$30 off During Our Annual Pro Sale. View Details »

CloudFront の managed prefix list が羨ましかったから Cloudflare の prefix list 作った

Katz Ueno
August 01, 2023

CloudFront の managed prefix list が羨ましかったから Cloudflare の prefix list 作った

Cloudflare は、ユーザーから Cloudflare までの経路は守ってくれますが、Cloudflare サーバーからオリジンへの通信は自己防御しなくてはいけません。

AWS の EC2, ECS などで管理しているオリジンで、Cloudflare からだけの HTTP(S) 通信を許可したい場合があります。

AWS が CloudFront の managed prefix list を用意している様に、Cloudflare のエッジ IP を定期的に確認し、AWS VPC の managed prefix list を自動的に更新してくれる Lambda 関数を作成してみました。

https://github.com/katzueno/lambda-update-cloudflare-ip-ranges

Katz Ueno

August 01, 2023
Tweet

More Decks by Katz Ueno

Other Decks in Programming

Transcript

  1. Meetup Nagoya
    Meetup Nagoya
    $MPVE'SPOUͷ
    NBOBHFEQSF
    fi
    YMJTU͕ત·͔͔ͬͨ͠Β

    $MPVE
    fl
    BSFͷQSF
    fi
    YMJTU࡞ͬͨ
    -BNCEB&WFOU#SJEHFͰఆظߋ৽
    1

    View Slide

  2. Meetup Nagoya
    Meetup Nagoya
    ຊ೔ͷΞδΣϯμ
    wഎܠɿͳͥNBOBHFEQSF
    fi
    YMJTUͳͷ͔ʁ
    w࡞ͬͨ-BNCEBؔ਺ͷ঺հ
    w%FNP
    2

    View Slide

  3. Meetup Nagoya
    Meetup Nagoya
    3
    Katz Ueno (Χπ - ্໺উ೭)
    Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢

    Cloudflare ྺ12೥

    SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com


    ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰


    ޷͖ͳ৯΂෺:
    ΧϨʔ 🍛


    झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞

    ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) /

    AWS SAA (2017~) SAP (2023~)


    View Slide

  4. Meetup Nagoya
    Meetup Nagoya
    4

    View Slide

  5. Meetup Nagoya
    Meetup Nagoya
    ᙱ͍ͱ͜Ζʹख͕ಧ͘$MPVE
    fl
    BSF
    "844Ͱख࣋ͪυϝΠϯΛ

    ָʹӡ༻͢Δ5*14
    5
    ຊ౰ͷݩͷλΠτϧ

    View Slide

  6. Meetup Nagoya
    Meetup Nagoya
    ؆୯ʹ͍͏ͱ
    ύʔΫυϝΠϯ సૹͱϝʔϧ
    Λ$MPVE
    fl
    BSF"844ͷϦμΠϨΫτ
    ػೳ ্ݶϧʔϧ

    w (9999F%PNBJOച٫ͷෆ҆
    w $MPVE
    fl
    BSFͷυϝΠϯ͸Է஋Ձ֨
    w υϝΠϯΛ$MPVE
    fl
    BSFʹҠ؅͍ͨ͠
    w $MPVE
    fl
    BSF"844Ͱ$MPVE'SPOUͷ൥Θ͍͠ઃఆແ͠Ͱ

    ੩తαΠτΛ݄ചΕΔ
    w $MPVE
    fl
    BSF"844ͷϦμΠϨΫτͱ$MPVE
    fl
    BSF&NBJM3PVUJOHͰύʔΫυϝΠϯͰ͖Δʂ
    6

    View Slide

  7. Meetup Nagoya
    Meetup Nagoya
    ؆୯ʹ͍͏ͱ
    ύʔΫυϝΠϯ సૹͱϝʔϧ
    Λ$MPVE
    fl
    BSF"844ͷϦμΠϨΫτ
    ػೳ ্ݶϧʔϧ

    w (9999F%PNBJOച٫ͷෆ҆
    w $MPVE
    fl
    BSFͷυϝΠϯ͸Է஋Ձ֨
    w υϝΠϯΛ$MPVE
    fl
    BSFʹҠ؅͍ͨ͠
    w $MPVE
    fl
    BSF"844Ͱ$MPVE'SPOUͷ൥Θ͍͠ઃఆແ͠Ͱ

    ੩తαΠτΛ݄ചΕΔ
    w $MPVE
    fl
    BSF"844ͷϦμΠϨΫτͱ$MPVE
    fl
    BSF&NBJM3PVUJOHͰύʔΫυϝΠϯͰ͖Δʂ
    7

    ػձ͋Ε͹ɺ·ͩ࣍ճʹ

    View Slide

  8. Meetup Nagoya
    Meetup Nagoya
    ΜͰʂຊ୊
    8

    View Slide

  9. Meetup Nagoya
    Meetup Nagoya
    ͳ͔ͥͱ͍͏ͱ
    9

    View Slide

  10. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    10
    example.com
    Load
    Balancer
    Web Server

    View Slide

  11. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    11
    ͕͜͜कΒΕΔ
    example.com
    Load
    Balancer
    Web Server

    View Slide

  12. Meetup Nagoya
    Meetup Nagoya
    Ұൠత
    ͳ$MPVE
    fl
    BSF؀ڥ
    12
    ͕͜͜कΒΕΔ
    example.com
    Load
    Balancer
    Web Server
    Security Group


    HTTP / HTTPS: 0.0.0.0/0

    View Slide

  13. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    13
    ͕͜͜कΒΕΔ Security Group


    HTTP / HTTPS: 0.0.0.0/0
    example.com
    Load
    Balancer
    Web Server

    View Slide

  14. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    14
    ͕͜͜कΒΕΔ Security Group


    HTTP / HTTPS: 0.0.0.0/0
    example.com
    SG ͕ެ։ঢ়ଶͩͱ


    ύϒϦοΫ IP Ͱ


    ELB ΍ EC2 ʹΞΫηε͞ΕͪΌ͏


    AWS ͷ IP ͸ΈΜͳ͕஌ͬͯΔ
    Load
    Balancer
    Web Server

    View Slide

  15. Meetup Nagoya
    Meetup Nagoya
    ͪΐͬͱؾʹͳΔ
    15
    ͕͜͜कΒΕΔ Security Group


    HTTP / HTTPS: 0.0.0.0/0
    example.com
    ࣮ࡍʹΞΫηεϩάͰ WordPress ͳͲ


    PHPπʔϧͷ੬ऑੑ߈ܸ΍ SQLΠϯδΣΫγϣϯ߈ܸ͕


    IP ΞυϨε૯౰ͨΓͰ͘Δ


    ͳΜͱ͔͍ͨ͠ɾɾɾ

    View Slide

  16. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ
    "84$MPVE'SPOU͸
    16

    View Slide

  17. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ"84$MPVE'SPOU͸
    ͍ΖΜͳํ๏Ͱ௚઀"84Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏͕͋Δ
    w $MPVE'SPOUͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"848"'Ͱ
    ஄͘
    w 8"'Ͱ"MMPX*1-JTUΛΞοϓσʔτ͢Δ
    w "NB[PONBOBHFEQSF
    fi
    YMJTU
    17

    View Slide

  18. Meetup Nagoya
    Meetup Nagoya
    ͦ͏͍͑͹ɾɾɾ"84$MPVE'SPOU͸
    ͍ΖΜͳํ๏Ͱ௚઀"84Ϧιʔε΁ͷ௚઀ΞΫηεΛ๷͙ํ๏
    w $MPVE'SPOUͰΧελϜϔομʔ෇༩ɺҎ֎ͷΞΫηεΛ"848"'Ͱ
    ஄͘
    w 8"'Ͱ"MMPX*1-JTUΛΞοϓσʔτ͢Δ
    w "NB[PONBOBHFEQSF
    fi
    YMJTU
    18

    View Slide

  19. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    w "NB[PO͕$MPVE'SPOU ଞ
    ͕ར༻͍ͯ͠Δ*1ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ(SPVQͳͲʹར༻Ͱ͖ΔΑ͏ʹ͍ͯ͠Δ
    w *1ΞυϨε͕ߋ৽͞Εͯ΋"84͕ߋ৽ͯ͘͠ΕΔ
    w $MPVE'SPOU͔ΒͷΈ͔͠ɺΞΫηεͰ͖ͳ͍4(Λ࡞ΕΔʂ
    19

    View Slide

  20. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    w "NB[PO͕$MPVE'SPOU ଞ
    ͕ར༻͍ͯ͠Δ*1ΞυϨεҰཡΛϦετԽ
    w 4FDVSJUZ(SPVQͳͲʹར༻Ͱ͖Δ༷ʹ͍ͯ͠Δ
    w *1ΞυϨε͕ߋ৽͞Εͯ΋"84͕ߋ৽ͯ͘͠ΕΔ
    20

    View Slide

  21. Meetup Nagoya
    Meetup Nagoya
    .BOBHFEQSF
    fi
    YMJTUT
    21
    Managed Pre
    fi
    x List
    com.amazonaws.global.cloudfront.origin-facing
    CloudFront ALB EC2

    View Slide

  22. Meetup Nagoya
    Meetup Nagoya
    ͍͍ͳʔ
    22

    View Slide

  23. Meetup Nagoya
    Meetup Nagoya
    ʜΛʁ
    23

    View Slide

  24. Meetup Nagoya
    Meetup Nagoya
    $MPVE
    fl
    BSF͸*1Ϧετެ։ͯ͠Δʂ
    "1*ܦ༝Ͱ+40/ܗࣜ΋ʂ
    24

    View Slide

  25. Meetup Nagoya
    Meetup Nagoya
    25

    View Slide

  26. Meetup Nagoya
    Meetup Nagoya
    26
    ຊ౰͸ tunnel ͕͋Γ·͢

    View Slide

  27. Meetup Nagoya
    Meetup Nagoya
    ͡Όɺͭ͘Ζʂ
    27

    View Slide

  28. Meetup Nagoya
    Meetup Nagoya
    Ͱ͖ͨʂ
    ॳ1ZUIPO
    28

    View Slide

  29. Meetup Nagoya
    Meetup Nagoya
    29

    View Slide

  30. Meetup Nagoya
    Meetup Nagoya
    ΍Γํ
    .BOBHFEQSF
    fi
    YMJTUTߋ৽Ͱ͖Δ-BNCEBͷ*".3PMF࡞੒
    ۭͷQSF
    fi
    YMJTUT࡞੒
    -BNCEBʹϦʔδϣϯͱQSF
    fi
    YMJTUTͷ*%Λίϐϖͯ͠Ξοϓϩʔυ
    &WFOU#SJEHFͰఆظ࣮ߦ
    Ҏ্
    30

    View Slide

  31. Meetup Nagoya
    Meetup Nagoya
    ΍Γํ
    .BOBHFEQSF
    fi
    YMJTUTߋ৽Ͱ͖Δ-BNCEBͷ*".3PMF࡞੒
    ۭͷQSF
    fi
    YMJTUT࡞੒
    -BNCEBʹϦʔδϣϯͱQSF
    fi
    YMJTUTͷ*%Λίϐϖͯ͠Ξοϓϩʔυ
    &WFOU#SJEHFͰఆظ࣮ߦ
    Ҏ্
    31
    γϯϓϧʂ

    View Slide

  32. Meetup Nagoya
    Meetup Nagoya
    %FNP
    32

    View Slide

  33. Meetup Nagoya
    Meetup Nagoya
    Ͱ͖ͨʂ
    33
    example.com
    Load
    Balancer
    Web Server

    View Slide

  34. Meetup Nagoya
    Meetup Nagoya
    ࠓޙ
    w ࣮͸࣮ӡ༻͸·ͩɻςετˍϑΟʔυόοΫΛ͓ئ͍͠·͢
    w Τϥʔىͬͨ͜Β4/4Ͱඈ͹ͤΔ༷ʹ͍ͨ͠
    w ٙ໰Ϧετʹ*1͕௥Ճ͞ΕΔλΠϛϯά͸ʁ
    w &WFOU#SJEHF೔ճͷߋ৽Ͱେৎ෉͔ʁ
    34

    View Slide

  35. Meetup Nagoya
    Meetup Nagoya
    35
    Katz Ueno (Χπ - ্໺উ೭)
    Concrete CMS ͱΠϯϑϥ΍ͬͯ·͢

    Cloudflare ྺ12೥

    SNS: Twitter @katzueno / Instagram @katzueno & @katzcurry / Blog: katzueno.com


    ίϛϡχςΟ Cncrete CMS Japan / CoderDojo ඌு / JAWS UG ໊ݹ԰


    ޷͖ͳ৯΂෺:
    ΧϨʔ 🍛


    झຯ: Ϛϥιϯ🏃݄ؒ400km, ंதധ, ϥΠϒ഑৴, ಈը੍࡞

    ࢿ֨: ΞϚνϡΞແઢ4ڃ (1993) / TOEIC 990 (2013) /

    AWS SAA (2017~) SAP (2023~)

    View Slide