AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-least-privilege

ӡ༻ઃܭϥϘ߹ಉձࣾ Operation Lab ӡ༻ઃܭϥϘ "84Ͱz࠷খݖݶͷݪଇzΛ࣮ݱ͢ΔͨΊͷߟ͑ํ 1 γχΞΞʔΩςΫτ೾ా໺༟Ұ TTNPOMJOF

Operation Lab ӡ༻ઃܭϥϘ 2 ʮ࠷খݖݶͷݪଇʯ 5IFQSJODJQMFPGMFBTUQSJWJMFHF ࣮ફ͍ͯ͠·͔͢ ʮԿɺͦΕɺ͓͍͍͠ͷ ʯ ʮฉ͍ͨ͜ͱ͸͋Δ͚ͲɺΑ͘Θ͔ΒΜʯ
ʮ஌͍ͬͯΔ͚Ͳɺ࣮ࡍ͸ແཧͩΑͶʯ ·ͣ͸ ͱ͔͔ͬΓΛ ࡞Γ·͠ΐ͏

Operation Lab ӡ༻ઃܭϥϘ 8IPBN* 3 +"846($-*ઐ໳ࢧ෦ࢧ෦௕ +"846(ΞʔΩςΫνϟઐ໳ࢧ෦ӡӦ +"846(ேձӡӦ ೾ా໺༟Ұ "84$PNNVOJUZ)FSP
ʙ "844BNVSBJ ݸਓ "844BNVSBJ $-*ઐ໳ࢧ෦ ೔ຊ.41ڠձಛผձһ ʙ ࠓ೥લ൒ʹશ෦ࣦޮ༧ఆͰ͕ͨ͠ɺແࣄߋ৽͠·ͨ͠ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ

Operation Lab ӡ༻ઃܭϥϘ ΞδΣϯμ 4 ʮ࠷খݖݶͷݪଇʯͱ͸ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ઃܭ໘Ͱͷલఏ ஌ࣝ໘Ͱͷલఏ ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ
·ͱΊ

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯͱ͸ 5

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯͱ͸ 6 ʮ࠷খݖݶͷݪଇʯͱ͸ IUUQTEPDTBXTBNB[PODPNKB@KQXFMMBSDIJUFDUFEMBUFTUTFDVSJUZQJMMBSTFD@QFSNJTTJPOT@MFBTU@QSJWJMFHFTIUNM IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNMHSBOUMFBTUQSJWJMFHF

Operation Lab ӡ༻ઃܭϥϘ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ 7

Operation Lab ӡ༻ઃܭϥϘ *".ʹΑΔ"84"1*ͷΞΫηε੍ޚ 8 *".͕"84"1*΁ͷΞΫηε੍ޚΛ୲͏ *". "84 Ϧιʔε ར༻ऀ
֎෦ Ϧιʔε "84 "1* ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO ΄΅શͯͷ"84"1*ϦΫϦετ͸ *".Λհ࣮ͯ͠ߦ͞ΕΔ "1*ΞΫγϣϯ୯ҐͰ͖Ίࡉ੍͔͘ޚՄೳ 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε ϧʔτΞΧ΢ϯτͷϦΫΤετ͸*".Λܦ༝͠ͳ͍ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷

Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ͷجຊߏ଄ 9 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε
ϓϦϯγύϧ *".ΤϯςΟςΟ ਎ݩ؅ཧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ *".ϩʔϧ *".Ϣʔβʔ "84 "1* ݺͼग़͞ΕΔଆ ೝՄ ΞΫηε؅ཧ "VUIPSJ[BUJPO ೝՄ͞ΕͨϦΫΤετ ͚͕࣮ͩߦ͞ΕΔ *".ϙϦγʔ ΠϯϥΠϯ ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ ڥք *".ΞΠσϯςΟςΟ *".ϩʔϧ *".Ϣʔβʔ *".άϧʔϓ *".ϙϦγʔͷ ׂΓ౰ͯઌ ຊਓ ࣮ମ ࣝผࢠ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷

Operation Lab ӡ༻ઃܭϥϘ *".͸ʮ࠷খݖݶͷݪଇʯΛ࣮ݱ͢Δ࣮૷Λఏڙ͍ͯ͠Δ 10 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε
͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ { "Sid": "AllowCreateNetworkInterfaceWithCloudShellTag", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "ManagedByCloudShell" } } }, FD"1*ͷΞΫγϣϯͷ͏ͪ ͚ͭͩΛࢦఆ͍ͯ͠Δɻ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷

Operation Lab ӡ༻ઃܭϥϘ "84͸ʮ࠷খݖݶͷݪଇʯͷ࣮ફΛར༻ऀʹҕͶ͍ͯΔ 11 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε
͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ͔Ͳ͏͔͸ɺ ར༻ऀͷϦεΫ൑அʹҕͶΒΕ͍ͯΔɻ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͠ͳ͍ϦεΫ 12 "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ηΩϡϦςΟΠϯγσϯτͷӨڹ͕க໋తʹͳΔ ΦϖϨʔγϣϯϛε͕ࣄނʹ௚݁͢Δ • ݖݶΛୣΘΕͨ৔߹ʹɺ෯޿͍ݖݶΛѱ༻͞Εͯ͠·͏ɻ
• ݖݶΛୣΘΕͨ࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ • ؒҧͬͨૢ࡞ɺ૝ఆ֎ͷૢ࡞Ͱ΋ɺݖݶ͕͋ΔͨΊʹͦͷ··࣮ߦ͞Εͯ͠·͏ɻ • ΦϖϛεΛͨ͠࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢΂͖ཧ༝ 13 "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ηΩϡϦςΟΠϯγσϯτͷӨڹ͕க໋తʹͳΔ͜ͱΛճආ͢Δɻ ΦϖϨʔγϣϯϛε͕ࣄނʹ௚݁͢Δ͜ͱΛճආ͢Δɻ Ϗδωε΍૊৫ͷ๷Ӵ ࣄނ๷ࢭɾ࡞ۀऀอޢ
"84"1*΍*".ͷ஌ࣝΛݻΊͯɺͰ͖Δͱ͜Ζ͔Β࣮૷ɾ࣮ફ͍ͯ͘͠ ཧ༝ ཧ༝

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊͷલఏ 14 "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ར༻ऀͷʮ஌ࣝ໘ʯͰͷલఏ ར༻ऀͷʮ࣮૷໘ʯͰͷલఏ • "84"1*ͷ஌ࣝ
• ૢ࡞ର৅Ϧιʔεͷಛఆ • "84ͷ֤छϙϦγʔͷ஌ࣝ • ʮ6/*9ͷߟ͑ํʯͷ࣮ફ • ඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭ • ೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ 15

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏʮ6/*9ͷߟ͑ํʯʹجͮ͘ઃܭ େલఏ 16 ઃܭ໘Ͱͷલఏ ࠷΋6/*9తͳߟ͑ํ͸ ʮҰͭ ͚ͩ
ͷ͜ͱΛ͏·͘΍ΒͤΔʯ ͜ͱ ఆཧ ͭͷʮ*".Ϣʔβʔʯ΍ʮ*".ϩʔϧʯʹ ͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭ *".ϩʔϧ *".Ϣʔβʔ ͭͷ*".Ϣʔβʔʹ ৭ʑͳ͜ͱΛͤ͞ͳ͍ ͭͷ*".ϩʔϧʹ ৭ʑͳ͜ͱΛͤ͞ͳ͍

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭ 17 ઃܭ໘Ͱͷલఏ ΠϯλϥΫςΟϒར༻ ඇΠϯλϥΫςΟϒར༻ • ਓ͕ࢼߦࡨޡ͠ͳ͕Βૢ࡞͢ΔͨΊʹ࢖͏ɻ
• ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠ʹ͍͘ɻ • εΫϦϓτ΍-BNCEBؔ਺ͷ࣮ߦͳͲʹ࢖͏ • ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠΍͍͢ɻ ඇΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧͱ ΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧΛ෼͚Δɻ ࠷খݖݶͷݪଇʹ४ڌՄೳ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇΠϯλϥΫςΟϒ༻ *".ϩʔϧ ඇΠϯλϥΫςΟϒ༻ *".Ϣʔβʔ ΠϯλϥΫςΟϒ༻ *".ϩʔϧ ΠϯλϥΫςΟϒ༻ *".Ϣʔβʔ ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ

Operation Lab ӡ༻ઃܭϥϘ "84 "84 ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷ֦େ ྫ 18 ઃܭ໘Ͱͷલఏ ॲཧ಺༰ΛΫϥΠΞϯτଆͰ੍ޚ
ΠϯλϥΫςΟϒʹ͍ۙ ॲཧ಺༰Λ-BNCEBؔ਺Խ੍ͯ͠ޚ ඇΠϯλϥΫςΟϒԽ ॲཧΛ"84αʔϏεʹҠస͢Δ͜ͱͰ "84֎෦ͰඞཁͱͳΔݖݶΛ཈੍͢Δ͜ͱ͕Ͱ͖Δ ख࡞ۀ΍ ෳࡶͳεΫϦϓτ "84 "1* ଟ༷ͳΞΫγϣϯʹର͢Δݖݶ͕ඞཁ ΩοΫεΫϦϓτ "84 "1* -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ -BNCEB ؔ਺ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷྫ 19 ઃܭ໘Ͱͷલఏ "84 ΩοΫεΫϦϓτ -BNCEB ؔ਺
ར༻ऀ ηΩϡϦςΟ άϧʔϓ &$ Πϯελϯε 44) ΞΫηεݩ*1ΞυϨεΛ ఻͑ͯJOWPLF͢Δ͚ͩ ΞΫηεݩ*1ΞυϨε͔Βͷ ΞΫηεڐՄϧʔϧΛ௥Ճ ಉ࣌ʹطଘͷڐՄΛશ࡟আ ॾൠͷࣄ৘ͰηογϣϯϚωʔδϟʔ ࢖͍ͬͯ·ͤΜ -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷϙϦγʔྫ 20 ઃܭ໘Ͱͷલఏ { "Version": "2012-10-17", "Statement":
[ { "Sid": "Invoke", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:ap-northeast-1:XXXXXXXXXXXX:function:update-port-ssh" } ] } "84 ΩοΫεΫϦϓτ -BNCEB ؔ਺

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭ 21 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε
ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ "84 "1* ݺͼग़͞ΕΔଆ ೝՄ "VUIPSJ[BUJPO *".ϙϦγʔ ΠϯϥΠϯ ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ ڥք ࡞ۀ$༻ *".ϩʔϧ ࡞ۀ"༻ *".ϩʔϧ ઃܭ໘Ͱͷલఏ ࡞ۀ#༻ *".ϩʔϧ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯ༻ *".Ϣʔβʔ "84ΞΧ΢ϯτ௚઀ ඇਪ঑

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏೝূ໨తͷϩʔϧ 22 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε
ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ αΠϯΠϯ༻ *".Ϣʔβʔ ઃܭ໘Ͱͷલఏ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ "84ΞΧ΢ϯτ௚઀ ඇਪ঑ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ ύεϫʔυมߋ .'"ઃఆ Ҏ֎͸ڐՄ͠ͳ͍ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ Ҏ֎͸ڐՄ͠ͳ͍ ೝূ໨త ΋͠*".ϢʔβʔΛ࢖͏ͳΒ͹

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏೝՄ໨తͷϩʔϧ 23 ೝՄ "VUIPSJ[BUJPO ࡞ۀ$༻ *".ϩʔϧ ࡞ۀ"༻
*".ϩʔϧ ઃܭ໘Ͱͷલఏ ࡞ۀ#༻ *".ϩʔϧ ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝՄ໨త ͦΕͧΕͷ࡞ۀʹඞཁͳ • ࠷খݶͷαʔϏεͷ • ࠷খݶͷΞΫγϣϯΛ • ࠷খݶͷϦιʔεʹରͯ͠ • ݶఆ͞Εͨ৚݅ԼͰ ڐՄ͢Δɻ "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ αΠϯΠϯ༻ *".Ϣʔβʔ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ "84ΞΧ΢ϯτ௚઀ ඇਪ঑ ೝূ໨త ࡞ۀ಺༰ʹԠͯ͡ඃΔ๧ࢠ ϩʔϧ Λ ม͑ΔΠϝʔδ ࣄނ๷ࢭɾ࡞ۀऀอޢ ؍఺ͷઃܭ͔Β͸͡ΊΔ

Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ ·ͱΊ 24 ઃܭ໘Ͱͷલఏ ͭͷ*".ΤϯςΟςΟ *".Ϣʔβʔ΍*".ϩʔϧ ʹ
͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭΛ͢Δ ೝূ "VUIFOUJDBUJPO "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ ೝՄ "VUIPSJ[BUJPO ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯͱ ϩʔϧҾड͚͚ͩͷ *".ϩʔϧ ඇΠϯλϥΫςΟϒ໨తͷ *".ϩʔϧ ϙϦγʔ ΠϯλϥΫςΟϒ໨తͷ *".ϩʔϧ ϙϦγʔ ࠷খݖݶͷݪଇʹ४ڌՄೳ ࠷খݖݶͷݪଇ ʹ४ڌ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇਪ঑͕ͩ*".Ϣʔβʔ΋ ೥ࠒ͔Βݸਓతʹ ͜ͷΑ͏ͳઃܭΛ͍ͯ͠·͢ɻ *".*EFOUJUZ$FOUFSҠߦத ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ ࣄނ๷ࢭɾ࡞ۀऀอޢ ؍఺ͷઃܭ͔Β͸͡ΊΔ

Operation Lab ӡ༻ઃܭϥϘ ࢀߟ$36%ͱϦεΫϨϕϧ 25 ઃܭ໘Ͱͷલఏ ࡞ۀͷओ໨త͕$36%ͷ͍ͣΕͳͷ͔ʹΑͬͯϦεΫΛධՁ͢Δ ӡ༻ࣗಈԽର৅ͷબఆʹ͓͍ͯ΋༗ޮͳධՁج४ ϦεΫϨϕϧ ϦεΫϨϕϧ
ϦεΫϨϕϧ 3FBE $SFBUF 6QEBUF %FMFUF جຊతʹ͸௿ϦεΫ ηΩϡϦςΟ؍఺Ͱ͸৘ใ࿙ӮϦεΫΛՃຯ͢Δඞཁ͕͋Δ தϦεΫ ޡ࡞੒ʹରͯ͠͸ɺ࡟আ͢Ε͹Өڹ͠ͳ͍৔߹΋ଟ͍ɻ ߴϦεΫ ޡ࡟আʹରͯ͠͸ɺ࠶࡞੒͢Ε͹Өڹ͕ݶఆతͳ৔߹΋͋Δ͕ɺ ޡߋ৽ʹ͍ͭͯ͸ɺ༰қʹ෮چͰ͖ͳ͍৔߹΋͋ΔͨΊɺ ߋ৽ͱ࡟আͷͲͪΒ͕ϦεΫߴ͍͔Ұ֓ʹ͸ݴ͑ͳ͍ɻ ϩʔϧͷݖݶʹ͍ͭͯ΋ɺҟͳΔϦεΫϨϕϧͷ΋ͷΛࠞͥͳ͍

Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ͷݖݶΛ҆қʹ෇༩͠ͳ͍ 26 ઃܭ໘Ͱͷલఏ ࣗ෼ࣗ਎ͷೝূ৘ใΛૢ࡞͢ΔΞΫγϣϯ *".αʔϏεͷDSFBUFVQEBUFEFMFUFܥ"1*ΞΫγϣϯ͸ ݪଇͱͯ͠*".؅ཧऀҎ֎ʹ͸ڐՄ͠ͳ͍ɻ ϧʔτϢʔβʔʹ͔͠Ͱ͖ͳ͍͜ͱҎ֎ͷ
શͯͷݖݶͷ෇༩΍ണୣΛͰ͖Δɻ ࣗ෼ࣗ਎ͷݖݶΛࣗࡏʹมߋͰ͖Δɻ *".'VMM"DDFTT *".؅ཧऀ༻ϙϦγʔ க໋తɾഁյతͳૢ࡞͕؆୯ʹ࣮ࢪͰ͖ͯ͠·͏ɻ ྫ֎ αΠϯΠϯ༻ *".Ϣʔβʔ ύεϫʔυมߋ .'"ઃఆ ॳظύεϫʔυͷڧ੍มߋ΍.'"ڧ੍Λ͢Δ্ͰඞཁͱͳΔɻ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ 27

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84"1*ͷ஌ࣝ 28 ஌ࣝ໘Ͱͷલఏ 383 APIs 15319 Actions
ग़య"84$-*ެࣜϦϑΝϨϯε ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ "84Λ"1*αʔϏεͱͯ͠ཧղ͢Δ͜ͱ͕ෆՄܽ ͭ·Γ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘ͰͷલఏϚωδϝϯτίϯιʔϧͷཪଆ 29 ஌ࣝ໘Ͱͷલఏ (6* "84 "1* ΦϖϨʔλʔ
Ϛωδϝϯτίϯιʔϧ 383 APIs 15319 Actions Ϛωδϝϯτίϯιʔϧͷૢ࡞ͷཪଆͰ͸"1*͕ݺͼग़͞Ε͍ͯΔ Ϛωδϝϯτίϯιʔϧ͔Β "1*ݺͼग़͠಺༰͸ݟ͑ͳ͍ ݱঢ় Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸ ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍

Operation Lab ӡ༻ઃܭϥϘ (6* $-* ϓϩάϥϜίʔυ Ϛωδϝϯτίϯιʔϧ ஌ࣝ໘Ͱͷલఏ"84"1*ͷ௚઀తͳར༻ɾཧղ 30 ஌ࣝ໘Ͱͷલఏ
"84 "1* ΦϖϨʔλʔ 383 APIs 15319 Actions "84$-*4%,͸"84"1*Λ௚઀తʹૢ࡞͢Δɻ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊʹ͸ "84$-*4%,Ͱ௚઀తʹ"84"1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ͲͷΑ͏ͳͱ͖ʹ ͲΜͳ"1*ΞΫγϣϯΛߦ͏͔ཧղ͍ͯ͠Δ ίϯϐϡʔςΟϯά Ϧιʔε "84$-* "844%,

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏૢ࡞ର৅Ϧιʔεͷಛఆ 31 ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ
"84$-*Ͱͷૢ࡞खॱͳͲʹΑΓɺඞཁͳΞΫγϣϯΛಛఆ͢Δɻ ΞΫγϣϯͷૢ࡞ର৅ͱͳΔϦιʔεΛಛఆ͢Δɻ ໋໊نଇͷ੔උͳͲʹΑΓɺݫີʹಛఆͰ͖ΔΑ͏ʹ޻෉͢Δɻ ઀಄ࣙ΍઀ඌࣙɺλάͳͲ ૢ࡞ର৅Ϧιʔεʹ͍ͭͯɺͲͷཻ౓ͰΞΫηε੍ޚͰ͖Δͷ͔Λ֬ೝ͢Δɻ ૢ࡞ର৅ϦιʔεͷϥΠϑαΠΫϧΛ೺Ѳ͠ɺӬଓతͳϦιʔεͷഁյతͳૢ࡞͸ڐՄ͠ͳ͍ͳͲͷݕ౼Λߦ͏ɻ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏૢ࡞ର৅Ϧιʔεͷྫ $MPVE'SPOU 32 ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ { "Version":
"2012-10-17", "Statement": [ { "Sid": "", "Action": [ "cloudfront:CreateInvalidation", "cloudfront:GetInvalidation", "cloudfront:ListDistributions", "cloudfront:ListInvalidations", "cloudfront:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" } ] } ੲ͸ɺσΟετϦϏϡʔγϣϯ୯ҐͰ ੍ޚͰ͖ͳ͔ͬͨɻ ଞͷσΟετϦϏϡʔγϣϯͷΩϟογϡແޮԽ͕Մೳ $%/ͷΩϟογϡແޮԽΛߦ͏ͨΊͷΞΫγϣϯͷڐՄ ݱࡏ͸ arn:${Partition}:cloudfront::${Account}:distribution/${DistributionId} Ͱର৅ϦιʔεΛࢦఆͰ͖Δɻ $%/ͷΩϟογϡແޮԽͷૢ࡞ର৅Ϧιʔε͸ $MPVE'SPOUσΟετϦϏϡʔγϣϯ $MPVE'SPOUσΟετϦϏϡʔγϣϯͷಛੑ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84ͷ֤छϙϦγʔͷ஌ࣝ 33 ஌ࣝ໘Ͱͷલఏ "84ͷೝՄͰ࢖ΘΕΔϙϦγʔ͸*".͚ͩ͡Όͳ͍ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ *". ϦιʔεϕʔεͷϙϦγʔ
0SHBOJ[BUJPOT ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ 4$1 44244/4ͳͲ ΞΫηείϯτϩʔϧϦετ "$- 4&$ͳͲ &$ 71$ΤϯυϙΠϯτϙϦγʔ 454 ηογϣϯϙϦγʔ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84ͷ֤छϙϦγʔͷ஌ࣝ 34 ஌ࣝ໘Ͱͷલఏ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ ΞΫηείϯτϩʔϧϦετ "$- 71$ΤϯυϙΠϯτϙϦγʔ
҉໧తͳڋ൱ σϑΥϧτ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ϦιʔεϕʔεͷϙϦγʔ ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ 4$1 ηογϣϯϙϦγʔ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ ϦιʔεϕʔεධՁ 424ΩϡʔϙϦγʔ 4/4τϐοΫϙϦγʔ 4όέοτϙϦγʔ "84ͷϙϦγʔධՁ࿦ཧ ໌ࣔతͳڋ൱͸࠷༏ઌͰద༻͞ΕΔ

Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ·ͱΊ 35 ஌ࣝ໘Ͱͷલఏ $-* ϓϩάϥϜίʔυ "84$-* "844%,
"84 "1* ΦϖϨʔλʔ 383 APIs 15319 Actions ίϯϐϡʔςΟϯά Ϧιʔε "84$-*4%,Ͱ௚઀తʹ "84"1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸ ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍ "84ϓϩϑΣογϣφϧͷᅂΈͱͯ͠ͷʮ࠷খݖݶͷݪଇʯΛ਎ʹ෇͚Α͏

Operation Lab ӡ༻ઃܭϥϘ ࢀߟ"84ʹ͓͚Δ*".ͷҐஔ෇͚ 36 ʮ*".͕Θ͔Βͳ͍ʯͱ͍͏͜ͱ͸ ʮ"84ͷجૅΛΘ͔ͬͯͳ͍ʯͱ͍͏͜ͱ "84ͷ֤αʔϏεͷ஌ࣝ *".ͷ஌ࣝ *".͸ɺ"84ͷֶश΍࣮຿ʹ͓͚Δɺ࠷΋ॏཁͳ౔୆ͱݴ͏΂͖αʔϏε
جૅ ౔୆ Ԡ༻ *".ར༻͸ແྉ ௥Ճྉۚͳ͠Ͱར༻Ͱ͖Δ ͭ·Γ ஌ࣝ໘Ͱͷલఏ

Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ϙϦγʔͷ࢖͍෼͚ 37 *".ͷछྨͷϙϦγʔΛ࢖͍෼͚Δ ஌ࣝ໘Ͱͷલఏ ؅ཧϙϦγʔ ΠϯϥΠϯϙϦγʔ ෳ਺ͷ*".ΞΠσϯςΟςΟͰڞ༗Ͱ͖ΔϙϦγʔ
୯ಠͷ*".ΞΠσϯςΟςΟ಺෦Ͱอ༗͢ΔϙϦγʔ "84؅ཧϙϦγʔ ΧελϚʔ؅ཧϙϦγʔ "84͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͸มߋͰ͖ͳ͍ɻ Ϧιʔε͕ ͳͷͰϦεΫߴ͍ɻ ຊ൪Ͱͷར༻ඇਪ঑ɻओʹݕূ༻ɻ ར༻ऀ͕มߋͰ͖Δɻ ڞ༗ར༻ͨ͠৔߹ɺӨڹൣғ͕େ͖͘ɺ ݖݶͷංେԽʹΑΓ࠷খݖݶͷݪଇʹ൓͢Δ͜ͱ΋͋Δɻ ར༻ऀ͕มߋͰ͖Δɻ ڞ༗Ͱ͖ͳ͍ͨΊɺ࠷খݖݶͷݪଇΛ९क͠΍͍͢ɻ هड़Ͱ͖Δจࣈ਺ʹ੍ݶ͕͋Δɻ

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ 38

Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ ྫ 39 ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ ೝূ໨తͷϩʔϧͱೝՄ໨తͷϩʔϧΛ෼͚Δ ೝՄ໨తͷϩʔϧͷݖݶΛɺ࡞ۀऀอޢɾࣄނ๷ࢭͷ؍఺Ͱ෼཭͍ͯ͘͠ɻ "84$-*Λ௨ͯ͡"84"1*ΞΫγϣϯʹ׳Ε਌͠ΜͰ͍͘ɻ
εςοϓ εςοϓ εςοϓ ඇΠϯλϥΫςΟϒૢ࡞ͱΠϯλϥΫςΟϒૢ࡞ͷϩʔϧ෼཭ *".ݖݶͷ෇༩Λݫີʹ͢Δ *".؅ཧऀҎ֎ʹ͸ݪଇ෇༩͠ͳ͍ ओͳ࡞ۀ໨త $36% ʹΑΓϩʔϧΛ੾Γସ͑Δɻ

Operation Lab ӡ༻ઃܭϥϘ ·ͱΊ 40

Operation Lab ӡ༻ઃܭϥϘ ·ͱΊ"84Ͱz࠷খݖݶͷݪଇzΛ࣮ݱ͢ΔͨΊͷߟ͑ํ 41 ·ͱΊ "84͸ʮ࠷খݖݶͷݪଇʯΛ࣮ݱ͢Δ࣮૷Λఏڙ͍ͯ͠Δ ࠷ॳ͸ࣄނ๷ࢭɾ࡞ۀऀอޢͷ؍఺͔Βʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δͷ͕Φεεϝ "84ϓϩϑΣογϣφϧͷᅂΈͱͯ͠ͷʮ࠷খݖݶͷݪଇʯΛ਎ʹ෇͚Α͏ ࣮૷΁ͷཧղ
஌ࣝͷ؍఺ ઃܭͷ؍఺

Operation Lab ӡ༻ઃܭϥϘ ๻͸ৗʑࢥͬͯΔΜͰ͕͢ 42 উखʹిݯҾͬ͜ൈ͔ΕͨΓ ॳظԽର৅ͷϋʔυ΢ΣΞؒҧ͑ΒΕͨΓ ҧ͏ϙʔτͷέʔϒϧൈ͖ࠩ͠͞ΕͨΓ "84͸*".ҰͭͰ΋؆୯ʹΞΫηε੍ݶͰ͖ΔͷͰ ΈΜͳ΍Ε͹͍͍ͷʹɻ
ΦϯϓϨ࣌୅͸ ಛʹ௿ϨΠϠʔͰͷΞΫηείϯτϩʔϧ͕೉͔ͬͨ͠Ͱ͢ɻ

͔͜͜Β͸ ࣭໰λΠϜ

ॳΊͯ৮ΔαʔϏεͩͱʮͲ͜·Ͱ։͚ͨΒࢥͬͯΔࣄ͕Ͱ͖Δ͔Θ͔Βͳ͍ʯʮτϥΠΞϯυΤϥʔ Ͱ૝ఆ͍ͯͨ͠ΑΓ΋͕͔͔࣌ؒͬͯ͠·͏ʯʮͦͷޙͷεέδϡʔϧ͕ζϨ·͘Δʯ ͱݴΘΕΔͷͰɺઈର΍ͬͯ΄͘͠ͳ͍͜ͱ͚ͩ%FOZ͢Ε͹͍͍Ͱ͢ΑͶ ࣭໰ऀ$͞Μ ճ౴ऀ"͞Μ ͦΕ͕ܦӦ൑அʹͳ͍ͬͯΕ͹ྑ͍ͱࢥ͍·͢ɻ ·͍ͣͷ͸ɺݱ৔൑அͰͦΕΛ΍ͬͯͯɺܦӦ͕ೝࣝͯ͠ͳ͍͜ͱͰ͢Ͷɻ ࣭໰

ॳΊͯ৮ΔαʔϏεͩͱʮͲ͜·Ͱ։͚ͨΒࢥͬͯΔࣄ͕Ͱ͖Δ͔Θ͔Βͳ͍ʯʮτϥΠΞϯυΤϥʔ Ͱ૝ఆ͍ͯͨ͠ΑΓ΋͕͔͔࣌ؒͬͯ͠·͏ʯʮͦͷޙͷεέδϡʔϧ͕ζϨ·͘Δʯ ͱݴΘΕΔͷͰɺઈର΍ͬͯ΄͘͠ͳ͍͜ͱ͚ͩ%FOZ͢Ε͹͍͍Ͱ͢ΑͶ ࣭໰ऀ$͞Μ ճ౴ऀ"͞Μ ͦΕ͕ܦӦ൑அʹͳ͍ͬͯΕ͹ྑ͍ͱࢥ͍·͢ɻ ·͍ͣͷ͸ɺݱ৔൑அͰͦΕΛ΍ͬͯͯɺܦӦ͕ೝࣝͯ͠ͳ͍͜ͱͰ͢Ͷɻ ͨͩɺຊ൪ϦϦʔεલఏͰɺͦͷ΍Γํ͸·ͣ͘ͳ͍Ͱ͔͢ "84ͷυΩϡϝϯτΛͪΌΜͱಡΊ͹ɺ গͳ͘ͱ΋"1*ΞΫγϣϯͱૢ࡞ର৅Ϧιʔεʹର͢ΔΞΫηεݖݶͷચ͍ग़͠͸೉͘͠ͳ͍
࣭໰ ॳΊͯͷαʔϏε΍ػೳ͸ɺ։ൃணखલʹ ݕূɾධՁΛͯ͠ɺϦεΫධՁ΍ηΩϡϦςΟධՁ͠·ͤΜ ੲͷ৬৔Ͱ͸ɺηΩϡϦςΟ෦໳͕ϦϦʔε൑ఆ͍ͯͨ͠ͷͰ Ή͠ΖΞΫηε੍ݶͰ͖͍ͯͳ͍ͱεέδϡʔϧ͕ζϨ·ͬͯ͘·ͨ͠ɻ

$MPVE'PSNBUJPO $'O ͷελοΫ࡞੒ɾ࡟আͱ͔ ࠷খݖݶͷݪଇकΔͷ೉͘͠ͳ͍Ͱ͔͢ ࣭໰ऀ"͞Μ ճ౴ऀ"͞Μ $'OͷϦιʔεͱ"1*ΞΫγϣϯ͕ର͡Όͳ͍͜ͱ͕͋ΔͷͰ $'OͷڍಈΛ༧ଌͯ͠ϙϦγʔ࡞Δ͔͠ͳ͍Ͱ͢Ͷɻ কདྷతʹ͸ɺ$'OςϯϓϨʔτΛ"*ղੳͯ͠ɺඞཁͳ*".ϙϦγʔΛੜ੒͢ΔػೳΛ "84͞Μ͕ग़ͯ͘͠ΕΔͰ͠ΐ͏ɻ
ظ଴ ࣭໰

Operation Lab ӡ༻ઃܭϥϘ ࢀߟաڈͷൃදࢿྉ 47 IUUQTXXXPQTMBCKQQVCMJTI աڈͷൃදࢿྉ͸ 0QT-BCKQͱ͍͏αΠτʹஔ͍ͯ͋Γ·͢ɻ

Operation Lab ӡ༻ઃܭϥϘ 48 Operation ӡ༻ઃܭ IUUQXXXPQFSBUJPOMBCDPKQ Lab

AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-le...

AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-least-privilege

More Decks by opelab

Other Decks in Technology

Featured

Transcript