自由でセキュアな環境のつくりかた / Building free and secure cloud environment

14a602891dce5c68facca9de28340522?s=47 Hokuto Hoshi
November 08, 2018

自由でセキュアな環境のつくりかた / Building free and secure cloud environment

14a602891dce5c68facca9de28340522?s=128

Hokuto Hoshi

November 08, 2018
Tweet

Transcript

  1. ࣗ༝ͰηΩϡΞͳ؀ڥͷ
 ͭ͘Γ͔ͨ Hokuto Hoshi Head of Infrastructure, Cookpad Inc. hokuto@cookpad.com

  2. ੕ ๺ే (΄͠ ΄͘ͱ) / @kani_b • ΫοΫύουגࣜձࣾ
 ΠϯϑϥετϥΫνϟʔ෦ ෦௕


    ݉ ίʔϙϨʔτΤϯδχΞϦϯά෦
 ݉ ؂ࠪҕһձ ؂ࠪิॿऀ • SRE, ηΩϡϦςΟΤϯδχΞ • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)
  3. https://speakerdeck.com/kanny

  4. None
  5. Ϩγϐ਺ ໿ສ඼ ࠃ಺ͷ݄ؒར༻ऀ਺ ໿ ສਓ

  6. ରԠݴޠ ݴޠΧࠃ ւ֎ͷ݄ؒར༻ऀ਺ ໿ ສਓ

  7. ৽͍͠औΓ૊Έ • cookpadTV https://www.cookpad.tv/ • Cookpad DO! https://cookpad.do/ • OiCy

    https://oicy.cookpad.com/ • komerco https://komer.co/ • etc…
  8. ΫοΫύουͱΫϥ΢υ • 2011೥ʹ DC ͔Β׬શҠߦ͠ϑϧΫϥ΢υԽ • ଟ͘ͷαʔϏε͕ AWS ͰՔಇ •

    Ұ෦ͷαʔϏε͸ Google Firebase ্ͰՔಇ
  9. എܠ • ػೳɺࣄۀͳͲ৽͍͠औΓ૊ΈΛՃ଎͍ͨ͠

  10. ౰࣌ͷ૊৫ߏ଄ • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦) • Πϯϑϥͷ؅ཧ͸શͯΠϯϑϥ෦͕ߦ͏
 (=

    AWS ͷ؅ཧ͸શͯΠϯϑϥ෦) • AWS ʹؔ͢Δϊ΢ϋ΢͸શͯΠϯϑϥ෦ʹू໿ • ηΩϡϦςΟରࡦ΋΄΅Πϯϑϥ෦͕ओಋ ࣄۀ෦ Πϯϑϥ෦ ࣄۀ෦ ࣄۀ෦
  11. தԝ؅ཧͷݶք • ςετ༻Πϯελϯε΍ϦιʔεΛ࡞Δͷʹ
 Πϯϑϥ෦Ͱ࡞ۀΛߦ͏ඞཁ͕͋ͬͨ • ηΩϡϦςΟͷϨϏϡʔ΋ • ʮͦ΋ͦ΋ AWS ͷྑ͞Λࡴͯ͠ΔͷͰ͸ʁʁʁʁʁʁʯ

    • αʔϏεͷ҆ఆੑ΍ηΩϡϦςΟΛଛͳΘͣʹ࣮ݱ͍ͨ͠
  12. ؅ཧํ਑ͷస׵ • ݖݶͱ੹೚Λ֤։ൃऀʹҠৡ͢Δํ޲ʹγϑτ • ؅ཧ͢΂͖෦෼Λ͓͑ͯ͞Ҡৡ͍ͯ͘͠

  13. ։ൃऀ༻ΞΧ΢ϯτ • ։ൃऀͰ͋Ε͹୭Ͱ΋ࣗ༝ʹར༻Ͱ͖Δ AWS ΞΧ΢ϯτ • ຊ൪ͷ AWS ΞΧ΢ϯτͱ෼཭͞Ε͍ͯΔ •

    AWS IAM ͷۭؒΛ෼ׂ͢Δ͜ͱ͕Ͱ͖Δ • ϩάΠϯ͸ SAML ܦ༝
  14. ݖݶ؅ཧ • ඞཁͳαʔϏεͷ Admin ݖݶΛ޿͘෇༩ • “ಛఆαʔϏεͷΈڐՄ͠ ͳ͍” ϙϦγʔ \

    7FSTJPO  4UBUFNFOU< \ &⒎FDU"MMPX  /PU"DUJPO< DMPVEUSBJM   DPOpH   EJSFDUDPOOFDU   SPVUF   SPVUFEPNBJOT   BXTQPSUBM.PEJGZ"DDPVOU  BXTQPSUBM.PEJGZ#JMMJOH  BXTQPSUBM.PEJGZ1BZNFOU.FUIPET  JBN$SFBUF6TFS  FD$SFBUF7QD >  3FTPVSDF  ^ > ^
  15. ϩάͷه࿥ • CloudTrail, VPC Flow Logs • AWS શମͷ API

    ϩά΍ VPC ͷ௨৴ϩάΛه࿥Ͱ͖Δ • ຊ൪ΞΧ΢ϯτͷ S3 όέοτʹอ࣋ • ϩάͷมߋ΍࡟আ͸Ͱ͖ͳ͘ͳΔ
  16. ϩάͷ෼ੳ • Graylog ʹऔΓࠐΈ෼ੳͰ͖ΔΑ͏ʹ https://speakerdeck.com/mizutani/ohuisuawshuan-jing-wosekiyuritei-jian-shi-surutamefalserokushou-ji

  17. AWS Config • EC2 ΍֤छϦιʔεͷมߋཤྺΛه࿥Ͱ͖Δ

  18. ࢖͍ํ • Output ઌΛຊ൪ΞΧ΢ϯτ (CloudTrail ͱಉ͡) ʹηοτͯ͠༗ޮԽ • “͜Εมߋͨ͠ͷ୭ͩΖ͏ʁ” Λ୳͢ࡍʹར༻

    • ಛఆͷΠϯελϯε΍ηΩϡϦςΟάϧʔϓͳͲʹඥ͚ͮͯ୳ͤΔ ͷͰศར
  19. AWS Config Rules • ઃఆมߋΛτϦΨͱͯ͠ lambda function ͰઃఆΛνΣοΫͰ͖Δ • ηΩϡϦςΟάϧʔϓͷΠϯλʔωοτղ์ͳͲΛνΣοΫ

    • Fail ͨ͠৔߹ Slack ͳͲʹ௨஌ͤ͞Δ • શαʔϏεରԠͯ͠΄͍͠…
  20. None
  21. awslabs/aws-config-rules • ศརϨϙδτϦ • https://github.com/awslabs/aws-config-rules • Config Rules ʹ࢖͑Δ Lambda

    function ͕͍Ζ͍Ζ͋Δ • EBS ͸҉߸Խ͞Ε͍ͯΔ͔ʁ • IAM Ϣʔβͷ MFA ͸༗ޮԽʁ • etc…
  22. Amazon GuardDuty • CloudTrail ΍ VPC FlowLog Λ෼ੳͯ͠Ξϥʔτ • Ξϥʔτͷྫ

    • ීஈ࢖ΘΕͳ͍ IP ͔Βͷ API ίʔϧ • Πϯελϯεͷ௨৴ઌ͕͍ͭ΋ͱҧ͏ • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό
  23. ΫοΫύουͰͷ࢖͍ํ • Ξϥʔτ͸ GitHub -> PagerDuty ܦ༝Ͱൃใ͠
 ηΩϡϦςΟνʔϜ͕؂ࢹ • ௐࠪ෼ੳʹ

    CloudTrail ΍ Config Λ࢖͏ • ϩά͸ Graylog ʹ஝ੵ • ͪΐͬͱաහͳͷ͕࠷ۙͷ೰Έ
  24. ωοτϫʔΫߏ੒ • ౿Έ୆ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧ΢ϯτ) ͔Β
 VPC Peering

    ܦ༝Ͱ઀ଓͰ͖ΔΑ͏ʹ͢Δ • ౿Έ୆Λू໿ (TOTP ΍ FIDO U2F ʹ΋ରԠ͍ͯͯ͠ศར) • Name λάΛ࢖ͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ
  25.    https://speakerdeck.com/kanny/machine-learning-ops-at-cookpad

  26. ։ൃऀΞΧ΢ϯτͷಛ௃ • “໰୊Λະવʹ๷͙” ͜ͱΑΓ “໰୊Λ͋ͱ͔ΒͰ΋͍͍ͷͰݕग़ Ͱ͖Δ” ରࡦʹϑΥʔΧε • ΞΧ΢ϯτʹٻΊΒΕΔॊೈੑͳͲ͔Βߟ͑ͨ݁Ռ •

    AWS αʔϏεΛׂͱૉ๿ʹ࢖ͬͨߏ੒ • ͜͏͍͏ͱ͜Ζ·ͰͰ͖ΔΑ͏ʹͳͬͨɺͱ͍͑Δ
  27. ࣮ࡍͷӡ༻ • ։ൃऀΞΧ΢ϯτ͔ΒͷΞϥʔτ͸ଟ͘͸ͳ͍ঢ়گ • ར༻ͷ૯ྔ͸ଟ͍ • EC2 ΠϯελϯεΛىಈͯ͠ͷ࣮ݧ • AWS

    ৽αʔϏεͳͲͷݕূ
  28. ·ͱΊ • ηΩϡϦςΟͱࣗ༝͞Λཱ྆ͤͨ͞։ൃ؀ڥΛͭ͘Δ࿩ • ͍ΘΏΔ “ηΩϡϦςΟଆ” ͕Ͳ͏ߟ͑ΒΕΔ͔ʹΑͬͯ
 ࣮ݱͰ͖Δࣗ༝౓͕มΘͬͯ͘Δ • AWS

    αʔϏεΛϑϧʹ࢖ͬͯΈΔ͚ͩͰ΋ׂͱ৭ʑͰ͖Δ • ʮ͏ͪͰ͸͜͏͍͏ײ͡ʯͳͲ͕͋Ε͹ڭ͑ͯ΄͍͠Ͱ͢
  29. PR

  30. We’re Hiring!!! • Software Engineer (Security) • Software Engineer (Site

    Reliability) • ͦͷଞͷϙδγϣϯ΋͍Ζ͍Ζ͋Γ·͢ • https://cookpad.jobs/
  31. Q?