AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-least-privilege

ssmonline #43 での発表資料です。

(運用設計ラボ合同会社 波田野裕一)

Transcript

1. ӡ༻ઃܭϥϘ߹ಉձࣾ Operation Lab ӡ༻ઃܭϥϘ "84Ͱz࠷খݖݶͷݪଇzΛ࣮ݱ͢ΔͨΊͷߟ͑ํ 1
   
   γχΞΞʔΩςΫτ
   ೾ా໺
   ༟Ұ  TTNPOMJOF
   
2. Operation Lab ӡ༻ઃܭϥϘ 2 ʮ࠷খݖݶͷݪଇʯ
   5IF
   QSJODJQMF
   PG
   MFBTU
   QSJWJMFHF ࣮ફ͍ͯ͠·͔͢ ʮԿɺͦΕɺ͓͍͍͠ͷ ʯ ʮฉ͍ͨ͜ͱ͸͋Δ͚ͲɺΑ͘Θ͔ΒΜʯ ʮ஌͍ͬͯΔ͚Ͳɺ࣮ࡍ͸ແཧͩΑͶʯ ·ͣ͸ ͱ͔͔ͬΓΛ ࡞Γ·͠ΐ͏
3. Operation Lab ӡ༻ઃܭϥϘ 8IP
   BN
   * 3 +"846(
   $-*ઐ໳ࢧ෦
   ࢧ෦௕ +"846(
   ΞʔΩςΫνϟઐ໳ࢧ෦
   ӡӦ +"846(
   ேձ
   ӡӦ ೾ా໺
   ༟Ұ "84
   $PNNVOJUZ
   )FSP
   ʙ "84
   4BNVSBJ
   
   ݸਓ "84
   4BNVSBJ
   
   $-*ઐ໳ࢧ෦ ೔ຊ.41ڠձ
   ಛผձһ
   ʙ ࠓ೥લ൒ʹશ෦ࣦޮ༧ఆͰ͕ͨ͠ɺແࣄߋ৽͠·ͨ͠ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ
4. Operation Lab ӡ༻ઃܭϥϘ ΞδΣϯμ 4 ʮ࠷খݖݶͷݪଇʯͱ͸
   "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
   ઃܭ໘Ͱͷલఏ
   ஌ࣝ໘Ͱͷલఏ
   ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ
   ·ͱΊ
5. Operation Lab ӡ༻ઃܭϥϘ 
   ʮ࠷খݖݶͷݪଇʯͱ͸ 5
6. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯͱ͸ 6 
   ʮ࠷খݖݶͷݪଇʯͱ͸ IUUQTEPDTBXTBNB[PODPNKB@KQXFMMBSDIJUFDUFEMBUFTUTFDVSJUZQJMMBSTFD@QFSNJTTJPOT@MFBTU@QSJWJMFHFTIUNM IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNMHSBOUMFBTUQSJWJMFHF
7. Operation Lab ӡ༻ઃܭϥϘ 
   "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ 7
8. Operation Lab ӡ༻ઃܭϥϘ *".ʹΑΔ"84
   "1*ͷΞΫηε੍ޚ 8 *".͕"84
   "1*΁ͷΞΫηε੍ޚΛ୲͏ *". "84
   Ϧιʔε ར༻ऀ ֎෦
   Ϧιʔε "84
   "1* ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO ΄΅શͯͷ"84
   "1*ϦΫϦετ͸
   *".Λհ࣮ͯ͠ߦ͞ΕΔ "1*ΞΫγϣϯ୯ҐͰ͖Ίࡉ੍͔͘ޚՄೳ 383 APIs 15319 Actions ग़య
   "84
   $-*
   
   ެࣜϦϑΝϨϯε ϧʔτΞΧ΢ϯτͷϦΫΤετ͸*".Λܦ༝͠ͳ͍ 
   "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
9. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
   *".ͷجຊߏ଄ 9 "84
   Ϧιʔε ར༻ऀ ֎෦
   Ϧιʔε ϓϦϯγύϧ *".ΤϯςΟςΟ ਎ݩ؅ཧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ *".ϩʔϧ *".Ϣʔβʔ "84
   "1* ݺͼग़͞ΕΔଆ ೝՄ ΞΫηε؅ཧ "VUIPSJ[BUJPO ೝՄ͞ΕͨϦΫΤετ
   ͚͕࣮ͩߦ͞ΕΔ *".ϙϦγʔ ΠϯϥΠϯ
   ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ
   ڥք *".ΞΠσϯςΟςΟ *".ϩʔϧ *".Ϣʔβʔ *".άϧʔϓ *".ϙϦγʔͷ
   ׂΓ౰ͯઌ ຊਓ ࣮ମ ࣝผࢠ 
   "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
10. Operation Lab ӡ༻ઃܭϥϘ *".͸ʮ࠷খݖݶͷݪଇʯΛ࣮ݱ͢Δ࣮૷Λఏڙ͍ͯ͠Δ 10 383 APIs 15319 Actions ग़య
    "84
    $-*
    
    ެࣜϦϑΝϨϯε ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ { "Sid": "AllowCreateNetworkInterfaceWithCloudShellTag", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "ManagedByCloudShell" } } }, FD
    "1*ͷΞΫγϣϯͷ͏ͪ
    ͚ͭͩΛࢦఆ͍ͯ͠Δɻ 
    "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
11. Operation Lab ӡ༻ઃܭϥϘ "84͸ʮ࠷খݖݶͷݪଇʯͷ࣮ફΛར༻ऀʹҕͶ͍ͯΔ 11 383 APIs 15319 Actions ग़య
    "84
    $-*
    
    ެࣜϦϑΝϨϯε ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ͔Ͳ͏͔͸ɺ
    ར༻ऀͷϦεΫ൑அʹҕͶΒΕ͍ͯΔɻ 
    "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
12. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͠ͳ͍ϦεΫ 12 
    "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ηΩϡϦςΟΠϯγσϯτͷӨڹ͕க໋తʹͳΔ ΦϖϨʔγϣϯϛε͕ࣄނʹ௚݁͢Δ • ݖݶΛୣΘΕͨ৔߹ʹɺ෯޿͍ݖݶΛѱ༻͞Εͯ͠·͏ɻ
    • ݖݶΛୣΘΕͨ࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ • ؒҧͬͨૢ࡞ɺ૝ఆ֎ͷૢ࡞Ͱ΋ɺݖݶ͕͋ΔͨΊʹͦͷ··࣮ߦ͞Εͯ͠·͏ɻ
    • ΦϖϛεΛͨ͠࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ
13. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢΂͖ཧ༝ 13 
    "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ηΩϡϦςΟΠϯγσϯτͷӨڹ͕க໋తʹͳΔ͜ͱΛճආ͢Δɻ ΦϖϨʔγϣϯϛε͕ࣄނʹ௚݁͢Δ͜ͱΛճආ͢Δɻ Ϗδωε΍૊৫ͷ๷Ӵ ࣄނ๷ࢭɾ࡞ۀऀอޢ "84
    "1*΍*".ͷ஌ࣝΛݻΊͯɺͰ͖Δͱ͜Ζ͔Β࣮૷ɾ࣮ફ͍ͯ͘͠ ཧ༝ ཧ༝
14. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊͷલఏ 14 
    "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ར༻ऀͷʮ஌ࣝ໘ʯͰͷલఏ ར༻ऀͷʮ࣮૷໘ʯͰͷલఏ • "84
    "1*ͷ஌ࣝ
    • ૢ࡞ର৅Ϧιʔεͷಛఆ
    • "84ͷ֤छϙϦγʔͷ஌ࣝ • ʮ6/*9ͷߟ͑ํʯͷ࣮ફ
    • ඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭
    • ೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭
15. Operation Lab ӡ༻ઃܭϥϘ 
    ઃܭ໘Ͱͷલఏ 15
16. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ʮ6/*9ͷߟ͑ํʯʹجͮ͘ઃܭ
    େલఏ 16 
    ઃܭ໘Ͱͷલఏ ࠷΋6/*9తͳߟ͑ํ͸
    ʮҰͭ ͚ͩ ͷ͜ͱΛ͏·͘΍ΒͤΔʯ
    ͜ͱ ఆཧ ͭͷʮ*".Ϣʔβʔʯ΍ʮ*".ϩʔϧʯʹ
    ͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭ *".ϩʔϧ *".Ϣʔβʔ ͭͷ*".Ϣʔβʔʹ
    ৭ʑͳ͜ͱΛͤ͞ͳ͍ ͭͷ*".ϩʔϧʹ
    ৭ʑͳ͜ͱΛͤ͞ͳ͍
17. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭ 17 
    ઃܭ໘Ͱͷલఏ ΠϯλϥΫςΟϒར༻ ඇΠϯλϥΫςΟϒར༻ • ਓ͕ࢼߦࡨޡ͠ͳ͕Βૢ࡞͢ΔͨΊʹ࢖͏ɻ
    • ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠ʹ͍͘ɻ • εΫϦϓτ΍-BNCEBؔ਺ͷ࣮ߦͳͲʹ࢖͏
    • ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠΍͍͢ɻ ඇΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧͱ
    ΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧΛ෼͚Δɻ ࠷খݖݶͷݪଇʹ४ڌՄೳ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇΠϯλϥΫςΟϒ༻
    *".ϩʔϧ ඇΠϯλϥΫςΟϒ༻
    *".Ϣʔβʔ ΠϯλϥΫςΟϒ༻
    *".ϩʔϧ ΠϯλϥΫςΟϒ༻
    *".Ϣʔβʔ ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ
18. Operation Lab ӡ༻ઃܭϥϘ "84 "84 ઃܭ໘Ͱͷલఏ
    ඇΠϯλϥΫςΟϒར༻ͷ֦େ
    ྫ 18 
    ઃܭ໘Ͱͷલఏ ॲཧ಺༰ΛΫϥΠΞϯτଆͰ੍ޚ
    ΠϯλϥΫςΟϒʹ͍ۙ ॲཧ಺༰Λ-BNCEBؔ਺Խ੍ͯ͠ޚ
    ඇΠϯλϥΫςΟϒԽ ॲཧΛ"84αʔϏεʹҠస͢Δ͜ͱͰ
    "84֎෦ͰඞཁͱͳΔݖݶΛ཈੍͢Δ͜ͱ͕Ͱ͖Δ ख࡞ۀ΍
    ෳࡶͳεΫϦϓτ "84
    "1* ଟ༷ͳΞΫγϣϯʹର͢Δݖݶ͕ඞཁ ΩοΫεΫϦϓτ "84
    "1* -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ -BNCEB
    ؔ਺ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ
19. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ඇΠϯλϥΫςΟϒར༻ͷྫ 19 
    ઃܭ໘Ͱͷલఏ "84 ΩοΫεΫϦϓτ -BNCEB
    ؔ਺ ར༻ऀ ηΩϡϦςΟ
    άϧʔϓ &$
    Πϯελϯε 44) ΞΫηεݩ*1ΞυϨεΛ
    ఻͑ͯJOWPLF͢Δ͚ͩ ΞΫηεݩ*1ΞυϨε͔Βͷ
    ΞΫηεڐՄϧʔϧΛ௥Ճ ಉ࣌ʹطଘͷڐՄΛશ࡟আ ॾൠͷࣄ৘ͰηογϣϯϚωʔδϟʔ
    ࢖͍ͬͯ·ͤΜ -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ
20. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ඇΠϯλϥΫςΟϒར༻ͷϙϦγʔྫ 20 
    ઃܭ໘Ͱͷલఏ { "Version": "2012-10-17", "Statement": [ { "Sid": "Invoke", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:ap-northeast-1:XXXXXXXXXXXX:function:update-port-ssh" } ] } "84 ΩοΫεΫϦϓτ -BNCEB
    ؔ਺
21. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭ 21 "84
    Ϧιʔε ར༻ऀ ֎෦
    Ϧιʔε ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻
    *".ϩʔϧ "84
    "1* ݺͼग़͞ΕΔଆ ೝՄ "VUIPSJ[BUJPO *".ϙϦγʔ ΠϯϥΠϯ
    ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ
    ڥք ࡞ۀ$༻
    *".ϩʔϧ ࡞ۀ"༻
    *".ϩʔϧ 
    ઃܭ໘Ͱͷલఏ ࡞ۀ#༻
    *".ϩʔϧ "84ΞΧ΢ϯτʹ
    ೖΔͨΊ͚ͩʹ࢖͏ *".
    *EFOUJUZ
    $FOUFS
    ܦ༝ ࡞ۀʹඞཁͳݖݶʹΑͬͯ
    Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯ༻
    *".Ϣʔβʔ "84ΞΧ΢ϯτ௚઀
    ඇਪ঑
22. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ೝূ໨తͷϩʔϧ 22 "84
    Ϧιʔε ར༻ऀ ֎෦
    Ϧιʔε ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻
    *".ϩʔϧ αΠϯΠϯ༻
    *".Ϣʔβʔ 
    ઃܭ໘Ͱͷલఏ "84ΞΧ΢ϯτʹ
    ೖΔͨΊ͚ͩʹ࢖͏ *".
    *EFOUJUZ
    $FOUFS
    ܦ༝ "84ΞΧ΢ϯτ௚઀
    ඇਪ঑ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ
    ύεϫʔυมߋ
    .'"ઃఆ
    Ҏ֎͸ڐՄ͠ͳ͍ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ
    Ҏ֎͸ڐՄ͠ͳ͍ ೝূ໨త ΋͠*".ϢʔβʔΛ࢖͏ͳΒ͹
23. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ೝՄ໨తͷϩʔϧ 23 ೝՄ "VUIPSJ[BUJPO ࡞ۀ$༻
    *".ϩʔϧ ࡞ۀ"༻
    *".ϩʔϧ 
    ઃܭ໘Ͱͷલఏ ࡞ۀ#༻
    *".ϩʔϧ ࡞ۀʹඞཁͳݖݶʹΑͬͯ
    Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝՄ໨త ͦΕͧΕͷ࡞ۀʹඞཁͳ
    • ࠷খݶͷαʔϏεͷ
    • ࠷খݶͷΞΫγϣϯΛ
    • ࠷খݶͷϦιʔεʹରͯ͠
    • ݶఆ͞Εͨ৚݅ԼͰ
    ڐՄ͢Δɻ "84
    Ϧιʔε ར༻ऀ ֎෦
    Ϧιʔε ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻
    *".ϩʔϧ αΠϯΠϯ༻
    *".Ϣʔβʔ "84ΞΧ΢ϯτʹ
    ೖΔͨΊ͚ͩʹ࢖͏ *".
    *EFOUJUZ
    $FOUFS
    ܦ༝ "84ΞΧ΢ϯτ௚઀
    ඇਪ঑ ೝূ໨త ࡞ۀ಺༰ʹԠͯ͡ඃΔ๧ࢠ ϩʔϧ Λ ม͑ΔΠϝʔδ ࣄނ๷ࢭɾ࡞ۀऀอޢ
    ؍఺ͷઃܭ͔Β͸͡ΊΔ
24. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ
    ·ͱΊ 24 
    ઃܭ໘Ͱͷલఏ ͭͷ*".ΤϯςΟςΟ *".Ϣʔβʔ΍*".ϩʔϧ ʹ
    ͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭΛ͢Δ ೝূ "VUIFOUJDBUJPO "84ΞΧ΢ϯτʹ
    ೖΔͨΊ͚ͩʹ࢖͏ ೝՄ "VUIPSJ[BUJPO ࡞ۀʹඞཁͳݖݶʹΑͬͯ
    Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯͱ
    ϩʔϧҾड͚͚ͩͷ
    *".ϩʔϧ ඇΠϯλϥΫςΟϒ໨తͷ
    *".ϩʔϧ
    
    ϙϦγʔ ΠϯλϥΫςΟϒ໨తͷ
    *".ϩʔϧ
    
    ϙϦγʔ ࠷খݖݶͷݪଇʹ४ڌՄೳ ࠷খݖݶͷݪଇ
    ʹ४ڌ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇਪ঑͕ͩ*".Ϣʔβʔ΋ ೥ࠒ͔Βݸਓతʹ
    ͜ͷΑ͏ͳઃܭΛ͍ͯ͠·͢ɻ *".
    *EFOUJUZ
    $FOUFSҠߦத ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ ࣄނ๷ࢭɾ࡞ۀऀอޢ
    ؍఺ͷઃܭ͔Β͸͡ΊΔ
25. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
    $36%ͱϦεΫϨϕϧ 25 
    ઃܭ໘Ͱͷલఏ ࡞ۀͷओ໨త͕$36%ͷ͍ͣΕͳͷ͔ʹΑͬͯϦεΫΛධՁ͢Δ ӡ༻ࣗಈԽର৅ͷબఆʹ͓͍ͯ΋༗ޮͳධՁج४ ϦεΫϨϕϧ ϦεΫϨϕϧ ϦεΫϨϕϧ 3FBE $SFBUF 6QEBUF %FMFUF جຊతʹ͸௿ϦεΫ ηΩϡϦςΟ؍఺Ͱ͸৘ใ࿙ӮϦεΫΛՃຯ͢Δඞཁ͕͋Δ தϦεΫ ޡ࡞੒ʹରͯ͠͸ɺ࡟আ͢Ε͹Өڹ͠ͳ͍৔߹΋ଟ͍ɻ ߴϦεΫ ޡ࡟আʹରͯ͠͸ɺ࠶࡞੒͢Ε͹Өڹ͕ݶఆతͳ৔߹΋͋Δ͕ɺ
    ޡߋ৽ʹ͍ͭͯ͸ɺ༰қʹ෮چͰ͖ͳ͍৔߹΋͋ΔͨΊɺ
    ߋ৽ͱ࡟আͷͲͪΒ͕ϦεΫߴ͍͔Ұ֓ʹ͸ݴ͑ͳ͍ɻ ϩʔϧͷݖݶʹ͍ͭͯ΋ɺҟͳΔϦεΫϨϕϧͷ΋ͷΛࠞͥͳ͍
26. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
    *".ͷݖݶΛ҆қʹ෇༩͠ͳ͍ 26 
    ઃܭ໘Ͱͷલఏ ࣗ෼ࣗ਎ͷೝূ৘ใΛૢ࡞͢ΔΞΫγϣϯ *".αʔϏεͷDSFBUFVQEBUFEFMFUFܥ"1*ΞΫγϣϯ͸
    ݪଇͱͯ͠*".؅ཧऀҎ֎ʹ͸ڐՄ͠ͳ͍ɻ ϧʔτϢʔβʔʹ͔͠Ͱ͖ͳ͍͜ͱҎ֎ͷ શͯͷݖݶͷ෇༩΍ണୣΛͰ͖Δɻ
    
    ࣗ෼ࣗ਎ͷݖݶΛࣗࡏʹมߋͰ͖Δɻ *".'VMM"DDFTT
    *".؅ཧऀ༻ϙϦγʔ க໋తɾഁյతͳૢ࡞͕؆୯ʹ࣮ࢪͰ͖ͯ͠·͏ɻ ྫ֎ αΠϯΠϯ༻
    *".Ϣʔβʔ ύεϫʔυมߋ
    .'"ઃఆ ॳظύεϫʔυͷڧ੍มߋ΍.'"ڧ੍Λ͢Δ্ͰඞཁͱͳΔɻ
27. Operation Lab ӡ༻ઃܭϥϘ 
    ஌ࣝ໘Ͱͷલఏ 27
28. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    "84
    "1*ͷ஌ࣝ 28 
    ஌ࣝ໘Ͱͷલఏ 383 APIs 15319 Actions ग़య
    "84
    $-*
    
    ެࣜϦϑΝϨϯε ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ "84Λ"1*αʔϏεͱͯ͠ཧղ͢Δ͜ͱ͕ෆՄܽ ͭ·Γ
29. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    Ϛωδϝϯτίϯιʔϧͷཪଆ 29 
    ஌ࣝ໘Ͱͷલఏ (6* "84
    "1* ΦϖϨʔλʔ Ϛωδϝϯτίϯιʔϧ 383 APIs 15319 Actions Ϛωδϝϯτίϯιʔϧͷૢ࡞ͷཪଆͰ͸"1*͕ݺͼग़͞Ε͍ͯΔ Ϛωδϝϯτίϯιʔϧ͔Β
    "1*ݺͼग़͠಺༰͸ݟ͑ͳ͍ ݱঢ় Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸
    ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍
30. Operation Lab ӡ༻ઃܭϥϘ (6* $-* ϓϩάϥϜίʔυ Ϛωδϝϯτίϯιʔϧ ஌ࣝ໘Ͱͷલఏ
    "84
    "1*ͷ௚઀తͳར༻ɾཧղ 30 
    ஌ࣝ໘Ͱͷલఏ "84
    "1* ΦϖϨʔλʔ 383 APIs 15319 Actions "84
    $-*
    
    4%,͸"84
    "1*Λ௚઀తʹૢ࡞͢Δɻ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊʹ͸
    "84
    $-*
    
    4%,Ͱ௚઀తʹ"84
    "1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ͲͷΑ͏ͳͱ͖ʹ
    ͲΜͳ"1*ΞΫγϣϯΛߦ͏͔ཧղ͍ͯ͠Δ ίϯϐϡʔςΟϯά Ϧιʔε "84
    $-* "84
    4%,
31. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    ૢ࡞ର৅Ϧιʔεͷಛఆ 31 
    ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ "84
    $-*Ͱͷૢ࡞खॱͳͲʹΑΓɺඞཁͳΞΫγϣϯΛಛఆ͢Δɻ ΞΫγϣϯͷૢ࡞ର৅ͱͳΔϦιʔεΛಛఆ͢Δɻ
    ໋໊نଇͷ੔උͳͲʹΑΓɺݫີʹಛఆͰ͖ΔΑ͏ʹ޻෉͢Δɻ ઀಄ࣙ΍઀ඌࣙɺλάͳͲ ૢ࡞ର৅Ϧιʔεʹ͍ͭͯɺͲͷཻ౓ͰΞΫηε੍ޚͰ͖Δͷ͔Λ֬ೝ͢Δɻ
    ૢ࡞ର৅ϦιʔεͷϥΠϑαΠΫϧΛ೺Ѳ͠ɺӬଓతͳϦιʔεͷഁյతͳૢ࡞͸ڐՄ͠ͳ͍ͳͲͷݕ౼Λߦ͏ɻ
32. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    ૢ࡞ର৅Ϧιʔεͷྫ
    $MPVE'SPOU 32 
    ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Action": [ "cloudfront:CreateInvalidation", "cloudfront:GetInvalidation", "cloudfront:ListDistributions", "cloudfront:ListInvalidations", "cloudfront:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" } ] } ੲ͸ɺσΟετϦϏϡʔγϣϯ୯ҐͰ
    ੍ޚͰ͖ͳ͔ͬͨɻ
    ଞͷσΟετϦϏϡʔγϣϯͷΩϟογϡແޮԽ͕Մೳ $%/ͷΩϟογϡແޮԽΛߦ͏ͨΊͷΞΫγϣϯͷڐՄ ݱࡏ͸ arn:${Partition}:cloudfront::${Account}:distribution/${DistributionId} Ͱର৅ϦιʔεΛࢦఆͰ͖Δɻ $%/ͷΩϟογϡແޮԽͷૢ࡞ର৅Ϧιʔε͸
    $MPVE'SPOUσΟετϦϏϡʔγϣϯ $MPVE'SPOUσΟετϦϏϡʔγϣϯͷಛੑ
33. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    "84ͷ֤छϙϦγʔͷ஌ࣝ 33 
    ஌ࣝ໘Ͱͷલఏ "84ͷೝՄͰ࢖ΘΕΔϙϦγʔ͸*".͚ͩ͡Όͳ͍ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ *". ϦιʔεϕʔεͷϙϦγʔ 0SHBOJ[BUJPOT ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ
    4$1 44244/4ͳͲ ΞΫηείϯτϩʔϧϦετ
    "$- 4&$ͳͲ &$ 71$ΤϯυϙΠϯτϙϦγʔ 454 ηογϣϯϙϦγʔ
34. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    "84ͷ֤छϙϦγʔͷ஌ࣝ 34 
    ஌ࣝ໘Ͱͷલఏ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ ΞΫηείϯτϩʔϧϦετ
    "$- 71$ΤϯυϙΠϯτϙϦγʔ ҉໧తͳڋ൱
    σϑΥϧτ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ϦιʔεϕʔεͷϙϦγʔ ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ
    4$1 ηογϣϯϙϦγʔ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ ϦιʔεϕʔεධՁ 424ΩϡʔϙϦγʔ 4/4τϐοΫϙϦγʔ 4όέοτϙϦγʔ "84ͷϙϦγʔධՁ࿦ཧ ໌ࣔతͳڋ൱͸࠷༏ઌͰద༻͞ΕΔ
35. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ
    ·ͱΊ 35 
    ஌ࣝ໘Ͱͷલఏ $-* ϓϩάϥϜίʔυ "84
    $-* "84
    4%, "84
    "1* ΦϖϨʔλʔ 383 APIs 15319 Actions ίϯϐϡʔςΟϯά Ϧιʔε "84
    $-*
    
    4%,Ͱ௚઀తʹ
    "84
    "1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸
    ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍ "84ϓϩϑΣογϣφϧͷᅂΈͱͯ͠ͷʮ࠷খݖݶͷݪଇʯΛ਎ʹ෇͚Α͏
36. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
    "84ʹ͓͚Δ*".ͷҐஔ෇͚ 36 ʮ*".͕Θ͔Βͳ͍ʯͱ͍͏͜ͱ͸
    ʮ"84ͷجૅΛΘ͔ͬͯͳ͍ʯͱ͍͏͜ͱ "84ͷ֤αʔϏεͷ஌ࣝ *".ͷ஌ࣝ *".͸ɺ"84ͷֶश΍࣮຿ʹ͓͚Δɺ࠷΋ॏཁͳ౔୆ͱݴ͏΂͖αʔϏε جૅ
    ౔୆ Ԡ༻ *".ར༻͸ແྉ
    ௥Ճྉۚͳ͠Ͱར༻Ͱ͖Δ ͭ·Γ 
    ஌ࣝ໘Ͱͷલఏ
37. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
    *".ϙϦγʔͷ࢖͍෼͚ 37 *".ͷछྨͷϙϦγʔΛ࢖͍෼͚Δ 
    ஌ࣝ໘Ͱͷલఏ ؅ཧϙϦγʔ ΠϯϥΠϯϙϦγʔ ෳ਺ͷ*".ΞΠσϯςΟςΟͰڞ༗Ͱ͖ΔϙϦγʔ ୯ಠͷ*".ΞΠσϯςΟςΟ಺෦Ͱอ༗͢ΔϙϦγʔ "84؅ཧϙϦγʔ ΧελϚʔ؅ཧϙϦγʔ "84͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͸มߋͰ͖ͳ͍ɻ
    Ϧιʔε͕ ͳͷͰϦεΫߴ͍ɻ
    ຊ൪Ͱͷར༻ඇਪ঑ɻओʹݕূ༻ɻ ར༻ऀ͕มߋͰ͖Δɻ
    ڞ༗ར༻ͨ͠৔߹ɺӨڹൣғ͕େ͖͘ɺ
    ݖݶͷංେԽʹΑΓ࠷খݖݶͷݪଇʹ൓͢Δ͜ͱ΋͋Δɻ ར༻ऀ͕มߋͰ͖Δɻ
    ڞ༗Ͱ͖ͳ͍ͨΊɺ࠷খݖݶͷݪଇΛ९क͠΍͍͢ɻ
    هड़Ͱ͖Δจࣈ਺ʹ੍ݶ͕͋Δɻ
38. Operation Lab ӡ༻ઃܭϥϘ 
    ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ 38
39. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ
    ྫ 39 
    ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ ೝূ໨తͷϩʔϧͱೝՄ໨తͷϩʔϧΛ෼͚Δ ೝՄ໨తͷϩʔϧͷݖݶΛɺ࡞ۀऀอޢɾࣄނ๷ࢭͷ؍఺Ͱ෼཭͍ͯ͘͠ɻ "84
    $-*Λ௨ͯ͡"84
    "1*ΞΫγϣϯʹ׳Ε਌͠ΜͰ͍͘ɻ εςοϓ εςοϓ εςοϓ ඇΠϯλϥΫςΟϒૢ࡞ͱΠϯλϥΫςΟϒૢ࡞ͷϩʔϧ෼཭
    *".ݖݶͷ෇༩Λݫີʹ͢Δ
    *".؅ཧऀҎ֎ʹ͸ݪଇ෇༩͠ͳ͍
    ओͳ࡞ۀ໨త $36% ʹΑΓϩʔϧΛ੾Γସ͑Δɻ
40. Operation Lab ӡ༻ઃܭϥϘ 
    ·ͱΊ 40
41. Operation Lab ӡ༻ઃܭϥϘ ·ͱΊ
    "84Ͱz࠷খݖݶͷݪଇzΛ࣮ݱ͢ΔͨΊͷߟ͑ํ 41 
    ·ͱΊ "84͸ʮ࠷খݖݶͷݪଇʯΛ࣮ݱ͢Δ࣮૷Λఏڙ͍ͯ͠Δ ࠷ॳ͸ࣄނ๷ࢭɾ࡞ۀऀอޢͷ؍఺͔Βʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δͷ͕Φεεϝ "84ϓϩϑΣογϣφϧͷᅂΈͱͯ͠ͷʮ࠷খݖݶͷݪଇʯΛ਎ʹ෇͚Α͏ ࣮૷΁ͷཧղ ஌ࣝͷ؍఺ ઃܭͷ؍఺
42. Operation Lab ӡ༻ઃܭϥϘ ๻͸ৗʑࢥͬͯΔΜͰ͕͢ 42 উखʹిݯҾͬ͜ൈ͔ΕͨΓ
    ॳظԽର৅ͷϋʔυ΢ΣΞؒҧ͑ΒΕͨΓ
    ҧ͏ϙʔτͷέʔϒϧൈ͖ࠩ͠͞ΕͨΓ "84͸*".ҰͭͰ΋؆୯ʹΞΫηε੍ݶͰ͖ΔͷͰ
    ΈΜͳ΍Ε͹͍͍ͷʹɻ ΦϯϓϨ࣌୅͸
    ಛʹ௿ϨΠϠʔͰͷΞΫηείϯτϩʔϧ͕೉͔ͬͨ͠Ͱ͢ɻ
43. ͔͜͜Β͸
    ࣭໰λΠϜ
44. ॳΊͯ৮ΔαʔϏεͩͱʮͲ͜·Ͱ։͚ͨΒࢥͬͯΔࣄ͕Ͱ͖Δ͔Θ͔Βͳ͍ʯʮτϥΠΞϯυΤϥʔ Ͱ૝ఆ͍ͯͨ͠ΑΓ΋͕͔͔࣌ؒͬͯ͠·͏ʯʮͦͷޙͷεέδϡʔϧ͕ζϨ·͘Δʯ
    ͱݴΘΕΔͷͰɺઈର΍ͬͯ΄͘͠ͳ͍͜ͱ͚ͩ%FOZ͢Ε͹͍͍Ͱ͢ΑͶ ࣭໰ऀ$͞Μ ճ౴ऀ"͞Μ ͦΕ͕ܦӦ൑அʹͳ͍ͬͯΕ͹ྑ͍ͱࢥ͍·͢ɻ
    ·͍ͣͷ͸ɺݱ৔൑அͰͦΕΛ΍ͬͯͯɺܦӦ͕ೝࣝͯ͠ͳ͍͜ͱͰ͢Ͷɻ
    ࣭໰
45. ॳΊͯ৮ΔαʔϏεͩͱʮͲ͜·Ͱ։͚ͨΒࢥͬͯΔࣄ͕Ͱ͖Δ͔Θ͔Βͳ͍ʯʮτϥΠΞϯυΤϥʔ Ͱ૝ఆ͍ͯͨ͠ΑΓ΋͕͔͔࣌ؒͬͯ͠·͏ʯʮͦͷޙͷεέδϡʔϧ͕ζϨ·͘Δʯ
    ͱݴΘΕΔͷͰɺઈର΍ͬͯ΄͘͠ͳ͍͜ͱ͚ͩ%FOZ͢Ε͹͍͍Ͱ͢ΑͶ ࣭໰ऀ$͞Μ ճ౴ऀ"͞Μ ͦΕ͕ܦӦ൑அʹͳ͍ͬͯΕ͹ྑ͍ͱࢥ͍·͢ɻ
    ·͍ͣͷ͸ɺݱ৔൑அͰͦΕΛ΍ͬͯͯɺܦӦ͕ೝࣝͯ͠ͳ͍͜ͱͰ͢Ͷɻ
    ͨͩɺຊ൪ϦϦʔεલఏͰɺͦͷ΍Γํ͸·ͣ͘ͳ͍Ͱ͔͢ "84ͷυΩϡϝϯτΛͪΌΜͱಡΊ͹ɺ
    গͳ͘ͱ΋"1*ΞΫγϣϯͱૢ࡞ର৅Ϧιʔεʹର͢ΔΞΫηεݖݶͷચ͍ग़͠͸೉͘͠ͳ͍ ࣭໰ ॳΊͯͷαʔϏε΍ػೳ͸ɺ։ൃணखલʹ
    ݕূɾධՁΛͯ͠ɺϦεΫධՁ΍ηΩϡϦςΟධՁ͠·ͤΜ ੲͷ৬৔Ͱ͸ɺηΩϡϦςΟ෦໳͕ϦϦʔε൑ఆ͍ͯͨ͠ͷͰ
    Ή͠ΖΞΫηε੍ݶͰ͖͍ͯͳ͍ͱεέδϡʔϧ͕ζϨ·ͬͯ͘·ͨ͠ɻ
46. $MPVE'PSNBUJPO $'O ͷελοΫ࡞੒ɾ࡟আͱ͔
    ࠷খݖݶͷݪଇकΔͷ೉͘͠ͳ͍Ͱ͔͢ ࣭໰ऀ"͞Μ ճ౴ऀ"͞Μ $'OͷϦιʔεͱ"1*ΞΫγϣϯ͕ର͡Όͳ͍͜ͱ͕͋ΔͷͰ
    $'OͷڍಈΛ༧ଌͯ͠ϙϦγʔ࡞Δ͔͠ͳ͍Ͱ͢Ͷɻ
    কདྷతʹ͸ɺ$'OςϯϓϨʔτΛ"*ղੳͯ͠ɺඞཁͳ*".ϙϦγʔΛੜ੒͢ΔػೳΛ
    "84͞Μ͕ग़ͯ͘͠ΕΔͰ͠ΐ͏ɻ ظ଴ ࣭໰
47. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ
    աڈͷൃදࢿྉ 47 IUUQTXXXPQTMBCKQQVCMJTI աڈͷൃදࢿྉ͸
    0QT-BCKQ
    ͱ͍͏αΠτʹஔ͍ͯ͋Γ·͢ɻ
48. Operation Lab ӡ༻ઃܭϥϘ 48 Operation ӡ༻ઃܭ IUUQXXXPQFSBUJPOMBCDPKQ Lab