AWS IAMの属人的な管理からの脱却【DeNA TechCon 2021】/techcon2021-19

"84*".ͷ ଐਓతͳ؅ཧ͔Βͷ୤٫ ,FOUB4BUP !LBSVQBOFSVSB %F/" $P-5%

!LBSVQBOFSVSB %F/"ೝূೝՄج൫पลαʔϏε։ൃɾӡ༻ +BQBO1FSM"TTPDJBUJPO୅දཧࣄ 1FSM(P+BWB5ZQF4DSJQU.Z42-FUD 5XJUUFS(JUIVC!LBSVQBOFSVSB

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

࿩͞ͳ͍͜ͱ w ηΩϡϦςΟͷجૅ w "84΍*".ͷجૅ w ֤छ"84αʔϏε w *".؅ཧͷৄ͍͠ӡ༻ํ๏ w
"84ΞΧ΢ϯτͷϚϧνΞΧ΢ϯτ؅ཧ w "84$%,ͳͲͷ࢓૊Έͷৄࡉ

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾํ๏ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

*".؅ཧͷ ϕετϓϥΫςΟε

*".ͰͷηΩϡϦςΟͷϕετϓϥΫςΟε IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNM

ಛʹେࣄͳͱ͜Ζ ࠓճͷ࿩Λཧղ͢Δ্Ͱ

*".ͰͷηΩϡϦςΟͷϕετϓϥΫςΟε IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNM

࠷খݶͷಛݖΛೝΊΔ w ඞཁҎ্ͷݖݶΛ͚ͭͳ͍ w ࠷খݶͷΞΫηεݖݶ͔Βঃʑʹҭ͍ͯͯ͘ Կނ͔ʁ ˠඞཁҎ্ͷݖݶ͕෇༩͞Εͨঢ়ଶͷৗଶԽΛ๷͙ͨΊ ඞཁҎ্ʹݖݶΛ࣋ͭͱೝূ৘ใͷ࿙Ӯ࣌ͷϦεΫ͕ߴ͘ͳΔ

ΞΫηεΩʔΛڞ༗͠ͳ͍ w ಉҰ*".ϢʔβʔͷΞΫηεΩʔΛෳ਺ՕॴͰڞ༗͠ͳ͍ w *".ϩʔϧͷར༻Λਪ঑͢Δ Կނ͔ʁ ˠΞΫηεΩʔΛ࣋ͭγεςϜΛ૿΍͞ͳ͍ͨΊ ΞΫηεΩʔΛ࢖͏Օॴ͕૿͑Ε͹࿙Ӯ͢ΔՄೳੑ΋૿͑Δ

ͭ·Γ

*".؅ཧͷϕετϓϥΫςΟε w ݸʑݸผͷࣄ৘ʹ߹Θͤͨ࠷খݶͷݖݶΛ࣋ͭ*".ϩʔϧΛ࢖͏ w ඞཁҎ্ͷݖݶΛ͚ͭͳ͍ w *".Ϣʔβʔ͸γεςϜϢʔεͰ͸ݪଇͱͯ͠࢖Θͳ͍ w ($1͔Βར༻͢Δ৔߹ͳͲ͸ผ

*".؅ཧͷ೉͠͞

*".ϙϦγʔ͸ෳࡶԽ͕ͪ͠ w 3FTPVSDF΍$POEJUJPOʹΑΔॊೈͰࡉ͔͍ݖݶ؅ཧ͕Մೳ w ୯७ʹ"DUJPOΛ෇͚Δ͚ͩͰ͸े෼ʹݖݶΛߜΕͳ͍ w 4΍,.4ͷར༻Ͱ͸࣮༻্3FTPVSDFͷ੍ݶ΋ඞཁʹͳΔ w "84؅ཧϙϦγʔʹ͸Ϧιʔε੍ݶ͕ແ͍ w
ݖݶΛे෼ʹߜΔʹ͸ࣗ෼ͰϙϦγʔΛ࡞Δ΄͏͕ྑ͍ w ݁Ռతʹ*".ϙϦγʔ؅ཧʹ͸ϊ΢ϋ΢͕ඞཁʹͳΔ

ݖݶΛ؅ཧ͢Δݖݶ͕ඞཁʹͳΔ w ʮ*".Λ؅ཧ͢Δݖݶʯ͸ʮݖݶΛ؅ཧ͢ΔݖݶʯͰ͋Δ w ͭ·Γࣗ෼ࣗ਎ͷݖݶ΋ίϯτϩʔϧͰ͖Δ w ࣮࣭తʹ͢΂ͯͷݖݶΛ࣋ͭ͜ͱʹ΄΅౳͍͠ঢ়ଶ w ແҋʹશһ͕͜ΕΛ࣋ͭͱݖݶ؅ཧ͢Δҙຯ͕ͳ͘ͳͬͯ͠·͏ w
Ұ෦ͷϝϯόʔ͚͕ͩ*".؅ཧݖݶΛ࣋ͭΑ͏ʹ͢Ε͹ղܾ͢Δ w Ұൠతʹ͸ґཔ੍ νέοτ੍ ͱͳΔ͜ͱ͕ଟͦ͏

%FW0QTͷڥ໨͕ᐆດ w Ϋϥ΢υΠϯϑϥʹ͓͍ͯ͸%FWͱ0QTͷڥ໨͸ᐆດ w *BB4͔Β཭Ε͍͚ͯ͹͍͘΄Ͳ͜Ε͸ݦஶʹͳ͍ͬͯ͘ w %FWͷจ຺Ͱ৽͍͠ΠϯϑϥετϥΫνϟΛ࡞Δ͜ͱʹͳΔ w ͦΕʹ߹Θͤͯ৽͍͠ݖݶηοτ͕ඞཁʹͳΔ͜ͱ͕ଟ͍ w
-BNCEB΍'JSFIPTFʹ෇༩͢Δ*".ϩʔϧͳͲ w ։ൃن໛͕޿͘ଟ༷Խ͢Δͱɺґཔ੍Ͱ͸ᴥᴪ͕ى͖΍͘͢ͳΔ

͓Θ͔Γ ͍͚ͨͩͨͩΖ͏͔ʜ

΋͏Ұ౓͝ཡ͍ͨͩ͜͏ʜ

*".؅ཧͷϕετϓϥΫςΟε w ݸʑݸผͷࣄ৘ʹ߹Θͤͨ࠷খݶͷݖݶΛ࣋ͭ*".ϩʔϧΛ࢖͏ w ඞཁҎ্ͷݖݶΛ͚ͭͳ͍ w *".Ϣʔβʔ͸γεςϜϢʔεͰ͸ݪଇͱͯ͠࢖Θͳ͍ w ($1͔Βར༻͢Δ৔߹ͳͲ͸ผ

ݖݶΛ؅ཧ͢Δݖݶ͕ඞཁʹͳΔ w ʮ*".Λ؅ཧ͢Δݖݶʯ͸ʮݖݶΛ؅ཧ͢ΔݖݶʯͰ͋Δ w ͭ·Γࣗ෼ࣗ਎ͷݖݶ΋ίϯτϩʔϧͰ͖Δ w ࣮࣭తʹ͢΂ͯͷݖݶΛ࣋ͭ͜ͱʹ΄΅౳͍͠ঢ়ଶ w ແҋʹશһ͕͜ΕΛ࣋ͭͱݖݶ؅ཧ͢Δҙຯ͕ͳ͘ͳͬͯ͠·͏ w
Ұ෦ͷϝϯόʔ͚͕ͩ*".؅ཧݖݶΛ࣋ͭΑ͏ʹ͢Ε͹ղܾ͢Δ w Ұൠతʹ͸ґཔ੍ νέοτ੍ ͱͳΔ͜ͱ͕ଟͦ͏

ແ਺ʹൃੜ͢Δ ݸʑݸผͷ*".ϩʔϧ

ͦΕΒΛશͯ؅ཧ͢Δ Ұ෦ͷϝϯόʔ

։ൃن໛ʹରͯ͠ ؅ཧ͕εέʔϧͰ͖ͳ͍

ʘ ?P? ʗ

Ͳ͏͢Ε͹ྑ͍ͷ͔

ղܾํ๏

*".؅ཧͷ෦෼తͳҕৡ

ͦ΋ͦ΋ͷ໰୊ w *".ϦιʔεશମΛ؅ཧ͢Δ͔Ұ੾؅ཧ͠ͳ͍͔ͷۃ୺ͳೋ୒ w ։ൃن໛͕εέʔϧͯ͠΋*".؅ཧऀ͕εέʔϧͰ͖ͳ͍ w Ұ෦ͷݸਓ͕؅ཧ୲౰ऀͱͯͦ͠ΕΛ΍Δ͔͠ͳ͍ҝ w ݁Ռతʹ*".Ϣʔβʔ΍*".ϩʔϧͷ࢖͍·Θ͠Ͱଥڠ͕ͪ͠ w
΋ͪΖΜજࡏతͳηΩϡϦςΟʔϦεΫ͕෇͖·ͱ͏

෼୲͸͍͚ͨ͠ΕͲ શݖ࣋ͬͨਓ͕૿͑͗ͯ͢΋ࠔΔ

ʮ͜ͷ-BNCEB͋ͨΓͷݖݶ͸ ͦͬͪͰΑ͠ͳʹ؅ཧͯ͠Ͷʯ Έ͍ͨʹ෼୲͍ͨ͠

"MMPS/PUIJOH͸ࠔΔ

΋͠෦෼తͳ؅ཧΛҕৡͯ͠ ෼୲͢Δ͜ͱ͕Ͱ͖ͨΒʜʁ

ղܾͦ͠͏

Ͳ͏΍ͬͯʁ

෦෼తͳ*".ݖݶૢ࡞͕Ͱ͖Δݖݶ ͳΜͯ࡞ΕΔͷ͔ʁ

ͭ͘Ε·͢

1FSNJTTJPOT#PVOEBSZ w ݖݶͷڥքΛఆΊΔ͜ͱ͕Ͱ͖Δػೳ w Ұൠతʹ͸૊৫ؒͰ*".؅ཧݖݶͷҰ෦ΛҕৡͷͨΊʹ࢖ΘΕΔ w *".Ϣʔβʔ΍*".ϩʔϧʹઃఆ͢Δ͜ͱ͕Ͱ͖Δ w ͜Ε͕ઃఆ͞Ε͍ͯΔ*".Ϧιʔε͸ɺͲͷΑ͏ͳݖݶΛ࣋ͬͯ ͍ͯ΋ɺ͜ͷڥքΛ௒͑ͨݖݶΛߦ࢖͢Δ͜ͱ͸Ͱ͖ͳ͘ͳΔ
w Τϥʔ͸୯ʹݖݶΛ͍࣋ͬͯͳ͍ͱ͖ͱಉ͡΋ͷ͕ൃੜ͢Δ IUUQTEPDTBXTBNB[PODPN*".MBUFTU6TFS(VJEFBDDFTT@QPMJDJFT@CPVOEBSJFTIUNM

ͲͷΑ͏ʹݖݶͷڥքΛఆΊΔͷ͔ w ࣮ଶͱͯ͠͸ී௨ͷҰൠతͳ؅ཧϙϦγʔ w 1FSNJTTJPOT#PVOEBSZͱͯ͠෇༩ͨ͠৔߹ʹಛघͳಇ͖Λ͢Δ w 1FSNJTTJPOT#PVOEBSZͰڐՄ͞Ε͍ͯͳ͍"DUJPO͸࢖͑ͳ͘ͳΔ w ΠϯϥΠϯϙϦγʔͳͲͰڐՄ͞Ε͍ͯͯ΋ͦΕ͸࢖͑ͳ͘ͳΔ w
୯ʹڐՄ͍ͯ͠ͳ͍ͱ͖ͱൃੜ͢ΔΤϥʔ͸มΘΒͳ͍ w ౰ͨΓલ͕ͩ ͜͜Ͱ*".Ϧιʔεͷૢ࡞ݖݶΛڐՄ͢Δͱݖݶঢ͕֨Ͱ͖ΔͷͰຊ຤స౗ʹͳͬͯ͠·͏ɻ΍ͬͯ͸͍͚ͳ͍

ͲͷΑ͏ʹݖݶͷڥքΛఆΊΔͷ͔ w Ұൠతʹ͸αʔϏε୯ҐͰࢦఆ͢ Δ͜ͱ͕ଟ͍ w ӈͷྫͷϙϦγʔΛ1FSNJTTJPOT #PVOEBSZʹࢦఆͨ͠৔߹͸ɺ4 ͱ$MPVE8BUDIʹؔ܎͢Δݖݶͩ ͚͕ػೳ͢Δ {
"Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*", "cloudwatch:*" ], "Resource": "*" } ] }

ͭ·Γ

୯ʹ*".Ϧιʔεͷݖݶ͚͕ͩ͋Δঢ়ଶ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ

1FSNJTTJP OT#PVOEBSZ ͦ͜ʹ1FSNJTTJPOT#PVOEBSZ͕ͭ͘ͱ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ

1FSNJTTJP OT#PVOEBSZ ࣮ࡍʹ࢖͑ΔݖݶΛ੍ݶͰ͖Δ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ ࣮ࡍʹ
࢖͑Δ ݖݶ

2෇͚ͳ͔ͬͨΓ֎͞ΕͨΓ͠ͳ͍ʁ

"෇༩Λڧ੍͢Ε͹Α͍

1FSNJTTJPOT#PVOEBSZͷ෇༩Λڧ੍ w *".$POEJUJPOͰ͋ΔJBN1FSNJTTJPOT#PVOEBSZΛ࢖͏ w ࢦఆͨ͠1FSNJTTJPOT#PVOEBSZΛ෇༩ͨ͠*".ϦιʔεͷΈʹ ରͯ͠ͷΈར༻Ͱ͖ΔݖݶΛදݱͰ͖Δ w ࣮࣭తʹಛఆͷ1FSNJTTJPOT#PVOEBSZͷ෇༩Λڧ੍Ͱ͖Δ w ࢦఆͨ͠1FSNJTTJPOT#PVOEBSZΛ෇༩͠ͳ͍Ϧιʔεʹରͯ͠
ͷૢ࡞Λڋ൱Ͱ͖Δ

1FSNJTTJP OT#PVOEBSZ ࣮ࡍʹ࢖͑Δݖݶͷ੍ݶΛڧ੍Ͱ͖Δ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ ࣮ࡍʹ
࢖͑Δ ݖݶ ֎ͤͳ͍ʂ

ͲͷΑ͏ʹ࢖͏͔

*".ݖݶ؅ཧͷ෦෼తͳҕৡͷ࣮ݱ ݖݶൣғΛදݱ͢Δ1FSNJTTJPOT#PVOEBSZ༻؅ཧϙϦγʔΛ࡞Δ ෦෼తͳ*".؅ཧݖݶΛ༩͍͑ͨ*".Ϧιʔεʹର͠ JBN1FSNJTTJPOT#PVOEBSZͰ্هͷ1FSNJTTJPOT#PVOEBSZ Ͱ੍ݶͨ͠*".ૢ࡞ݖݶΛ෇༩͢Δ ඞཁͳΒ ࣗ෼ࣗ਎ͷ*".Ϧιʔεʹର͢Δૢ࡞΋ېࢭ͢Δ

Ͱ͖·ͨ͠

͜ΕͰ*".؅ཧΛ ෼୲͠΍͘͢ͳͬͨ

΍Γ·ͨ͠Ͷ

͔͠͠

·ͩ໰୊͸࢒͍ͬͯΔʜ

ࢥ͍ग़ͯ͠Έ·͠ΐ͏

*".ϙϦγʔ͸ෳࡶԽ͕ͪ͠ w 3FTPVSDF΍$POEJUJPOʹΑΔॊೈͰࡉ͔͍ݖݶ؅ཧ͕Մೳ w ୯७ʹ"DUJPOΛ෇͚Δ͚ͩͰ͸े෼ʹݖݶΛߜΕͳ͍ w 4΍,.4ͷར༻Ͱ͸࣮༻্3FTPVSDFͷ੍ݶ΋ඞཁʹͳΔ w "84؅ཧϙϦγʔʹ͸Ϧιʔε੍ݶ͕ແ͍ w
ݖݶΛे෼ʹߜΔʹ͸ࣗ෼ͰϙϦγʔΛ࡞Δ΄͏͕ྑ͍ w ݁Ռతʹ*".ϙϦγʔ؅ཧʹ͸ϊ΢ϋ΢͕ඞཁʹͳΔ

ݸਓͰͳ͘૊৫ͱͯ͠ *".؅ཧϊ΢ϋ΢Λ ஝ੵ͍ͨ͠

ཧ૝

૊৫Ͱ؅ཧ͢Δཧ૝ͷ*".؅ཧ؀ڥ w ඞཁ࠷খݶͷਓ͕؅ཧݖݶΛ͍࣋ͬͯΔ w ͜ͷਓ਺Λن໛ʹ߹Θͤͯ૿ݮͰ͖Δ w ࡞ۀऀ͸୭Ͱ΋มߋΛϦΫΤετͰ͖Δ w มߋ಺༰͸٬؍తʹᴥᴪͷແ͍දݱͰهࡌͰ͖Δ w
͍ͭͩΕ͕ͳΜͷͨΊʹͲͷΑ͏ͳมߋΛͨ͠ͷ͔Λ௥੻Ͱ͖Δ w มߋͷࡍʹؾΛ͚ͭΔ΂͖ϊ΢ϋ΢͕஝ੵͰ͖Δ

*OGSBTUSVDUVSFBTDPEF Ͱղܾͦ͠͏

૊৫Ͱ؅ཧ͢Δཧ૝ͷ*".؅ཧ؀ڥ w ඞཁ࠷খݶͷਓ͕؅ཧݖݶΛ͍࣋ͬͯΔˠ(JUIVC3FWJFX w ͜ͷਓ਺Λن໛ʹ߹Θͤͯ૿ݮͰ͖Δˠ(JUIVC5FBN w ࡞ۀऀ͸୭Ͱ΋มߋΛϦΫΤετͰ͖Δˠ1VMM3FRVFTU w มߋ಺༰͸٬؍తʹᴥᴪͷແ͍දݱͰهࡌͰ͖Δˠ$PEF w
͍ͭͩΕ͕ͳΜͷͨΊʹͲͷΑ͏ͳมߋΛͨ͠ͷ͔Λ௥੻Ͱ͖Δ w มߋͷࡍʹؾΛ͚ͭΔ΂͖ϊ΢ϋ΢͕஝ੵͰ͖Δˠ(JU

1VMM3FRVFTUग़ͯ͠ ϨϏϡʔͯ͠Ϛʔδͯ͠ $*Ͱࣗಈಉظ

͍ͨ͠

΍Γ·͠ΐ͏

1VMM3FRVFTUग़ͯ͠ ϨϏϡʔͯ͠Ϛʔδͯ͠ $*Ͱࣗಈಉظ

Kick Job Github Enterprise Server Sync CI Create Developer Review
Reviewer Pull-Request Merge AWS IAM ֓೦ਤ

Αͬ͠Ό ΍͍ͬͯͧ͘ʂʂʂʂʂ

ͦͷલʹʜ

*".มߋద༻ΛࣗಈԽ͢ΔϦεΫ w $*+PC͕*".؅ཧݖݶΛ࣋ͭ͜ͱʹͳΔ w *".ͷશݖΛ࣋ͭͱ಺෦ෆਖ਼ߦҝऀʹѱ༻͞ΕͨࡍͷϦεΫ͕ߴ͍ w ෦෼తͳ*".؅ཧݖݶΛ࣋ͭ৔߹͸ͦͷϦεΫ͸ݶఆత w ϦϙδτϦʹΞΫηεݖݶ͕͋Ε͹୭Ͱ΋มߋͰ͖Δ w
ϨϏϡʔ͕βϧͩͱѱҙͷ͋ΔݖݶΛݟམͱ͔͠Ͷͳ͍ w $*ͷߏ੒ࣗମʹ੬ऑੑ͕ແ͍ݶΓ͸֎෦͔Β߈ܸ͢Δ༨஍͸ͳ͍

ϦεΫʹର͢Δߟ͑ํ w ಺෦ෆਖ਼ߦҝऀͷ༨஍͔͠ͳ͍ࣗಈԽͤͣͱ΋ৗʹ͋ΔϦεΫ w *".؅ཧݖݶΛ͍࣋ͬͯΔਓ͕ډΔݶΓ͸ى͜ΓಘΔ w ෆਖ਼ߦҝΛ͠ʹ͘͘͢Δ࢓૊ΈΛ࡞Δ͜ͱͰϦεΫΛԼ͛ΒΕΔ w $MPVE5SBJMͷ*"."1*ΠϕϯτΛ4MBDLʹ௨஌ w
*".ϦιʔεͷมߋͳͲΛݕ஌प஌͢Δ w มߋػձ͸ൺֱతগͳ͍ͷͰมͳૢ࡞͕͋ͬͯ΋ؾ͖ͮ΍͍͢ w 1FSNJTTJPOT#PVOEBSZͰൣғΛݶఆ͠ඃ֐ϦεΫΛԼ͛ΒΕΔ

࢓૊Έ࣍ୈͰ े෼ʹϦεΫΛԼ͛ΒΕΔ

Αͬ͠Ό ΍͍ͬͯͧ͘ʂʂʂʂʂ

ཧ૝ͷ*B$ʹΑΔ*".؅ཧ w (JUIVCʹ1VMM3FRVFTU 13 Λ࡞ΓϚʔδ͞ΕͨΒ$*Ͱࣗಈಉظ w ίʔυ ઃఆ Λਖ਼ͱͯࠩ͠෼ಉظ͍ͨ͠ w
શಉظͰ͸4%,ͳͲͷεϩοτϧֻ͕͔Γ͕࣌ؒͱͯ΋ֻ͔Δ w ఆظతʹ"84ଆΛਖ਼ͱͨࠩ͠෼ಉظΛऔΓࠐΈ͍ͨ w ۓٸ࣌ͳͲʹߦͬͨ௚ͷมߋ͕ҙਤͤͣר͖໭͞Εͳ͍Α͏ʹ w -JOUFSΛ༻ҙͯ͠ϙϦγʔͳͲͷෆඋΛࣗಈϨϏϡʔ͍ͨ͠ w ϊ΢ϋ΢Λ13͚ͩͰ͸ͳ͘ίʔυͱͯ͠΋஝ੵͰ͖Δ

Ͳ͏΍ͬͯಉظ͢Δ͔ʁ

ಉظखஈͷબ୒ࢶ w 5FSSBGPSN w QSPTJNQPSU΋Մೳಠࣗ%4-Ͱࣗ༝౓͕ߴ͗͢ͳ͍ w DPOTTUBUFͷ؅ཧ͕ඞཁ w "84$%, $GO$MPVE'PSNBUJPO
w QSPTTUBUFͷ؅ཧ͕ෆཁ w DPOTESJGUൃੜ࣌ʹखͰݕ஌ɾमਖ਼͕ඞཁࣗ༝౓͕ߴ͗͢Δ

هड़ͷࣗ༝౓ͷӨڹ w "84ଆͷঢ়ଶΛਖ਼ͱͨࠩ͠෼औΓࠐΈͷ͠΍͢͞ w هड़ͷࣗ༝౓͕௿͍΄ͲςΩετͰͷࠩ෼͕ग़ʹ͍͘ w ϑΥʔϚολʔͳͲ͕͋Ε͹Ϛγ͕ͩʜ w ͨͱ͑͹5ZQF4DSJQUͷίʔυʹམͱ͞Εͯ΋ࠩ෼͕େม w
७ਮͳ+40/ͷΑ͏ͳ୯ͳΔߏ଄ମ͕Ұ൪ྑ͍

طଘ*B$ιϦϡʔγϣϯͷTUBUF؅ཧ w $GO΍5FSSBGPSNͳͲͷ*B$Ͱ͸TUBUFΛ࣋ͬͯͦΕͱͷࠩ෼ΛऔΔ w ࣮ଶͱTUBUF͸ဃ཭͠ಘΔ ͜ͷဃ཭ΛESJGUͱݺͿ w Ұൠతͳߏ੒؅ཧͰ͸ESJGU͸Ͳͷঢ়ଶ͕ਖ਼͍͔͠౎౓൑அ͕ඞཁ w
"84ଆͷঢ়ଶΛਖ਼ͱͨ͠*".Λදݱ͢Δίʔυ ઃఆ ΁ͷࠩ෼औΓ ࠐΈΛ͢ΔͨΊʹ͸TUBUF͸अຐʹͳΔ

Ͳ͏͢Δ͔ʁ

ࣗ࡞͠·ͨ͠

࣮૷ w ࠩ෼ݕग़͠"844%,Ͱ*"."1*Λద੾ʹୟ͘ײ͡ͷ࣮૷ w +40/Ͱ*".Ϣʔβʔ΍*".ϩʔϧͷઃఆ಺༰Λهड़ w ΠϯϥΠϯϙϦγʔͳͲ΋ͦͷ··هࡌͰ͖Δ w 5ZQF4DSJQUͰ࣮૷ w
"84$%,ΛಋೖࡁΈͩͬͨͷͰ։ൃݴޠΛ߹Θ͔ͤͨͬͨ w JPUTͰόϦσʔγϣϯ͢Δ͜ͱͰ؆୯ͳUZQPͳͲ΋ݕग़Մೳ

ఆٛྫ { "UserName": "foo", "Tags": {}, "PermissionBoundary": "arn:aws:iam::012345678901:policy/OurPermissionsBoundary", "InlinePolicies": {
"Bar": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket" }, { "Effect": "Allow", "Action": [ "s3:GetObject",

"Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket"
], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket/*" } ] } }, "AttachedPolicies": [] } ఆٛྫ

ӡ༻ͨͦ͠ͷޙ

تͼͷ੠ w ʮ*".पΓΛ୲౰ऀʹґཔ͢Δඞཁ͕ͳ͘ͳָͬͯʹͳͬͨʯ w ʮศརʯ w ͕ͬͭΓ࢖ΘΕ͍ͯ·͢

ى͖ͨτϥϒϧ

τϥϒϧ w *"."1*ͷো֐Ͱಉظ͕ࢭ·Δ w ଘࡏ͠ͳ͍"DUJPOΛࢦఆͯ͠ಉظΤϥʔ w ଘࡏ͠ͳ͍ϢʔβʔΛ"TTVNF3PMF1PMJDZͰ৴པ͠Α͏ͱͯ͠ಉظ Τϥʔ w 1FSNJTTJPOT#PVOEBSZͰڐՄ͍ͯ͠ͳ͍΋ͷΛ௥Ճͯ͠ϋϚΔ
͍ͣΕ΋मਖ਼΍ϦτϥΠͰղܾࡁ

ΊͰͨ͠

·ͱΊ

·ͱΊ w *".؅ཧ͸೉͍͠ w ϕετϓϥΫςΟε͸͋Δ͕࣮ફʹ͸࿑ྗతͳ՝୊͕ଟ͍ w 1FSNJTTJPOT#PVOEBSZΛ͏·͘࢖͏ͱղܾͰ͖Δ w *".؅ཧϊ΢ϋ΢͸૊৫ʹ஝ੵ͢Δ࢓૊ΈΛ࡞Δͱ٢ w
(JUIVCͰ1VMM3FRVFTUϕʔεͰ*".ϦιʔεΛ؅ཧ͢Δಓ΋͋Δ w ϦεΫ͕ड͚ೖΕΒΕͦ͏ͳΒݕ౼ͷՁ஋ΞϦ

͋Γ͕ͱ͏͍͟͝·ͨ͠ ࣭ٙԠ౴:PVUVCFίϝϯτཝʹͯ

AWS IAMの属人的な管理からの脱却【DeNA TechCon 2021】/techcon2...

AWS IAMの属人的な管理からの脱却【DeNA TechCon 2021】/techcon2021-19

More Decks by DeNA_Tech

Other Decks in Technology

Featured

Transcript