Upgrade to Pro — share decks privately, control downloads, hide ads and more …

サーバレスVulsアーキテクチャ再び / serverless-vuls-again

サーバレスVulsアーキテクチャ再び / serverless-vuls-again

E8ac626646da35420ffba5da02f4787d?s=128

Shuichi Ohsawa

October 19, 2017
Tweet

Transcript

  1. αʔόϨεVulsΞʔΩςΫνϟ࠶ͼ VulsࡇΓ #3 Shuichi Ohsawa (@ohsawa0515) 1/9

  2. ࣗݾ঺հ • େᖒलҰ • http://blog.jicoman.info/ • @shu1_0515 • Sansanגࣜձࣾ •

    σʔλԽγεςϜͷΠϯϑϥΛ୲౰ • Πϯϑϥߏஙɾӡ༻ɾվળɺ։ൃج൫ͷվળͳͲ 2/9
  3. લճͷVulsࡇΓͰαʔόϨεͰVulsεΩϟϯ ͢Δ࿩Λ͠·ͨ͠ https://speakerdeck.com/ohsawa0515/vuls-serverless- architecture ࠓճ͸ͦͷଓ͖ʹ͍ͭͯ࿩͠·͢ɻ (εϥΠυݟ͍ͯͳ͍ਓ͸ཁνΣοΫ) 3/9

  4. CloudFormationςϯϓϨʔτͭ͘Γ·ͨ͠ ! • https://github.com/ohsawa0515/serverless-vuls • લճͷVulsࡇΓͷͱ͖ʹͳΔૣͰެ։͢Δͱݴ͍ͬͯ·͕ͨ͠ Α͏΍͘ެ։͠·ͨ͠ ! • READMEͱ͔ෆ଍͍ͯ͠Δͱ͜Ζ͕͋ΔͷͰޙʑ௥ه͍ͯ͠·

    ͢ 4/9
  5. 5/9

  6. KMSͰ҉߸Խɾ෮߸ • DBύεϫʔυɺSSHൿີ伴 • CloudFormationͷΧελϜϦιʔεͰ҉߸Խɾ෮߸ΛLambda ؔ਺Ͱ࣮ߦ • εΩϟϯ༻Lambdaؔ਺ʹ҉߸Խ͞ΕͨσʔλΛ؀ڥม਺Ͱ౉͠ ͯɺLambdaؔ਺಺Ͱ෮߸ 6/9

  7. Step FunctionsͰLambdaؔ਺ͷϧʔϓ࣮ߦ • go-cve-dictionary ͰCVE৘ใΛDBʹ֨ೲ͢Δ • Lambdaͷ࣮ߦ࣌ؒ(5෼)Λ௒͑ͳ͍Α͏ʹ1೥ຖʹ۠੾࣮ͬͯߦ 7/9

  8. ec2-vuls-config ͰεΩϟϯର৅Λબఆ • https://github.com/ohsawa0515/ec2-vuls-config • EC2λά(vuls:scan)Λ෇͚ͨΠϯελϯε৘ใΛVulsͷίϯϑΟάϑΝΠ ϧʹॻ͖ࠐΉ • Vuls v0.4.0

    ͔ΒσϑΥϧτͰ֎෦SSHΛ࢖͏Α͏ʹͳΓɺϗετΩʔν ΣοΫ͕ඞਢʹ • සൟʹEC2Πϯελϯε͕ೖΕସΘΔ؀ڥʹ͓͍ͯ͸૬ੑ͕ѱ͍ • -ssh-native-insecure ͰϗετΩʔνΣοΫ͕ೖΒͳ͍ 8/9
  9. ͥͻࢼͯ͠Έ͍ͯͩ͘͞ ! • όά͕͋Γ·ͨ͠ΒPR͍͚ͨͩΔͱॿ͔Γ·͢ ! ! • αϯϓϧ༻ͷεΩϟϯ؀ڥ(VPCɺEC2ͳͲ)Λߏங͢Δ CloudFormationςϯϓϨʔτ΋͋ΔͷͰ·ͬ͞ΒͳAWS؀ڥͰ ΋ࢼ͢͜ͱ͕Ͱ͖·͢ʂ

    9/9