Save 37% off PRO during our Black Friday Sale! »

AWS上でインシデントの調査 Amazon Detective

AWS上でインシデントの調査 Amazon Detective

Classmethod主催のイベント、re:Growth2019での登壇資料です。#cmregrowth
詳細はブログ参照: xxxx

A857277d74d4719f7f7751dca5ed553e?s=128

cm-usuda-keisuke

December 11, 2019
Tweet

Transcript

  1. "84্ͰΠϯγσϯτͷௐࠪ "NB[PO%FUFDUJWF  ӓాɹՂ༞

  2. ࣗݾ঺հ   ӓాɹՂ༞ ɾΫϥεϝιουגࣜձࣾ ɾ"84ࣄۀຊ෦ ɹιϦϡʔγϣϯΞʔΩςΫτ ɹηΩϡϦςΟνʔϜϦʔμʔ ɾ4FDVSJUZ+"84ӡӦ ɾ޷͖ͳαʔϏε

    ɹ"848"'Ϛωʔδυϧʔϧ AWS WAF
  3. SF*OWFOUपลͷηΩϡϦςΟܥͷൃද   w ࣄલϦϦʔε w "848"'W গ͠ղઆ  w

    *.%4WΠϯελϯεϝλσʔλαʔϏε গ͠ղઆ  w Πϕϯτத w 4"DDFTT1PJOU ผ࿮Ͱղઆ  w *"."DDFTT"OBMZ[FS ผ࿮Ͱղઆ  w "DDFTT"OBMZ[FSGPS4 ผ࿮Ͱղઆ  w "NB[PO%FUFDUJWF ͜ͷൃදͷϝΠϯ  w "NB[PO'SBVE%FUFDUPS ࣗ෼ͷαʔϏεͷෆਖ਼ݕग़  w 1SJODJQBM0SH1BUIT$POEJUJPO "840SHBOJ[BUJPOTΛར༻ͨ͠ΞΫηε੍ޚ  w 4FTTJPO5BHT *E1࿈ܞ࣌ʹλάΛ౉ͯ͠ΞΫηε੍ޚ  w "84/JUSP&ODMBWFT &$಺͔ΒͷϩʔΧϧ઀ଓͷΈՄೳͳִ཭ྖҬ  w 71$*OHSFTT3PVUJOH &/*Λϧʔτͷλʔήοτʹࢦఆɺ/8ܥ੡඼౳Ͱ׆༻  SF*OWFOUηΩϡϦςΟؔ࿈৘ใ·ͱΊSFJOWFOUIUUQTEFWDMBTTNFUIPEKQDMPVEBXTSFJOWFOUTFDVSJUZ
  4. "848"'W   w தͷ࢓૊ΈΛม͑ͯผػೳͱͯ͠ϦϦʔε w ͜Ε·Ͱͷ"848"'͸$MBTTJD"848"'ʹ w ಛ௃ w

    +40/Ͱ8FC"$-Λఆٛ ϧʔϧΛҰׅઃఆ  w ϧʔϧݸ੍ݶഇࢭ ΩϟύγςΟϢχοτ࠾༻  w 03ԋࢉࢠʹΑΓॊೈͳϧʔϧߏ੒͕Մೳ w "84.BOBHFE3VMFT ".3T ϦϦʔε w "1*΋XBGWʹͳͬͯSFHJPOBMͱ౷߹
  5. "848"'W   IUUQTEFWDMBTTNFUIPEKQDMPVEBXTBXTXBGW IUUQTEFWDMBTTNFUIPEKQDMPVEBXTBXTXBGWDTDTFSWFSMFTTNBOBHFESVMF

  6. *.%4W   w &$ΠϯελϯεϝλσʔλαʔϏεW w Πϯελϯεϝλσʔλͱ͸ʁ w ͜Μͳ΍ͭDVSMIUUQMBUFTUNFUBEBUB w

    Կ͕ྑ͘ͳͬͨͷ͔ w ηΩϡϦςΟ͕޲্ͨ͠ w Կ͕໰୊ͩͬͨͷ͔ w ੬ऑͳ࣮૷͕͋Δ৔߹ʹ443'߈ܸ౳ʹΑΓΫϨσϯγϟϧ͕ྲྀग़͢ Δ w ௚ۙͰ͸$BQJUBM0OFͷࣄ͕݅͋ͬͨ w 443'߈ܸʹΑΔ$BQJUBM0OFͷݸਓ৘ใྲྀग़ʹ͍ͭͯ·ͱΊͯΈͨ QJZPMPHIUUQTQJZPMPHIBUFOBEJBSZKQFOUSZ
  7. *.%4Wվળ఺   w W΁ͷΞΫηεʹ͸ࣄલʹऔಘͨ͠5PLFOΛඞਢͱ͢Δ w 5PLFO͸165Ͱऔಘ͢Δඞཁ͕͋Δ w 5PLFOϦΫΤετ࣌ʹ༗ޮظݶ ඵ

    ΛઃఆͰ͖Δ w 5PLFO͸ϔομʹೖΕͯϦΫΤετ͢Δඞཁ͕͋Δ w WΛແޮԽͰ͖Δ σϑΥϧτͰ͸ซ༻Մೳ  w ϝλσʔλαʔϏεࣗମΛແޮԽͰ͖Δ w &$ΠϯελϯεΛ্ཱͪ͛ΔࡍʹWͷΈʹઃఆ͢Δ͜ͱΛ*".Ͱ ڧ੍͢Δ͜ͱ͕Ͱ͖Δ w 9'PSXBSEFE'PSϔομʔ͕͋ΔϦΫΤετʹ5PLFOΛൃߦ͠ͳ ͍ w ϝλσʔλϨεϙϯεͷ55-Λ୹͘͠ෳ਺ϗετΛܦ༝ͨ͠औಘΛ ๷ࢭͰ͖Δ
  8. *.%4W   w ͋͘·Ͱ΋؇࿨ࡦɺଟ૚๷ޚͱͯ͠࢖͏ w ࠜຊରࡦ͸֎෦63-ʹΞΫηε͠ͳ͍࢓༷౳ w ಙؙઌੜͷΑ͘෼͔Δղઆ΋ඞಡ w

    ಙؙߒͷ೔ه443'ରࡦͱͯ͠"NB[PO͔Βൃද͞Εͨ *.%4WͷޮՌͱݶքIUUQTCMPHUPLVNBSVPSH EFGFOTFTTSGBNB[POFD JNETWIUNM
  9. *.%4W   ࡉ͔͍ղઆͱ࣮ࡍͷ࢖͍ํ IUUQTEFWDMBTTNFUIPEKQDMPVEBXTFDJNETWSFMFBTF

  10. ຊ୊   Amazon Detective

  11. "NB[PO%FUFDUJWFͱ͸   w જࡏతͳηΩϡϦςΟ໰୊·ͨ͸ٙΘ͍͠ΞΫςΟϏ ςΟͷࠜຊݪҼΛ؆୯ʹௐࠪɺ෼ੳɺ͓Αͼਝ଎ʹಛఆ Ͱ͖Δ w "84Ϧιʔε͔ΒϩάσʔλΛࣗಈతʹऩू͠ɺػցֶ शɺ౷ܭ෼ੳɺάϥϑཧ࿦Λ࢖༻ͯ͠ɺΑΓਝ଎͔ͭޮ

    ཰తͳηΩϡϦςΟௐࠪͷࢹ֮Խͱ࣮ࢪΛࢧԉ͢Δ w "NB[PO(VBSE%VUZ΍"844FDVSJUZ)VCͳͲͷ "84ηΩϡϦςΟαʔϏεɺ͓Αͼ"84ύʔτφʔη ΩϡϦςΟ੡඼ͱ౷߹͞Ε͍ͯΔ
  12. ͳΔ΄Ͳʁ  

  13. ͱ͍͏Θ͚ͰηογϣϯࢀՃ͖ͯͨ͠   ײ૝ҰݴͰ͍͏ͱ Πϯγσϯτͷௐ͕ࠪ ΊͬͪΌḿΔʂ

  14. Α͘෼͔ΔϏϑΥʔΞϑλʔ   ͜Ε͕…

  15. Α͘෼͔ΔϏϑΥʔΞϑλʔ   ͜͏͡Όʂ

  16. ΋͏গ͠ਤͷઆ໌   w /*45ͷ$4' αΠόʔηΩϡϦςΟϑϨʔϜϫʔΫ ʹ͋ΔηΩϡϦ ςΟͷௐࠪϑϩʔͱ"84αʔϏεΛϚοϐϯάͨ͠ਤ w *EFOUJGZ

    1SPUFDU %FUFDU 3FTQPOE 3FDPWFSͱ͍͏ͭͷػೳ ͕͋Δ w ͜Ε·Ͱ͸(VBSE%VUZΛ࢝Ίɺ$MPVE8BUDI΍.BDJFɺ 4FDVSJUZ)VC౳Ͱݕ஌ %FUFDU Λ͍ͯͨ͠ w ͔͠͠ݕ஌ͨ͠ޙͷରԠ 3FTQPOE ͷͨΊʹ͸ௐࠪ *OWFTUJHBUF ͕ඞཁͰɺ͕͔͜͜ͳΓਏ͔ͬͨ w ۩ମతʹ͸$MPVE5SBJMϩά΍71$'MPX-PHTΛௐࠪ͢Δ w ͜ͷௐࠪΛ໓஡ۤ஡΍Γ΍͘͢͢Δͷ͕"NB[PO%FUFDUJWF
  17. ͲΜͳ෩ʹ࢖͑Δͷ͔σϞը໘ͷڞ༗   (VBSE%VUZͷ'JOEJOHTΛى఺ʹௐࠪ։࢝

  18. 'JOEJOHTͷௐࠪ   ؔ࿈͢Δ"1*ίʔϧ͕͍ͭͲΕ͘Β͍࣮ߦ͞Ε͔ͨάϥϑͰදࣔ ੒ޭͱࣦഊͰผάϥϑ

  19. 'JOEJOHTͷௐࠪ   άϥϑΫϦοΫͰυϦϧμ΢ϯ ؔ࿈ͷ*1ΞυϨε΍NFUIPEɺΞΫηεΩʔ౳͕දࣔ͞ΕΔ

  20. 'JOEJOHTͷௐࠪ   ผλϒͰ͸(FPϩέʔγϣϯΛϚοϐϯάͯ͠Ͳ͔͜Β ͷΞΫηε͔Θ͔Γ΍͘͢දࣔ

  21. 'JOEJOHTͷௐࠪ   ͪ͜Β΋υϦϧμ΢ϯՄೳ ͲΜͳ"1*͕ݺ͹Ε͍ͯΔ͔֬ೝͰ͖Δ

  22. *1ͷௐࠪ   *1ΞυϨε͔Β΋ௐࠪՄೳ ඥͮ͘'JOEJOHT΍Ϧιʔε౳Λ֬ೝͰ͖Δ

  23. *1ͷௐࠪ   *1ʹجͮ͘"1*ίʔϧͷάϥϑ

  24. *1ͷௐࠪ   ผλϒͰ͸*1ʹඥͮ͘*".6TFS΍Πϯελϯε ͔͜͜ΒͦΕͧΕḷΕΔ

  25. Πϯελϯεͷௐࠪ   Πϯελϯεى఺Ͱ΋ௐࠪ τϥϑΟοΫͷભҠ΋ՄࢹԽ

  26. 44)ͷϒϧʔτϑΥʔεͷ'JOEJOHT   ϓϩτίϧຖʹͲͷఔ౓ͷྲྀྔ͕͋Δ͔Ұཡʹ ௨ৗΑΓଟ͍ͱ੺͘ͳΔ

  27. αʔυύʔςΟͱͷ࿈ܞ΋Մೳ  

  28. ͦͷଞͷαϚϦ   w ϚϧνΞΧ΢ϯτͰू໿Մೳ w ೔ͷτϥΠΞϧ͕Մೳ w ౦ژϦʔδϣϯΛؚΉͭͷϦʔδϣϯͰϓϥΠϕʔτϓ ϨϏϡʔ

    w Ձ֨ w ࠷ॳͷ (#݄(#͔Β w औΓࠐΉϩά ࣗಈతʂ  w 71$'MPX-PHT w $MPVE5SBJM؅ཧϩά w (VBSE%VUZ'JOEJOHT
  29. ·ͱΊ   ௐ͕ࠪḿΔ͔Β ·ͣϓϨϏϡʔਃ͠ࠐΈʂ

  30. None