Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Flava IAM: Bridging Security and Usability with...

Flava IAM: Bridging Security and Usability with Athenz

本セッションでは、新社内クラウドプラットフォーム「Flava」におけるIAM(Identity and Access Management)の設計および構築経験を紹介します。
セキュリティと使いやすさの両立を目指し、その基盤としてオープンソースの権限管理システムである Athenz を採用しました。
Athenzの強みを活かしながら、実際の運用環境に適したユーザー体験と運用効率をどう実現したのか、従来の社内IAMとの違いに焦点を当ててご説明します。

More Decks by LINEヤフーTech (LY Corporation Tech)

Other Decks in Technology

Transcript

  1. -FBSOJOHGSPNUIF1BTU ⎯ #VJMUEJSFDUMZPO"UIFO[ XJUINJOJNBMBCTUSBDUJPO ⎯ ✅ 1SPWJEFSTIBEIJHIBVUPOPNZŠ 4FDVSF ⎯ 🤔

    1MBZFEBMJNJUFESPMFJODMPVEVTFSFYQFSJFODF)JHISFTQPOTJCJMJUZPOQSPWJEFST 4FDVSFCZ%FTJHO CVU-FTT*OUFHSBUFE :BIPP+"1"/$MPVE
  2. 0VS"QQSPBDI 5PCFDPNF#BMBODFE#SPLFS -*/& $MPVE :BIPP +"1"/ $MPVE 'MBWB *". "VUPOPNZ

    4FDVSJUZ $POTJTUFODZ 4JNQMJDJUZ "UIFO[ 6* 4FDVSJUZ 1SFTFSWJOH69
  3. 8IBUJT"UIFO[ ⎯ 'JOFHSBJOFE3PMF1PMJDZ.PEFM ⎯ .VMUJUFOBODZTVQQPSU ⎯ .VMUJQMF"VUI.FUIPET Y 0"VUI ⎯

    .PEVMBS TDBMBCMFBSDIJUFDUVSF ⎯ 1SPWFOTUBCJMJUZ CBTJTPG:BIPP+"1"/$MPVE*". "UIFO[0QFOTPVSDF3#"$"VUI/"VUI; 1MBUGPSN
  4. 3PMF#BTFE"DDFTT$POUSPM 4FSWFS "ENJO %BUBCBTF"ENJO • $SFBUF4FSWFS • -JTU4FSWFS • 6QEBUF4FSWFS

    • %FMFUF4FSWFS • $SFBUF%# • -JTU%# • 6QEBUF%# • %FMFUF%# 4FSWJDF "DDPVOU 6TFS 1SJODJQBM 3PMF 1PMJDZ
  5. 6TFS4DFOBSJP 6TFS "UIFO[ 1SPWJEFS%PNBJO "DDFTTUP 3FTPVSDF 6TFS 1SPWJEFS 4JEFDBS 5PLFO4ZTUFN

    1SPWJEFS4FSWJDF (SBOUQFSNJTTJPO 3PMF 1PMJDZ 1SPWJEFS 1SPDFTT 1SPWJEFS
  6. 6TFS4DFOBSJP 6TFS "UIFO[ 1SPWJEFS%PNBJO "DDFTTUP 3FTPVSDF 6TFS 1SPWJEFS 4JEFDBS 5PLFO4ZTUFN

    (FU5PLFO 1SPWJEFS4FSWJDF (SBOUQFSNJTTJPO 3PMF 1PMJDZ 1SPWJEFS 1SPDFTT 1SPWJEFS
  7. 6TFS4DFOBSJP 6TFS "UIFO[ 1SPWJEFS%PNBJO "DDFTTUP 3FTPVSDF 6TFS 1SPWJEFS 4JEFDBS 5PLFO4ZTUFN

    (FU5PLFO 3FRVFTUXJUI5PLFO 1SPWJEFS4FSWJDF (SBOUQFSNJTTJPO 3PMF 1PMJDZ 1SPWJEFS 1SPDFTT 1SPWJEFS
  8. 6TFS4DFOBSJP 6TFS "UIFO[ 1SPWJEFS%PNBJO "DDFTTUP 3FTPVSDF 6TFS 1SPWJEFS 4JEFDBS 5PLFO4ZTUFN

    (FU5PLFO 3FUSJFWF1PMJDZ 3FRVFTUXJUI5PLFO 1SPWJEFS4FSWJDF (SBOUQFSNJTTJPO 3PMF 1PMJDZ 1SPWJEFS 1SPDFTT 7BMJEBUF5PLFO 7FSJGZ1PMJDZ 1SPWJEFS
  9. 6TFS4DFOBSJP 6TFS "UIFO[ 1SPWJEFS%PNBJO "DDFTTUP 3FTPVSDF 6TFS 1SPWJEFS 4JEFDBS 5PLFO4ZTUFN

    (FU5PLFO 3FUSJFWF1PMJDZ 3FRVFTUXJUI5PLFO 1SPWJEFS4FSWJDF (SBOUQFSNJTTJPO 3PMF 1PMJDZ 1SPWJEFS 1SPDFTT 'PSXBSEJOH 3FRVFTU 7BMJEBUF5PLFO 7FSJGZ1PMJDZ 1SPWJEFS
  10. 5FOBODZ ⎯ *UMFUTQSPWJEFSTHJWFVTFSTQFSNJTTJPOUPNBOBHFXIPHFUTBDDFTTŠ XJUIPVU NBOBHJOHFWFSZNFNCFSTUIFNTFMWFT 6TFS %PNBJO 1SPWJEFS %PNBJO 5SVTU

    6TFS" 4FSWJDF# 5SVTU6TFS%PNBJO 6TFS" 4FSWJDF# "DDFTTUP 3FTPVSDF 6TF1SPWJEFS %PNBJO3PMF 3PMF 1PMJDZ %FMFHBUFE3PMF
  11. 6TFS4DFOBSJP 5FOBODZ 6TFS 6TFS DBOTQFDJGZXIJDI1SJODJQBMT BSFHSBOUFEQFSNJTTJPOT 1SPWJEFSTGPDVTPOXIBU3PMF1PMJDZ DPNCJOBUJPOTUPDSFBUF 1SPWJEFS%PNBJO 6TF1SPWJEFS

    %PNBJO3PMF "DDFTTUP 3FTPVSDF 6TFS%PNBJO 5SVTU6TFS %PNBJO 6TFS" 4FSWJDF# 1SPWJEFS %FDFOUSBMJ[FE QFSNJTTJPONBOBHFNFOUXJUITFBNMFTTNVMUJUFOBOUEFMFHBUJPO
  12. "SDIJUFDUVSF "UIFO[ "1*4FSWFS 6*6TFS $BDIF 1SPKFDU .FUBEBUB 1SPWJEFS $BUBMPH 'MBWB*".

    ⎯ 'MBWB*".JT -BZFSUPNBLF"UIFO[ FBTJFSGPSVTFSTBOEQSPWJEFSTUPVTF ⎯ 1FSNJTTJPOTUPJOEJWJEVBM"UIFO[ %PNBJOTBSFTUJMMIFMECZUIF6TFSBOE1SPWJEFS
  13. 3FMBUJPOTCFUXFFO'MBWB*".BOE"UIFO[ 1SPKFDU "UIFO[ 'MBWB*". 6TFS%PNBJO 1SPWJEFS%PNBJO %BUBCBTF 1SPWJEFS%PNBJO 4FSWFS -JTU4FSWFS

    4FSWFS 3FBEPOMZ $36% %BUBCBTF %#"ENJO "DDFTT %BUBCBTF %#"DDFTT $SFBUF3PMFTCBTFE PO1SFEFGJOFE 5FNQMBUFT $36% 4FSWFS 4FSWFS "ENJO 5SVTU
  14. 3FMBUJPOTCFUXFFO'MBWB*".BOE"UIFO[ 1SPKFDU 6TFS 4FSWJDF "DDPVOU 3PMF(SPVQ "UIFO[ 'MBWB*". 6TFS%PNBJO 1SPWJEFS%PNBJO

    %BUBCBTF $36% 4FSWFS 4FSWFS "ENJO %#"ENJO 6TFS 1SPWJEFS%PNBJO 4FSWFS -JTU4FSWFS 4FSWFS 3FBEPOMZ $36% %BUBCBTF %#"ENJO 3FBE %BUBCBTF %#"DDFTT 4FSWFS 3FBEPOMZ 4FSWJDF 4FSWFS"ENJO %#"ENJO  6TFST  4FSWJDFT .PEJGZUIF3PMF1PMJDZJO 6TFS%PNBJOUIBU DPSSFTQPOETUP'MBWB*".
  15. 3FMBUJPOTCFUXFFO'MBWB*".BOE"UIFO[ 1SPKFDU 6TFS" 4FSWJDF "DDPVOU 3PMF(SPVQ "UIFO[ 'MBWB*". 6TFS%PNBJO 1SPWJEFS%PNBJO

    %BUBCBTF $36% 4FSWFS 4FSWFS "ENJO %#"ENJO 6TFS" 1SPWJEFS%PNBJO 4FSWFS -JTU4FSWFS 4FSWFS 3FBEPOMZ $36% %BUBCBTF %#"ENJO  6TFS" 3FBE %BUBCBTF %#"DDFTT 4FSWFS 3FBEPOMZ 4FSWJDF 4FSWFS"ENJO %#"ENJO  6TFST  4FSWJDFT .PEJGZUIF3PMF1PMJDZJO 6TFS%PNBJOUIBU DPSSFTQPOETUP'MBWB*".
  16. 1SPWJEFS69*NQSPWFNFOUT 6TFS "UIFO[ 'MBWB*". 1SPWJEFS $BUBMPH ⎯ %PNBJOSPMFTDSFBUFEWJB"UIFO[ UFNQMBUF ⎯

    'MBWB*".IBTMJNJUFEQFSNJTTJPOTPO%PNBJOŠ 4UJMM4FDVSF ⎯ /PDVTUPN"1*PSEJSFDU"UIFO[ IBOEMJOHCZ1SPWJEFS • -PXFSFGGPSU)JHIFSDPOTJTUFODZ "GUFS 5FNQMBUFT
  17. "UIFO[ 5FNQMBUF template: metadata: - template-name: flava-provider-function-v1 roles: - name:

    function_admin trust: _userDomain_ - name: function_readonly trust: _userDomain_ policies: - name: function_admin assertions: - grant * to function_admin on function.* - name: function_readonly assertions: - grant GET to function_readonly on function.api.*
  18. "UIFO[ 5FNQMBUF template: metadata: - template-name: flava-provider-function-v1 roles: - name:

    function_admin trust: _userDomain_ - name: function_readonly trust: _userDomain_ policies: - name: function_admin assertions: - grant * to function_admin on function.* - name: function_readonly assertions: - grant GET to function_readonly on function.api.* %FGJOF3PMFT UIBUUSVTUT 6TFSEPNBJO
  19. "UIFO[ 5FNQMBUF template: metadata: - template-name: flava-provider-function-v1 roles: - name:

    function_admin trust: _userDomain_ - name: function_readonly trust: _userDomain_ policies: - name: function_admin assertions: - grant * to function_admin on function.* - name: function_readonly assertions: - grant GET to function_readonly on function.api.* %FGJOF1PMJDJFT
  20. 1SPWJEFS$BUBMPH flava-faas: register: type: template template: name: flava-provider-function-v1 admins: -

    flava-iam.dev.flava-faas.faas-api authority: type: athenz athenz: includeRoles: - name: function_admin description: ”All permissions provided for all function resources." - name: function_readonly description: "Read permissions provided for all function resources." 3FHJTUFSUFNQMBUFT BOEVTFSSPMFT UPDBUBMPH
  21. 1SJODJQBMWT3PMF"VUIFOUJDBUJPO "VUIFOUJDBUJPO1SJODJQBMWT3PMF ⎯ 1SJODJQBM"VUIFOUJDBUJPO 8IBUDBOUIJT1SJODJQBMEP • "MXBZTSFGMFDUTDVSSFOUQFSNJTTJPOT • 3FRVJSFTDFOUSBMRVFSZ QPUFOUJBMCPUUMFOFDL

     ⎯ 3PMF"VUIFOUJDBUJPO8IBUDBOUIJT3PMFEP • 4VJUTEJTUSJCVUFE IJHITDBMFVTFDBTFT *GUIF3PMFT1PMJDZSBSFMZDIBOHFT • -FTTQSFDJTFBVEJUJOH
  22. *OUFHSBUFXJUI,FZTUPOF ⎯ "VUIFOUJDBUJPO$POWFSU"UIFO[ UPLFOUP,FZTUPOFUPLFOWJB,FZTUPOF GFEFSBUJPONBQQJOH ⎯ "VUIPSJ[BUJPO6QEBUFUP"UIFO[ JO'MBWB*".BOETZODISPOJ[F 1SJODJQBMTJO "UIFO[

    SPMFTXJUISPMFTJO,FZTUPOFJO0QFO4UBDL ⎯ $BODPOUJOVFUPVTF"UIFO[ BTBTJOHMFTPVSDFPGUSVUI 5IBOLTUP*BB45FBN 4PMVUJPO  3FTVMU "UIFO[ 'MBWB*". ,FZTUPOF 6QEBUF 4ZOD