Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS IAMポリシーのConditionを書くときの勘所

AWS IAMポリシーのConditionを書くときの勘所

IAMポリシーのConditionを使うことで柔軟な権限設計を実現できます。今回はこの Conditionを書くときに意識したい「キーの可用性」の話をします。

MasahiroKawahara

July 25, 2022
Tweet

More Decks by MasahiroKawahara

Other Decks in Technology

Transcript

  1. *".ϙϦγʔͷ
    $POEJUJPOΛॻ͘ͱ͖ͷצॴ
    dΩʔͷՄ༻ੑͷ࿩d

    "84ࣄۀຊ෦ ઒ݪ੐େ

    View full-size slide

  2. ૝ఆࢹௌऀ
    Ø *".Ϣʔβʔϩʔϧͷݖݶ؅ཧΛ͍ͯ͠Δਓ
    ü $POEJUJPOΛ࢖ͬͨॊೈͳݖݶઃܭΛݕ౼த
    Ø "84Λֶश͍ͯ͠Δਓ
    ü ϕʔγοΫͳ*".ϙϦγʔ͸ॻ͍ͨ͜ͱ͕͋Δ
    ü $POEJUJPOͷࡉ͔͍࢖͍ํΛ೺Ѳ͍ͨ͠
    3

    View full-size slide

  3. ໨࣍
    લఏ஌ࣝ
    ΩʔՄ༻ੑͷ࿩
    $POEJUJPOઃܭͷ࿩
    4

    View full-size slide

  4. 5
    લఏ஌ࣝ
    ✎τϐοΫ✎
    *".ϙϦγʔ ϦΫΤετίϯςΩετ
    ৚݅Ωʔ ϙϦγʔม਺
    $POEJUJPO۟

    View full-size slide

  5. 6
    *".ϙϦγʔ

    View full-size slide

  6. *".ϙϦγʔͱ͸
    ݖݶΛఆΊͨ΋ͷɻ+40/ܗࣜͰॻ͘
    Ø ୭͕ <1SJODJQBM>
    Ø ͲͷϦιʔεʹରͯ͠ <3FTPVSDF>
    Ø ͲͷΞΫγϣϯΛ <"DUJPO>
    Ø ೚ҙ
    Ͳͷ৚݅ԼͰ <$POEJUJPO>˞ࠓ೔ͷτϐοΫ
    Ø ڐՄڋ൱͢Δ͔ <&GGFDU>
    7

    View full-size slide

  7. *".ϙϦγʔཁૉͷΠϝʔδ
    ը૾"84ʹ͓͚Δ"#"$ͷخ͠͞ɺਏ͞ΛޠΓ·ͨ͠ ",*#""84c%FWFMPQFST*0
    8

    View full-size slide

  8. 9
    ϦΫΤετίϯςΩετ

    View full-size slide

  9. ϦΫΤετίϯςΩετͱ͸
    ϦΫΤετʹؔ͢Δ৘ใΛ·ͱΊͨ΋ͷ
    ڐՄڋ൱Λܾఆ͢ΔͨΊͷΠϯϓοτ
    10

    View full-size slide

  10. ϦΫΤετίϯςΩετͷΩʔ ৚݅Ωʔ
    ͱ͸
    ಛఆཁૉΛࢦͨ͢ΊͷΩʔ
    ৚݅Ωʔͱ΋ݺͿ ओʹ$POEJUJPO۟Ͱ࢖͏ͨΊ

    11

    View full-size slide

  11. ৚݅Ωʔͷछྨ
    छྨ͋Δ
    Ø άϩʔόϧ৚݅Ωʔ ྫ aws:username

    Ø αʔϏεݻ༗ͷ৚݅Ωʔ ྫ ec2:Vpc

    13

    View full-size slide

  12. άϩʔόϧ৚݅Ωʔ 14
    AWS グローバル条件コンテキストキー - AWS Identity and Access Management

    View full-size slide

  13. αʔϏεݻ༗ͷ৚݅Ωʔ
    ˞Ϧιʔε୯Ґ ΋͘͠͸ ΞΫγϣϯ YϦιʔε୯Ґ
    15
    AWS のサービスのアクション、リソース、および条件キー - サービス認証リファレンス

    View full-size slide

  14. 16
    ϙϦγʔม਺

    View full-size slide

  15. ϙϦγʔม਺
    ʮϦΫΤετίϯςΩετͷΩʔͷ஋ʯΛࢦ͢΋ͷ
    ͜ΕΛ*".ϙϦγʔͷ஋ʹࢦఆͰ͖Δ
    17

    View full-size slide

  16. 18
    $POEJUJPO۟

    View full-size slide

  17. *".ϙϦγʔͷ$POEJUJPO۟
    ϙϦγʔ͕ద༻ ڐՄڋ൱
    ͞ΕΔ৚݅Λهड़Ͱ͖Δ
    19

    View full-size slide

  18. $POEJUJPO׆༻ͷྫ
    Ø ৚݅Ωʔ
    Ø ৚݅Ωʔͷ஋
    Ø ৚݅ԋࢉࢠ
    20

    View full-size slide

  19. $POEJUJPO׆༻ͷྫ ৚݅Ωʔ
    Ø ৚݅Ωʔ
    Ø ৚݅Ωʔͷ஋
    Ø ৚݅ԋࢉࢠ
    21
    ϦΫΤετίϯςΩετͷΩʔ

    View full-size slide

  20. $POEJUJPO׆༻ͷྫ ৚݅Ωʔͷ஋
    Ø ৚݅Ωʔ
    Ø ৚݅Ωʔͷ஋
    Ø ৚݅ԋࢉࢠ
    22
    ۩ମతͳจࣈྻ਺஋ɺ΋͘͠
    ͸ϙϦγʔม਺

    View full-size slide

  21. $POEJUJPO׆༻ͷྫ ৚݅ԋࢉࢠ
    Ø ৚݅Ωʔ
    Ø ৚݅Ωʔͷ஋
    Ø ৚݅ԋࢉࢠ
    23
    ʮ৚݅Ωʔͷ஋ʯͱʮ࣮ࡍͷϦ
    ΫΤετίϯςΩετͷ஋ʯΛ
    Ͳͷج४Ͱൺֱ͢Δ͔

    View full-size slide

  22. ৚݅ԋࢉࢠͷྫ
    Ø จࣈྻͷൺֱ StringEquals/StringNotEquals
    Ø ਺஋ͷൺֱ NumericLessThan/NumericGreaterThan
    Ø ৚݅Ωʔͷ༗ແνΣοΫNull
    Ø ͳͲ
    24

    View full-size slide

  23. ࢀߟ
    ͲΕ͕৚݅ΩʔʁͲΕ͕ϙϦγʔม਺ʁ
    Ø ৚݅Ωʔ
    Ø $POEJUJPO۟Ͱ࢖͏
    Ø +40/ͷʮΩʔʯ෦෼Ͱ࢖͏
    Ø ϙϦγʔม਺
    Ø $POEJUJPO۟ ΋͘͠͸ 3FTPVSDF۟Ͱ࢖͏
    Ø +40/ͷʮΩʔͷ஋ʯ෦෼Ͱ࢖͏
    Ø ${} ͰׅΔ
    25

    View full-size slide

  24. ࢀߟ
    ϙϦγʔͷධՁ࿦ཧ"/% 03 26
    ը૾4όέοτϙϦγʔͷ۩ମྫͰֶͿ"84ͷ1PMJDZυΩϡϝϯτ c%FWFMPQFST*0

    View full-size slide

  25. 27
    ΩʔՄ༻ੑͷ࿩
    ✎τϐοΫ✎
    ΩʔͷՄ༻ੑ
    ৚݅Ωʔ͕ແ͍ͱ͖ͷڍಈ
    ϙϦγʔม਺͕ແ͍ͱ͖ͷڍಈ

    View full-size slide

  26. ͸͡Ίʹ·ͱΊ
    Ø ϦΫΤετίϯςΩετͷΩʔʹ͸Մ༻ੑ͕͋Δ
    Ø ࢦఆͨ͠৚݅Ωʔ͕ແ͍ͱ͖ɺෆҰக GBMTF
    ͱ͠
    ͯѻΘΕΔ
    ü ූ߸൓సܥͷ৚݅ԋࢉࢠͷ৔߹ɺUSVFʹͳΔ
    Ø ࢦఆͨ͠ϙϦγʔม਺͕ແ͍ͱ͖ɺͦͷεςʔτ
    ϝϯτ͸ແޮʹͳΔ
    28

    View full-size slide

  27. 29
    ΩʔͷՄ༻ੑ

    View full-size slide

  28. ΩʔͷՄ༻ੑʁ
    ϦΫΤετͷ಺༰࣍ୈͰɺಛఆΩʔ͕
    ଘࡏ͢Δέʔεɺଘࡏ͠ͳ͍έʔε͕͋Δ
    30

    View full-size slide

  29. ΩʔͷՄ༻ੑͷௐ΂ํ άϩʔόϧ৚݅Ωʔ
    υΩϡϝϯτʹهࡌ
    31
    AWS グローバル条件コンテキストキー #aws:ResourceTag - AWS Identity and Access Management

    View full-size slide

  30. ΩʔͷՄ༻ੑͷௐ΂ํ αʔϏεݻ༗ͷ৚݅Ωʔ
    Ϧιʔε୯Ґ ΋͘͠͸ΞΫγϣϯ º Ϧιʔε୯ҐͰՄ༻ੑ͕ܾఆ
    32
    AWS のサービスのアクション、リソース、および条件キー - サービス認証リファレンス

    View full-size slide

  31. Ωʔແ͍ͱ͖ͷڍಈΛ೺Ѳ͠Α͏
    Ø ࢦఆͨ͠ʮ৚݅Ωʔʯ͕ແ͍ͱ͖
    Ø ࢦఆͨ͠ʮϙϦγʔม਺ʯ͕ແ͍ͱ͖
    33

    View full-size slide

  32. Ωʔແ͍ͱ͖ͷڍಈΛ೺Ѳ͠Α͏
    Ø ࢦఆͨ͠ʮ৚݅Ωʔʯ͕ແ͍ͱ͖
    Ø ࢦఆͨ͠ʮϙϦγʔม਺ʯ͕ແ͍ͱ͖
    34

    View full-size slide

  33. ࢦఆͨ͠ʰ৚݅Ωʔʱ͕ແ͍ͱ͖ͷڍಈ
    ෆҰக GBMTF
    ͱͯ͠ѻΘΕΔ
    35

    View full-size slide

  34. ࢦఆͨ͠ʰ৚݅Ωʔʱ͕ແ͍ͱ͖ͷڍಈ
    ⾠ ͨͩ͠ʮNot ৚݅ԋࢉࢠʯͷ৔߹͸ USVF ʹͳΔ
    36

    View full-size slide

  35. Ωʔແ͍ͱ͖ͷڍಈΛ೺Ѳ͠Α͏
    Ø ࢦఆͨ͠ʮ৚݅Ωʔʯ͕ແ͍ͱ͖
    Ø ࢦఆͨ͠ʮϙϦγʔม਺ʯ͕ແ͍ͱ͖
    37

    View full-size slide

  36. ࢦఆͨ͠ʰϙϦγʔม਺ʱ͕ແ͍ͱ͖ͷڍಈ
    ⾠ εςʔτϝϯτ͕ແޮʹͳΔ
    38

    View full-size slide

  37. 39
    ͜͜Ͱ໰୊

    View full-size slide

  38. ͜͜Ͱ໰୊
    ʲέʔεʳ ʲέʔεʳ͸ %FOZ͞ΕΔ PS͞Εͳ͍ʁ
    40

    View full-size slide

  39. ͜͜Ͱ໰୊
    ʲέʔεʳ ʲέʔεʳ͸ %FOZ͞ΕΔ PS͞Εͳ͍ʁ
    41
    ʮϓϦϯγύϧ ϩʔϧ
    ͷ 1SPKFDUλά஋ʯͱ
    ʮϦιʔε &$
    ͷ 1SPKFDUλά஋ʯ͕
    Ұக͠ͳ͍ͱ͖ʹ
    &$ΠϯελϯεͷىಈఀࢭΛڋ൱͢Δ

    View full-size slide

  40. ͜͜Ͱ໰୊
    ʲέʔεʳ ʲέʔεʳ͸ %FOZ͞ΕΔ PS͞Εͳ͍ʁ
    42
    ʲέʔεʳ
    ϩʔϧʹ1SPKFDUλάΛ෇͚๨Εͨ

    View full-size slide

  41. ͜͜Ͱ໰୊
    ʲέʔεʳ ʲέʔεʳ͸ %FOZ͞ΕΔ PS͞Εͳ͍ʁ
    43
    ʲέʔεʳ
    Πϯελϯεʹ1SPKFDUλάΛ෇͚๨Εͨ

    View full-size slide

  42. ͜͜Ͱ໰୊
    ʲέʔεʳ ʲέʔεʳ͸ %FOZ͞ΕΔ PS͞Εͳ͍ʁ
    44

    View full-size slide

  43. ·ͣ౴͑
    ʲέʔεʳ͸%FOZ͞ΕΔ ʲέʔεʳ͸%FOZ͞Εͳ͍
    45

    View full-size slide

  44. ʲέʔεʳ͸%FOZ͞ΕΔ
    ৚݅Ωʔ͕ແ͍ঢ়ଶͳͷͰ
    ෆҰக GBMTF
    ѻ͍

    ͨͩɺ৚݅ԋࢉࢠ͸
    StringNotEquals

    ූ߸൓సͷ৚݅ԋࢉࢠͳͷͰɺ
    USVF ʹͳΔ

    ϙϦγʔ͸࣮ߦ %FOZ

    46

    View full-size slide

  45. ʲέʔεʳ͸%FOZ͞Εͳ͍
    ϙϦγʔม਺͕ແ͍ঢ়ଶ

    εςʔτϝϯτ͸ແޮ

    ϙϦγʔ͸࣮ߦ͞Εͳ͍
    %FOZ͞Εͳ͍

    47

    View full-size slide

  46. 48
    $POEJUJPOઃܭͷ࿩
    ✎τϐοΫ✎
    IfExists, Null,
    ϙϦγʔม਺ͷσϑΥϧτ஋

    View full-size slide

  47. 49
    ৚݅ΩʔΛߟྀͨ͠
    $POEJUJPOઃܭ

    View full-size slide

  48. ৚݅Ωʔͷ৔߹
    Ωʔ͕ແ͍ͱ͖ͷʮϙϦγʔΛ࣮ߦ͢Δ͠ͳ͍ʯΛ
    ίϯτϩʔϧ͠Α͏ʂ
    Ø USVF ϙϦγʔΛ࣮ߦ͢Δ
    ͱ͍͔ͨ͠
    Ø GBMTF ϙϦγʔΛ࣮ߦ͠ͳ͍
    ͱ͍͔ͨ͠
    50

    View full-size slide

  49. ʮ৚݅Ωʔ͕ແ͍ʯͱ͖ʹ USVF ʹ͢Δ
    ...IfExists ৚݅ԋࢉࢠΛ࢖͓͏ʂ
    Ø NullΛআ͘
    શͯͷ৚݅ԋࢉࢠͷ຤ඌʹ௥ՃՄೳ
    ü ৚݅Ωʔ͕ແ͍ͱ͖ʹ USVF ͱͳΔ
    51
    ✎ϙΠϯτ✎
    ʮ৚݅ԋࢉࢠʹࠨӈ͞Εͳ͍ʯ

    View full-size slide

  50. ʮ৚݅Ωʔ͕ແ͍ʯͱ͖ʹ GBMTF ʹ͢Δ
    “Null”: {“key”: false} Λ௥ه͠Α͏ʂ
    Ø Null͸ ৚݅Ωʔͷଘࡏ൑ఆͰ࢖͑Δ৚݅ԋࢉࢠ
    ü ஋͸ USVF Ωʔ͕ଘࡏ͠ͳ͍
    ·ͨ͸ GBMTF Ωʔ͕ଘࡏ͢Δ

    52
    ✎ϙΠϯτ✎
    ʮ৚݅ԋࢉࢠʹࠨӈ͞Εͳ͍ʯ

    View full-size slide

  51. 53
    ϙϦγʔม਺Λߟྀͨ͠
    $POEJUJPOઃܭ

    View full-size slide

  52. ϙϦγʔม਺ͷ৔߹
    Ωʔ͕ແ͍ͱ͖ͷڍಈΛίϯτϩʔϧ͠Α͏ʂ
    Ø σϑΥϧτ஋ͷࢦఆ
    Ø Null ͷ໌ࣔతͳهࡌ
    54

    View full-size slide

  53. ϙϦγʔม਺ͷ σϑΥϧτ஋ ࢦఆ
    Ωʔ͕ແ͍ͱ͖ͷσϑΥϧτ஋ΛࢦఆՄೳ
    ॻ͖ํ${key,‘default-value’}
    55
    ✎ϙΠϯτ✎
    ʮεςʔτϝϯτແޮԽΛճආʯ

    View full-size slide

  54. Null ͷ໌ࣔతͳهࡌ
    Null Λ໌ࣔతʹهࡌͯ͠
    ʮΩʔ͕͋ΔલఏͷεςʔτϝϯτʯΛࣔ͢
    56
    ✎ϙΠϯτ✎
    ʮϙϦγʔ࣮ߦ৚݅Λ໌ࣔతʹهࡌʯ

    View full-size slide

  55. Null ͷ໌ࣔతͳهࡌ 57
    ➥Ωʔ͕ͳ͍ͱ͖
    Ø /VMMͷ෦෼Ͱ GBMTFͱͳΔ
    Ø ͜ͷ࣌఺Ͱ $POEJUJPO෦෼͕ GBMTFʹͳ
    Δ͜ͱ͕֬ఆ͢Δ˞
    Ø ϙϦγʔ͸࣮ߦ͞Εͳ͍
    ➥Ωʔ͕ͳ͍ͱ͖
    Ø ϙϦγʔม਺ʹࢦఆͨ͠Ωʔ͕ແ͍
    Ø εςʔτϝϯτ͕ແޮʹͳΔ
    Ø ϙϦγʔ͸࣮ߦ͞Εͳ͍
    ˞$POEJUJPO͸શ৚݅ͷ"/%Ͱ
    ධՁ͞ΕΔͨΊ

    View full-size slide

  56. ·ͱΊ
    ΩʔͷՄ༻ੑͱڍಈͷ࿩
    Ø ϦΫΤετίϯςΩετͷ
    Ωʔʹ͸Մ༻ੑ͕͋Δ
    Ø ৚݅Ωʔ͕ແ͍ͱ͖͸
    ෆҰக GBMTF

    ü /PUܥͷ৔߹͸ USVF
    Ø ϙϦγʔม਺͕ແ͍ͱ͖͸
    εςʔτϝϯτແޮ
    59
    ϙϦγʔม਺ ੍ޚͷ࿩
    Ø σϑΥϧτ஋ͷࢦఆ
    Ø Nullͷ໌ࣔతͳهࡌ
    ৚݅Ωʔ ੍ޚͷ࿩
    Ø USVFʹ͍ͨ͠ͱ͖͸ IfExists
    Ø GBMTFʹ͍ͨ͠ͱ͖͸ Null

    View full-size slide

  57. ࢀߟ
    • "84
    • "84άϩʔόϧ৚݅ίϯςΩετΩʔ "84*EFOUJUZBOE"DDFTT.BOBHFNFOU
    • "84ͷαʔϏεͷΞΫγϣϯɺϦιʔεɺ͓Αͼ৚݅Ωʔ αʔϏεೝূϦϑΝϨϯε
    • *".+40/ϙϦγʔཁૉ৚݅ԋࢉࢠ "84*EFOUJUZBOE"DDFTT.BOBHFNFOU
    • ϙϦγʔͷཁૉม਺ͱλά "84*EFOUJUZBOE"DDFTT.BOBHFNFOU
    • %FWFMPQFST*0
    • 4όέοτϙϦγʔͷ۩ମྫͰֶͿ"84ͷ1PMJDZυΩϡϝϯτ c%FWFMPQFST*0
    • ʲ"84*".ʳ$POEJUJPOͷ৚݅Ωʔ΍ϙϦγʔม਺͸Մ༻ੑΛҙࣝ͠Α͏ʂͱ͍͏࿩ c
    %FWFMPQFST*0
    • খωλ"84*".ϙϦγʔͷ $POEJUJPOͰ࢖͑Δ৚݅ԋࢉࢠ l/VMMzͷ࢖͍ΈͪΛߟ͑Δ c
    %FWFMPQFST*0
    • "84ʹ͓͚Δ"#"$ͷخ͠͞ɺਏ͞ΛޠΓ·ͨ͠ ",*#""84c%FWFMPQFST*0
    61

    View full-size slide