CloudFront の managed prefix list が羨ましかったから Cloudflare の prefix list 作った

Cloudflare は、ユーザーから Cloudflare までの経路は守ってくれますが、Cloudflare サーバーからオリジンへの通信は自己防御しなくてはいけません。

AWS の EC2, ECS などで管理しているオリジンで、Cloudflare からだけの HTTP(S) 通信を許可したい場合があります。

AWS が CloudFront の managed prefix list を用意している様に、Cloudflare のエッジ IP を定期的に確認し、AWS VPC の managed prefix list を自動的に更新してくれる Lambda 関数を作成してみました。

https://github.com/katzueno/lambda-update-cloudflare-ip-ranges

Transcript

1. Meetup Nagoya
   Meetup Nagoya
   $MPVE'SPOUͷ
   NBOBHFEQSF
   fi
   YMJTU͕ત·͔͔ͬͨ͠Β
   

   $MPVE
   fl
   BSFͷQSF
   fi
   YMJTU࡞ͬͨ
   -BNCEB&WFOU#SJEHFͰఆظߋ৽
   1
   

   View Slide

2. Meetup Nagoya
   Meetup Nagoya
   ຊ೔ͷΞδΣϯμ
   wഎܠɿͳͥNBOBHFEQSF
   fi
   YMJTUͳͷ͔ʁ
   w࡞ͬͨ-BNCEBؔ਺ͷ঺հ
   w%FNP
   2
   

   View Slide

3. Meetup Nagoya
   Meetup Nagoya
   3
   Katz Ueno (Χπ - ্໺উ೭)
   Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢
   

   Cloudflare ྺ12೥
   

   SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com
   
   
   ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰
   
   
   ޷͖ͳ৯΂෺:
   ΧϨʔ 🍛
   
   
   झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞
   

   ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) /
   

   AWS SAA (2017~) SAP (2023~)
   
   
   

   View Slide

4. Meetup Nagoya
   Meetup Nagoya
   4
   

   View Slide

5. Meetup Nagoya
   Meetup Nagoya
   ᙱ͍ͱ͜Ζʹख͕ಧ͘$MPVE
   fl
   BSF
   "844Ͱख࣋ͪυϝΠϯΛ
   

   ָʹӡ༻͢Δ5*14
   5
   ຊ౰ͷݩͷλΠτϧ
   

   View Slide

6. Meetup Nagoya
   Meetup Nagoya
   ؆୯ʹ͍͏ͱ
   ύʔΫυϝΠϯ సૹͱϝʔϧ
   Λ$MPVE
   fl
   BSF"844ͷϦμΠϨΫτ
   ػೳ ্ݶϧʔϧ
   
   w (9999F%PNBJOച٫ͷෆ҆
   w $MPVE
   fl
   BSFͷυϝΠϯ͸Է஋Ձ֨
   w υϝΠϯΛ$MPVE
   fl
   BSFʹҠ؅͍ͨ͠
   w $MPVE
   fl
   BSF"844Ͱ$MPVE'SPOUͷ൥Θ͍͠ઃఆແ͠Ͱ
   

   ੩తαΠτΛ݄ചΕΔ
   w $MPVE
   fl
   BSF"844ͷϦμΠϨΫτͱ$MPVE
   fl
   BSF&NBJM3PVUJOHͰύʔΫυϝΠϯͰ͖Δʂ
   6
   

   View Slide

7. Meetup Nagoya
   Meetup Nagoya
   ؆୯ʹ͍͏ͱ
   ύʔΫυϝΠϯ సૹͱϝʔϧ
   Λ$MPVE
   fl
   BSF"844ͷϦμΠϨΫτ
   ػೳ ্ݶϧʔϧ
   
   w (9999F%PNBJOച٫ͷෆ҆
   w $MPVE
   fl
   BSFͷυϝΠϯ͸Է஋Ձ֨
   w υϝΠϯΛ$MPVE
   fl
   BSFʹҠ؅͍ͨ͠
   w $MPVE
   fl
   BSF"844Ͱ$MPVE'SPOUͷ൥Θ͍͠ઃఆແ͠Ͱ
   

   ੩తαΠτΛ݄ചΕΔ
   w $MPVE
   fl
   BSF"844ͷϦμΠϨΫτͱ$MPVE
   fl
   BSF&NBJM3PVUJOHͰύʔΫυϝΠϯͰ͖Δʂ
   7
   ଞ
   ػձ͋Ε͹ɺ·ͩ࣍ճʹ
   

   View Slide

8. Meetup Nagoya
   Meetup Nagoya
   ΜͰʂຊ୊
   8
   

   View Slide

9. Meetup Nagoya
   Meetup Nagoya
   ͳ͔ͥͱ͍͏ͱ
   9
   

   View Slide

10. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    10
    example.com
    Load
    Balancer
    Web Server
    

    View Slide

11. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    11
    ͕͜͜कΒΕΔ
    example.com
    Load
    Balancer
    Web Server
    

    View Slide

12. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    12
    ͕͜͜कΒΕΔ
    example.com
    Load
    Balancer
    Web Server
    Security Group
    
    
    HTTP / HTTPS: 0.0.0.0/0
    

    View Slide

13. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    13
    ͕͜͜कΒΕΔ Security Group
    
    
    HTTP / HTTPS: 0.0.0.0/0
    example.com
    Load
    Balancer
    Web Server
    

    View Slide

14. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    14
    ͕͜͜कΒΕΔ Security Group
    
    
    HTTP / HTTPS: 0.0.0.0/0
    example.com
    SG ͕ެ։ঢ়ଶͩͱ
    
    
    ύϒϦοΫ IP Ͱ
    
    
    ELB ΍ EC2 ʹΞΫηε͞ΕͪΌ͏
    
    
    AWS ͷ IP ͸ΈΜͳ͕஌ͬͯΔ
    Load
    Balancer
    Web Server
    

    View Slide

15. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    15
    ͕͜͜कΒΕΔ Security Group
    
    
    HTTP / HTTPS: 0.0.0.0/0
    example.com
    ࣮ࡍʹΞΫηεϩάͰ WordPress ͳͲ
    
    
    PHPπʔϧͷ੬ऑੑ߈ܸ΍ SQLΠϯδΣΫγϣϯ߈ܸ͕
    
    
    IP ΞυϨε૯౰ͨΓͰ͘Δ
    
    
    ͳΜͱ͔͍ͨ͠ɾɾɾ
    

    View Slide

16. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ
    "84$MPVE'SPOU͸
    16
    

    View Slide

17. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ"84$MPVE'SPOU͸
    ͍ΖΜͳํ๏Ͱ௚઀"84Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏͕͋Δ
    w $MPVE'SPOUͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"848"'Ͱ
    ஄͘
    w 8"'Ͱ"MMPX*1-JTUΛΞοϓσʔτ͢Δ
    w "NB[PONBOBHFEQSF
    fi
    YMJTU
    17
    

    View Slide

18. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ"84$MPVE'SPOU͸
    ͍ΖΜͳํ๏Ͱ௚઀"84Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏
    w $MPVE'SPOUͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"848"'Ͱ
    ஄͘
    w 8"'Ͱ"MMPX*1-JTUΛΞοϓσʔτ͢Δ
    w "NB[PONBOBHFEQSF
    fi
    YMJTU
    18
    

    View Slide

19. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    w "NB[PO͕$MPVE'SPOU ଞ
    ͕ར༻͍ͯ͠Δ*1ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ(SPVQͳͲʹར༻Ͱ͖ΔΑ͏ʹ͍ͯ͠Δ
    w *1ΞυϨε͕ߋ৽͞Εͯ΋"84͕ߋ৽ͯ͘͠ΕΔ
    w $MPVE'SPOU͔ΒͷΈ͔͠ɺΞΫηεͰ͖ͳ͍4(Λ࡞ΕΔʂ
    19
    

    View Slide

20. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    w "NB[PO͕$MPVE'SPOU ଞ
    ͕ར༻͍ͯ͠Δ*1ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ(SPVQͳͲʹར༻Ͱ͖Δ༷ʹ͍ͯ͠Δ
    w *1ΞυϨε͕ߋ৽͞Εͯ΋"84͕ߋ৽ͯ͘͠ΕΔ
    20
    

    View Slide

21. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    21
    Managed Pre
    fi
    x List
    com.amazonaws.global.cloudfront.origin-facing
    CloudFront ALB EC2
    

    View Slide

22. Meetup Nagoya
    Meetup Nagoya
    ͍͍ͳʔ
    22
    

    View Slide

23. Meetup Nagoya
    Meetup Nagoya
    ʜΛʁ
    23
    

    View Slide

24. Meetup Nagoya
    Meetup Nagoya
    $MPVE
    fl
    BSF͸*1Ϧετެ։ͯ͠Δʂ
    "1*ܦ༝Ͱ+40/ܗࣜ΋ʂ
    24
    

    View Slide

25. Meetup Nagoya
    Meetup Nagoya
    25
    

    View Slide

26. Meetup Nagoya
    Meetup Nagoya
    26
    ຊ౰͸ tunnel ͕͋Γ·͢
    

    View Slide

27. Meetup Nagoya
    Meetup Nagoya
    ͡Όɺͭ͘Ζʂ
    27
    

    View Slide

28. Meetup Nagoya
    Meetup Nagoya
    Ͱ͖ͨʂ
    ॳ1ZUIPO
    28
    

    View Slide

29. Meetup Nagoya
    Meetup Nagoya
    29
    

    View Slide

30. Meetup Nagoya
    Meetup Nagoya
    ΍Γํ
    .BOBHFEQSF
    fi
    YMJTUTߋ৽Ͱ͖Δ-BNCEBͷ*".3PMF࡞੒
    ۭͷQSF
    fi
    YMJTUT࡞੒
    -BNCEBʹϦʔδϣϯͱQSF
    fi
    YMJTUTͷ*%Λίϐϖͯ͠Ξοϓϩʔυ
    &WFOU#SJEHFͰఆظ࣮ߦ
    Ҏ্
    30
    

    View Slide

31. Meetup Nagoya
    Meetup Nagoya
    ΍Γํ
    .BOBHFEQSF
    fi
    YMJTUTߋ৽Ͱ͖Δ-BNCEBͷ*".3PMF࡞੒
    ۭͷQSF
    fi
    YMJTUT࡞੒
    -BNCEBʹϦʔδϣϯͱQSF
    fi
    YMJTUTͷ*%Λίϐϖͯ͠Ξοϓϩʔυ
    &WFOU#SJEHFͰఆظ࣮ߦ
    Ҏ্
    31
    γϯϓϧʂ
    

    View Slide

32. Meetup Nagoya
    Meetup Nagoya
    %FNP
    32
    

    View Slide

33. Meetup Nagoya
    Meetup Nagoya
    Ͱ͖ͨʂ
    33
    example.com
    Load
    Balancer
    Web Server
    

    View Slide

34. Meetup Nagoya
    Meetup Nagoya
    ࠓޙ
    w ࣮͸࣮ӡ༻͸·ͩɻςετˍϑΟʔυόοΫΛ͓ئ͍͠·͢
    w Τϥʔىͬͨ͜Β4/4Ͱඈ͹ͤΔ༷ʹ͍ͨ͠
    w ٙ໰Ϧετʹ*1͕௥Ճ͞ΕΔλΠϛϯά͸ʁ
    w &WFOU#SJEHF೔ճͷߋ৽Ͱେৎ෉͔ʁ
    34
    

    View Slide

35. Meetup Nagoya
    Meetup Nagoya
    35
    Katz Ueno (Χπ - ্໺উ೭)
    Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢
    

    Cloudflare ྺ12೥
    

    SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com
    
    
    ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰
    
    
    ޷͖ͳ৯΂෺:
    ΧϨʔ 🍛
    
    
    झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞
    

    ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) /
    

    AWS SAA (2017~) SAP (2023~)
    

    View Slide