CloudTrail の証跡から IAM ポリシーを生成する IAM Access Analyzer の機能を AWS CLI から使ってみた話 /jawsug-asa-20-lt

JAWS UG 朝会 #20 の LT 資料です。
https://jawsug-asa.connpass.com/event/208498/

スライドの詳細
CloudTrail の証跡から IAM ポリシーを作成する IAM Access Analyzer の新機能を AWS CLI で試す - michimani.net
https://michimani.net/post/aws-get-started-generating-iam-policies-based-on-actual-activity/

Transcript

1. 2021.04.22
   @michimani210
   CloudTrail IAM
   IAM Access Analyzer
   AWS CLI
   [JAWS-UG #20]
   #jawsug_asa
   

   View Slide

2. #
   # AWS
   AWS CLI
   AWS Certificate Manager
   #
   : https://michimani.net
   / Yoshihiro Ito
   @michimani210
   

   View Slide

3. 1. IAM Access Analyzer
   2. AWS CLI
   3.
   IAM Access Analyzer
   CloudTrail
   

   View Slide

4. 1. IAM Access Analyzer
   CloudTrail IAM
   IAM
   90
   ( )
   IAM JSON
   

   IAM Access Analyzer makes it easier to implement least privilege permissions by generating IAM policies based on access activity
   https://aws.amazon.com/about-aws/whats-new/2021/04/iam-access-analyzer-easier-implement-least-privilege-permissions-generating-iam-policies-access-activity
   

   View Slide

5. 2. AWS CLI
   IAM Access Analyzer
   aws accessanalyzer
   
   
   ・cancel-policy-generation
   
   
   ・get-generated-policy
   
   
   ・list-policy-generations
   
   
   ・start-policy-generation
   
   
   v1 1.19.47 v2 2.1.36
   (2021/04/22 07:40 JST) 1.19.55 2.1.39
   

   View Slide

6. 2. AWS CLI - start-policy-generation
   start-policy-generation
   CloudTrail ARN
   IAM IAM ARN
   

   View Slide

7. 2. AWS CLI - start-policy-generation
   1: IAM ( ) ARN
   AWS CLI ARN
   

   View Slide

8. 2. AWS CLI - start-policy-generation
   2: JSON
   

   View Slide

9. 2. AWS CLI - start-policy-generation
   2: JSON
   IAM ARN
   

   View Slide

10. 2. AWS CLI - start-policy-generation
    2: JSON
    IAM ARN
    ( 90 )
    endTime
    

    View Slide

11. 2. AWS CLI - start-policy-generation
    2: JSON
    IAM ARN
    CloudTrail ARN
    ( 90 )
    endTime
    

    View Slide

12. 2. AWS CLI - start-policy-generation
    2: JSON
    IAM ARN
    CloudTrail ARN
    ( 90 )
    endTime
    

    View Slide

13. 2. AWS CLI - start-policy-generation
    

    View Slide

14. 2. AWS CLI - get-generated-policy
    

    View Slide

15. 2. AWS CLI - get-generated-policy
    

    View Slide

16. 2. AWS CLI - get-generated-policy
    

    View Slide

17. 2. AWS CLI - get-generated-policy
    (JSON )
    

    View Slide

18. 2. AWS CLI - get-generated-policy
    (JSON )
    jq
    &
    

    View Slide

19. 2. AWS CLI - get-generated-policy
    (JSON )
    jq
    &
    : ReadOnly s3:PutObject
    s3:PutObject
    

    View Slide

20. 2. AWS CLI - get-generated-policy
    (JSON )
    jq
    &
    : ReadOnly s3:PutObject
    s3:PutObject
    

    View Slide

21. 2. AWS CLI - get-generated-policy
    (JSON )
    jq
    &
    : ReadOnly s3:PutObject
    s3:PutObject
    aws iam create-policy
    aws iam attach-role-policy
    

    View Slide

22. 3.
    IAM Access Analyzer
    CloudTrail
    AWS CLI
    #
    CloudTrail IAM IAM Access Analyzer AWS CLI
    https://michimani.net/post/aws-get-started-generating-iam-policies-based-on-actual-activity/
    

    View Slide

23. #jawsug_asa
    

    View Slide