AWS上でStripeを利用したアプリをより安全にデプロイする方法 /jaws-pankration-2021

JAWS PANKRATION 2021登壇資料です。
https://jawspankration2021.jaws-ug.jp/sessions/40

Transcript

1. How to develop application safely
   using Stripe on AWS
   

   View Slide

2. Agenda
   ● About Stripe
   ● Using AWS to use Stripe more secure
   ● Community information about Stripe
   

   View Slide

3. https://stripe.com/
   

   View Slide

4. We can add/do...
   ● Send invoice and charge it
   ● Membership / Subscription
   ● Create marketplace (CtoC)
   ● POS / Finance / Card / eKYC / etc...
   

   View Slide

5. Use case
   https://getshifter.io
   https://stripe.com/
   

   View Slide

6. Use Case: Shifter
   ● Save/update credit card
   ● Create/modify subscription
   ● Provide PAYG option plan to customer
   ● Analyze business (on Stripe Dashboard)
   ● etc...
   

   View Slide

7. How to use it?
   

   View Slide

8. We need to get
   the API key to
   call Stripe API
   

   View Slide

9. Publishable API Key
   ● For frontend
   ● Tokenize Card and confirm payment
   Secret API Key
   ● For backend
   ● Access & modify all resource in Stripe
   

   View Slide

10. Publishable API Key
    ● For frontend
    ● Tokenize Card and confirm payment
    Secret API Key
    ● For backend
    ● Access & modify all resource in Stripe
    

    View Slide

11. “Restricted API Key”
    -> Custom API key
    -> Custom policy
    

    View Slide

12. Use API Key to
    init Client
    

    View Slide

13. And call
    Stripe API
    

    View Slide

14. ● Stripe Secret API key is critical
    ● We can access&modify real customer data
    ● We need to hold it secure
    

    View Slide

15. AWS can hold
    the API key security
    

    View Slide

16. https://aws.amazon.com/secrets-manager/
    

    View Slide

17. View Slide

18. View Slide

19. ● We never place API key on our local
    ● Just call AWS API to get it
    ● Set once, only read
    

    View Slide

20. Amplify CLI supports AWS Secrets Manager (and SSM)
    

    View Slide

21. Automatically generate a code to get the env value
    

    View Slide

22. ● Secrets Manager can handle API key
    secure
    ● AWS Amplify can use this from CLI
    ● Stripe with AWS is good for developer
    ● Let’s create your own SaaS bussiness !
    

    View Slide

23. Info &
    Community
    

    View Slide

24. Official Docs & Tutorial
    https://stripe.dev
    Japanese Community
    https://www.facebook.com/groups/jpstripes
    Discord
    https://discord.com/invite/stripe
    

    View Slide

25. https://qiita.com/advent-calendar/2021/stripe
    

    View Slide

26. https://stripe.events/jpdevguides
    

    View Slide

27. Thanks!
    

    View Slide