Upgrade to Pro — share decks privately, control downloads, hide ads and more …

みんなでセキュリティを強化!仕組みで解決するAWS環境のマネジメント & ガバナンス

みんなでセキュリティを強化!仕組みで解決するAWS環境のマネジメント & ガバナンス

JAWSDAYS2020登壇資料です(オンライン)
詳細な解説や動画は下記ブログを参照してください。
https://dev.classmethod.jp/cloud/aws/jaws-days-2020-security/

cm-usuda-keisuke

March 14, 2020
Tweet

More Decks by cm-usuda-keisuke

Other Decks in Technology

Transcript

  1. ηογϣϯͷλʔήοτ   w "84ॳ৺ऀ w "84ͷΞΧ΢ϯτ؅ཧऀ w ηΩϡϦςΟ୲౰ऀ w

    ؂ࠪਓ w $*40 w ݸਓͰ"84ͷ؅ཧΛؤு͍ͬͯͨΓɺ؅ཧର৅ͷ "84ΞΧ΢ϯτ͕૿͖͍͑ͯͯΔ؀ڥʹ͍Δਓ
  2. ͜ͷηογϣϯͰͲΜͳηΩϡϦςΟΛѻ͏͔   w "84ηΩϡϦςΟશମͷجૅ͸ܰ͘৮ΕΔ w ϝΠϯ͸ϚωδϝϯτΨόφϯε w "84ΞΧ΢ϯτͷ؅ཧ w

    ར༻ऀ΍؀ڥͷεέʔϧʹͲ͏΍ͬͯରԠ͢Δ͔ w ήʔτ͔ΒΨʔυϨʔϧ΁ w ࢓૊ΈΛ׆༻ͯ͠ແཧͳ੍໿ͳ͘"84Λར༻͢Δ
  3. "84ηΩϡϦςΟجૅ   w ͭͷ؍఺ w "84ϨΠϠʔͷηΩϡϦςΟ w 04ϛυϧΞϓϦϨΠϠʔͷηΩϡϦςΟ w

    "84ϨΠϠʔ͸ઐ༻ͷ஌͕ࣝඞཁ w ֮͑Δ w 04Ҏ্͸جຊΦϯϓϨϛεͱมΘΒͳ͍ w "84ͷαʔϏεΛ׆༻ͯ͠؆୯ʹରࡦͰ͖Δ΋ͷ΋͋Δ
  4. ͋ΘͤͯಡΈ͍ͨ   w 8FMM"SDIJUFDUFEϑϨʔϜϫʔΫ w "84ͷϕετϓϥΫςΟεू w ͭͷப͕͋Δ w

    ӡ༻্ͷ༏लੑɺηΩϡϦςΟɺ৴པੑɺύϑΥʔϚ ϯεޮ཰ɺίετ࠷దԽ w ηΩϡϦςΟͷபͷதʹ΋ͭͷཁૉ w ΞΠσϯςΟςΟɺൃݟత౷੍ɺΠϯϑϥอޢɺσʔ λอޢɺΠϯγσϯτϨεϙϯε w IUUQTBXTBNB[PODPNKQBSDIJUFDUVSFXFMMBSDIJUFDUFE
  5. *".ͷ࠷ॏཁࣄ߲   w *".Ϣʔβʹ͸.'"ඞਢ w ΞΫηεΩʔΛίʔυʹຒΊࠐ·ͳ͍ *".ϩʔϧΛར ༻͢Δ 

    w ίʔυΛѻ͏୺຤͢΂ͯʹHJUTFDSFUTΛಋೖ͢Δ w ࠷খݖݶΛҙࣝ͢Δ w "84ར༻Ϣʔβ͢΂ͯʹ*".ͷѻ͍ʹ͍ͭͯڭҭ͢Δ
  6. ར༻։࢝࣌ʹ༗ޮԽ͢ΔαʔϏε   w "84$MPVE5SBJM w "84ʹର͢Δ"1*ίʔϧΛه࿥͢Δ w "84$POpH w

    "84ϦιʔεϕʔεͷมߋཤྺΛه࿥͢Δ w "NB[PO(VBSE%VUZ w "84ʹର͢Δෆ৹ͳಈ͖Λݕ஌͢Δ w ෆਖ਼ͳϩάΠϯ΍ίΠϯϚΠχϯάͳͲͷڴҖΛݕ஌ w ͜ΕΒ͸ଟগ͓͕͔͔ۚͬͯ΋ඞਢ Կ͔͋ͬͨΒऔΓฦ͕ͭ͠ ͔ͳ͍ͷͰ
  7. 71$   w ؀ڥ͝ͱʹ71$΍ΞΧ΢ϯτΛ෼ׂ͢Δ w "84ΞΧ΢ϯτ͝ͱ෼ׂ͢Ε͹*".΋෼͚ΕΔ w 4FDVSJUZ(SPVQͱ/"$-Λద੾ʹར༻͢Δ w

    جຊ͸4FDVSJUZ(SPVQͰߜΔ w /"$-͸αϒωοτશମͰඞཁͳ΋ͷ͚ͩ w 71$಺͔Β"84αʔϏεΛར༻͢Δ৔߹͸71$ &OEQPJOU 1SJWBUF-JOL Λར༻͢Δ w ΠϯλʔωοτΛܦ༝͠ͳ͍"1*௨৴Λ࣮ݱ
  8. ҰൠతʹηΩϡΞͳߏ੒   w ࡾ૚ωοτϫʔΫ w ϑϩϯτҎ֎͸ϓϥΠϕʔτ w Ϛϧν"; w

    "VUP4DBMJOH w ֎෦௨৴͸/"5ܦ༝ w ඞཁʹԠ͡$MPVE'SPOU΍ 8"'Λಋೖ
  9. ໰୊   w ͢΂ͯͷ"84ར༻ऀʹ"84ͷηΩϡϦςΟରࡦΛ ࣮ࢪͯ͠΋Β͏ʹ͸Ͳ͏͢Ε͹͍͍ʁ w ڭҭʁ w ΋ͪΖΜڭҭ΋ඞཁ

    ͜Ε͸ϗϯτେࣄ  w Ͱ΋ڭҭ͢Δͷ΋େม w ୭͕ڭ͑Δͷʁ w ڭࡐ͸ʁ w ڭҭ͸͢Δʹͯ͠΋ɺଞͷ࢓૊Έ΋ඞཁ
  10. ΨʔυϨʔϧ   w "84ͷϚωδϝϯτΨόφϯεαʔϏεͳͲΛར༻͢Δ͜ ͱʹΑΓΨʔυϨʔϧΛ࣮ݱͰ͖Δ w $POUSPM5PXFS w େن໛ͳ"84ΞΧ΢ϯτ΁ͷΨόφϯεΛߦ͏αʔϏε

    w $POpH3VMFT w ద੾ͳઃఆ͕ߦΘΕ͍ͯΔ͔؂ࢹͯ͠ҧ൓ͨ͠ΒΞϥʔτ͢Δ w 4FDVSJUZ)VC w ηΩϡϦςΟΞϥʔτͱίϯϓϥΠΞϯε؅ཧͷαʔϏε w $*4ϕϯνϚʔΫɾ1$*%44ରԠͷίϯϓϥΠΞϯεϧʔϧ Λ׆༻Ͱ͖Δ
  11. ϚϧνΞΧ΢ϯτઓུ   w ѻ͏"84؀ڥ͕ଟ͘ͳΔ৔߹ʹ͸ɺ؀ڥຖʹ"84ΞΧ΢ϯ τࣗମΛ෼͚Δ΄͏͕͍͍ w *".΍ωοτϫʔΫΛ׬શʹ੾Γ཭͢͜ͱ͕Ͱ͖Δ w ੹೚෼ք఺΍ηΩϡϦςΟͷڥք͕໌֬ʹͳΔ

    w γεςϜຖ෼͚Δ͔ɺγεςϜ εςʔδ ։ൃݕূຊ ൪౳ Ͱ෼͚Δ w Φεεϝ͸γεςϜ εςʔδ w ։ൃ؀ڥͷηΩϡϦςΟ͕ΏΔͯ͘΍ΒΕΔύλʔϯ͕Α͘ ͋ΔͷͰɺ͔ͦ͜ΒӨڹ͕ຊ൪؀ڥ·Ͱ೾ٴ͠ͳ͍Α͏ʹ
  12. "840SHBOJ[BUJPOT   w ϚϧνΞΧ΢ϯτͷ؅ཧΛߦ͏αʔϏε w 06 ૊৫୯Ґ Λ֊૚తʹ࡞੒ͯ͠"84ΞΧ΢ϯτΛॴଐ͞ ͤΔࣄ͕Ͱ͖Δ

    w αʔϏείϯτϩʔϧϙϦγʔ 4$1 Λར༻ͯ͠ར༻Մೳͳ ݖݶΛ੍ޚͰ͖Δ w ୅ཧళܦ༝ͷ"84ར༻ͷ৔߹੍໿͕͋Δ͜ͱ΋͋ΔͷͰ஫ҙ
  13. -BOEJOH;POF   w 0SHBOJ[BUJPOTΛϕʔεʹ༷ʑͳαʔ ϏεΛ૊Έ߹ΘͤͯϚϧνΞΧ΢ϯτͰΨ όφϯε΍ηΩϡϦςΟΛ֬อ͢Δߟ͑ํ w "84-BOEJOH;POFιϦϡʔγϣϯͱ ͯ͠$MPVE'PSNBUJPOςϯϓϨʔτͷ

    ఏڙ΋͋Γ w 0SHBOJ[BUJPOTΛར༻͍ͯ͠Δͱ੍໿ ͕͋Δ৔߹͕͋Δ͕ɺ0SHBOJ[BUJPOT ແ͠Ͱ΋ಉ͡Α͏ͳϚϧνΞΧ΢ϯτ࿈ܞ ͸ՄೳͳͷͰࢀߟʹͳΔ
  14. $POUSPM5PXFS   w -BOEJOH;POFΛϚωʔδυͰఏڙ͢ΔαʔϏε w "84-BOEJOH;POFιϦϡʔγϣϯͱ͸গ͠ΞʔΩ ςΫνϟ͕ҧ͏ w μογϡϘʔυͰ֤ΞΧ΢ϯτͷίϯϓϥΠΞϯεঢ়گ

    ͕೺ѲͰ͖Δ w 0SHBOJ[BUJPOTΛར༻͢ΔͷͰಉ͡Α͏ͳ੍໿͋Γ w ͔ͭ৽ن0SHBOJ[BUJPOTΛ࡞੒͢Δඞཁ͕͋Δ w ݱঢ়౦ژϦʔδϣϯͰ͸ఏڙ͞Ε͍ͯͳ͍
  15. $POUSPM5PXFSͷΞʔΩςΫνϟ   w ϚελʔΞΧ΢ϯτͰ$POUSPM5PXFS࡞੒ w 0SHBOJ[BUJPOT͕࡞੒͞Ε֤Ϣʔβ͸"84440Ͱ؅ཧ͞ ΕΔ w ؅ཧ༻ͷίΞΞΧ΢ϯτͭ࡞੒

    w ϩάΞʔΧΠϒ5SBJM΍$POpHϩάू໿ w ؂ࠪ(VBSE%VUZ΍$POpH3VMFT౳֤छηΩϡϦςΟ Ξϥʔτू໿ ֤ΞΧ΢ϯτ΁ͷ"ENJOݖݶ w 4FSWJDF$BUBMPH͔ΒܾΊΒΕͨύλʔϯͷ"84ΞΧ΢ϯ τΛ෷͍ग़͢ 71$΍ίϯϓϥΠΞϯεઃఆೖΓ
  16. $POUSPM5PXFS΁ͷظ଴   w ·ͩ·੍ͩ໿͕ଟ͍ w ୅ཧళܦ༝Ͱͷఏڙ͕ͮ͠Β͍ w ৽ن0SHBOJ[BUJPOTΛ࡞੒͠ͳ͍ͱ͍͚ͳ͍ w

    ౦ژʹདྷͯͳ͍ w ͜ͷล͕ղܾ͞ΕͨΒ͍͍ײ͡ʹϚϧνΞΧ΢ϯτͷ؅ཧ͕ ָʹͳΔ͔΋ w ͔͠͠ͳ͕Βɺݱঢ়Ͱ΋ಉ͡Α͏ͳ͜ͱ͸0SHBOJ[BUJPOT Λར༻͠ͳͯ͘΋Ͱ͖ΔͷͰࢀߟʹ͍ͯ͘͠
  17. $POUSPM5PXFSͷϩʔυϚοϓ   w طଘ0SHBOJ[BUJPOT΁ͷ৽نΞΧ΢ϯτ෷͍ग़͠ 2༧ఆ  w طଘΞΧ΢ϯτ΁ͷΨʔυϨʔϧద༻ 2༧ఆ

     w ࢀߟIUUQTEFWDMBTTNFUIPEKQDMPVEBXT SFJOWFOUSFQPSUNHU w ͜Ε͕དྷΕ͹طଘ؀ڥʹ$POUSPM5PXFS͕ద༻Ͱ͖ ͯྑ͛͞ w ͋ͱ͸౦ژϦʔδϣϯʹདྷΕ͹ʜ
  18. $POUSPM5PXFSΛ࢖͑Δέʔε   w ৽ن"84؀ڥΛར༻Ͱ͖Δ w ৽ن0SHBOJ[BUJPOTΛར༻Ͱ͖Δ w όʔδχΞϦʔδϣϯ౳Λར༻Ͱ͖Δ w

    ల։͞Εͨ࢓૊Έͷඅ༻Λؾʹͤͣར༻Ͱ͖Δ w ू໿͞ΕΔϩά w 4FSWJDF$BUBMPH w ωοτϫʔΫϕʔεϥΠϯ
  19. ಛʹ͓͢͢Ίͷ$POpHϚωʔδυϧʔϧ   w SFTUSJDUFETTIηΩϡϦςΟάϧʔϓʹ͕෇͍͍ͯͳ͍͔ w DMPVEUSBJMFOBCMFE$MPVE5SBJM͕༗ޮʹͳ͍ͬͯΔ͔ w HVBSEEVUZFOBCMFEDFOUSBMJ[FE(VBSE%VUZ͕༗ޮʹͳ͍ͬͯΔ͔ w

    JBNSPPUBDDFTTLFZDIFDLSPPUͷΞΫηεΩʔ͕ͳ͍͔ w JBNVTFSNGBFOBCMFE*".Ϣʔβʔͷ.'"͕༗ޮ͔ w NGBFOBCMFEGPSJBNDPOTPMFBDDFTTίϯιʔϧϩάΠϯϢʔβʔ͕ .'"༗ޮ͔ w SPPUBDDPVOUNGBFOBCMFEϧʔτΞΧ΢ϯτͰ.'"͕༗ޮ͔ w FCTTOBQTIPUQVCMJDSFTUPSBCMFDIFDL&#4͕ύϒϦοΫ෮ݩͰ͖ͳ͍ ͔ w SETJOTUBODFQVCMJDBDDFTTDIFDL3%4͕ύϒϦοΫɾΞΫηεͰ͖ͳ ͍͔
  20. ४͓͢͢Ίͷ$POpHϚωʔδυϧʔϧ   w FMCMPHHJOHFOBCMFE&-#ͰϩΪϯά͕༗ޮ͔ w DMPVEUSBJMDMPVEXBUDIMPHTFOBCMFE$MPVE5SBJMͷ-PHTग़ྗ͕༗ ޮ͔ w DMPVEUSBJMMPHpMFWBMJEBUJPOFOBCMFEϩάϑΝΠϧݕূ͕༗ޮ͔

    w FMCEFMFUJPOQSPUFDUJPOFOBCMFE&-#ͷ࡟আอޢ͕༗ޮ͔ w ECJOTUBODFCBDLVQFOBCMFE%#ΠϯελϯεͷόοΫΞοϓ͕༗ޮ͔ w SETNVMUJB[TVQQPSU3%4͕Ϛϧν";͔ w WQDEFGBVMUTFDVSJUZHSPVQDMPTFEɿEFGBVMUηΩϡϦςΟάϧʔϓ͕ ແޮ͔ w HVBSEEVUZOPOBSDIJWFEpOEJOHT(VBSE%VUZʹΞʔΧΠϒ͞Εͯ ͍ͳ͍'JOEJOHT͕͋Δ͔
  21. 4FDVSJUZ)VCͷϧʔϧͰؾΛ͚ͭΔ͜ͱ   w શ߲໨ୡ੒͢Ε͹͍͍Έ͍ͨͳ໡໨తͳ࢖͍ํΛ͠ͳ ͍ w ͢΂ͯͷϧʔϧΛຬͨ͢ͷ͸΍Γ͗͢ͳ͜ͱ͕ଟ͍ͷ Ͱνϡʔχϯά ඞཁͳ͍΋ͷΛແޮԽ

    ͢Δ w ϧʔϧͷద༻ൣғΛௐ੔Ͱ͖ͳ͍ શͯͷϦιʔε͕ ର৅ʹͳΔ ͷͰൣғΛݶఆ͢Δ w ΞΧ΢ϯτ෼ׂ͢Δ w खಈ࡞੒ͨ͠ϧʔϧʹஔ͖׵͑Δ
  22. ͭͷϧʔϧͷ࢖͍෼͚   w $*4ͱ1$*ͲͪΒΛ࢖͏΂͖ʁ w ࢖͏ͱ൑அͨ͠Β جຊ͸྆ํ࢖͏Ͱ͍͍ͱࢥ͏ w ॏෳ͢Δͱ͜Ζ͸΅ͪ΅ͪ͋Δ͕ɺ࣮ଶͱͯ͠ͷ

    $POpH3VMFT͸ݸʹͳΔͷͰඅ༻౳ؾʹ͠ͳ͍ͯ͘ ͍ w ͲͷΈͪ࢖Θͳ͍߲໨ΛແޮԽ͢Δඞཁ͕͋Δ w ख͕ؒมΘΒͳ͍ͳΒ͍ͬͺ͍νΣοΫ߲໨͕͋Δํ͕͍ ͍ ଟ͘ͳ͍͠
  23. $*4ͷ࢖͑ΔνΣοΫ߲໨ൈਮ   w rίϯιʔϧύεϫʔυΛ͍࣋ͬͯΔ͢΂ͯͷ *".Ϣʔβʔʹ͍ͭͯଟཁૉೝূ .'" ͕༗ޮʹ ͠·͢ɻ w

    r$MPVE5SBJM͸͢΂ͯͷϦʔδϣϯͰ༗ޮʹ ͳ͍ͬͯ·͢ɻ w rෆਖ਼ͳ"1*ݺͼग़͠ʹରͯ͠ϩάϝτϦΫε ϑΟϧλʔͱΞϥʔϜ͕ଘࡏ͢Δ͜ͱΛ֬ೝ͠·͢
  24. $*4ͰແޮԽ͢Δ߲໨ࢀߟྫൈਮ   w r$MPVE5SBJMϩά͸อ؅࣌ʹ"84,.4 $.,Λ࢖༻ͯ͠҉߸Խ͞Ε͍ͯΔ͜ͱΛ֬ೝ͠·͢ w ҉߸Խཁ͕݅ಛʹͳ͍৔߹ʹ͸ແޮԽͯ͠΋͍͍ w r͢΂ͯͷ71$Ͱ71$ϑϩʔϩάه࿥͕༗ޮ

    ʹͳ͍ͬͯΔ͜ͱΛ֬ೝ͠·͢ w ඞͣ͠΋ඞཁͰ͸ͳ͍ w ༗ޮʹͭͭ͠3FKFDUϩάͷΈऔಘ͢Δɺͱ͍͏ํ๏΋͋Γ w ͜ͷ৔߹͸ϩάྔ͕গͳ͘ͳΔͨΊݱ࣮త
  25. 1$*%44ϧʔϧνϡʔχϯά   w 1$*%44WʹରԠͨ͠ϧʔϧ w ͜ΕΛຬͨͤΕ͹1$*%44ͷೝఆ͕ड͚ΒΕΔΘ͚Ͱ͸ ·ͬͨ͘ͳ͍ w ӡ༻Λॿ͚ΔͨΊͷػೳͱߟ͑ͯ࢖͏

    w جຊతʹ1"/ ΫϨδοτΧʔυձһ৘ใ Λѻ͏ͨ ΊͷϧʔϧͳͷͰɺҰൠར༻ʹஔ͖׵͑Δͱ΍΍ڧΊ ͷͨΊɺద౓ʹແޮԽͯ͠࢖͏ͱ͍͍
  26. 1$*%44ͷ࢖͑ΔνΣοΫ߲໨ൈਮ   w <1$*"VUP4DBMJOH>ϩʔυόϥϯαʔʹؔ࿈෇͚ΒΕ ͨ"VUP4DBMJOHάϧʔϓ͸ɺϔϧενΣοΫΛ࢖༻͠· ͢ w <1$*&$>ະ࢖༻ͷ&$&*1Λ࡟আ͢Δඞཁ͕͋Γ· ͢

    w <1$*3%4>3%4%#ΠϯελϯεͰ͸ύϒϦοΫΞΫ ηεΛېࢭ͢Δඞཁ͕͋Γ·͢ w <1$*$PEF#VJME>$PEF#VJMEϓϩδΣΫτ؀ڥม਺ ʹΫϦΞςΩετͷೝূ৘ใΛؚΊΔ͜ͱ͸Ͱ͖·ͤΜ
  27. 1$*%44ͷແޮԽ͢Δ߲໨ࢀߟൈਮ   w <1$*-BNCEB>ϥϜμؔ਺͸71$ʹ͋Δඞཁ͕͋Γ·͢ w -BNCEBपลͷΞʔΩςΫνϟؚΊͯ71$ʹറΒΕͳ͍͜ͱʹΑΔϝ Ϧοτ͕ଟ͍ w 71$಺ͷηϯγςΟϒ৘ใΛѻ͏3%4ʹΞΫηε͢ΔΑ͏ͳ-BNCEB

    ʹ͍ͭͯ͸71$ʹஔ͘ඞཁ͕͋Δ w جຊ͸71$֎ͳͷͰແޮԽͰ໰୊ͳ͍ w <1$*4>4όέοτͰΫϩεϦʔδϣϯϨϓϦέʔγϣϯΛ༗ ޮʹ͢Δඞཁ͕͋Γ·͢ w 4͸ͷ଱ٱੑΛ͍࣋ͬͯΔ w ຆͲͷσʔλ͸ΫϩεϦʔδϣϯϨϓϦέʔγϣϯΛ͢Δඞཁ͸ͳ͍ w %3ͷཁ݅ͰͲ͏ͯ͠΋ผϦʔδϣϯʹஔ͘ඞཁ͕͋Δ৔߹ͳͲʹݕ౼
  28. "VUPNBUJPOͷத਎   w εςοϓͷҰ෦Λൈਮ w "84ͷ"1*ΛZBNMͰఆٛ ࣮ͯ͠ߦ w ӈਤ͸ηΩϡϦςΟάϧʔϓ

    ͷϧʔϧͷ࡟আΛ࣮ߦ͍ͯ͠ Δ w -BNCEBΛ࣮ߦͨ͠Γ $MPVE'PSNBUJPOΛ࣮ߦ ͨ͠Γ΋Ͱ͖Δ