ূͷऔಘ • $MPVE5SBJMͳͲΛ"1*ͷར༻ϩάΛऔಘ • ΞϓϦέʔγϣϯͷϩάͳͲ$MPVE 8BUDI-PHTΛ༻͍ͯऔಘ ূͷอଘ • 4ΫϩεΞΧϯτઌͷ4ʹอଘ
ূͷอશ • আͤ͞ͳ͍ͨΊʹ • 4ͷόʔδϣχϯάΛ༗ޮԽ • .'" EFMFUFͷ༗ޮԽ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ·ͱΊ "84*".ͷ "84 *".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূڌͷอશ
·ͱΊ ͜ͷ-5Ͱͬ͘͟Γͱͨ͠ݖݶঢ֨ͷϑϩʔʹ͍ͭͯ৮Ε·ͨ͠ • "84*". ʹతͳมߋͳͲʹΑΓѱ༻͢Δͷ • طଘͷͷΛѱ༻͢Δͷ • ೋͭΛ߹ΘͤͨϋΠϒϦοτ "84ͳͲͷΫϥυαʔϏεʹରͯ͠ɺ߈ܸऀৗʹΛޫΒͤ
͍ͯ·͢ɻ ར༻ऀͱͯ͠ɺࢲͨͪͰ͖ΔݶΓͷରࡦͱূڌΛूΊམͪண͍ͨ ΫϥυϥΠϑΛա͝͠·͠ΐ͏ɻ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
͓͠·͍ 4QFDJBMUIBOLT*$000/.0/0 IUUQTJDPPPONPOPDPN !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ ͓·͚ ֶशʹ͍ͭͯ
ֶशؔ࿈ • "84ެࣜυΩϡϝϯτͱᛀΊͬ͜ • ࣮ڥͰࢼͯ͠ΈΔ • ࠷ॳ GMBXTDMPVE ͱ͔Ͱ͍͍͔ •
4FSWFSMFTTपΓͩͱಈ͘ͷগͳ͍ • ҰԠհ • 08"41%74" • 08"414FSWFSMFTT(PBU !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ https://github.com/RhinoSecurityLabs/cloudgoat
ֶशؔ࿈ !B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ https://rhinosecuritylabs.com/blog/?category=cloud-security