Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
IAMのセキュアな利用 ココを押さえておけばOK
Nakahara
August 17, 2021
2
1.7k
IAMのセキュアな利用 ココを押さえておけばOK
Nakahara
August 17, 2021
Tweet
Share
More Decks by Nakahara
See All by Nakahara
つらみが解決! Rainを使ってCloudFormationをもっと便利に
cmnakahara
0
730
Featured
See All Featured
Designing for Performance
lara
596
63k
Mobile First: as difficult as doing things right
swwweet
212
7.5k
Rebuilding a faster, lazier Slack
samanthasiow
62
7.2k
Done Done
chrislema
174
14k
Creatively Recalculating Your Daily Design Routine
revolveconf
205
10k
Building a Scalable Design System with Sketch
lauravandoore
447
30k
Navigating Team Friction
lara
175
11k
GraphQLの誤解/rethinking-graphql
sonatard
24
6.2k
The Mythical Team-Month
searls
208
39k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
7
1k
The Invisible Customer
myddelton
110
11k
Fireside Chat
paigeccino
11
1.3k
Transcript
Ր "84ࣄۀຊ෦ ίϯαϧςΟϯά෦ ͳ͔Β *".ͷηΩϡΞͳར༻ ίίΛԡ͓͚͑ͯ͞0,
2 ࣗݾհ ͳ͔Β • "84ࣄۀຊ෦ ίϯαϧςΟϯά෦ • ͖ͳαʔϏε • "84$MPVE'PSNBUJPO
ݱࡏ"84Λར༻தͷํɺ͜Ε͔Β"84Λར༻͢Δํɺ "84Λ҆৺҆શʹར༻͢Δҝɺ *".ͷ۩ମతͳઃఆํ๏Λ͠·͢ طग़ͳใ͔ΓͰ͕͢ɺԿͰ͓͍͑ͨ͠ॏཁͳ༰ͩͱ ࢥ͍ͬͯΔͷͰͥͻ࣋ͪؼ͍ͬͯͩ͘͞ ຊ͓͢Δ͜ͱ
l *".Ϣʔβʔͷ.'"ඞਢ l *".ϙϦγʔ ಛʹJBN ɺඞཁͳΞΫγϣϯͷΈڐՄ l εΠονϩʔϧΛ͍͜ͳ͢ l ΞΫηεΩʔ*%ɺγʔΫϨοτʔΩʔۃྗΘͳ͍
͢༰
Έͳ͞Μ .'"ɺઃఆ͠·͔͢ʁ *".Ϣʔβʔͷ.'"ඞਢ
.'"͕ະઃఆͷํɺ ࠓ͙͢ಋೖΛݕ౼͠·͠ΐ͏ʂ *".Ϣʔβʔͷ.'"ඞਢ
"84ͷར༻ʹ͔ܽͤͳ͍*".ϢʔβʔɺछྨͷΞΫηεํ๏͋Γ l ϓϩάϥϜʹΑΔΞΫηε ΞΫηεΩʔ*%ͱγʔΫϨοτΞΫηεΩʔͰ"84"1*ɺ$-*ɺ4%,ͳͲͷ։ൃπʔϧ͔ΒΞΫ ηε l "84ϚωδϝϯτίϯιʔϧͷΞΫηε Ϣʔβʔ໊ɺύεϫʔυͰ"84Ϛωδϝϯτίϯιʔϧ ҎԼɺ".$ ΞΫηε
*".Ϣʔβʔͷ.'"ඞਢ
ϓϩάϥϜʹΑΔΞΫηεɺ"84ϚωδϝϯτίϯιʔϧͷΞΫηεͲͪΒೝ ূཁૉͰ͍͏ʮLOPXMFEHFGBDUPSʯʹΑΔೝূͰ͢ɻ͜ͷϢʔβʔ໊ɺύεϫʔ υ͕࿙Ӯ͢ΔͳͲͰ୭ͰΞΫηεͰ͖ͯ͠·͍·͢ɻ *".Ϣʔβʔͷ.'"ඞਢ
*".Ͱɺଟཁૉೝূ .'" Λαϙʔτ LOPXMFEHFGBDUPS Ϣʔβʔ໊ɺύεϫʔυ QPTTFTTJPOGBDUPS .'"σόΠε ʹΑΔೝূ͕ՄೳͰ͢ɻϢʔβʔ໊ɺύεϫʔυ͕࿙Ӯͯ͠ɺ͏Ұͭͷೝূཁ ૉ͕ແ͍ͱΞΫηεͰ͖·ͤΜɻ
*".Ϣʔβʔͷ.'"ඞਢ
͍͔ͭ͘ͷ.'"͕αϙʔτ l 6'ηΩϡϦςΟΩʔ 1$ʹ64#ΩʔΛࢦͯ͠ར༻ l ϋʔυΣΞ .'"σόΠε ϋʔυΣΞ.'"σόΠεʹੜ͞ΕΔϫϯλΠϜύεϫʔυΛར༻ l Ծ.'"σόΠε
(PPHMF"VUIFOUJDBUPS.JDSPTPGU"VUIFOUJDBUPSɺ1BTTXPSEͳͲʹઃఆͯ͠ੜ͞ΕΔ ϫϯλΠϜύεϫʔυΛར༻ 1$ɺεϚʔτϑΥϯɺJ1IPOFͳͲͰઃఆ͕ՄೳɻηΩϡϦςΟϙϦγʔʹԠͯ͡બ *".Ϣʔβʔͷ.'"ඞਢ
ϙΠϯτ l ύεϫʔυ͓Αͼ.'"ͷઃఆɺϢʔβʔ͕࣮ࢪ͢Δ *".Ϣʔβʔͷ.'"ඞਢ ଟཁૉೝূᘳͰͳ͍ .'"σόΠεΛઃఆ͢Δ23ίʔυ·ͨɺγʔΫϨο τίʔυ͕࿙Ӯ͢Εɺ୭Ͱ.'"ͷઃఆ͕Մೳ ˠ ύεϫʔυ͓Αͼ.'"ͷઃఆɺϢʔβʔ͕࣮ࢪ͢Δ͜ ͱͰΑΓηΩϡΞ
ϙΠϯτ l ϢʔβʔࣗͰύεϫʔυɺ.'"͕ઃఆͰ͖Δ*".ϙϦγʔΛׂΓͯΔ - *".ࢀর - *".3FBE0OMZ"DDFTT "84ཧϙϦγʔ - ύεϫʔυઃఆ
- *".6TFS$IBOHF1BTTXPSE "84ཧϙϦγʔ - ύεϫʔυϙϦγʔͰ lϢʔβʔʹύεϫʔυͷมߋΛڐՄ͢Δz͕༗ޮͷ߹ෆཁ - .'"ઃఆ ҎԼͷ"DUJPOΛ"MMPX - lJBN$SFBUF7JSUVBM.'"%FWJDFz - JBN&OBCMF.'"%FWJDFz - JBN3FTZOD.'"%FWJDFz - 3FTPVSDFɺzBSOBXTJBN"84ΞΧϯτ*%NGB\BXTVTFSOBNF^zࣗͷΈՄ *".Ϣʔβʔͷ.'"ඞਢ
ϙΠϯτ l ϓϩάϥϜΞΫηεɺ.'"͕༗ޮͰΞΫηεͰ͖ͯ͠·͏ *".Ϣʔβʔͷ.'"ඞਢ
ϙΠϯτ l ϓϩάϥϜΞΫηεͷ੍ޚํ๏ - *".ϙϦγʔʹ l$POEJUJPOz\l#PPMz\lBXT.VMUJ'BDUPS"VUI1SFTFOUzlUSVFz^Λઃఆɻ .'"Ͱೝূ͞Ε͍ͯΕΞΫηεΛڐՄɻBXT TUT HFUTFTTJPOUPLFOίϚϯυͰҰ࣌Ϋ ϨσϯγϟϧΛൃߦɻ"DDFTT,FZ*Eɺ4FDSFU"DDFTT,FZɺ4FTTJPO5PLFOΛڥมʹΤ
Ϋεϙʔτͯ͠ར༻ *".Ϣʔβʔͷ.'"ඞਢ
.'"͕ઃఆͰ͖·ͨ͠ ͕ɺ*".ϙϦγʔʹΑͬͯࣗͷ .'"Λແޮʹ͢Δ͜ͱ͕Ͱ͖ͯ͠·͍·͢ ϫϯλΠϜύεϫʔυͷೖྗ͕ΊΜͲ͍͘͞ͳͲɻɻ *".Ϣʔβʔͷ.'"ඞਢ
*".ͷૢ࡞ΛՄೳͱ͢Δ*".ϙϦγʔΛઃఆ͠ͳ͍ l "ENJOJTUSBUPST"DDFTT "84ཧϙϦγʔ - ϧʔτΞΧϯτͷ࣍ʹڧ͍ݖݶΛ࣋ͭϙϦγʔɻ*".ؚΉ΄ͱΜͲͷૢ࡞͕Մೳ - ҆қͳΞλονઈରμϝʂ"84ΞΧϯτΛཧ͢ΔϢʔβʔͷΈΞλον l *".'VMM"DDFTT
"84ཧϙϦγʔ - *".ͯ͢ͷૢ࡞͕Մೳ - ҆қͳΞλονઈରμϝʂ"84ΞΧϯτϢʔβʔΛཧ͢ΔϢʔβʔͷΈΞλον l "DUJPOͰ JBN JBN$SFBUF JBN"EE JBN%FMFUF JBN3FNPWFͳͲ͕"MMPXͱͳΔϙϦγʔ ΧελϚʔཧϙϦγʔɺΠϯϥΠϯϙϦγʔ - *".Ϧιʔεͷ࡞ɺআͷૢ࡞͕ՄೳɻˢͷݖݶΛ࣋ͭϙϦγʔΛۃྗ࡞Βͳ͍ɺΞλο ν͠ͳ͍ *".ϙϦγʔ ಛʹJBN ɺඞཁͳΞΫγϣϯͷΈڐՄ
ͱ͍͑ɺ*".ΛڐՄ͠ͳ͍ͱ ։ൃͰ͖ͳ͍ ӡ༻Ͱ͖ͳ͍ *".ϙϦγʔ ಛʹJBN ɺඞཁͳΞΫγϣϯͷΈڐՄ
ಛఆͷ*".ͷૢ࡞ΛՄೳͱ͢Δ*".ϙϦγʔ ։ൃ l 1PXFS6TFST"DDFTT ৬ػೳͷ"84ཧϙϦγʔ - ։ൃऀ͚ͷݖݶΛ࣋ͭϙϦγʔɻ*".ɺ0SHBOJ[BUJPOTɺٻΛআ͘΄ͱΜͲͷૢ࡞͕Մೳ - αʔϏεʹϦϯΫ͞Εͨϩʔϧͷ࡞ΛڐՄ l
*".ϩʔϧͷ࡞ΛڐՄ͢ΔϙϦγʔ ΧελϚʔཧϙϦγʔɺΠϯϥΠϯϙϦγʔ - *".ϩʔϧΛݸผʹ࡞Ͱ͖ΔϙϦγʔɻҎԼͷ"DUJPOΛ"MMPX - JBN$SFBUF*OTUBODF1SPGJMFz - JBN$SFBUF3PMFz - JBN"EE3PMF5P*OTUBODF1SPGJMFz - JBN"UUBDI3PMF1PMJDZ - "ENJOJTUSBUPST"DDFTTɺ*".'VMM"DDFTTϙϦγʔͷΞλονΛڐՄ͠ͳ͍ϙϦγʔɻҎԼͷ"DUJPO Λ%FOZɺ$POEJUJPOͰˢͷϙϦγʔΛࢦఆ - JBN"UUBDI3PMF1PMJDZz - l$POEJUJPOz\l'PS"OZ7BMVF"SO&RVBMT*G&YJTUTz \lJBN1PMJDZ"3/zlBSOBXTJBNBXTQPMJDZ"ENJOJTUSBUPS"DDFTTz BSOBXTJBNBXTQPMJDZ *".'VMM"DDFTT^^ - "84Λར༻͢ΔڥʹԠͯ͡Ξλονͤ͞ͳ͍ϙϦγʔΛՃ *".ϙϦγʔ ಛʹJBN ɺඞཁͳΞΫγϣϯͷΈڐՄ
ಛఆͷ*".ͷૢ࡞ΛՄೳͱ͢Δ*".ϙϦγʔ ӡ༻ - *".ࢀর - *".3FBE0OMZ"DDFTT "84ཧϙϦγʔ - *"."DDFTT"OBMZ[FSࢀর -
*"."DDFTT"OBMZ[FS3FBE0OMZ"DDFTT "84ཧϙϦγʔ - *"."DDFTT"EWJTPSࢀর - *"."DDFTT"EWJTPS3FBE0OMZ "84ཧϙϦγʔ *".ϙϦγʔ ಛʹJBN ɺඞཁͳΞΫγϣϯͷΈڐՄ
ΑΓηΩϡΞͳ*".ར༻ͷख๏ͱͯ͠ εΠονϩʔϧΛར༻͢Δ εΠονϩʔϧΛ͍͜ͳ͢
εΠονϩʔϧͱɺ৴པ͞ΕͨΤϯςΟςΟ "84αʔϏε"84Ξ Χϯτ ͔Β*".ϩʔϧʹεΠονͯ͠Ξλον͞ΕͨΞΫγϣϯΛ ࣮ߦ͢Δ͜ͱ͕Ͱ͖Δ εΠονϩʔϧΛ͍͜ͳ͢
εΠονϩʔϧෳͷ"84ΞΧϯτΛεΠον͢Δ߹Ͱձ͞ ΕΔ͜ͱ͕͋Δ͕ɺͭͷ"84ΞΧϯτͰར༻Մೳ εΠονϩʔϧΛ͍͜ͳ͢
εΠονϩʔϧͷ͍͍ͱ͜Ζ l "84$-*5FSSBGPSNͳͲʹΑΔϓϩάϥϜΞΫηεͰҰ࣌ΫϨσϯγϟϧͷൃߦɺڥมͷΤΫε ϙʔτ͕ෆཁ - BXTDPOGJHϑΝΠϧɺҎԼͷ௨ΓɻεΠονϩʔϧ͕ෳ͋Δ߹ɺ͜ͷηοτͰه εΠονϩʔϧΛ͍͜ͳ͢ - ίϚϯυྫ BXT
TMTrQSPGJMFOBLBIBSB ˡBXTDPOGJHϑΝΠϧͷQSPGJMF໊Λࢦఆ <QSPGJMFOBLBIBSB> SFHJPOBQOPSUIFBTU NGB@TFSJBM BSOBXTJBN.'"Λઃఆͨ͠"84ΞΧϯτ*%NGB*".Ϣʔβʔ໊ SPMF@BSO BSOBXTJBNεΠονϩʔϧઌͷ"84ΞΧϯτ*%SPMF*".ϩʔϧ໊ TPVSDF@QSPGJMF EFGBVMU NGB@TFSJBM ɺ*".Ϣʔβʔͷ ೝূใͰ֬ೝͰ͖Δ
εΠονϩʔϧͷ͍͍ͱ͜Ζ l "84ΞΧϯτ͕૿͑ͯεΠονϩʔϧઌͷ"84ΞΧϯτ͕มΘΔ͚ͩͳͷͰΞʔΩς ΫνϟҰॹ l ೝূ͕ෆཁͱͳΔ εΠονϩʔϧೝՄ εΠονϩʔϧΛ͍͜ͳ͢
ϙΠϯτ l εΠονϩʔϧ͢Δ*".ϩʔϧΛ࡞ - ৴པ͢ΔΤϯςΟςΟͰ"84ΞΧϯτΛࢦఆ - .'"ඞਢ εΠονϩʔϧͷಋೖ
ϙΠϯτ l ͯ͢ͷ*".Ϣʔβʔ͕ॴଐ͢Δ*".Ϣʔβʔάϧʔϓ - ύεϫʔυɺ.'"ɺΞΫηεΩʔ*%ΛൃߦͰ͖Δ*".ϙϦγʔΛΞλον l ׂຖͷ*".ϢʔβʔάϧʔϓΛ༻ҙ - εΠον͢Δ*".ϙϦγʔΛΞλον εΠονϩʔϧͷಋೖ
εΠονϩʔϧͷಋೖ ϙΠϯτ l εΠον͢Δ*".ϙϦγʔ - εΠονϩʔϧઌͷ*".ϩʔϧΛࢦఆ - $POEJUJPOͰ.'"Λඞਢͱ͢Δ \ 7FSTJPO
4UBUFNFOU< \ 4JE7JTVBM&EJUPS &GGFDU"MMPX "DUJPOTUT"TTVNF3PMF 3FTPVSDF< BSOBXTJBNεΠονϩʔϧઌͷ"84ΞΧϯτ*%SPMF*".ϩʔϧ໊ > $POEJUJPO\ #PPM*G&YJTUT\ BXT.VMUJ'BDUPS"VUI1SFTFOUUSVF ^ ^ ^ > ^
ҟͳΔ"84ΞΧϯτͷεΠονϩʔϧΛՃ͢Δ߹ɺεΠον ϩʔϧઌͷ*".ϩʔϧΛׂຖͷ*".ϙϦγʔʹه εΠονϩʔϧͷಋೖ
͜͜·Ͱ࣮Ͱ͖ΕϢʔβʔͷηΩϡϦςΟ˕ εΠονϩʔϧΛ͍͜ͳ͢
࠷ޙʹ͏ͻͱͭ ӬଓతͳΞΫηεΩʔ*%ΛۃྗΘͳ͍ ӬଓతͳΞΫηεΩʔ*%ۃྗΘͳ͍
ӬଓతͳΞΫηεΩʔ*%ۃྗΘͳ͍
ͳͥۃྗΘͳ͍΄͏͕͍͍ͷ͔ l *".Ϣʔβʔ͔Β͍ग़ͨ͠ӬଓతͳΞΫηεΩʔ*%ɺγʔΫϨοτΞΫηεΩʔ͕ɺϋʔυ ίʔσΟϯά͞ΕͨϓϩάϥϜͷιʔείʔυͷྲྀग़ͳͲͰଟେͳඃ͕ग़ΔՄೳੑ - ʲ࣮ʳΞΫηεΩʔྲྀग़ɺ߈ܸऀͷͱͬͨߦಈͱͦͷରࡦ - IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBDDFTTLFZMFBL l ʮ͏ͪେৎʯͱ͍͏ઈରແ͍ͷͰۃྗΘͳ͍͜ͱ͕ਪ
ӬଓతͳΞΫηεΩʔ*%ۃྗΘͳ͍
Ͳ͏͢ΕΑ͍͔ l ࡞ۀ͔Β"84$-*5FSSBGPSNʹΑΔΞΫηεΩʔ*%ͷ༻ - *".ϙϦγʔʹ l$POEJUJPOz\l#PPMz\lBXT.VMUJ'BDUPS"VUI1SFTFOUzlUSVFz^Λઃఆ - εΠονϩʔϧͰ.'"Λඞਢͱ͢Δ l "84Ϧιʔε
&$ɺ&$4ɺ-BNCEBͳͲ ɺ*".ϩʔϧΛ༻ - *".ϩʔϧΛ"84ϦιʔεʹΞλονɻΠϯελϯεϝλσʔλ͔ΒҰ࣌ΫϨσϯγϟϧ Λൃߦͯ͠ར༻ "DDFTT,FZ*Eɺ4FDSFU"DDFTT,FZɺ5PLFO - "844%,ɺΠϯελϯεϓϩϑΝΠϧ͔ΒࣗಈͰऔಘɺΞϓϦέʔγϣϯͱͯ͠ೝূ ใͷཧɺอ࣋ෆཁ ӬଓతͳΞΫηεΩʔ*%ۃྗΘͳ͍
Ͳ͏ͯ͠ར༻͢Δඞཁ͕͋Δ l ΦϯϓϨϛε͔Β"84ʹΞΫηε͕ඞཁͳ߹ - *".ϙϦγʔΛඞཁͳ"DSJPOͷΈڐՄ - *".ϙϦγʔʹ l$POEJUJPOz\l#PPMz\lBXT4PVSDF*QzlYYYYYz^Λઃఆɻૹ৴ݩ*1Ξ υϨεΛ੍ݶ ӬଓతͳΞΫηεΩʔ*%ۃྗΘͳ͍
l *".Ϣʔβʔͷ.'"ࠓ͙͢ಋೖ͠·͠ΐ͏ʂ l *".ϙϦγʔͰదͳݖݶΛઃఆʂ l εΠονϩʔϧͭͷΞΧϯτͰಋೖ͠·͠ΐ͏ʂ l ӬଓతͳΞΫηεΩʔ*%ɺγʔΫϨοτʔΩʔΛΘͳ͍ϫʔΫ ϩʔυΛࢦ͠·͠ΐ͏ʂ ·ͱΊ
36