AWS上でインシデントの調査 Amazon Detective

AWS上でインシデントの調査 Amazon Detective

Classmethod主催のイベント、re:Growth2019での登壇資料です。#cmregrowth
詳細はブログ参照: xxxx

A857277d74d4719f7f7751dca5ed553e?s=128

cm-usuda-keisuke

December 11, 2019
Tweet

Transcript

  1. 3.

    SF*OWFOUपลͷηΩϡϦςΟܥͷൃද   w ࣄલϦϦʔε w "848"'W গ͠ղઆ  w

    *.%4WΠϯελϯεϝλσʔλαʔϏε গ͠ղઆ  w Πϕϯτத w 4"DDFTT1PJOU ผ࿮Ͱղઆ  w *"."DDFTT"OBMZ[FS ผ࿮Ͱղઆ  w "DDFTT"OBMZ[FSGPS4 ผ࿮Ͱղઆ  w "NB[PO%FUFDUJWF ͜ͷൃදͷϝΠϯ  w "NB[PO'SBVE%FUFDUPS ࣗ෼ͷαʔϏεͷෆਖ਼ݕग़  w 1SJODJQBM0SH1BUIT$POEJUJPO "840SHBOJ[BUJPOTΛར༻ͨ͠ΞΫηε੍ޚ  w 4FTTJPO5BHT *E1࿈ܞ࣌ʹλάΛ౉ͯ͠ΞΫηε੍ޚ  w "84/JUSP&ODMBWFT &$಺͔ΒͷϩʔΧϧ઀ଓͷΈՄೳͳִ཭ྖҬ  w 71$*OHSFTT3PVUJOH &/*Λϧʔτͷλʔήοτʹࢦఆɺ/8ܥ੡඼౳Ͱ׆༻  SF*OWFOUηΩϡϦςΟؔ࿈৘ใ·ͱΊSFJOWFOUIUUQTEFWDMBTTNFUIPEKQDMPVEBXTSFJOWFOUTFDVSJUZ
  2. 4.

    "848"'W   w தͷ࢓૊ΈΛม͑ͯผػೳͱͯ͠ϦϦʔε w ͜Ε·Ͱͷ"848"'͸$MBTTJD"848"'ʹ w ಛ௃ w

    +40/Ͱ8FC"$-Λఆٛ ϧʔϧΛҰׅઃఆ  w ϧʔϧݸ੍ݶഇࢭ ΩϟύγςΟϢχοτ࠾༻  w 03ԋࢉࢠʹΑΓॊೈͳϧʔϧߏ੒͕Մೳ w "84.BOBHFE3VMFT ".3T ϦϦʔε w "1*΋XBGWʹͳͬͯSFHJPOBMͱ౷߹
  3. 6.

    *.%4W   w &$ΠϯελϯεϝλσʔλαʔϏεW w Πϯελϯεϝλσʔλͱ͸ʁ w ͜Μͳ΍ͭDVSMIUUQMBUFTUNFUBEBUB w

    Կ͕ྑ͘ͳͬͨͷ͔ w ηΩϡϦςΟ͕޲্ͨ͠ w Կ͕໰୊ͩͬͨͷ͔ w ੬ऑͳ࣮૷͕͋Δ৔߹ʹ443'߈ܸ౳ʹΑΓΫϨσϯγϟϧ͕ྲྀग़͢ Δ w ௚ۙͰ͸$BQJUBM0OFͷࣄ͕݅͋ͬͨ w 443'߈ܸʹΑΔ$BQJUBM0OFͷݸਓ৘ใྲྀग़ʹ͍ͭͯ·ͱΊͯΈͨ QJZPMPHIUUQTQJZPMPHIBUFOBEJBSZKQFOUSZ
  4. 7.

    *.%4Wվળ఺   w W΁ͷΞΫηεʹ͸ࣄલʹऔಘͨ͠5PLFOΛඞਢͱ͢Δ w 5PLFO͸165Ͱऔಘ͢Δඞཁ͕͋Δ w 5PLFOϦΫΤετ࣌ʹ༗ޮظݶ ඵ

    ΛઃఆͰ͖Δ w 5PLFO͸ϔομʹೖΕͯϦΫΤετ͢Δඞཁ͕͋Δ w WΛແޮԽͰ͖Δ σϑΥϧτͰ͸ซ༻Մೳ  w ϝλσʔλαʔϏεࣗମΛແޮԽͰ͖Δ w &$ΠϯελϯεΛ্ཱͪ͛ΔࡍʹWͷΈʹઃఆ͢Δ͜ͱΛ*".Ͱ ڧ੍͢Δ͜ͱ͕Ͱ͖Δ w 9'PSXBSEFE'PSϔομʔ͕͋ΔϦΫΤετʹ5PLFOΛൃߦ͠ͳ ͍ w ϝλσʔλϨεϙϯεͷ55-Λ୹͘͠ෳ਺ϗετΛܦ༝ͨ͠औಘΛ ๷ࢭͰ͖Δ
  5. 8.

    *.%4W   w ͋͘·Ͱ΋؇࿨ࡦɺଟ૚๷ޚͱͯ͠࢖͏ w ࠜຊରࡦ͸֎෦63-ʹΞΫηε͠ͳ͍࢓༷౳ w ಙؙઌੜͷΑ͘෼͔Δղઆ΋ඞಡ w

    ಙؙߒͷ೔ه443'ରࡦͱͯ͠"NB[PO͔Βൃද͞Εͨ *.%4WͷޮՌͱݶքIUUQTCMPHUPLVNBSVPSH EFGFOTFTTSGBNB[POFD JNETWIUNM
  6. 11.

    "NB[PO%FUFDUJWFͱ͸   w જࡏతͳηΩϡϦςΟ໰୊·ͨ͸ٙΘ͍͠ΞΫςΟϏ ςΟͷࠜຊݪҼΛ؆୯ʹௐࠪɺ෼ੳɺ͓Αͼਝ଎ʹಛఆ Ͱ͖Δ w "84Ϧιʔε͔ΒϩάσʔλΛࣗಈతʹऩू͠ɺػցֶ शɺ౷ܭ෼ੳɺάϥϑཧ࿦Λ࢖༻ͯ͠ɺΑΓਝ଎͔ͭޮ

    ཰తͳηΩϡϦςΟௐࠪͷࢹ֮Խͱ࣮ࢪΛࢧԉ͢Δ w "NB[PO(VBSE%VUZ΍"844FDVSJUZ)VCͳͲͷ "84ηΩϡϦςΟαʔϏεɺ͓Αͼ"84ύʔτφʔη ΩϡϦςΟ੡඼ͱ౷߹͞Ε͍ͯΔ
  7. 16.

    ΋͏গ͠ਤͷઆ໌   w /*45ͷ$4' αΠόʔηΩϡϦςΟϑϨʔϜϫʔΫ ʹ͋ΔηΩϡϦ ςΟͷௐࠪϑϩʔͱ"84αʔϏεΛϚοϐϯάͨ͠ਤ w *EFOUJGZ

    1SPUFDU %FUFDU 3FTQPOE 3FDPWFSͱ͍͏ͭͷػೳ ͕͋Δ w ͜Ε·Ͱ͸(VBSE%VUZΛ࢝Ίɺ$MPVE8BUDI΍.BDJFɺ 4FDVSJUZ)VC౳Ͱݕ஌ %FUFDU Λ͍ͯͨ͠ w ͔͠͠ݕ஌ͨ͠ޙͷରԠ 3FTQPOE ͷͨΊʹ͸ௐࠪ *OWFTUJHBUF ͕ඞཁͰɺ͕͔͜͜ͳΓਏ͔ͬͨ w ۩ମతʹ͸$MPVE5SBJMϩά΍71$'MPX-PHTΛௐࠪ͢Δ w ͜ͷௐࠪΛ໓஡ۤ஡΍Γ΍͘͢͢Δͷ͕"NB[PO%FUFDUJWF
  8. 28.

    ͦͷଞͷαϚϦ   w ϚϧνΞΧ΢ϯτͰू໿Մೳ w ೔ͷτϥΠΞϧ͕Մೳ w ౦ژϦʔδϣϯΛؚΉͭͷϦʔδϣϯͰϓϥΠϕʔτϓ ϨϏϡʔ

    w Ձ֨ w ࠷ॳͷ (#݄(#͔Β w औΓࠐΉϩά ࣗಈతʂ  w 71$'MPX-PHT w $MPVE5SBJM؅ཧϩά w (VBSE%VUZ'JOEJOHT
  9. 30.