cdk deployに必要な権限ってなんだ？

CDK Security And Safety Dev Guide
https://github.com/aws/aws-cdk/wiki/Security-And-Safety-Dev-Guide

CDK Security And Safety Dev Guide を読んでみた
https://tech.isid.co.jp/entry/cdk-security-and-safety-dev-guide

JAWS-UG CDK支部 #5
https://jawsug-cdk.connpass.com/event/269789/

Transcript

1. cdk deployʹ
   
   
   ඞཁͳݖݶͬͯͳΜͩʁ
   2023/1/25
   
   JAWS-UG CDKࢧ෦ #5
   

   View Slide

2. Kinyo

   

   גࣜձࣾి௨ࠃࡍ৘ใαʔϏεʢISIDʣ

   ηΩϡϦςΟΤϯδχΞʢ։ൃ΋গ͠ʣ

   

   

   

   ࠓ೔ͷ಺༰ʹ͍ͭͯϒϩά΋ॻ͖·ͨ͠👉

   ʮCDK Security And Safety Dev Guide ΛಡΜͰΈͨʯ

   

   CDK Security And Safety Dev Guide ͷ಺༰Λࢀߟʹ͍ͯ͠·͢

   https://github.com/aws/aws-cdk/wiki/Security-And-Safety-Dev-Guide

   

   CDK v2 ͷ DefaultStackSynthesizer Λ࢖͏લఏͷ࿩Ͱ͢
   ࣗݾ঺հ
   

   View Slide

3. cdk deploy͢Δͱ͖ʹ
   
   AdministratorAccessΛ࢖͍ͬͯ·ͤΜ͔ʁ
   

   View Slide

4. ආ͚͍ͨ͜ͱ
   • CDKͰΠϯϑϥߏங͢ΔͨΊͷAWSΫϨσϯγϟϧ͕࿙Εͨͱ͖ʹɺ

   ڧ͍ݖݶ͕֎෦ʹ౉Δ͜ͱ
   CDK
   cdk deploy
   ։ൃऀ
   γεςϜ
   

   View Slide

5. CDK
   cdk deploy
   CloudFormation
   ϦιʔεσϓϩΠ
   Ϧιʔεૢ࡞Λ୲͏ͷ͸CloudFormation
   ඞཁͳݖݶ͸ʁ ڧ͍ݖݶ͕ඞཁ
   

   View Slide

6. ൿີ͸ cdk bootstrap ʹ͋Γ
   

   View Slide

7. cdk bootstrapͰ࡞੒͞ΕͨϦιʔεΛݟͯΈΑ͏
   IAMϩʔϧ͕5ͭ࡞੒͞Ε͍ͯΔ
   
   ɾCloudFormationExecutionRole
   
   ɾDeploymentActionRole
   
   ɾFilePublishingRole
   
   ɾImagePublishingRole
   
   ɾLookupRole
   
   →কདྷͷcdk deployͰར༻͞ΕΔ
   Ξηοτ༻ͷECRϦϙδτϦ
   Ξηοτ༻ͷS3όέοτ
   

   View Slide

8. cdk deployͰى͍ͬͯ͜Δ͜ͱ
   CDK
   CloudFormation
   S3όέοτ
   ECRϦϙδτϦ
   LookupRole
   cdk deploy
   fromLookupͰ
   
   ϦιʔεΛࢀর͢Δ࣌ͳͲ
   PassRole
   ίϯςφΠϝʔδ
   
   ʢDockerImageAssetͳͲʣ
   CfnςϯϓϨʔτ΍
   
   Lambdaؔ਺ίʔυ
   ࢀর
   ϦιʔεσϓϩΠ
   ࢀর
   File
   
   
   PublishingRole
   Image
   
   
   PublishingRole
   Deployment
   
   
   ActionRole
   CloudFormation
   
   
   ExecutionRole
   AssumeRole
   AssumeRole
   AssumeRole
   AssumeRole
   

   View Slide

9. ɾAWS؅ཧͷ ReadOnlyAccess ϙϦγʔ
   ɾΠϯϥΠϯͰ kms:Decrypt ͸ Deny ͞Ε͍ͯΔ
   ※Bootstrap v15 ࣌఺
   

   View Slide

10. ɾΞηοτ༻S3όέοτ΁ͷݖݶ
    ɾ҉߸Խ༻KMSΩʔ΁ͷݖݶ
    ɾΞηοτ༻ECRϦϙδτϦ΁ͷݖݶ
    ※Bootstrap v15 ࣌఺
    

    View Slide

11. ɾCloudFormationͷૢ࡞ݖݶʢStackɺChangeSetʣ
    ɾΫϩεΞΧ΢ϯτͰPipelineͷArtifactΛૢ࡞͢ΔݖݶʢS3ͱKMSʣ
    
    ɾΞηοτ༻S3όέοτͷಡΈऔΓݖݶ
    
    ɾParameter Store͔ΒCDK bootstrapόʔδϣϯͷಡΈऔΓݖݶ
    ɾɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ͷiam:PassRole
    CloudFormationExecutionRole
    ※Bootstrap v15 ࣌఺
    CloudFormation
    
    
    ExecutionRole
    CloudFormation
    PassRole
    

    View Slide

12. AdministratorAccess
    ※Bootstrap v15 ࣌఺
    

    View Slide

13. ͭ·Γɺcdk deployʹඞཁͳݖݶ͸ʁ
    ͜ΕΒ΁ͷAssumeRoleݖݶ
    🙅AssumeRoleෆཁ
    

    View Slide

14. {
    
    "Version": "2012-10-17",
    
    "Statement": [
    
    {
    
    "Sid": "AssumeCDKRoles",
    
    "E
    ff
    ect": "Allow",
    
    "Action": "sts:AssumeRole",
    
    "Resource": [
    
    "arn:aws:iam::111111111111:role/cdk-hnb659fds-deploy-role-111111111111-ap-northeast-1",
    
    "arn:aws:iam::111111111111:role/cdk-hnb659fds-
    fi
    le-publishing-role-111111111111-ap-northeast-1",
    
    "arn:aws:iam::111111111111:role/cdk-hnb659fds-image-publishing-role-111111111111-ap-northeast-1",
    
    "arn:aws:iam::111111111111:role/cdk-hnb659fds-lookup-role-111111111111-ap-northeast-1"
    
    ]
    
    }
    
    ]
    
    }
    cdk deploy͢ΔͨΊͷ࠷খݖݶIAMϙϦγʔ
    ෳ਺ϦʔδϣϯʹσϓϩΠ͢Δ৔߹ɺ
    
    ϩʔϧ͸Ϧʔδϣϯ͝ͱʹ͋Δ͜ͱʹ஫ҙ
    

    View Slide

15. cdk deploy͢Δݖݶ͕
    
    ɾAdminݖݶΛ௚઀࣋ͨͳ͍
    
    ɾAdminݖݶΛ࣋ͭϩʔϧΛAssumeͰ͖ͳ͍
    
    ͜ͱͰϦεΫΛݮΒ͢
    

    View Slide

16. ͞Βʹਂ۷Γ
    ͜ΕͰສશʁ🤔
    

    View Slide

17. ݫີͳ੍ݶ͸Ͱ͖͖ͯͳ͍
    • ɹɹɹɹɹɹɹ͕CloudFormationελοΫΛ࡞Εͯɺ

    AdminݖݶΛ౉ͤΔͷͰɺCloudFormationܦ༝Ͱ͍Ζ͍ΖͰ͖ͯ͠·͏

    • ྫ͑͹ɾɾɾ
    
    • ಛఆͷ໊લͷڧݖݶͷRoleΛ࡞੒͠ɺAssume͢Δ

    ʢAssumeΛڐՄ͢Δϩʔϧ໊ΛϫΠϧυΧʔυͰࢦఆ͍ͯ͠Δ৔߹ʣ
    
    • ɹɹɹɹɹɹɹࣗ਎ʹڧݖݶͷϙϦγʔΛ௥Ճ͢Δ
    Deployment
    
    
    ActionRole
    Deployment
    
    
    ActionRole
    

    View Slide

18. ݫີͳ੍ݶΛ͍ͨ͠৔߹͸ɺ
    
    ɹɹɹɹͷݖݶΛߜΔ
    
    CloudFormation
    
    
    ExecutionRole
    

    View Slide

19. cdk bootstrapͷΦϓγϣϯͰ
    
    
    ɹɹɹɹɹͷݖݶΛߜΔํ๏3ͭ
    • --cloudformation-execution-policies … ϙϦγʔΛ্ॻ͖
    
    • https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-customizing
    
    • ؆୯ʹݖݶΛ੍ݶ͍ͨ͠৔߹
    
    • --template … BootstrapςϯϓϨʔτΛϑϧΧελϚΠζ
    
    • https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-customizing-extended
    
    • --custom-permissions-boundary … Permissions boundaryΛ௥Ճʢv2.54.0~ʣ
    
    • https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/README.md#cdk-bootstrap
    
    • IAMϦιʔεͷ࡞੒ΛڐՄͭͭ͠ݖݶঢ֨Λ๷͍͗ͨ৔߹
    CloudFormation
    
    
    ExecutionRole
    

    View Slide

20. ݁࿦
    bootstrapͨ͠ޙ͸
    
    cdk deploy͢ΔݖݶΛݟ௚ͦ͏
    

    View Slide