Upgrade to Pro — share decks privately, control downloads, hide ads and more …

セキュリティインシデントを乗り越えるために行ったマルチアカウントでの取り組みについて / AWS multi-account approach in Classi

34422c5081821c9af0d5dddc673ace27?s=47 kenryooo
February 09, 2021

セキュリティインシデントを乗り越えるために行ったマルチアカウントでの取り組みについて / AWS multi-account approach in Classi

2021/02/09開催「第二回 AWSマルチアカウント事例祭り」での発表資料です。

34422c5081821c9af0d5dddc673ace27?s=128

kenryooo

February 09, 2021
Tweet

Transcript

  1. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ୈೋճ"84ϚϧνΞΧ΢ϯτࣄྫࡇΓ ηΩϡϦςΟΠϯγσϯτΛ৐Γӽ͑ΔͨΊʹߦͬͨ ϚϧνΞΧ΢ϯτͰͷऔΓ૊Έʹ͍ͭͯ $MBTTJ$PSQ,FOSZP0NJOBNJ

  2. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE $ whoami • ,FOSZP0NJOBNJ !LFOSZPPP  • ௚ۙ೥͘Β͍͸#$αʔϏεΛத৺ʹ%#"ɺαʔό αΠυΤϯδχΞɺ43&Λܦݧɻ

    • $MBTTJʹ43&ͱͯ͠δϣΠϯɻ • ͜͜਺೥͸ΠϯϑϥηΩϡϦςΟྖҬΛத৺ʹۀ຿Λ ߦ͍ͬͯΔɻ
  3. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE About Classi ʮ$MBTTJʯ͸ڭҭݱ৔Λࢧԉ͢Δ Ϋϥ΢υαʔϏε • શࠃͷߴߍͷˋ௒͕ಋೖ • ߴߍੜͷਓʹਓ͕ར༻ •

    ར༻ऀ਺ສਓ௒ • ઌੜɺੜెɺอޢऀ͕ܨ͕Δ ֶशࢧԉϓϥοτϑΥʔϜ
  4. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ࿩͞ͳ͍͜ͱ • ೥݄ɺ݄ͷߴෛՙʹΑΔΞΫηεো֐ঢ়ଶʹؔ͢ΔऔΓ૊Έʹ͍ͭͯ • ͪ͜Βʹ͍ͭͯ͸ԼهΛ͝ཡ͍ͩ͘͞ • $MBTTJ։ൃऀϒϩά IUUQTUFDIDMBTTJKQ 

    • %FWFMPQFST4VNNJU
  5. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE [PR] Developers Summit 2021 IUUQTFWFOUTIPFJTIBKQEFWTVNJTFTTJPO

  6. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  7. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  8. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ηΩϡϦςΟΠϯγσϯτʹ͍ͭͯ  4VO  4BU  ֎෦ͷ߈ܸऀ͔Βෆਖ਼ΞΫηεΛड͚αʔϏεఀࢭ αʔϏε͸਺࣌ؒޙʹ෮چͰ͖ͨ΋ͷͷϢʔβʔ৘ใྲྀग़ͷՄೳੑΛ֬ೝ ͢΂ͯͷϢʔβʔͷύεϫʔυมߋ͕׬ྃ

    ֎෦αΠτʹͯɺྲྀग़ͨ͠ݸਓ৘ใͷ࿙ӮΛ֬ೝ ΠϯϑϥɺΞϓϦέʔγϣϯͱ΋ʹൈຊతͳηΩϡϦςΟͷݟ௚͠Λ࣮ࢪ
  9. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  10. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ઓུͱධՁ • શମͷઓུ • "848FMM"SDIJUFDUFE'SBNFXPSL4FDVSJUZ1JMMBS • "84ΞΧ΢ϯτ؅ཧͷઓུ • #FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOT

    • ηΩϡϦςΟධՁ • "84ϓϩϑΣογϣφϧαʔϏεͷηΩϡϦςΟධՁ
  11. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  12. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Classi Organizations -Before- 0SHBOJ[BUJPOT 3PPU 1SPEVDUJPOΞΧ΢ϯτ ؅ཧΞΧ΢ϯτ "[VSF"% #BTUJPOΞΧ΢ϯτ

    ։ൃ༻ΞΧ΢ϯτ ࿈ܞαʔϏε༻ 1SPEVDUJPOΞΧ΢ϯτ 4XJUDI3PMF -PH*O
  13. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ໰୊఺ • 064$1Λར༻͍ͯ͠ͳ͍ • 1SPEVDUJPOΞΧ΢ϯτ͕0SHBOJ[BUJPOͷ؅ཧΞΧ΢ϯτͱͯ͠ઃఆ • ࠷΋ݫີʹ؅ཧ͍ͨ͠͸ͣͷΞΧ΢ϯτ͕؅ཧͰ͖ͳ͍ • #BTUJPOΞΧ΢ϯτ͸ɺ։ൃऀ͕4BOECPY؀ڥͱͯ͠΋ར༻

    • 1SPEVDUJPOΞΧ΢ϯτ΁ϩάΠϯ͢ΔݩͷΞΧ΢ϯτ͕ηΩϡΞͰ͸ͳ͍
  14. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • ؅ཧΞΧ΢ϯτͷ੾Γସ͑ • ؅ཧΞΧ΢ϯτΛ৽ن࡞੒ • طଘΞΧ΢ϯτ͸چ૊৫Λ཭୤ɺ՝ۚपΓͷઃఆΛ௥Ճ͠৽૊৫΁Ҡಈ େมʜ 

    • 0SHBOJ[BUJPOTಋೖ࣌͸৽نʹ؅ཧΞΧ΢ϯτΛ࡞Γ·͠ΐ͏ʂ • 06ઃܭͱ഑ஔ • ʮ#FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOTʯ
  15. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Classi Organizations -After- 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06 *OGSB@06

    .BJOUFOBODF@06 4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY #FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOT IUUQTBXTBNB[PODPNKQCMPHTNUCFTUQSBDUJDFTGPSPSHBOJ[BUJPOBMVOJUTXJUIBXTPSHBOJ[BUJPOT
  16. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organiztional Units 06 ༻్ 'PVOEBUJPOBM@06 1SPE4%-$ͷϫʔΫϩʔυͱڞ௨ج൫Λ಺แ͢Δ06 8PSLMPBET@06 1SPE4%-$ͷϫʔΫϩʔυΛ಺แ͢Δ06 1SPE@06

    ຊ൪ΞΧ΢ϯτͷΈΛ಺แ͢Δ06 4%-$@06 4UBHJOH΍%FWɺ4BOECPYͳͲΛ಺แ͢Δ06 *OGSB@06 ڞ௨ج൫ ϩάू໿ΞΧ΢ϯτ΍ηΩϡϦςΟ؂ࠪΞΧ΢ϯτ Λ಺แ͢Δ06 1PMJDZ4UBHJOH@06 ૊৫ߏ଄ͷมߋ΍4$1ͷมߋͳͲͷݕূͰར༻͢Δ06 .BJOUFOBODF@06 ؂ࠪܥػೳͷϝϯςφϯεͳͲɺҰ࣌తʹ4$1Λҳ୤͢Δ࡞ۀΛߦ͏৔߹ʹར༻͢Δ06 4VTQFOEFE@06 ഇغ༧ఆͷ"84ΞΧ΢ϯτΛ಺แ͢Δ06
  17. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  18. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE IDͱΞΫηε؅ཧ -Before- 0SHBOJ[BUJPOT 3PPU 1SPEVDUJPOΞΧ΢ϯτ ؅ཧΞΧ΢ϯτ "[VSF"% #BTUJPOΞΧ΢ϯτ ։ൃ༻ΞΧ΢ϯτ

    ࿈ܞαʔϏε༻ 1SPEVDUJPOΞΧ΢ϯτ 4XJUDI3PMF -PH*O Ϛωδϝϯτίϯιʔϧར༻ ֤"84ΞΧ΢ϯτͰݸผʹΞΫηεΩʔΛൃߦ
  19. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE IDͱΞΫηε؅ཧ -Before- • ։ൃऀ޲͚ʹҎԼͷ௨ΓͰΞΫηεํ๏Λఏڙ • ϚωδϝϯτίϯιʔϧͰͷར༻ • ϩάΠϯํ๏(4VJUFͱ4".-࿈ܞ •

    #BTUJPOΞΧ΢ϯτΛܦͯɺ࡞ۀ͍ͨ͠ΞΧ΢ϯτʹ4XJUDI3PMF͢Δ • ϓϩάϥϜΞΫηεͰͷར༻ • ֤"84ΞΧ΢ϯτͰݸผʹΞΫηεΩʔΛൃߦ
  20. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ໰୊఺ • 3PMFͱΞΫηεΩʔͷ؅ཧ • ผʑʹ؅ཧΛߦ͏ඞཁ͕͋Γ൥ࡶ • ΞΫηεΩʔ؅ཧ • ӬଓతͳΞΫηεΩʔͷ؅ཧ͕ར༻ऀ೚ͤ

    • 4XJUDI3PMFͷηΩϡϦςΟ • աڈɺεΠονઌ3PMFͷ1SJODJQBMઃఆϛεʹΑΓ૝ఆͯ͠ͳ͍ݖݶͰೖΓ์୊ʹ ͳ͍ͬͯͨ͜ͱ͕͋ͬͨ
  21. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • ϩʔΧϧϚγϯͷରࡦ • BXTMBCTHJUTFDSFUTಋೖ • ΞΫηεΩʔͳͲͷػີ৘ใͷ(JUϦϙδτϦ΁ͷίϛοτΛ๷͙

  22. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • "84ଆͷରࡦ • "84440΁ͷҠߦ • ݄ʹ5PLZP3FHJPOͰϩʔϯνͨ͠λΠϛϯάͰҠߦ • "[VSF"%ͱ௚઀࿈ܞ͢Δ͜ͱͰΞΧ΢ϯτ؅ཧ͕γϯϓϧʹ

    • ΞΫηεΩʔͷ؅ཧ΋ෆཁʹ ˞4BB4޲͚ͷ΋ͷ͸আ͘
  23. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06 *OGSB@06 .BJOUFOBODF@06

    4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY "[VSF"% Ϛωδϝϯτίϯιʔϧ ΞΫηεΩʔ "844JOHMF4JHO0O ֤ΞΧ΢ϯτ΁ϩάΠϯ
  24. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO Ҡߦ࣌ͷτϥϒϧ • ࣄ৅ • 4XJUDI3PMF࣌୅ͷ؅ཧऀ༻3PMFΛ࡟আͨ͠ͱ͜ΖɺαʔϏεͰར༻͍ͯ͠ Δ$.,͕ӾཡɺมߋෆՄೳʹͳͬͯ͠·ͬͨ •

    "ENJOJTUSBUPSݖݶϢʔβʔͰ΋SPPUͰ΋Ͳ͏ʹ΋Ͱ͖ͳ͍ • ݪҼ • ࡟আͨ͠؅ཧऀ3PMFͷΈ͕ΩʔϙϦγʔͱͯ͠ࢦఆ͞Ε͍ͯͨͨΊɺ࡟আ͠ ͨ࣌఺Ͱ؅ཧऀෆࡏͷΩʔʹͳΔ
  25. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO Ҡߦ࣌ͷτϥϒϧ • ରԠ • "84ͷαϙʔτ΁໰͍߹ΘͤɺҰ࣌తͳϢʔβʔΛ࡞੒ɺ1VU,FZ1PMJDZݖݶ Λ෇༩ͯ͠΋Β͍ݩͷΩʔϙϦγʔΛ෮׆ͤ͞Δ͜ͱͰ෮چͨ͠ •

    ͨͩ͠ɺ࡞ۀλΠϛϯάͳͲίϯτϩʔϧͰ͖ͳ͍ཁૉ΋͋ΔͷͰɺΩʔϙϦ γʔͷ؅ཧऀͱͯ͠ෳ਺ͷ6TFS΋͘͠͸3PMFΛ෇༩͓ͯ͘͠ͷ͕Φεεϝ
  26. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  27. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ༧๷తΨʔυϨʔϧ • 4$1ͷྫ • ෆ࢖༻Ϧʔδϣϯͷ੍ݶ • ؂ࠪܥૢ࡞ͷ੍ݶ • ؀ڥಛ༗ͷ੍ݶ

    ॏཁૢ࡞ͳͲ  • શૢ࡞ͷېࢭ • FUD
  28. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organizational Units and SCP 06 ༻్ 4$1 'PVOEBUJPOBM@06 1SPE4%-$ͷϫʔΫϩʔυͱڞ௨ج൫Λ಺แ͢Δ06

    Ϧʔδϣϯ੍ݶɺ؂ࠪܥૢ࡞ͷ੍ݶ 8PSLMPBET@06 1SPE4%-$ͷϫʔΫϩʔυΛ಺แ͢Δ06 ։ൃऀ޲͚ͷ੍ݶ 1SPE@06 ຊ൪ΞΧ΢ϯτͷΈΛ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ 4%-$@06 4UBHJOH΍%FWɺ4BOECPYͳͲΛ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ *OGSB@06 ڞ௨ج൫ ϩάू໿ΞΧ΢ϯτ΍ηΩϡϦςΟ؂ࠪΞΧ΢ϯτ Λ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ 1PMJDZ4UBHJOH@06 ૊৫ߏ଄ͷมߋ΍4$1ͷมߋͳͲͷݕূͰར༻͢Δ06 ݕূ಺༰ʹΑͬͯ౎౓มߋ .BJOUFOBODF@06 ؂ࠪܥػೳͷϝϯςφϯεͳͲɺҰ࣌తʹ4$1Λҳ୤͢Δ࡞ۀΛߦ͏৔߹ʹར༻͢Δ06 ϝϯς಺༰ʹΑͬͯ౎౓มߋ 4VTQFOEFE@06 ഇغ༧ఆͷ"84ΞΧ΢ϯτΛ಺แ͢Δ06 શૢ࡞Λېࢭ
  29. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organizational Units and SCP 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06

    *OGSB@06 .BJOUFOBODF@06 4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY Ϧʔδϣϯ੍ݶ ؂ࠪܥૢ࡞ͷ੍ݶ ։ൃऀ޲͚ͷ੍ݶ 1SPEʹ͓͚Δ ॏཁૢ࡞ͷ੍ݶ ڞ௨ج൫ಛ༗ͷ੍ݶ ౎౓มߋ ౎౓มߋ શૢ࡞ͷېࢭ
  30. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ൃݟతΨʔυϨʔϧ • $MPVE5SBJMΑΔಛఆૢ࡞ͷ؂ࢹ • $POpH • (VBSE%VUZ • 4FDVSJUZ)VC

    • 5SVTUFE"EWJTPS ݕ஌ͨ͠಺༰ͷϑΟϧλϦϯάʹؔͯ͠͸ɺνϡʔχϯάΛਐΊ͍ͯΔ
  31. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ൃݟతΨʔυϨʔϧ αʔϏε໊ 0SHBOJ[BUJPOTରԠ ϝϯόʔ΁ͷҕ೚ ϝϯόʔͷࣗಈ༗ޮԽ ิ଍ $POpH ˓ ˓

    ✕ $MPVE'PSNBUJPO4UBDL4FUTΛར༻ͯ͠ɺ ϝϯόʔΞΧ΢ϯτͷ༗ޮԽΛࣗಈͰ࣮ࢪ (VBSE%VUZ ˓ ˓ ˓  4FDVSJUZ)VC ˓ ˓ ˓  ·ͨɺൃݟతΨʔυϨʔϧͰར༻͢ΔҎԼͷαʔϏεʹؔͯ͠ɺ $POpH͚ͩ͸ࣗಈ༗ޮԽ͕Ͱ͖ͳ͔ͬͨͨΊ$'O4UBDL4FUTΛར༻͍ͯ͠Δ ૣ͘0SHBOJ[BUJPOTͱͷεϜʔζͳ౷߹͕࣮ݱͯ͠΄͍͠
  32. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ

    • ΨʔυϨʔϧ • ࠓޙ
  33. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ࠓޙ • ൃݟతΨʔυϨʔϧͷνϡʔχϯά • $POpH3VMFTͷνϡʔχϯά • (VBSE%VUZ4FDVSJUZ)VCͷݕ஌಺༰ͷਫ਼ࠪ • ϩΪϯάͱϞχλϦϯάͷڧԽ

    • 4*&.ͷಋೖ 4*&.PO"NB[PO&4Λݕ౼த  • ΠϯγσϯτϨεϙϯεͷڧԽ • )BSEFOJOHΠϕϯτ΁ͷࢀՃɺݚम
  34. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ·ͱΊ • ΠϯγσϯτҎ߱ɺϚϧνΞΧ΢ϯτߏ੒Λ׆͔ͨ͠ܗͰରࡦΛ͢͢Ί͖ͯͨ • "84440Λར༻͢Δ͜ͱͰΞΧ΢ϯτ؅ཧίετ͕Լ͕ΓηΩϡΞʹͳͬͨ • ༧๷తɺൃݟతΨʔυϨʔϧͷಋೖͰΑΓηΩϡΞʹͳͬͨ ϚϧνΞΧ΢ϯτΛಋೖͯ͠ηΩϡΞͳ؀ڥΛखʹೖΕΑ͏

  35. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ʘɹ8F"SF)JSJOHɹʗ IUUQTDPSQDMBTTJKQDBSFFST

  36. $PQZSJHIU˜$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ͓ΘΓ