LOCAL Developer Day Online ’21 /Security というイベントで利用した講演資料です。 イベントページ: https://local.connpass.com/event/219312/ 話者: https://twitter.com/lmt_swallow
%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ-0$"-%FWFMPQFS%BZ0OMJOF`4FDVSJUZ:0/&6$)* 5BLBTIJIUUQTTIJGUKTJOGP
View Slide
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํXIPBNJৄࡉIUUQTTIJGUKTJOGPʹ͋Γ·͢‣ ถوࢤ :0/&6$)* 5BLBTIJ‣ גࣜձࣾ'MBUU4FDVSJUZࣥߦһ$50‣ ʮ։ൃऀͷͨΊͷɺ։ൃऀʹدΓఴͬͨηΩϡϦςΟʯΛୈҰٛͱͯ͠ಇ͍͍ͯ·͢‣ ੈͷதͷʢಛʹΠϯϋεͷʣϓϩμΫτνʔϜ͕҆৺ͯ͠ಇ͚ΔੈքΛ࡞Γ͍ͨͰ͢‣ ஶॻͳͲ‣ ʰ8FCϒϥβηΩϡϦςΟʱ‣ ʰৄղηΩϡϦςΟίϯςετʱ‣ ւಓ۴࿏ࢢग़
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ‣ ࢲ͕ॳΊͯࢀՃٕͨ͠ज़ษڧձ-%%'BMMʢ۴࿏։࠵ʣͰͨ͠😌‣ ͋Ε͔Βޙͷ͍·ɺ·ͨ͜͏͍͏ܗͰؔΘΕ͍ͯΔͷ͕خ͍͠Ͱ͢ɻࢲͱ-0$"-%&7&-01&3%":IUUQTMNUTXBMMPXIBUFOBEJBSZPSHFOUSZ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 🤔͜ΕԿʁ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ%FWFMPQFS'JSTU4FDVSJUZͱ‣ ։ൃऀͷ׆ಈݍʹͱ͚͜ΜͰ͍͘4FDVSJUZ‣ ։ൃऀͷٕज़ελοΫʹͱ͚͜ΜͰ͍͘4FDVSJUZ‣ ։ൃऀͷखݩʹͱ͚͜ΜͰ͍͘4FDVSJUZ123ࠓ͢͜ͱʢͷ಄ग़͠ʣ%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ-0$"-%FWFMPQFS%BZ0OMJOF`4FDVSJUZ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ αΠόʔηΩϡϦςΟྖҬେ5IF.BQPG$ZCFSTFDVSJUZ%PNBJOTΑΓҾ༻IUUQTXXXMJOLFEJODPNQVMTFDZCFSTFDVSJUZEPNBJONBQWFSIFOSZKJBOH
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜඪ४Խஂମ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈڭҭऀใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμڭҭऀඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμIUUQTGMBUUUFDILFOSPڭҭऀඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜηΩϡϦςΟϕϯμ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈڭҭऀใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜηΩϡϦςΟϕϯμ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈڭҭऀใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏIUUQTCVHTDISPNJVNPSHQDISPNJVNJTTVFTEFUBJM JEIUUQTQPSUTXJHHFSOFUEBJMZTXJHCMJOESFHFYJOKFDUJPOUIFPSFUJDBMFYQMPJUPGGFSTOFXXBZUPGPSDFXFCBQQTUPTQJMMTFDSFUTඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜηΩϡϦςΟϕϯμ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏڭҭऀඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜηΩϡϦςΟϕϯμ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏIUUQTGMBUUUFDIBTTFTTNFOUEFUBJMڭҭऀඪ४Խஂମ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμڭҭऀඪ४ԽஂମTIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ͜Ε·Ͱ͕͖ࣗ߹͖ͬͯͨ͜ͱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํίʔϙϨʔτ*5෦ηΩϡϦςΟܥͷཧ෦ใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏ։ൃऀӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜඪ४Խஂମઃܭऀ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈγϑτϨϑτΛਪ͠ਐΊΔͱࠨͷ΄͏ʹ͍Δઃܭɾ։ൃऀʹ͍͍ۙͮͯ͘ηΩϡϦςΟϕϯμڭҭऀܦݧΛܦͯಘͨখ͞ͳؾ͖
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํίʔϙϨʔτ*5෦ηΩϡϦςΟܥͷཧ෦ใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏ։ൃऀӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜඪ४Խஂମઃܭऀ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈγϑτϨϑτΛਪ͠ਐΊΔͱࠨͷ΄͏ʹ͍Δઃܭɾ։ൃऀʹ͍͍ۙͮͯ͘ʜ͕ɺΒ͘ʮΈΜͳͨΓલʹ͏ͷʯੜ·Εͯ͜ͳ͔ͬͨηΩϡϦςΟϕϯμڭҭऀܦݧΛܦͯಘͨখ͞ͳؾ͖
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ‣ ͙͑͢ͳ͍ɾཁٻίετ͕ലେ1ηΩϡϦςΟϓϩμΫτʹΑ͋͘Δ՝‣ 69͕ৗਓ͚Ͱͳ͍2‣ ։ൃऀͷڥʹͳ͡·ͳ͍3
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํελʔτΞοϓͷ༂ਐIUUQTSDEFWCMPHSDTFSJFTCGVOEJOHIUUQTTOZLJPOFXTTOZLBEWBODFTEFWFMPQFSGJSTUTFDVSJUZXJUITFSJFTFJOWFTUNFOUͦΜͳதɺۙ։ൃऀ͚ͷηΩϡϦςΟϓϩμΫτͰେ͖ͳΛ͛ΔελʔτΞοϓݱΕΔΑ͏ʹ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํελʔτΞοϓͷ༂ਐIUUQTSDEFWCMPHSDTFSJFTCGVOEJOHIUUQTTOZLJPOFXTTOZLBEWBODFTEFWFMPQFSGJSTUTFDVSJUZXJUITFSJFTFJOWFTUNFOUͦΜͳதɺۙ։ൃऀ͚ͷηΩϡϦςΟϓϩμΫτͰେ͖ͳΛ͛ΔελʔτΞοϓݱΕΔΑ͏ʹ🤔ҧ͍Կʁ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ։ൃऀͷ׆ಈݍʹͱ͚͜ΜͰ͍͘‣ ։ൃऀͷٕज़ελοΫʹͱ͚͜ΜͰ͍͘‣ ։ൃऀͷखݩʹͱ͚͜ΜͰ͍͘༂ਐΛ͛Δ൴Βʹڞ௨͢ΔͷҎԼͷΑ͏ͳ%FWFMPQFS'JSTUͳߟ͑ํ123ϙΠϯτ
։ൃऀͷ׆ಈݍʹͱ͚͜ΉηΩϡϦςΟϓϩμΫτ$IBQUFS
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ։ൃऀͷ׆ಈݍʹͱ͚͜ΜͰ͍͘༂ਐΛ͛Δ൴Βʹڞ௨͢ΔͷҎԼͷΑ͏ͳ%FWFMPQFS'JSTUͳߟ͑ํϙΠϯτ‣ ։ൃऀͷٕज़ελοΫʹͱ͚͜ΜͰ͍͘‣ ։ൃऀͷखݩʹͱ͚͜ΜͰ͍͘123
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ։ൃऀͷීஈͷϫʔΫϑϩʔ͔Β֎ΕΔͱɺश׳తͳར༻ʹͭͳ͕Βͳ͍‣ ։ൃऀͷηΩϡϦςΟͷؔ৺ߦಈΛҾ͖ग़͢ʹɺ։ൃऀͷ׆ಈݍͷதʹ͏·͘ΈࠐΊΔ͜ͱ͕લఏͰ͋ΔͱࢥͬͯΑ͍։ൃऀͷ׆ಈݍͷத։ൃऀ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 4OZL։ൃऀͷ׆ಈݍͷੵۃతͳࢀೖίʔυϗεςΟϯάαʔϏεͱ͏·͘࿈ܞͯ͠վળͷΞΫγϣϯ·ͰΛαϙʔτ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ (JU)VC։ൃऀͷ׆ಈݍͷੵۃతͳࢀೖ։ൃऀͷ׆ಈݍͷத৺Ͱଟ͘ͷηΩϡϦςΟػೳΛల։
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ (JU)VC։ൃऀͷ׆ಈݍͷੵۃతͳࢀೖमਖ਼ͷ1VMM3FRVFTUԽ·Ͱαϙʔτ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 4UBDL)BXL։ൃऀͷ׆ಈݍͷੵۃతͳࢀೖ$*ͷதʹͰ͖Δ͚ͩΒ͔ʹ%"45Λར༻Ͱ͖ΔΑ͏ͳΈ
։ൃऀͷٕज़ελοΫʹͱ͚͜ΉηΩϡϦςΟϓϩμΫτ$IBQUFS
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ΫϥυωΠςΟϒٕज़पลۙΓ্͕ΓΛݟ͍ͤͯΔ‣ ͜ͷΑ͏ͳٕज़ಛ༗ͷ՝ͷղܾɺ͜ͷΑ͏ͳٕज़ελοΫͷ্͔ͩΒͦ͜ՄೳͱͳΔηΩϡϦςΟϓϥΫςΟεͷ࣮ݱͷͨΊʹɺଟ͘ͷϓϨΠϠʔ͕ࢀೖதΫϥυωΠςΟϒٕज़ͱͷ༥IUUQTXXXQBMPBMUPOFUXPSLTDPNQSJTNBDMPVEIUUQTXXX[TDBMFSDPNQSPEVDUT[TDBMFSDMPVEQSPUFDUJPOIUUQTPSDBTFDVSJUZIUUQTXXXBRVBTFDDPN;TDBMFS$MPVE1SPUFDUJPO 1SJTNB$MPVE "RVB4FDVSJUZ 0SDB4FDVSJUZ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀʹدΓఴͬͨମݧଟ͘ͷπʔϧΛ044ͱͯ͠ల։͠ɺίϛϡχςΟʹڧ͘ߩݙ͍ͯ͠Δ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ೝূॲཧͷαʔϏεԽIUUQTXXXBVUIMFUFDPNIUUQTBVUIDPNIUUQTB[VSFNJDSPTPGUDPNFOVTTFSWJDFTBDUJWFEJSFDUPSZFYUFSOBMJEFOUJUJFTCDೝূʹؔ͢Δཁ݅Α͘ෳࡶʹͳΔ࣮͕ͷԹচʹͳΔ͜͜Λ͏·͘ࢧ͑ΔϓϥοτϑΥʔϜ͕༻ྫΛ૿͍ͯ͠Δ"[VSF"%#$ "VUI "VUIMFUF
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀʹدΓఴͬͨମݧແྉ൛વͷΑ͏ʹɾͪʹ͑Δ࣮Ϣʔεέʔεผʹίʔυྫఏڙ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ೝՄॲཧͷαʔϏεԽIUUQTTBOENBOIFSPLVBQQDPNIUUQTBVUI[FEDPNIUUQTCVJMETFDVSJUZॊೈͳೝՄΛ؆ܿʹ࣮͢ΔͨΊͷίϯϙʔωϯτΛఏڙ͢Δ৺తͳاۀݱΕ͍ͯΔCVJMETFDVSJUZ BVUI[FE 1SPKFDU4BOEDBTUMF "VUI
։ൃऀͷखݩʹͱ͚͜ΉηΩϡϦςΟϓϩμΫτ$IBQUFS
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜඪ४Խஂମઃܭऀ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈ%FW0QT͜ͷΞΫλʔؒͷ༥ͷͨΊͷϓϥΫςΟεใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμڭҭऀ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ %FW0QTͷՃ0QTʢӡ༻νʔϜʣͷऔΓѻ͍ͬͯͨͷ͕ιϑτΣΞతʹऔΓѻ͑ΔΑ͏ʹͳͬͨ͜ͱɺͱΓΘ͚ίʔυͰදݱՄೳͳͷʹมԽͨ͜͠ͱʹେ͖͘ࢧ͑ΒΕ͍ͯΔͱ͍ͬͯաݴͰͳ͍ɻ%FW0QTͷਐԽΛࢧٕ͑ͨज़resource "google_container_cluster""challenge_cluster" {name = "challenges"location = "asia-northeast1"initial_node_count = 1cluster_autoscaling {enabled = trueresource_limits {resource_type = "cpu"minimum = 3maximum = 32}resource_limits {resource_type = "memory"minimum = 3maximum = 32}}...
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ։ൃऀηΩϡϦςΟܥͷཧ෦ίʔϙϨʔτ*5෦ӡ༻ऀηΩϡϦςΟݚڀऀࠪΝʔϜ$*40ͦͷଞܦӦ߈ܸऀ൜ࡑ৫ࠃՈใηΩϡϦςΟʹ༷ʑͳΞΫλʔ͕ଘࡏηΩϡϦςΟϕϯμڭҭऀ%FW4FD0QT͜ͷลͷ༥ͷͨΊͷϓϥΫςΟεඪ४Խஂମ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ %FW0QTͷՃ0QTʢӡ༻νʔϜʣͷऔΓѻ͍ͬͯͨͷ͕ιϑτΣΞతʹऔΓѻ͑ΔΑ͏ʹͳͬͨ͜ͱɺͱΓΘ͚ίʔυͰදݱՄೳͳͷʹมԽͨ͜͠ͱʹେ͖͘ࢧ͑ΒΕ͍ͯΔͱ͍ͬͯաݴͰͳ͍ɻ%FW0QTͷਐԽΛࢧٕ͑ͨज़resource "google_container_cluster""challenge_cluster" {name = "challenges"location = "asia-northeast1"initial_node_count = 1cluster_autoscaling {enabled = trueresource_limits {resource_type = "cpu"minimum = 3maximum = 32}resource_limits {resource_type = "memory"minimum = 3maximum = 32}}...
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ‣ 4FDʢηΩϡϦςΟνʔϜʣͷऔΓѻ͍ͬͯͨͷ͕ιϑτΣΞతʹऔΓѻ͑ΔΑ͏ʹͳΔͱ͖ɺ͜ͱίʔυͰදݱՄೳͳͷʹมԽͨ͠ͱ͖ʹɺΑΓ%FW0QTͱ4FDͱͷ༥͕ਐΈ͘͢ͳΔͱ͍͏ྨਪ͕Ͱ͖Δ‣ ։ൃνʔϜͱηΩϡϦςΟνʔϜͱͷڠಇͷͨΊͷഔମͱͯ͠ίʔυΛհ͢Δ1PMJDZBT$PEFͱΑΔΞϓϩʔνΛਪਐ͢ΔϓϩμΫτ૿͑ͭͭ͋Δ%FW4FD0QTΛࢧ͑ͭͭ͋Δٕज़IUUQTBQPMJDZJPIUUQTDZSBMDPN"QPMJDZ$ZSBM
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 1PMJDZBT$PEFϙϦγʔͷΠϝʔδٕज़తରʹؔ͢ΔϙϦγʔΛίʔυͱͯ͠දݱ͢Δख๏version: '1'rules:- id: 'unencrypted-ebs-volume'language: hclmessage: |There was unencrypted EBS module.pattern: |resource "aws_ebs_volume" :[NAME] {:[...X]}constraints:- target: Xshould: not-matchpattern: |encrypted = truerewrite: |resource "aws_ebs_volume" :[NAME] {:[X]encrypted = true}
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 0QFO1PMJDZ"HFOUIUUQTXXXPQFOQPMJDZBHFOUPSHEPDTWΑΓҾ༻‣ ൚༻ੑͷߴ͍ϙϦγʔΤϯδϯ‣ 3FHPͱ͍͏%4-ΑΓʹهड़͞ΕͨϙϦγʔΛݩʹɺ͋Δใʢ2VFSZʣ͕ϙϦγʔʹରͯ͠Ϛον͢Δ͔ͷஅʢ%FDJTJPOʣΛߦ͏͜ͱ͕Ͱ͖Δ‣ அͷͨΊͷϩδοΫͱஅ݁Ռʹґଘ͢ΔϩδοΫ͕͞ΕΔʢ1PMJDZ%FDPVQMJOHʣ‣ ར༻ྫ‣ (BUFLFFQFS,VCFSOFUFTϫʔΫϩʔυͷอޢͷͨΊͷΈ‣ $POGUFTU,VCFSOFUFTϚχϑΣετͷςετͷͨΊͷπʔϧ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ (BUFLFFQFS0QFO1PMJDZ"HFOUΛݩʹͨ͠γεςϜpackage deny_host_networkviolation[{"msg": msg, "details": {}}]{input.review.object.spec.hostNetworkmsg := sprintf("hostNetwork is prohibited", [])}apiVersion: v1kind: Podmetadata:name: examplelabels:app: examplespec:hostNetwork: truecontainers:- name: nginximage: nginxports:- containerPort: 9001hostPort: 90013FHPͰهड़͞ΕͨϙϦγʔϙϦγʔʹै͏͖,VCFSOFUFT.BOJGFTU$ kubectl apply ...ࣦഊ͢ΔɻະવʹϙϦγʔʹԊΘͳ͍Ϧιʔεͷ࡞Λ͙͜ͱ͕Ͱ͖Δ😌
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ (BUFLFFQFS0QFO1PMJDZ"HFOUΛݩʹͨ͠γεςϜpackage deny_host_networkviolation[{"msg": msg, "details": {}}]{input.review.object.spec.hostNetworkmsg := sprintf("hostNetwork is prohibited", [])}apiVersion: v1kind: Podmetadata:name: examplelabels:app: examplespec:hostNetwork: truecontainers:- name: nginximage: nginxports:- containerPort: 9001hostPort: 90013FHPͰهड़͞ΕͨϙϦγʔϙϦγʔʹै͏͖,VCFSOFUFT.BOJGFTU$ kubectl apply ...ࣦഊ͢ΔɻະવʹϙϦγʔʹԊΘͳ͍Ϧιʔεͷ࡞Λ͙͜ͱ͕Ͱ͖Δ😌ϙϦγʔʹҧͨ͠هड़͕͋Δ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ *O4QFDIUUQTHJUIVCDPNJOTQFDJOTQFDΠϯϑϥʹର͢ΔςετΛίʔυͱͯ͠هड़͢ΔͨΊͷπʔϧ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 4FNHSFQIUUQTTFNHSFQEFWίʔυʹର͢ΔϙϦγʔΛ:".-Ͱهड़ɾݕূͰ͖ΔπʔϧίϛϡχςΟͰϙϦγʔΛڞ༗͢ΔͨΊͷΈͳͲఏڙIUUQTTFNHSFQEFWS
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 4IJTIPίʔυʹର͢ΔϙϦγʔهड़ɾߴͳݕূΛՄೳʹ͢ΔπʔϧͦΕʹجͮ͘αʔϏεʢΛ࡞͍ͬͯ·͢ʣIUUQTEPDTTIJTIPEFW IUUQTTIJTIPEFW
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ 4IJTIPΑ͘ͳ͍ίʔυϓϥΫςΟεΛஔ͢Δϧʔϧ ஔରͷίʔυ4IJTIPʹΑΔݕग़ͷ༷ࢠฏͨ͘ݴ͑-JOUFSͷϧʔϧΛ؆୯ʹࣗ࡞Ͱ͖ΔͭͰɺίʔσΟϯάʹؔ͢ΔόουϓϥΫςΟεΛίʔυԽͰ͖·͢
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ‣ )BTIJ$PSQ4FOUJOFM1PMJDZBT$PEFͷརΛҎԼͷΑ͏ʹཧ͍ͯ͠ΔIUUQTEPDTIBTIJDPSQDPNTFOUJOFMDPODFQUTQPMJDZBTDPEF‣ 4BOECPYJOHڥͷΨʔυϨʔϧͱͯ͠ϙϦγʔ͕ར༻Ͱ͖ΔΑ͏ʹͳΔ‣ $PEJpDBUJPOίʔυԽ͞ΕΔ͜ͱͰϙϦγʔ͕໌֬ʹͳΔ‣ 7FSTJPO$POUSPMόʔδϣϯཧͷରʹͳΔ‣ 5FTUJOHϙϦγʔʹهड़͞Ε͍ͯΔ͜ͱςετՄೳͳରʹͳΔ‣ "VUPNBUJPOࣗಈԽπʔϧͰऔΓѻ͑ΔରʹͳΔ‣ 1PMJDZBT$PEFʮηΩϡϦςΟνʔϜͷݟࣄΛදݱ͢ΔͨΊͷํ๏ʯͰ͋ΓɺʮηΩϡϦςΟͱ͍͏ࣄͷରԽʯͰ͋Δ1PMJDZBT$PEF͕ͨΒ͢ͷ
ηΩϡϦςΟΛΤϯδχΞϦϯά͢Δ$IBQUFS
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ։ൃऀͷ׆ಈݍʹͱ͚͜ΜͰ͍͘‣ ։ൃऀͷٕज़ελοΫʹͱ͚͜ΜͰ͍͘‣ ։ൃऀͷखݩʹͱ͚͜ΜͰ͍͘༂ਐΛ͛Δ൴Βʹڞ௨͢ΔͷҎԼͷΑ͏ͳ%FWFMPQFS'JSTUͳߟ͑ํ123ৼΓฦΓ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ ‣ %FW4FD0QTγϑτϨϑτΛਪਐ͢Δจ຺ͷதʹ͓͍ͯɺηΩϡϦςΟઐՈʹٻΊΒΕΔߦಈɺগͣͭ͠ม༰͖ͯͨ͠ͷͩͱࢥ͏‣ ͜ΕΒͷߦಈࠓͰ୭͕ͨΓલʹ࣮ફͰ͖͍ͯΔΘ͚Ͱͳ͍‣ ͜Ε%FW0QT͕͔ͭͯͨΓલͰͳ͔ͬͨͷͱಉ͜͡ͱ‣ ઌड़ͷΑ͏ʹ4FD%FW0QTΛ༥͢ΔͨΊͷςΫϊϩδͷෆͳͲ͕ҰҼηΩϡϦςΟઐՈzͷظͷมԽઐՈͱͯ͠܅ྟ͢Δ։ൃऀͷԕ͘Ͱಇࣝ͘ΛϓϩμΫτͷܗͰຽओԽ͢Δ։ൃऀͱڠಇ͢Δ։ൃऀͱҧ͏ࣄΛ͢Δ ։ൃऀͱಉ͡ରΛѻ͏ηΩϡϦςΟͷਓηΩϡϦςΟΛΤϯδχΞϦϯά͢Δਓ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํXIPBNJৄࡉIUUQTTIJGUKTJOGPʹ͋Γ·͢‣ ถوࢤ :0/&6$)* 5BLBTIJ‣ ւಓ۴࿏ࢢग़‣ גࣜձࣾ'MBUU4FDVSJUZࣥߦһ$50‣ ʮ։ൃऀͷͨΊͷɺ։ൃऀʹدΓఴͬͨηΩϡϦςΟʯΛୈҰٛͱͯ͠ಇ͍͍ͯ·͢‣ ੈͷதͷʢಛʹΠϯϋεͷʣϓϩμΫτνʔϜ͕҆৺ͯ͠ಇ͚ΔੈքΛ࡞Γ͍ͨͰ͢‣ ஶॻͳͲ‣ ʰ8FCϒϥβηΩϡϦςΟʱ‣ ʰৄղηΩϡϦςΟίϯςετʱ
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํXIPBNJৄࡉIUUQTTIJGUKTJOGPʹ͋Γ·͢‣ ถوࢤ :0/&6$)* 5BLBTIJ‣ ւಓ۴࿏ࢢग़‣ גࣜձࣾ'MBUU4FDVSJUZࣥߦһ$50‣ ʮ։ൃऀͷͨΊͷɺ։ൃऀʹدΓఴͬͨηΩϡϦςΟʯΛୈҰٛͱͯ͠ಇ͍͍ͯ·͢‣ ੈͷதͷʢಛʹΠϯϋεͷʣϓϩμΫτνʔϜ͕҆৺ͯ͠ಇ͚ΔੈքΛ࡞Γ͍ͨͰ͢‣ ஶॻͳͲ‣ ʰ8FCϒϥβηΩϡϦςΟʱ‣ ʰৄղηΩϡϦςΟίϯςετʱηΩϡϦςΟͷྗͰ৴པΛͭͳ͛ɺΫϦΤΠςΟϒͳࣾձΛ࣮ݱ͢ΔɻCYBER SECURITY PROVIDING ALL SOCIETY TRUST and UNLIMITED CREATIVITY8FSF)JSJOH
TIJGUKTJOGP%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ‣ ։ൃऀͷ׆ಈݍʹͱ͚͜ΜͰ͍͘4FDVSJUZ‣ ։ൃऀͷٕज़ελοΫʹͱ͚͜ΜͰ͍͘4FDVSJUZ‣ ։ൃऀͷखݩʹͱ͚͜ΜͰ͍͘4FDVSJUZ123,FZ5BLFBXBZ%FWFMPQFS'JSTU4FDVSJUZͱ͍͏ߟ͑ํ-0$"-%FWFMPQFS%BZ0OMJOF`4FDVSJUZ%FWFMPQFS'JSTU4FDVSJUZͱ
lmt_swallow
oekazuma
k1low
sat
nenonaninu
mii3king
kentosuzuki
shimashima35
nasa9084
bun913
stefafafan
fixstars
oracle4engineer
smashingmag
malarkey
revolveconf
zakiwarfel
rmw
mza
paulrobertlloyd
edds
skipperchong
keithpitt
iamctodd
jlugia