CloudFront の managed prefix list が羨ましかったから Cloudflare の prefix list 作った

Cloudflare は、ユーザーから Cloudflare までの経路は守ってくれますが、Cloudflare サーバーからオリジンへの通信は自己防御しなくてはいけません。

AWS の EC2, ECS などで管理しているオリジンで、Cloudflare からだけの HTTP(S) 通信を許可したい場合があります。

AWS が CloudFront の managed prefix list を用意している様に、Cloudflare のエッジ IP を定期的に確認し、AWS VPC の managed prefix list を自動的に更新してくれる Lambda 関数を作成してみました。

https://github.com/katzueno/lambda-update-cloudflare-ip-ranges

Transcript

1. Meetup Nagoya Meetup Nagoya $MPVE'SPOU
   ͷ
   NBOBHFE
   QSF fi Y
   MJTU
   ͕ત·͔͔ͬͨ͠Β 
 $MPVE fl BSF
   ͷ
   QSF fi Y
   MJTU
   ࡞ͬͨ -BNCEB
   
   &WFOU#SJEHF
   Ͱఆظߋ৽ 1
2. Meetup Nagoya Meetup Nagoya ຊ೔ͷΞδΣϯμ wഎܠɿͳͥ
   NBOBHFE
   QSF fi Y
   MJTU
   ͳͷ͔ʁ
   w࡞ͬͨ
   -BNCEB
   ؔ਺ͷ঺հ
   w%FNP 2
3. Meetup Nagoya Meetup Nagoya 3 Katz Ueno (Χπ - ্໺উ೭) Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢ 
 Cloudflare ྺ12೥ 
 SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰ ޷͖ͳ৯΂෺: ΧϨʔ 🍛 झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞ 
 ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) / 
 AWS SAA (2017~) SAP (2023~)
4. Meetup Nagoya Meetup Nagoya 4
5. Meetup Nagoya Meetup Nagoya ᙱ͍ͱ͜Ζʹख͕ಧ͘
   $MPVE fl BSF
   
   "84
   4
   Ͱख࣋ͪυϝΠϯΛ 
 ָʹӡ༻͢Δ
   5*14 5 ຊ౰ͷݩͷλΠτϧ
6. Meetup Nagoya Meetup Nagoya ؆୯ʹ͍͏ͱ ύʔΫυϝΠϯ
   సૹͱϝʔϧ
   Λ
   $MPVE fl BSF
   
   
   "84
   4
   ͷϦμΠϨΫτ ػೳ
   ্ݶϧʔϧ
   
   w (9999F
   %PNBJO
   ച٫ͷෆ҆
   w $MPVE fl BSF
   ͷυϝΠϯ͸Է஋Ձ֨
   w υϝΠϯΛ
   $MPVE fl BSF
   ʹҠ؅͍ͨ͠
   w $MPVE fl BSF
   
   "84
   4
   Ͱ
   $MPVE'SPOU
   ͷ൥Θ͍͠ઃఆແ͠Ͱ 
 ੩తαΠτΛ݄ചΕΔ
   w $MPVE fl BSF
   
   "84
   4
   ͷϦμΠϨΫτͱ
   $MPVE fl BSF
   &NBJM
   3PVUJOH
   ͰύʔΫυϝΠϯͰ͖Δʂ 6
7. Meetup Nagoya Meetup Nagoya ؆୯ʹ͍͏ͱ ύʔΫυϝΠϯ
   సૹͱϝʔϧ
   Λ
   $MPVE fl BSF
   
   
   "84
   4
   ͷϦμΠϨΫτ ػೳ
   ্ݶϧʔϧ
   
   w (9999F
   %PNBJO
   ച٫ͷෆ҆
   w $MPVE fl BSF
   ͷυϝΠϯ͸Է஋Ձ֨
   w υϝΠϯΛ
   $MPVE fl BSF
   ʹҠ؅͍ͨ͠
   w $MPVE fl BSF
   
   "84
   4
   Ͱ
   $MPVE'SPOU
   ͷ൥Θ͍͠ઃఆແ͠Ͱ 
 ੩తαΠτΛ݄ചΕΔ
   w $MPVE fl BSF
   
   "84
   4
   ͷϦμΠϨΫτͱ
   $MPVE fl BSF
   &NBJM
   3PVUJOH
   ͰύʔΫυϝΠϯͰ͖Δʂ 7 ଞ
   ػձ͋Ε͹ɺ·ͩ࣍ճʹ
8. Meetup Nagoya Meetup Nagoya ΜͰʂຊ୊ 8
9. Meetup Nagoya Meetup Nagoya ͳ͔ͥͱ͍͏ͱ 9
10. Meetup Nagoya Meetup Nagoya Ұൠత
    ͳ
    $MPVE fl BSF
    ؀ڥ 10 example.com Load Balancer Web Server
11. Meetup Nagoya Meetup Nagoya Ұൠత
    ͳ
    $MPVE fl BSF
    ؀ڥ 11 ͕͜͜कΒΕΔ example.com Load Balancer Web Server
12. Meetup Nagoya Meetup Nagoya Ұൠత
    ͳ
    $MPVE fl BSF
    ؀ڥ 12 ͕͜͜कΒΕΔ example.com Load Balancer Web Server Security Group HTTP / HTTPS: 0.0.0.0/0
13. Meetup Nagoya Meetup Nagoya ͪΐͬͱؾʹͳΔ 13 ͕͜͜कΒΕΔ Security Group HTTP / HTTPS: 0.0.0.0/0 example.com Load Balancer Web Server
14. Meetup Nagoya Meetup Nagoya ͪΐͬͱؾʹͳΔ 14 ͕͜͜कΒΕΔ Security Group HTTP / HTTPS: 0.0.0.0/0 example.com SG ͕ެ։ঢ়ଶͩͱ ύϒϦοΫ IP Ͱ ELB ΍ EC2 ʹΞΫηε͞ΕͪΌ͏ AWS ͷ IP ͸ΈΜͳ͕஌ͬͯΔ Load Balancer Web Server
15. Meetup Nagoya Meetup Nagoya ͪΐͬͱؾʹͳΔ 15 ͕͜͜कΒΕΔ Security Group HTTP / HTTPS: 0.0.0.0/0 example.com ࣮ࡍʹΞΫηεϩάͰ WordPress ͳͲ PHPπʔϧͷ੬ऑੑ߈ܸ΍ SQLΠϯδΣΫγϣϯ߈ܸ͕ IP ΞυϨε૯౰ͨΓͰ͘Δ ͳΜͱ͔͍ͨ͠ɾɾɾ
16. Meetup Nagoya Meetup Nagoya ͦ͏͍͑͹ɾɾɾ
    "84
    $MPVE'SPOU
    ͸ 16
17. Meetup Nagoya Meetup Nagoya ͦ͏͍͑͹ɾɾɾ"84
    $MPVE'SPOU
    ͸ ͍ΖΜͳํ๏Ͱ௚઀
    "84
    Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏͕͋Δ
    w $MPVE'SPOU
    ͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"84
    8"'
    Ͱ ஄͘
    w 8"'
    Ͱ
    "MMPX
    *1
    -JTU
    ΛΞοϓσʔτ͢Δ
    w "NB[PO
    NBOBHFE
    QSF fi Y
    MJTU 17
18. Meetup Nagoya Meetup Nagoya ͦ͏͍͑͹ɾɾɾ"84
    $MPVE'SPOU
    ͸ ͍ΖΜͳํ๏Ͱ௚઀
    "84
    Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏
    w $MPVE'SPOU
    ͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"84
    8"'
    Ͱ ஄͘
    w 8"'
    Ͱ
    "MMPX
    *1
    -JTU
    ΛΞοϓσʔτ͢Δ
    w "NB[PO
    NBOBHFE
    QSF fi Y
    MJTU 18
19. Meetup Nagoya Meetup Nagoya .BOBHFE
    QSF fi Y
    MJTUT w "NB[PO
    ͕
    $MPVE'SPOU
    ଞ
    ͕ར༻͍ͯ͠Δ
    *1
    ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ
    (SPVQ
    ͳͲʹར༻Ͱ͖ΔΑ͏ʹ͍ͯ͠Δ
    w *1
    ΞυϨε͕ߋ৽͞Εͯ΋
    "84
    ͕ߋ৽ͯ͘͠ΕΔ
    w $MPVE'SPOU
    ͔ΒͷΈ͔͠ɺΞΫηεͰ͖ͳ͍
    4(
    Λ࡞ΕΔʂ 19
20. Meetup Nagoya Meetup Nagoya .BOBHFE
    QSF fi Y
    MJTUT w "NB[PO
    ͕
    $MPVE'SPOU
    ଞ
    ͕ར༻͍ͯ͠Δ
    *1
    ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ
    (SPVQ
    ͳͲʹར༻Ͱ͖Δ༷ʹ͍ͯ͠Δ
    w *1
    ΞυϨε͕ߋ৽͞Εͯ΋
    "84
    ͕ߋ৽ͯ͘͠ΕΔ 20
21. Meetup Nagoya Meetup Nagoya .BOBHFE
    QSF fi Y
    MJTUT 21 Managed Pre fi x List com.amazonaws.global.cloudfront.origin-facing CloudFront ALB EC2
22. Meetup Nagoya Meetup Nagoya ͍͍ͳʔ 22
23. Meetup Nagoya Meetup Nagoya ʜΛʁ 23
24. Meetup Nagoya Meetup Nagoya $MPVE fl BSF
    ͸
    *1
    Ϧετެ։ͯ͠Δʂ
    "1*
    ܦ༝Ͱ
    +40/
    ܗࣜ΋ʂ 24
25. Meetup Nagoya Meetup Nagoya 25
26. Meetup Nagoya Meetup Nagoya 26 ຊ౰͸ tunnel ͕͋Γ·͢
27. Meetup Nagoya Meetup Nagoya ͡Όɺͭ͘Ζʂ 27
28. Meetup Nagoya Meetup Nagoya Ͱ͖ͨʂ
    ॳ
    1ZUIPO 28
29. Meetup Nagoya Meetup Nagoya 29
30. Meetup Nagoya Meetup Nagoya ΍Γํ  .BOBHFE
    QSF fi Y
    MJTUT
    ߋ৽Ͱ͖Δ
    -BNCEB
    ͷ
    *".
    3PMF
    ࡞੒
     ۭͷ
    QSF fi Y
    MJTUT
    ࡞੒
     -BNCEB
    ʹϦʔδϣϯͱ
    QSF fi Y
    MJTUT
    ͷ
    *%
    Λίϐϖͯ͠Ξοϓϩʔυ
     &WFOU#SJEHF
    Ͱఆظ࣮ߦ
    Ҏ্ 30
31. Meetup Nagoya Meetup Nagoya ΍Γํ  .BOBHFE
    QSF fi Y
    MJTUT
    ߋ৽Ͱ͖Δ
    -BNCEB
    ͷ
    *".
    3PMF
    ࡞੒
     ۭͷ
    QSF fi Y
    MJTUT
    ࡞੒
     -BNCEB
    ʹϦʔδϣϯͱ
    QSF fi Y
    MJTUT
    ͷ
    *%
    Λίϐϖͯ͠Ξοϓϩʔυ
     &WFOU#SJEHF
    Ͱఆظ࣮ߦ
    Ҏ্ 31 γϯϓϧʂ
32. Meetup Nagoya Meetup Nagoya %FNP 32
33. Meetup Nagoya Meetup Nagoya Ͱ͖ͨʂ 33 example.com Load Balancer Web Server
34. Meetup Nagoya Meetup Nagoya ࠓޙ w ࣮͸࣮ӡ༻͸·ͩɻςετˍϑΟʔυόοΫΛ͓ئ͍͠·͢
    w Τϥʔىͬͨ͜Β
    4/4
    Ͱඈ͹ͤΔ༷ʹ͍ͨ͠
    
    w ٙ໰
    Ϧετʹ
    *1
    ͕௥Ճ͞ΕΔλΠϛϯά͸ʁ
    w &WFOU#SJEHF
    ೔ճͷߋ৽Ͱେৎ෉͔ʁ 34
35. Meetup Nagoya Meetup Nagoya 35 Katz Ueno (Χπ - ্໺উ೭) Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢ 
 Cloudflare ྺ12೥ 
 SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰ ޷͖ͳ৯΂෺: ΧϨʔ 🍛 झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞ 
 ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) / 
 AWS SAA (2017~) SAP (2023~)