自由でセキュアな環境のつくりかた / Building free and secure cloud environment

Transcript

1. ࣗ༝ͰηΩϡΞͳ؀ڥͷ

   ͭ͘Γ͔ͨ
   Hokuto Hoshi
   Head of Infrastructure, Cookpad Inc.
   hokuto@cookpad.com
   

   View Slide

2. ੕ ๺ే (΄͠ ΄͘ͱ) / @kani_b
   • ΫοΫύουגࣜձࣾ

   ΠϯϑϥετϥΫνϟʔ෦ ෦௕

   ݉ ίʔϙϨʔτΤϯδχΞϦϯά෦

   ݉ ؂ࠪҕһձ ؂ࠪิॿऀ
   • SRE, ηΩϡϦςΟΤϯδχΞ
   • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)
   

   View Slide

3. https://speakerdeck.com/kanny
   

   View Slide

4. View Slide

5. Ϩγϐ਺
   ໿ສ඼
   ࠃ಺ͷ݄ؒར༻ऀ਺
   ໿ ສਓ
   

   View Slide

6. ରԠݴޠ
   ݴޠΧࠃ
   ւ֎ͷ݄ؒར༻ऀ਺
   ໿ ສਓ
   

   View Slide

7. ৽͍͠औΓ૊Έ
   • cookpadTV https://www.cookpad.tv/
   • Cookpad DO! https://cookpad.do/
   • OiCy https://oicy.cookpad.com/
   • komerco https://komer.co/
   • etc…
   

   View Slide

8. ΫοΫύουͱΫϥ΢υ
   • 2011೥ʹ DC ͔Β׬શҠߦ͠ϑϧΫϥ΢υԽ
   • ଟ͘ͷαʔϏε͕ AWS ͰՔಇ
   • Ұ෦ͷαʔϏε͸ Google Firebase ্ͰՔಇ
   

   View Slide

9. എܠ
   • ػೳɺࣄۀͳͲ৽͍͠औΓ૊ΈΛՃ଎͍ͨ͠
   

   View Slide

10. ౰࣌ͷ૊৫ߏ଄
    • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦)
    • Πϯϑϥͷ؅ཧ͸શͯΠϯϑϥ෦͕ߦ͏

    (= AWS ͷ؅ཧ͸શͯΠϯϑϥ෦)
    • AWS ʹؔ͢Δϊ΢ϋ΢͸શͯΠϯϑϥ෦ʹू໿
    • ηΩϡϦςΟରࡦ΋΄΅Πϯϑϥ෦͕ओಋ
    ࣄۀ෦
    Πϯϑϥ෦
    ࣄۀ෦ ࣄۀ෦
    

    View Slide

11. தԝ؅ཧͷݶք
    • ςετ༻Πϯελϯε΍ϦιʔεΛ࡞Δͷʹ

    Πϯϑϥ෦Ͱ࡞ۀΛߦ͏ඞཁ͕͋ͬͨ
    • ηΩϡϦςΟͷϨϏϡʔ΋
    • ʮͦ΋ͦ΋ AWS ͷྑ͞Λࡴͯ͠ΔͷͰ͸ʁʁʁʁʁʁʯ
    • αʔϏεͷ҆ఆੑ΍ηΩϡϦςΟΛଛͳΘͣʹ࣮ݱ͍ͨ͠
    

    View Slide

12. ؅ཧํ਑ͷస׵
    • ݖݶͱ੹೚Λ֤։ൃऀʹҠৡ͢Δํ޲ʹγϑτ
    • ؅ཧ͢΂͖෦෼Λ͓͑ͯ͞Ҡৡ͍ͯ͘͠
    

    View Slide

13. ։ൃऀ༻ΞΧ΢ϯτ
    • ։ൃऀͰ͋Ε͹୭Ͱ΋ࣗ༝ʹར༻Ͱ͖Δ AWS ΞΧ΢ϯτ
    • ຊ൪ͷ AWS ΞΧ΢ϯτͱ෼཭͞Ε͍ͯΔ
    • AWS IAM ͷۭؒΛ෼ׂ͢Δ͜ͱ͕Ͱ͖Δ
    • ϩάΠϯ͸ SAML ܦ༝
    

    View Slide

14. ݖݶ؅ཧ
    • ඞཁͳαʔϏεͷ Admin
    ݖݶΛ޿͘෇༩
    • “ಛఆαʔϏεͷΈڐՄ͠
    ͳ͍” ϙϦγʔ
    \
    7FSTJPO
    4UBUFNFOU
    \
    &⒎FDU"MMPX
    /PU"DUJPO
    DMPVEUSBJM
    DPOpH
    EJSFDUDPOOFDU
    SPVUF
    SPVUFEPNBJOT
    BXTQPSUBM.PEJGZ"DDPVOU
    BXTQPSUBM.PEJGZ#JMMJOH
    BXTQPSUBM.PEJGZ1BZNFOU.FUIPET
    JBN$SFBUF6TFS
    FD$SFBUF7QD
    >
    3FTPVSDF
    ^
    >
    ^
    

    View Slide

15. ϩάͷه࿥
    • CloudTrail, VPC Flow Logs
    • AWS શମͷ API ϩά΍ VPC ͷ௨৴ϩάΛه࿥Ͱ͖Δ
    • ຊ൪ΞΧ΢ϯτͷ S3 όέοτʹอ࣋
    • ϩάͷมߋ΍࡟আ͸Ͱ͖ͳ͘ͳΔ
    

    View Slide

16. ϩάͷ෼ੳ
    • Graylog ʹऔΓࠐΈ෼ੳͰ͖ΔΑ͏ʹ
    https://speakerdeck.com/mizutani/ohuisuawshuan-jing-wosekiyuritei-jian-shi-surutamefalserokushou-ji
    

    View Slide

17. AWS Config
    • EC2 ΍֤छϦιʔεͷมߋཤྺΛه࿥Ͱ͖Δ
    

    View Slide

18. ࢖͍ํ
    • Output ઌΛຊ൪ΞΧ΢ϯτ (CloudTrail ͱಉ͡) ʹηοτͯ͠༗ޮԽ
    • “͜Εมߋͨ͠ͷ୭ͩΖ͏ʁ” Λ୳͢ࡍʹར༻
    • ಛఆͷΠϯελϯε΍ηΩϡϦςΟάϧʔϓͳͲʹඥ͚ͮͯ୳ͤΔ
    ͷͰศར
    

    View Slide

19. AWS Config Rules
    • ઃఆมߋΛτϦΨͱͯ͠ lambda function ͰઃఆΛνΣοΫͰ͖Δ
    • ηΩϡϦςΟάϧʔϓͷΠϯλʔωοτղ์ͳͲΛνΣοΫ
    • Fail ͨ͠৔߹ Slack ͳͲʹ௨஌ͤ͞Δ
    • શαʔϏεରԠͯ͠΄͍͠…
    

    View Slide

20. View Slide

21. awslabs/aws-config-rules
    • ศརϨϙδτϦ
    • https://github.com/awslabs/aws-config-rules
    • Config Rules ʹ࢖͑Δ Lambda function ͕͍Ζ͍Ζ͋Δ
    • EBS ͸҉߸Խ͞Ε͍ͯΔ͔ʁ
    • IAM Ϣʔβͷ MFA ͸༗ޮԽʁ
    • etc…
    

    View Slide

22. Amazon GuardDuty
    • CloudTrail ΍ VPC FlowLog Λ෼ੳͯ͠Ξϥʔτ
    • Ξϥʔτͷྫ
    • ීஈ࢖ΘΕͳ͍ IP ͔Βͷ API ίʔϧ
    • Πϯελϯεͷ௨৴ઌ͕͍ͭ΋ͱҧ͏
    • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό
    

    View Slide

23. ΫοΫύουͰͷ࢖͍ํ
    • Ξϥʔτ͸ GitHub -> PagerDuty ܦ༝Ͱൃใ͠

    ηΩϡϦςΟνʔϜ͕؂ࢹ
    • ௐࠪ෼ੳʹ CloudTrail ΍ Config Λ࢖͏
    • ϩά͸ Graylog ʹ஝ੵ
    • ͪΐͬͱաහͳͷ͕࠷ۙͷ೰Έ
    

    View Slide

24. ωοτϫʔΫߏ੒
    • ౿Έ୆ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧ΢ϯτ) ͔Β

    VPC Peering ܦ༝Ͱ઀ଓͰ͖ΔΑ͏ʹ͢Δ
    • ౿Έ୆Λू໿ (TOTP ΍ FIDO U2F ʹ΋ରԠ͍ͯͯ͠ศར)
    • Name λάΛ࢖ͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ
    

    View Slide

25. 
    
    
    https://speakerdeck.com/kanny/machine-learning-ops-at-cookpad
    

    View Slide

26. ։ൃऀΞΧ΢ϯτͷಛ௃
    • “໰୊Λະવʹ๷͙” ͜ͱΑΓ “໰୊Λ͋ͱ͔ΒͰ΋͍͍ͷͰݕग़
    Ͱ͖Δ” ରࡦʹϑΥʔΧε
    • ΞΧ΢ϯτʹٻΊΒΕΔॊೈੑͳͲ͔Βߟ͑ͨ݁Ռ
    • AWS αʔϏεΛׂͱૉ๿ʹ࢖ͬͨߏ੒
    • ͜͏͍͏ͱ͜Ζ·ͰͰ͖ΔΑ͏ʹͳͬͨɺͱ͍͑Δ
    

    View Slide

27. ࣮ࡍͷӡ༻
    • ։ൃऀΞΧ΢ϯτ͔ΒͷΞϥʔτ͸ଟ͘͸ͳ͍ঢ়گ
    • ར༻ͷ૯ྔ͸ଟ͍
    • EC2 ΠϯελϯεΛىಈͯ͠ͷ࣮ݧ
    • AWS ৽αʔϏεͳͲͷݕূ
    

    View Slide

28. ·ͱΊ
    • ηΩϡϦςΟͱࣗ༝͞Λཱ྆ͤͨ͞։ൃ؀ڥΛͭ͘Δ࿩
    • ͍ΘΏΔ “ηΩϡϦςΟଆ” ͕Ͳ͏ߟ͑ΒΕΔ͔ʹΑͬͯ

    ࣮ݱͰ͖Δࣗ༝౓͕มΘͬͯ͘Δ
    • AWS αʔϏεΛϑϧʹ࢖ͬͯΈΔ͚ͩͰ΋ׂͱ৭ʑͰ͖Δ
    • ʮ͏ͪͰ͸͜͏͍͏ײ͡ʯͳͲ͕͋Ε͹ڭ͑ͯ΄͍͠Ͱ͢
    

    View Slide

29. PR
    

    View Slide

30. We’re Hiring!!!
    • Software Engineer (Security)
    • Software Engineer (Site Reliability)
    • ͦͷଞͷϙδγϣϯ΋͍Ζ͍Ζ͋Γ·͢
    • https://cookpad.jobs/
    

    View Slide

31. Q?
    

    View Slide