Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS上に構築し数年経過したシステムの見直しポイント Developers.IO 2019 in Sapporo

Hiroyuki Kaji
October 19, 2019

AWS上に構築し数年経過したシステムの見直しポイント Developers.IO 2019 in Sapporo

2019/10/19 Developers.IO 2019 in Sapporo での発表資料となります。

Hiroyuki Kaji

October 19, 2019
Tweet

More Decks by Hiroyuki Kaji

Other Decks in Technology

Transcript

  1. "84্ʹߏங͠਺೥ܦաͨ͠γεςϜͷݟ௚͠ϙΠϯτ
    "84ࣄۀຊ෦ɹίϯαϧςΟϯά෦
    )JSPZVLJ,BKJ

    View full-size slide

  2. ࣗݾ঺հ
    ֿɹߒ޾ʢ)JSPZVLJ,BKJʣ
    5XJUUFSɿ!DPDBDPMB
    "84؀ڥͷߏஙɺίϯαϧςΟϯά
    σϦόϦʔνʔϜϦʔμʢΤϯδχΞҭ੒ʣ
    ܦྺ
    ɾωοτϫʔΫػثϝʔΧ4&
    ɾηΩϡϦςΟؔ࿈اۀͷ঎༻γεςϜӡ༻ऀ
    ɾ೥ΫϥεϝιουࡳຈΦϑΟεೖࣾ
    ڵຯؔ৺
    ɾ/FUXPSLɺ4FDVSJUZ
    ɾϙʔλϒϧΦʔσΟΦɺήʔϜ

    View full-size slide

  3. ࣭໰
    AWSར༻ͯ͠2೥Ҏ্ʁ

    View full-size slide

  4. ໨࣍
    &$ؔ࿈
    3%4ؔ࿈
    ӡ༻ؔ࿈
    ηΩϡϦςΟؔ࿈

    View full-size slide

  5. &$ؔ࿈
    ࣭໰
    Amazon Linux 2Λར༻͍ͯ͠Δํʁ
    Amazon LinuxΛ࢖͍ͬͯΔํʁ

    View full-size slide

  6. &$ؔ࿈
    Amazon Linux 2΁Ҡߦ

    View full-size slide

  7. "NB[PO-JOVY΁ͷҠߦ
    ެࣜϖʔδʹهࡌ͕͋Δ௨Γɺ೥݄೔ʹ
    "NB[PO-JOVYͷηΩϡϦςΟߋ৽ఏڙ͕ऴྃ
    "NB[PO-JOVYΛ·ͩར༻͍ͯ͠Δํ͸"NB[PO
    -JOVY΁ͷҠߦݕ౼͕Φεεϝ
    Α͋͘Δ࣭໰"NB[PO-JOVY".*c"84

    View full-size slide

  8. "NB[PO-JOVY΁ͷҠߦϝϦοτ
    w 17Πϯελϯε͔Β)7.Πϯελϯε΁Ҡߦ
    w )%% TUBOEBSE
    ˠ44% HQ

    w ৽ੈ୅Πϯελϯε ND
    ར༻Մೳ
    ߹ΘͤͯҎԼΛ࢖͏ͱศརʹɾɾɾ
    w 44. "844ZTUFNT.BOBHFS
    ͷ"HFOUΠϯετʔϧࡁΈ
    w $MPVEXBUDI"HFOUߋ৽ʢϝϞϦɺσΟεΫ࢖༻཰औಘʣ

    View full-size slide

  9. "NB[PO-JOVY΁ͷҠߦϝϦοτ
    "844ZTUFNT.BOBHFSʹ׳ΕΔֶशίετ͕ඞཁ
    Ͱ͕͢౿Έ୆αʔό͕ෆཁʹ
    "844ZTUFNT.BOBHFSηογϣϯϚωʔδϟʔͰ
    44)ɾ4$1Ͱ͖ΔΑ͏ʹͳΓ·ͨ͠ʛ%FWFMPQFST*0
    "844ZTUFN.BOBHFSηογϣϯϚωʔδϟʔͰϙʔ
    τϑΥϫʔυ͢Δʛ%FWFMPQFST*0

    View full-size slide

  10. "NB[PO-JOVY΁ͷҠߦ͢ΔͨΊʹ࣮ࢪ͢Δ͜ͱ
    w Ҡߦ͢ΔͨΊͷ༧ࢉ֬อ
    w ର৅αʔόͷચ͍ग़͠
    w ϦβʔϒυΠϯελϯεʢ3*ʣͷ֬ೝ

    View full-size slide

  11. "NB[PO-JOVY΁ͷҠߦ͢ΔͨΊʹ࣮ࢪ͢Δ͜ͱ
    w Өڹൣғ֬ೝ
    w ΞϓϦέʔγϣϯɾϛυϧ΢ΣΞ
    w +%,
    w ߏ੒؅ཧπʔϧ

    View full-size slide

  12. "NB[PO-JOVY΁ͷҠߦ͢ΔͨΊʹ࣮ࢪ͢Δ͜ͱ
    w Πϯελϯεੈ୅ʢN DͳͲ͔Β৽ੈ୅NͳͲʣ
    w ݕূ
    w Ҡߦεέδϡʔϧ

    View full-size slide

  13. "NB[PO-JOVY΁ͷҠߦ͢ΔͨΊʹ࣮ࢪ͢Δ͜ͱ
    ৄࡉ͸ͪ͜Β
    "NB[PO-JOVY͔Β"NB[PO-JOVY΁ͷΞοϓά
    ϨʔυΛܭը͠Α͏ʛ%FWFMPQFST*0

    View full-size slide

  14. &$ؔ࿈
    ࣭໰
    CLBʢClassic Load BalancerʣΛ
    ར༻͍ͯ͠Δํʁ

    View full-size slide

  15. &$ؔ࿈
    ALBʢApplication Load Balancerʣ
    ͷར༻ݕ౼

    View full-size slide

  16. "QQMJDBUJPO-PBE#BMBODFSʢ"-#ʣҠߦϝϦοτ
    w ར༻ྉۚͷܭࢉࣜͷҧ͍ʹΑΔίετϝϦοτ
    w ༗ࣄͷࡍʹ"848"'Λ௥ՃՄೳ
    w ύϑΥʔϚϯεͷվળʢ)551ରԠʣ
    w )551)5514Ҏ֎ͷ৔߹͸ɺ/-#Λݕ౼

    View full-size slide

  17. "QQMJDBUJPO-PBE#BMBODFSʢ"-#ʣҠߦϝϦοτ
    w $-#
    w ࣌ؒ͋ͨΓͷྉۚσʔλసૹྔʹԠͯ͡՝ۚ
    w "-#
    w ࣌ؒ͋ͨΓͷྉۚΩϟύγςΟʔϢχοτ -$6
    ʹΑΔྉۚͰ՝ۚ
    w $-#Ͱσʔλసૹྔ͕ଟ͍৔߹͸ɺ"-#ʹมߋ͢Δ͚ͩͰίε
    τϝϦοτͷՄೳੑ͋Γ
    w ΩϟύγςΟʔϢχοτ -$6
    ͸$MPVEXBUDIͰݟੵ

    View full-size slide

  18. &$ؔ࿈
    ࣭໰
    EC2ΠϯελϯεΛͲͷΑ͏ʹ
    όοΫΞοϓ͍ͯ͠·͔͢ʁ

    View full-size slide

  19. &$ؔ࿈
    Amazon Data Lifecycle Manager
    (Amazon DLM)ͱAWS Backup

    View full-size slide

  20. "NB[PO%-."84#BDLVQͷϝϦοτ
    w ҎલͳΒɾɾɾ
    w #BDLVQόονॲཧ༻ͷ&$͔ΒόοΫΞοϓ࣮ߦ
    w $MPVEXBUDI&WFOU͔Β-BNCEBͰόοΫΞοϓ࣮ߦ
    w ͳͲͳͲɾɾɾ
    w ࠓͳΒ"84#BDLVQ΍"NB[PO%BUB-JGFDZDMF
    .BOBHFS "NB[PO%-.
    ͷϚωʔδυαʔϏεΛ
    ར༻Մೳ

    View full-size slide

  21. ϥΠϑαΠΫϧ؅ཧ
    w "NB[PO%-.͸εφοϓγϣοτΛԿݸ࢒͔͢
    SFUBJO
    ࢦఆ
    w "84#BDLVQ͸֤εφοϓγϣοτΛͲΕ͚ͩͷظ
    ؒ࢒͔͢ FYQJSF
    ࢦఆ

    View full-size slide

  22. "NB[PO%-.
    w ର৅αʔϏε
    w "NB[PO
    w ྉۚ
    w ແྉ
    w ผ్΍εφοϓγϣοτͷྉۚ͸ൃੜ

    View full-size slide

  23. "NB[PO%-.
    ৄࡉ͸ͪ͜Β
    ʲ৽αʔϏεʳεφοϓγϣοτͷϥΠϑαΠΫϧ
    ΛࣗಈԽ͢Δ"NB[PO%-.͕ొ৔ʂʛ
    %FWFMPQFST*0
    "NB[PO%-.͕౦ژʹ্཮ͯ͠ͷϥΠϑαΠΫϧ
    ؅ཧ͕؆୯ʹͳΓ·ͨ͠ʛ%FWFMPQFST*0

    View full-size slide

  24. "84#BDLVQ
    w ର৅αʔϏε
    w "NB[PO
    w "NB[PO3%4 "VSPSBҎ֎

    w "NB[PO%ZOBNP%#
    w "NB[PO&'4
    w "NB[PO4UPSBHF(BUFXBZ

    View full-size slide

  25. "84#BDLVQ
    w ྉۚ
    w ֤αʔϏε͝ͱͷόοΫΞοϓʢεφοϓγϣοτɺ
    %#εφοϓγϣοτͳͲʣʹ͔͔Δඅ༻͕ͦͷ··"84
    #BDLVQͷྉۚͱͳΔ
    w &'4ʹ͍ͭͯ͸(#͋ͨΓͷಠࣗͷඅ༻͕͔͔Δɻ

    View full-size slide

  26. "84#BDLVQ
    λΠϓ ΢ΥʔϜετϨʔδ ίʔϧυετϨʔδ ಛهࣄ߲
    "NB[PO&'4'JMF
    4ZTUFN#BDLVQ
    QFS(#
    .POUI
    QFS(#
    .POUI
    ಠࣗͷྉۚମܥ
    "NB[PO7PMVNF
    4OBQTIPU
    QFS(#
    .POUI

    "NB[PO4ʹର͢Δ"NB[PO
    εφοϓγϣοτͷֹۚ
    "NB[PO3%4
    %BUBCBTF4OBQTIPU
    QFS(#
    .POUI
    %#εφοϓγϣοτ͸Ұ཯͜ͷֹۚ
    "NB[PO%ZOBNP%#
    5BCMF#BDLVQ
    QFS(#
    .POUI
    ΦϯσϚϯυόοΫΞοϓͷྉۚ
    "844UPSBHF
    (BUFXBZ7PMVNF
    #BDLVQ
    QFS(#
    .POUI

    "NB[PO4ʹର͢Δ"NB[PO
    εφοϓγϣοτͷֹۚ

    View full-size slide

  27. "84#BDLVQ
    ৄࡉ͸ͪ͜Β
    "84࠶ೖ໳ϒϩάϦϨʔ"84#BDLVQฤʛ
    %FWFMPQFST*0

    View full-size slide

  28. &$ؔ࿈
    ࣭໰
    NATΠϯελϯεΛར༻͍ͯ͠Δํʁ

    View full-size slide

  29. &$ؔ࿈
    NAT Gateway

    View full-size slide

  30. /"5(BUFXBZ
    w ຊ൪؀ڥͰ/"5Πϯελϯεʢ&$Πϯελϯεʣ
    Λར༻͍ͯ͠ΔํʹΦεεϝɻ
    w ৑௕Խ΍&$ϝϯςφϯε͕৺഑ͳΒஔ͖׵͑ਪ঑
    w /"5(BUFXBZ͸";ʹͭ഑ஔ͢ΔඞཁɻͦͷͨΊ
    ͪΐͬͱߴΊ
    w ݕূ؀ڥͳͲ͸ɺ&$/"5ΠϯελϯεΛͦͷ··
    ར༻Ͱ0,ʢίετ௿ݮʣ

    View full-size slide

  31. &$ؔ࿈
    ͦͷଞ

    View full-size slide

  32. &$PO99͔ΒϚωʔδυαʔϏε΁ͷҠߦ
    Ҡߦ͢Δ͜ͱͰϚωʔδυαʔϏεͷͨΊɺαʔϏεϨ
    ϕϧΛ͋͛Δ͜ͱ͕Մೳ
    w &$PO4'51ˠ"845SBOTGFSGPS4'51
    w &$PO/'4ˠ"NB[PO&'4
    w &$POϦϞʔτΞΫηε71/੡඼ˠ$MJFOU71/

    View full-size slide

  33. 3%4ؔ࿈
    ࣭໰
    RDSͷϩάऔಘ͍ͯ͠·͔͢ʁ

    View full-size slide

  34. 3%4ؔ࿈
    RDS Cloudwatch logsϩάग़ྗ

    View full-size slide

  35. 3%4$MPVEXBUDIMPHTϩάग़ྗ
    3%4ͷओཁϩάΛ$MPVE8BUDI-PHT΁ग़ྗ
    ग़ྗʹ͸ɺόʔδϣϯࢦఆ͕͋Γ

    View full-size slide

  36. 3%4$MPVEXBUDIMPHTϩάग़ྗ
    .Z42-.BSJB%#
    w "VEJU-PH
    w &SSPS-PH
    w (FOFSBM-PH
    w 4MPX2VFSZ-PH

    View full-size slide

  37. 3%4$MPVEXBUDIMPHTϩάग़ྗ
    1PTUHSF42-
    w 1PTUHSF42-ϩά
    w ΞοϓάϨʔυϩά
    0SBDMF
    w Ξϥʔτϩά
    w ؂ࠪϩά
    w Ϧεφʔϩά
    w τϨʔεϩά

    View full-size slide

  38. 3%44MPX2VFSZ-PHϩάग़ྗ

    View full-size slide

  39. 3%4$MPVEXBUDIMPHTϩάग़ྗ
    3%4ͷ.Z42-.BSJB%#ͰϩάΛ$MPVE8BUDI
    -PHT΁ग़ྗՄೳʹͳΓ·ͨ͠ʛ%FWFMPQFST*0
    <৽ػೳ>3%4GPS0SBDMF͕$MPVE8BUDI-PHT΁
    ͷϩάग़ྗΛαϙʔτ͠·ͨ͠ʛ%FWFMPQFST*0
    <Ξοϓσʔτ>3%4GPS1PTUHSF42-ͷϩάΛ
    $MPVE8BUDI-PHTʹग़ྗͰ͖ΔΑ͏ʹͳΓ·ͨ͠ʛ
    %FWFMPQFST*0

    View full-size slide

  40. 3%4ؔ࿈
    ࣭໰
    RDSύϑΥʔϚϯε஗͍࣌
    ͲͷΑ͏ʹௐ͍ࠪͯ͠·͔͢ʁ

    View full-size slide

  41. ࢲݸਓͷ৔߹ɾɾɾ
    .Z42-ͷ৔߹ɺslow query logΛग़ྗ͠ϑΝΠϧΛ
    mysqldumpslowίϚϯυͰ෼ੳ
    w ฏۉϩοΫλΠϜͷ௕͍ॱ
    w ฏۉ࣮ߦ࣌ؒͷ௕͍ॱ
    w ฏۉߦ਺ͷଟ͍ॱ
    ͳͲͳͲɾɾɾ

    View full-size slide

  42. 3%4ؔ࿈
    RDS Performance Insight

    View full-size slide

  43. 3%41FSGPSNBODF*OTJHIU
    3%4ʹͯੑೳӨڹΛ֬ೝ͠ͳ͕ΒͰ͖Δ͚ͩ
    1FSGPSNBODF*OTJHIUTΛ༗ޮԽ
    1FSGPSNBODF*OTJHIUTͷμογϡϘʔυͰ͕͔࣌ؒ
    ͔͍ͬͯΔΫΤϦ౳͕෼͔Δ
    w Ұ෦ͷ%#ΤϯδϯͰόʔδϣϯࢦఆ͋Γ

    View full-size slide

  44. 3%41FSGPSNBODF*OTJHIU
    ྉۚ
    wܧଓ͢Δ೔ؒͷύϑΥʔϚϯεσʔλཤྺΛແྉͰఏڙ
    wύϑΥʔϚϯεΠϯαΠτͷμογϡϘʔυҎ֎͔Βͷ"1*ίʔϧ
    ສճ෼΋ؚΉ
    wผ్ྉۚ
    w௕ظؒͷύϑΥʔϚϯεσʔλཤྺΛอଘՄೳʢ࠷௕Ͱ೥෼ɺW$16͋ͨ
    Γʣ
    w ϦΫΤετ͋ͨΓ64%

    View full-size slide

  45. 3%41FSGPSNBODF*OTJHIU
    ύϑΥʔϚϯεΠϯαΠτΛར༻ͯ͠8PSE1SFTTͷ%#ෛՙΛ෼ੳͯ͠
    Έͨʛ%FWFMPQFST*0

    View full-size slide

  46. ӡ༻ؔ࿈
    ࣭໰
    CloudWatchར༻͍ͯ͠·͔͢ʁ

    View full-size slide

  47. ӡ༻ؔ࿈
    CloudWatch Dashboard

    View full-size slide

  48. $MPVE8BUDI%BTICPBSE
    Α͘νΣοΫ͢Δ߲໨ΛҰཡͰάϥϑࢀরͰ͖Δ
    ʢผ్ɺ؂ࢹγεςϜΛར༻͍ͯ͠Δํ͸ର৅֎ʣ
    w&-#ϦΫΤετ਺ɺΤϥʔ਺ͳͲ
    w&$$166UJMJ[BUJPOɺ/FUXPSL*O/FUXPSL0VUͳͲ
    w3%4$166UJMJ[BUJPOɺ%BUBCBTF$POOFDUJPOTɺ
    -BUFODZɺ%#-PBEͳͲ

    View full-size slide

  49. $MPVE8BUDI%BTICPBSE
    ྉۚ
    wμογϡϘʔυ͋ͨΓ64%݄
    wຖ݄࠷େݸͷϝτϦΫεରԠμογϡϘʔυݸ·Ͱແྉ

    View full-size slide

  50. $MPVE8BUDI%BTICPBSE
    ৄࡉ͸ͪ͜Β
    $MPVE8BUDIͷ"VUPNBUJD%BTICPBSETʹΑΓɺओཁͳ
    "84ϦιʔεͷՔಇঢ়گΛҰཡ֬ೝͰ͖ΔΑ͏ʹͳΓ·͠
    ͨʛ%FWFMPQFST*0
    $MPVE8BUDIμογϡϘʔυΛར༻ͯ͠Φʔτεέʔϧ؀
    ڥͷՔಇঢ়ଶΛՄࢹԽͯ͠Έͨʛ%FWFMPQFST*0
    $MPVE'PSNBUJPOΛར༻ͯ͠$MPVE8BUDIμογϡϘʔ
    υΛઃஔͯ͠Έͨʛ%FWFMPQFST*0

    View full-size slide

  51. ӡ༻ؔ࿈
    S3 Intelligent-Tiering

    View full-size slide

  52. 4*OUFMMJHFOU5JFSJOH
    w 4*OUFMMJHFOU5JFSJOH͸ίετͷҟͳΔ௿ස౓ΞΫη
    εߴස౓ΞΫηεͷͭͷ5JFS͋ΓΦϒδΣΫτผʹΞ
    Ϋηεස౓ʹԠͯࣗ͡ಈͰ5JFSΛҠಈ
    w ೔ؒΞΫηε͕ͳ͍ΦϒδΣΫτΛ௿ස౓ΞΫηε΁
    Ҡಈ
    w ΞΫηε͕͋Δͱࣗಈతʹߴස౓ΞΫηεʹҠಈ
    w ௿ස౓ΞΫηε5JFSʹҠಈޙɺετϨʔδ݄
    64%(#

    View full-size slide

  53. 4*OUFMMJHFOU5JFSJOH
    ʲΞοϓσʔτʳ4ʹ৽͍͠ετϨʔδΫϥ
    εz*OUFMMJHFOU5JFSJOHz͕ొ৔͠·ͨ͠SFJOWFOU
    ʛ%FWFMPQFST*0

    View full-size slide


  54. ηΩϡϦςΟؔ࿈

    View full-size slide

  55. ηΩϡϦςΟؔ࿈
    ࣭໰
    IAMͱSecurity Group
    ୨Էͯ͠·͔͢ʁ

    View full-size slide

  56. ར༻͍ͯ͠ͳ͍4FDVSJUZ(SPVQ
    ར༻͍ͯ͠ͳ͍4FDVSJUZ(SPVQ͸ҎԼ
    ʲ5JQTʳ࢖༻͍ͯ͠ͳ͍ηΩϡϦςΟάϧʔϓΛચ͍ग़͍ͨ͠ʂʂʂʛ
    %FWFMPQFST*0
    ීஈ͸ηΩϡϦςΟάϧʔϓΛ࢖Θͳ͍͚Ͳɺͨ·ʹ࢖͏Մೳੑ͕͋ΔαʔϏ
    ε΋͋ΔͷͰ஫ҙ
    w "VUP4DBMJOH
    w %BUB1JQMJOF
    w "84#BUDI
    w -BNCEBͳͲ

    View full-size slide

  57. ηΩϡϦςΟؔ࿈
    Trusted Advisor

    View full-size slide

  58. 5SVTUFE"EWJTPS
    "845SVTUFE"EWJTPS͸ɺҎԼͷͭͷ؍఺͔Βɺར༻ऀͷ"84
    ؀ڥΛ"84͕ࣗಈͰਫ਼ࠪ͠ɺਪ঑ઃఆͷ͓஌ΒͤΛͯ͘͠ΕΔػೳ
    w ίετ࠷దԽ
    w ύϑΥʔϚϯε
    w ϑΥʔϧττϨʔϥϯεʢ଱ো֐ੑʣ
    w ηΩϡϦςΟ
    w αʔϏε੍ݶ

    View full-size slide

  59. 5SVTUFE"EWJTPS
    ֤؂߲ࠪ໨νΣοΫ͸̏ஈ֊ͷεςʔλεͰঢ়ଶ
    μογϡϘʔυ্ͰҰ໨Ͱ൑ผ͕͠΍͍͢Α͏ʹ৭෼͚
    w /PQSPCMFNTEFUFDUFEʲ྘ʳ໰୊͕ݕग़͞Εͳ͔ͬͨ
    w *OWFTUJHBUJPOSFDPNNFOEFEʲԫʳௐ͕ࠪਪ঑͞ΕΔ
    w "DUJPOSFDPNNFOEFEʲ੺ʳଈ࣌ରԠ͕ਪ঑͞ΕΔ
    w /PU"WBJMBCMFʲʳඇදࣔ

    View full-size slide

  60. 5SVTUFE"EWJTPSίετ࠷దԽ
    w "NB[PO&$ϦβʔϒυΠϯελϯεͷ࠷దԽ
    w ௿Քಇ཰ͷ"NB[PO&$Πϯελϯε
    w ΞΠυϧঢ়ଶͷϩʔυόϥϯαʔ
    w ࢖༻཰ͷ௿͍"NB[PO7PMVNFT
    w ؔ࿈෇͚ΒΕ͍ͯͳ͍&MBTUJD*1ΞυϨε
    w "NB[PO3%4ͷΞΠυϧঢ়ଶͷ%#Πϯελϯε
    w "NB[PO3PVUFϨΠςϯγʔϦιʔεϨίʔυηοτ
    w "NB[PO&$3FTFSWFE*OTUBODF-FBTF&YQJSBUJPO
    w ࢖༻཰ͷ௿͍"NB[PO3FETIJGUΫϥελʔ

    View full-size slide

  61. 5SVTUFE"EWJTPSηΩϡϦςΟ
    w ηΩϡϦςΟάϧʔϓr੍ݶ͞Εͳ͍ಛఆͷϙʔτ
    w ηΩϡϦςΟάϧʔϓrແ੍ݶΞΫηε
    w *".6TF
    w "NB[PO4όέοτͷΞΫηεڐՄ
    w ϧʔτΞΧ΢ϯτͰͷ.'"
    w *".ύεϫʔυϙϦγʔ
    w "NB[PO3%4ηΩϡϦςΟάϧʔϓͷΞΫηεϦ
    εΫ
    w "84$MPVE5SBJMϩάه࿥
    w "NB[PO3PVUF.9͓Αͼ41'ͷϦιʔε
    Ϩίʔυηοτ
    w &-#ϦεφʔͷηΩϡϦςΟ
    w &-#ηΩϡϦςΟάϧʔϓ
    w *".ূ໌ॻετΞ಺ͷ$MPVE'SPOUಠࣗ
    44-ূ໌ॻ
    w ΦϦδϯαʔόʔͷ$MPVE'SPOU44-ূ໌ॻ
    w *".ΞΫηεΩʔͷߋ৽
    w ެ։͞ΕͨΞΫηεΩʔ
    w "NB[POύϒϦοΫεφοϓγϣοτ
    w "NB[PO3%4ύϒϦοΫεφοϓγϣοτ

    View full-size slide

  62. 5SVTUFE"EWJTPS଱ো֐ੑ
    w "NB[PO4OBQTIPUT
    w "NB[PO&$"WBJMBCJMJUZ;POF#BMBODF
    w ϩʔυόϥϯαʔͷ࠷దԽ
    w 71/τϯωϧ৑௕ੑ
    w "VUP4DBMJOHάϧʔϓͷϦιʔε
    w "NB[PO3%4όοΫΞοϓ
    w "NB[PO3%4Ϛϧν";
    w "VUP4DBMJOHάϧʔϓͷϔϧενΣοΫ
    w "NB[PO4όέοτϩΪϯά
    w "NB[PO3PVUFωʔϜαʔόʔͷσϦήʔγϣϯ
    w "NB[PO3PVUFߴ55-ϦιʔεϨίʔυηοτ
    w "NB[PO3PVUFϑΣΠϧΦʔόʔϦιʔεϨίʔυηο
    τ
    w "NB[PO3PVUFͷ࡟আ͞ΕͨϔϧενΣοΫ
    w &-#$POOFDUJPO%SBJOJOH
    w &-#Ϋϩεκʔϯෛՙ෼ࢄ
    w "NB[PO4όέοτͷόʔδϣχϯά
    w "84%JSFDU$POOFDU઀ଓͷ৑௕ੑ
    w "84%JSFDU$POOFDUϩέʔγϣϯͷ৑௕ੑ
    w "84%JSFDU$POOFDUԾ૝ΠϯλʔϑΣΠεͷ৑௕ੑ
    w "NB[PO"VSPSB%#ΠϯελϯεΞΫηγϏϦςΟ
    w &$8JOEPXTΠϯελϯε༻ͷ&$$POpHαʔϏ
    ε
    w &$8JOEPXTΠϯελϯεͷ17υϥΠόόʔδϣϯ

    View full-size slide

  63. 5SVTUFE"EWJTPSύϑΥʔϚϯε
    w ߴՔಇ཰ͷ"NB[PO&$Πϯελϯε
    w "NB[POͷϓϩϏδϣϯυ*014 44%
    ϘϦϡʔϜͷΞλονϝϯτઃఆ
    w &$ηΩϡϦςΟάϧʔϓͷϧʔϧ਺ͷաଟ
    w Πϯελϯεʹద༻͞ΕΔ&$ηΩϡϦςΟάϧʔϓͷϧʔϧͷ਺ͷաଟ
    w "NB[PO3PVUFΤΠϦΞεϦιʔεϨίʔυηοτ
    w ࢖༻཰͕ߴա͗Δ"NB[POϚάωςΟοΫϘϦϡʔϜ
    w "NB[PO$MPVE'SPOUίϯςϯπ഑৴ͷ࠷దԽ
    w $MPVE'SPOUϔομʔͷసૹͱΩϟογϡώοτ཰
    w "NB[PO&$͔Β΁ͷεϧʔϓοτ࠷దԽ
    w $MPVE'SPOU୅ସυϝΠϯ໊

    View full-size slide

  64. 5SVTUFE"EWJTPSαʔϏεͷ੍ݶ
    αʔϏεͷ࢖༻ྔ͕αʔϏεͷ੍ݶͷΛ௒͍͑ͯ
    ͳ͍͔ɺνΣοΫ͠·͢ɻ
    ඞཁʹԠ্ͯ͡ݶ؇࿨ਃ੥Λʂʂ

    View full-size slide

  65. ηΩϡϦςΟؔ࿈
    ࣭໰
    ໎࿭Ϙοτ΍໎࿭ΫϩʔϥΞΫηεͰ
    ແବͳϦιʔεফඅ͍ͯ͠·ͤΜ͔ʁ

    View full-size slide

  66. ηΩϡϦςΟؔ࿈
    AWS WAF
    +AWS WAF Managed Rule

    View full-size slide

  67. "848"'
    8"'ʢ8FC"QQMJDBUJPO'JSFXBMMʣ͸ɺ8FCαΠτ
    ͷΞϓϦέʔγϣϯ͕ɺ߈ܸ͞ΕͨΓɺσʔλ͕ྲྀग़͠
    ͳ͍Α͏௿ݮ͢Δରࡦ
    $MPVEGSPOU·ͨ͸"-#ͷར༻લఏ

    View full-size slide

  68. "848"'.BOBHFE3VMF
    "848"'ϚωʔδυϧʔϧΛซ༻ͰɺηΩϡϦςΟ
    اۀͷݫબ͞ΕͨϧʔϧΛൺֱత҆Ձʹར༻Մೳ
    ֹ݄ʙ64%ʴϦΫΤετ਺՝ۚ ສSFR୯Ґ

    View full-size slide

  69. "848"'.BOBHFE3VMFʢҰ෦Λൈਮʣ
    ϕϯμ ϧʔϧ໊ ༻్ Ձ֨
    ' '3VMFTGPS"848"'#PU
    1SPUFDUJPO3VMFT
    ࣗಈԽ͞Εͨ߈ܸ͔ΒอޢϘοτอޢϧʔϧ͸"848"'ͷͨΊͷύʔτφʔ͕؅ཧ͢ΔϧʔϧͰɺ੬
    ऑੑεΩϟφʔɺ΢ΣϒεΫϨʔύʔɺ%%P4πʔϧɺϑΥʔϥϜεύϜπʔϧͳͲͷଟذʹΘͨΔѱ
    ҙ͋ΔϘοτͷಈ͖Λ৯͍ࢭΊ·͢ɻ
    ݄

    ສSFR
    '
    '3VMFTGPS"848"'
    $PNNPO7VMOFSBCJMJUJFTBOE
    &YQPTVSFT $7&

    Α͋͘Δ੬ऑੑͱ๫࿐ $7&
    ͔Βอޢɻ"848"'ͷ$7&ϧʔϧ͸ɺ࣍ͷγεςϜΛλʔήοτͱ͢
    ΔΑ͘஌ΒΕͨ$7&ʹର͢ΔอޢΛ͠·͢"QBDIFɺ"QBDIF4USVUTɺ#BTIɺ&MBTUJDTFBSDIɺ**4ɺ
    +#PTTɺ+41ɺ+BWBɺ+PPNMBɺ.Z42-ɺ/PEFKTɺ1)1ɺ1)1.Z"ENJOɺ1FSMɺ3VCZ0O3BJMTɺ
    8PSE1SFTTɻ
    ݄

    ສSFR
    ' '3VMFTGPS"848"'8FC
    FYQMPJUT08"413VMFT
    ΢Σϒͷऑ఺Λอޢɻ'΢Σϒ͸"848"'ʹର͢Δ08"41ϧʔϧΛ׆༻͠ɺ08"41τοϓ
    ࠷΋ॏେͳ΢ΣϒΞϓϦέʔγϣϯϦεΫτοϓ
    ʹؚ·ΕΔ΢Σϒ߈ܸʹରͯ͠อޢ͠·͢ɻ͜
    Εʹ͸42-Jɺ944ɺίϚϯυΠϯδΣΫγϣϯɺ/P42-JΠϯδΣΫγϣϯɺܦ࿏τϥόʔαϧɺ༧ଌ
    తϦιʔεͳͲ͕͋Γ·͢ɻ
    ݄

    ສSFR
    $4$ $ZCFS4FDVSJUZ$MPVE.BOBHFE
    3VMFTGPS"848"'
    ೔ຊͷαΠόʔηΩϡϦςΟΫϥ΢υࣾͷϚωʔδυϧʔϧͰ͢ɻαΠόʔڴҖΠϯςϦδΣϯεΛ࢖༻
    ͯ͠࠷৽ͷڴҖΞϥʔτΛؚΉΑ͏ʹఆظతʹߋ৽͞ΕΔϧʔϧηοτΛఏڙ͠·͢ɻ͜ΕΒͷϧʔϧη
    οτ͸ɺ08"41ͷτοϓ8FCΞϓϦέʔγϣϯڴҖϦετʹؚ·ΕΔ΋ͷ͢΂ͯΛؚΊɺ੬ऑੑΛ
    ܰݮ͠·͢ɻ1$*%44ͳͲͷηΩϡϦςΟن֨ʹ४ڌ͢ΔͨΊʹ8FCΞϓϦέʔγϣϯͷηΩϡϦςΟ
    ཁ݅Λຬͨ͢͜ͱ͕Ͱ͖·͢ɻίʔυΠϯδΣΫγϣϯٕज़ʢ42-Jɺ/P42-Jɺ04ίϚϯυͳͲʣɺ
    944ɺσΟϨΫτϦτϥόʔαϧɺ͓Αͼ"QBDIF4USVUT"QBDIF5PNDBU0SBDMF8FC-PHJD
    8PSE1SFTTͳͲͷςΫϊϩδΛ࢖༻ͨ͠8FCΞϓϦέʔγϣϯʹؔ͢Δط஌ͷΤΫεϓϩΠτͳͲͷҰ
    ൠతͳ੬ऑੑΛඪతͱ͢Δ؅ཧϧʔϧ͕ଟ਺ؚ·Ε͍ͯ·͢%SVQBM+PPNMBʂͦͯ͠.BMJDJPVT#PUT
    ͷϧʔϧηοτͱͳΓ·͢ɻ
    ݄

    ສSFR

    View full-size slide

  70. "848"'.BOBHFE3VMF
    '#PU%FUFDUJPO4JHOBUVSFT'PS"848"'Λར
    ༻ͯ͠8FCαʔόʔετϨεπʔϧͷΞΫηεΛϒϩο
    Ϋʛ%FWFMPQFST*0
    ࠃ࢈8"'ϕϯμʔ$4$͔Β৽͍͠"848"'Ϛωʔδ
    υϧʔϧ͕ϦϦʔε͞ΕͨͷͰ࢖ͬͯΈͨʛ
    %FWFMPQFST*0

    View full-size slide

  71. ηΩϡϦςΟؔ࿈
    ࣭໰
    GuardDutyΛ஌͍ͬͯΔํʁ
    GuardDutyΛར༻͍ͯ͠Δํʁ

    View full-size slide

  72. ηΩϡϦςΟؔ࿈
    GuardDuty

    View full-size slide

  73. (VBSE%VUZͱ͸
    (VBSE%VUZΛ༗ޮԽ͢Δ͚ͩͰɺ&$΍"-#ͳͲͷ
    ӡ༻͍ͯ͠ΔαʔϏε΁ͷ߈ܸ΍"84ΞΧ΢ϯτࣗମ
    ΁ͷ߈ܸΛݕ஌
    ख͍ؒΒͣʂʢ&$΁Πϯετʔϧෆཁʣ
    ۩ମతʹ͸࣍ทͷ΋ͷΛݕ஌

    View full-size slide

  74. (VBSE%VUZݕ஌಺༰
    w ίΠϯϚΠχϯά
    w TTI3%1ϒϧʔτϑΥʔεΞλοΫʢ૯౰ͨΓ߈ܸʣ
    w *".6TFSͷෆਖ਼ϩάΠϯ
    w ίϚϯυˍίϯτϩʔϧʢ$$ʣαʔό΁ͷ௨৴
    w ϙʔτεΩϟϯ
    w ࿙Ӯͨ͠ΫϨσϯγϟϧར༻

    View full-size slide

  75. ݕग़ྫ
    44)ϒϧʔτϑΥʔε

    View full-size slide

  76. ݕग़ྫ
    ϙʔτεΩϟϯ

    View full-size slide

  77. (VBSE%VUZྉۚ
    w ແྉͰ೔ؒར༻Ͱ͖·͢ɻ
    w ແྉ࿮ར༻ͷؒʹ࣮ࡍ͍͘Β͔͔Δͷ͔Θ͔Γ·͢ʂ
    w "84ར༻අશମͷ͏ͪɺҎ্ͷΞΧ΢ϯτͰ
    ҎԼͷྉۚͰར༻ՄೳʢΫϥεϝιουௐ΂ʣ

    View full-size slide

  78. (VBSE%VUZ
    ৄࡉ͸ͪ͜Β
    ʲશһඞਢʳ(VBSE%VUZ͕ίεύ࠷ڧͷڴҖݕ஌αʔ
    ϏεͰ͋Δ͜ͱΛূ໌ͯ͠Έͨʛ%FWFMPQFST*0

    View full-size slide

  79. ηΩϡϦςΟؔ࿈
    ࣭໰
    ΞϓϦέʔγϣϯ΁
    σʔλϕʔε઀ଓ৘ใΛ
    ϋʔυίʔτ͍ͯ͠Δํʁ

    View full-size slide

  80. ηΩϡϦςΟؔ࿈
    AWS Systems Manager ύϥϝʔλετΞ
    AWS Secrets Manager

    View full-size slide

  81. AWS SSMύϥϝʔλετΞ/Secrets Manager ϝϦοτ
    ΞϓϦέʔγϣϯ͕ར༻͢Δػີ৘ใϋʔυίʔυෆཁʹ
    ΞϓϦέʔγϣϯߋ৽࣌ʹݕ౼Λʂʂ
    ػີ৘ใͷߋ৽ͷखؒ΋ܰݮ

    View full-size slide

  82. "8444.ύϥϝʔλετΞ4FDSFUT.BOBHFSϝϦοτ
    w ଟ༷ͳػີ৘ใΛ֨ೲՄೳ
    w ϩʔςʔγϣϯػೳͷ࣮૷ 4FDSFUT.BOBHFSͷΈ

    w ઃఆ஋΍ύεϫʔυΛूதతʹ؅ཧ͢Δ֊૚ܕετ
    Ϩʔδ
    w ΞΫηε੍ޚʗ҉߸Խ͕Մೳ
    w ଞͷαʔϏε͔Βͷࢀর͕༰қ

    View full-size slide

  83. ར༻ઌ&$
    w ݖݶ͸*".3PMFʢΠϯελϯεϓϩϑΝΠϧʣܦ༝
    w ༷ʑͳλΠϛϯάͰύϥϝʔλʔΛऔಘ
    w Πϯελϯεͷىಈ࣌ʢϢʔβʔσʔλʣ
    w ϓϩηεͷىಈ࣌ʢ".*࡞ΓࠐΈʗσϓϩΠ࣌ʹઃఆʣ
    w ͦͷଞʢΞϓϦέʔγϣϯͰ೚ҙͷλΠϛϯάʹʣ

    View full-size slide

  84. ར༻ઌ"NB[PO&MBTUJD$POUBJOFS4FSWJDF &$4

    w ݖݶ͸*".3PMFʢλεΫϩʔϧʣܦ༝Ͱ෇༩
    w ؀ڥม਺ͱͯ͠ύϥϝʔλʔετΞΛࢦఆՄೳ

    View full-size slide

  85. ར༻ઌ"84-BNCEB
    w ݖݶ͸*".3PMFܦ༝Ͱ෇༩
    w ೚ҙͷλΠϛϯάͰऔಘ
    w ࠓ͸-BNCEBؔ਺ʹ؀ڥม਺͕͋Δ
    w ूத؅ཧ͍ͨ͠৔߹͸ύϥϝʔλʔετΞΛҾ͖ଓ͖
    ར༻ʢ-BNCEBؔ਺͕ଟ͍৔߹ͳͲʣ

    View full-size slide

  86. ར༻ઌͦͷଞ
    w "84$PEF#VJMEˠ#VJME4QFDZNM಺Ͱऔಘ
    w "84$PEF%FQMPZˠ"QQ4QFDZNM಺Ͱऔಘ

    View full-size slide

  87. "8444.ύϥϝʔλετΞͱ4FDSFUT.BOBHFSҧ͍͸ʁ
    w ϩʔςʔγϣϯͰ͖ϥϯμϜจࣈྻͷੜ੒͕Ͱ͖Δ
    w ύϥϝʔλʔετΞ͸4FDSFU.BOBHFSͷύεε
    ϧʔαʔϏεͱͯ͠ػೳ͢Δ
    w lBXTSFGFSFODFTFDSFUTNBOBHFSzΛ໊લͷઌ
    ಄ʹ෇༩͢Δͱɺ4FDSFU.BOBHFSΛࢀর͢Δ
    w ύϥϝʔλετΞΛར༻͢ΔΑ͏ʹΞϓϦΛ࡞ΓࠐΜ
    Ͱ͍Δ৔߹Ͱ΋ɺ໊લΛमਖ਼͢Ε͹Ҡߦ͸ൺֱత༰қ

    View full-size slide

  88. "8444.ύϥϝʔλετΞͱ4FDSFUT.BOBHFSͷྉۚ
    4ZTUFNT.BOBHFSύϥϝʔλετΞ
    w ελϯμʔυ͸ແྉɻ
    w εϧʔϓοτ্ݶΛ૿Ճ΍ɺΞυόϯεύϥϝʔλͷ৔߹͸༗ྉɻ ճͷ"1*
    ίʔϧ͋ͨΓ64%ɻ
    w ·ͨɺ҉߸Խʹར༻͞ΕΔ,.4ʹͯ$., ΧελϚʔϚελʔΩʔɻϢʔβଆͰੜ੒͠
    ͨΩʔ
    Λར༻͢Δ৔߹ɺ,.4ͷ"1*ݺͼग़͠ྉ͕ۚඞཁɻ
    4FDSFUT.BOBHFS
    w ༗ྉɻγʔΫϨοτ݅͋ͨΓ64%݄ɻ ճͷ"1*ίʔϧ͋ͨΓ64%ɻ
    w ߋʹύϥϝʔλετΞͱಉ༷ɺ,.4ͷ҉߸Խʹ$.,Λར༻͢Δ৔߹ɺ,.4ͷ"1*ݺͼग़
    ͠ྉ͕ۚඞཁʢ೔ؒͷτϥΠΞϧظؒ͋Γɻʣ

    View full-size slide

  89. ৄࡉ
    ࣾ಺ษڧձͰύϥϝʔλʔετΞʹ͍ͭͯൃද͠·ͨ͠
    ʛ%FWFMPQFST*0

    View full-size slide

  90. ·ͱΊ
    γεςϜͷݟ௚͠ϙΠϯτ
    w ৽αʔϏεɾ৽ػೳͷऔΓࠐΈܧଓతͳվળ
    w "84ͷϚωʔδυαʔϏεΛ࠷େݶʹར༻
    w ݟ௚࣮͠ࢪ͢ΔͨΊͷఆظతͳγεςϜϩʔυϚοϓ
    ࡞੒ͱ༧ࢉ֬อ

    View full-size slide