Upgrade to Pro — share decks privately, control downloads, hide ads and more …

なぜ、IAMロールのプリンシパルに*による部分マッチングが使えないのか? / 20260518...

なぜ、IAMロールのプリンシパルに*による部分マッチングが使えないのか? / 20260518-ssmjp-iam-role-principal

ssmonline #52 第五回はたのさん祭 オンラインでの発表資料です。

JAWS Days 2026での登壇後にいただいた質問への回答です。
(公式ドキュメントには明記されていないので、個人的に演繹した結論です。)

(運用設計ラボ合同会社 波田野 裕一)

Avatar for opelab

opelab

May 18, 2026

More Decks by opelab

Other Decks in Technology

Transcript

  1. Operation Lab ӡ༻ઃܭϥϘ ʮೝূʯͱ͸ 8 ೝূओޠΛܾఆ͢Δ ར༻ऀ αΠϯΠϯ "84 IAMϢʔβʔ

    IAM Identity CenterϢʔβʔ Ϣʔβ໊ ύεϫʔυ ੜମ৘ใ *EFOUJUZ *% .BOBHFNFOU ೝূͱ͸γεςϜ্ͷϥϕϧ ࣝผࢠ Λਖ਼͍͠ར༻ऀʹషΓ෇͚Δ͜ͱ ਖ਼͍͠ೝূ৘ใΛ ͍࣋ͬͯΔɺ ͜ͷਓʹɺ ϥϕϧΛషΓ෇͚Δ    ʮೝূʯͱʮϓϦϯγύϧʯ
  2. Operation Lab ӡ༻ઃܭϥϘ ʮϓϦϯγύϧʯͱ͸ 9 ར༻ऀ αΠϯΠϯ "84 IAMϢʔβʔ IAM

    Identity CenterϢʔβʔ Ϣʔβ໊ ύεϫʔυ ੜମ৘ใ ϓϦϯγύϧ ΫϨσϯγϟϧ ΞΠσϯςΟςΟ *EFOUJUZ *% .BOBHFNFOU ೝূͱ͸γεςϜ্ͷϥϕϧ ࣝผࢠ Λਖ਼͍͠ར༻ऀʹషΓ෇͚Δ͜ͱ ʮೝূʯͱʮϓϦϯγύϧʯ γεςϜ͕૝ఆ͍ͯ͠Δ ʮਖ਼͍͠ར༻ऀຊਓʯ  ୅ཧਓʹରͯ͠ ຊਓ QSJODJQBM ग़య΢ΟζμϜӳ࿨࣌఺ ϓϦϯγύϧ͸ਖ਼͘͠ಛఆͰ͖ͳ͍ͱ͍͚ͳ͍ɻ ڞ༗ΞΧ΢ϯτ͸ ʮຊਓʯΛਖ਼͘͠ಛఆͰ͖ͳ͍
  3. Operation Lab ӡ༻ઃܭϥϘ ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO *".ͷجຊߏ଄ 11 ར༻ऀ

    ֎෦ Ϧιʔε *".ϙϦγʔ *".Ϣʔβʔ "84 "1* *".ϩʔϧ "84 Ϧιʔε ୭ʹ ݺͼग़͞ΕΔଆ ݺͼग़͢ଆ ԿΛڐՄېࢭ ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  4. Operation Lab ӡ༻ઃܭϥϘ ʮ*".ϩʔϧʯͷ໾ׂ 12 ୭ʹ ݺͼग़͞ΕΔଆ ݺͼग़͢ଆ ೝূ "VUIFOUJDBUJPO

    ԿΛڐՄېࢭ ೝՄ "VUIPSJ[BUJPO *".ϩʔϧ͸ɺ "84ϦιʔεͷʮೝূʯͱʮೝՄʯΛ୲͏ *".ϩʔϧ *".ϙϦγʔ "84Ϧιʔεͱ "84"1*Λܨ͙ "84 Ϧιʔε *".ΞΠσϯςΟςΟ *".ϙϦγʔ "84ΦϖϨʔγϣϯ *".ΤϯςΟςΟ ϓϦϯγύϧ "84 "1* ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  5. Operation Lab ӡ༻ઃܭϥϘ ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO ࢀߟݱࡏ͸ʮ*".Ϣʔβʔʯ͸ڧ͘ඇਪ঑ 13 ར༻ऀ

    ֎෦ Ϧιʔε *".ϙϦγʔ *".Ϣʔβʔ "84 "1* ୭ʹ ݺͼग़͞ΕΔଆ ݺͼग़͢ଆ ԿΛڐՄېࢭ ඇਪ঑ *".ϩʔϧ "84 Ϧιʔε ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  6. Operation Lab ӡ༻ઃܭϥϘ ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO ࠓͲ͖͸ɺΈΜͳʮ*".ϩʔϧΛ࢖͏ʯ 14 ར༻ऀ

    ֎෦ Ϧιʔε *".ϙϦγʔ "84 "1* *".ϩʔϧ "84 Ϧιʔε ୭ʹ ݺͼग़͞ΕΔଆ ݺͼग़͢ଆ ԿΛڐՄېࢭ *% ϓϩόΠμʔ ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  7. Operation Lab ӡ༻ઃܭϥϘ ೝূ "VUIFOUJDBUJPO *".ϩʔϧ͸ʮ৴པϙϦγʔʯͰϓϦϯγύϧΛಛఆ͢Δ 15 ར༻ऀ ֎෦ Ϧιʔε

    ৴པϙϦγʔ *".ϩʔϧ "84 Ϧιʔε ୭ʹ ݺͼग़͢ଆ *% ϓϩόΠμʔ *".ϙϦγʔ ೝՄ ԿΛڐՄېࢭ ϩʔϧΛ ୭͕࢖͑Δͷ͔ ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  8. Operation Lab ӡ༻ઃܭϥϘ ৴པϙϦγʔͷྫ 16 { "Version":"2012-10-17", "Statement": [ {

    "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Action": "sts:AssumeRole" } ] } -BNCEBαʔϏεΛϓϦϯγύϧͱ͢Δ৴པϙϦγʔͷྫ MBNCEBαʔϏεʹݶΓ ϩʔϧͷҾ͖ड͚ ΛڐՄ͢Δ ৴པϙϦγʔ͸ɺʮϦιʔεϕʔεϙϦγʔʯͷҰछ ʮ*".ϩʔϧʯͷجૅ஌ࣝ
  9. Operation Lab ӡ༻ઃܭϥϘ ϓϦϯγύϧͷࢦఆ "84ϙϦγʔจ๏ 18 QSJODJQBM@CMPDL 1SJODJQBMc/PU1SJODJQBM  *cQSJODJQBM@NBQ

    QSJODJQBM@NBQ\QSJODJQBM@NBQ@FOUSZ QSJODJQBM@NBQ@FOUSZ ^ QSJODJQBM@NBQ@FOUSZ "84c'FEFSBUFEc4FSWJDFc$BOPOJDBM6TFS <QSJODJQBM@JE@TUSJOH QSJODJQBM@JE@TUSJOH > 1SJODJQBM  ྫ 1SJODJQBM\4FSWJDFMBNCEBBNB[POBXTDPN^ ྫ 1SJODJQBM\ "84< BSOBXTJBNSPMFBXTSFTFSWFETTPBNB[POBXTDPNBQOPSUIFBTU "843FTFSWFE440@EFWFMPQQFSNJTTJPOTFU@CGCDCG  BSOBXTJBNVTFSIBOETPODMJTJHOJOVTFS > ^ ྫ จ๏͔ΒݟΔʮ*".ϩʔϧͷϓϦϯγύϧʯࢦఆ
  10. Operation Lab ӡ༻ઃܭϥϘ ϓϦϯγύϧͷࢦఆ จ๏ ΞελϦεΫࢦఆ 19 QSJODJQBM@CMPDL 1SJODJQBMc/PU1SJODJQBM 

    *cQSJODJQBM@NBQ 1SJODJQBM  ྫ QSJODJQBM@NBQ\QSJODJQBM@NBQ@FOUSZ QSJODJQBM@NBQ@FOUSZ ^ QSJODJQBM@NBQ@FOUSZ "84c'FEFSBUFEc4FSWJDFc$BOPOJDBM6TFS <QSJODJQBM@JE@TUSJOH QSJODJQBM@JE@TUSJOH > ໊લ΍"3/ͷҰ෦Λࢦఆ͢ΔͨΊʹ࢖༻͢Δ͜ͱ͸Ͱ͖ͳ͍ ύϒϦοΫಗ໊ΞΫηεΛڐՄ͢Δ ओͳ༻్ ϫΠϧυΧʔυ * ͸ɺಗ໊ΞΫηεΛڐՄ͢Δ৔߹ʹͷΈ࢖༻Ͱ͖Δ ύϒϦοΫಗ໊ΞΫηεΛڐՄ͢Δҙਤ͕ͳ͍ݶΓ࢖Θͳ͍ จ๏͔ΒݟΔʮ*".ϩʔϧͷϓϦϯγύϧʯࢦఆ
  11. Operation Lab ӡ༻ઃܭϥϘ ࢀߟΊͪΌΊͪΌϦεΫ͕ߴ͍ϓϦϯγύϧ  20 QSJODJQBM@CMPDL 1SJODJQBMc/PU1SJODJQBM  *cQSJODJQBM@NBQ

    1SJODJQBM  ྫ QSJODJQBM@NBQ\QSJODJQBM@NBQ@FOUSZ QSJODJQBM@NBQ@FOUSZ ^ QSJODJQBM@NBQ@FOUSZ "84c'FEFSBUFEc4FSWJDFc$BOPOJDBM6TFS <QSJODJQBM@JE@TUSJOH QSJODJQBM@JE@TUSJOH > ϫΠϧυΧʔυ * ͸ɺಗ໊ΞΫηεΛڐՄ͢Δ৔߹ʹͷΈ࢖༻Ͱ͖Δ ৴པϙϦγʔ͸ɺʮϦιʔεϕʔεϙϦγʔʯͷҰछ 424ΩϡʔͷΩϡʔϙϦγʔͰɺಗ໊ΞΫηεΛڐՄ͢Δ͜ͱ͸͋ΓಘΔ *".ϩʔϧͷ৴པϙϦγʔͰɺಗ໊ΞΫηεΛڐՄ͢Δ͜ͱ͸͋Γಘͳ͍ ύϒϦοΫಗ໊ΞΫηεΛڐՄ͢Δҙਤ͕ͳ͍ݶΓ࢖Θͳ͍ จ๏͔ΒݟΔʮ*".ϩʔϧͷϓϦϯγύϧʯࢦఆ
  12. Operation Lab ӡ༻ઃܭϥϘ ࢀߟΊͪΌΊͪΌϦεΫ͕ߴ͍ϓϦϯγύϧΞΧ΢ϯτ*% 21 QSJODJQBM@CMPDL 1SJODJQBMc/PU1SJODJQBM  *cQSJODJQBM@NBQ 1SJODJQBM\"84^

    ྫ QSJODJQBM@NBQ\QSJODJQBM@NBQ@FOUSZ QSJODJQBM@NBQ@FOUSZ ^ QSJODJQBM@NBQ@FOUSZ "84c'FEFSBUFEc4FSWJDFc$BOPOJDBM6TFS <QSJODJQBM@JE@TUSJOH QSJODJQBM@JE@TUSJOH > ΞΧ΢ϯτ಺෦Ͱͷಗ໊ΞΫηεΛڐՄ͢Δ͜ͱΛҙຯ͢Δɻ ΫϩεΞΧ΢ϯτͰͷಗ໊ΞΫηε͸๷͛Δ ΞΧ΢ϯτ಺ಗ໊ΞΫηεΛڐՄ͢Δҙਤ͕ͳ͍ݶΓ࢖Θͳ͍ *".ϙϦγʔͰ & ff FDU"MMPX "DUJPOTUT"TTVNF3PMF SFTPVSDF  ݖݶ͕෇༩͞Ε͍ͯΕ͹ϩʔϧͷҾड͚͕Ͱ͖ͯ͠·͏ɻ จ๏͔ΒݟΔʮ*".ϩʔϧͷϓϦϯγύϧʯࢦఆ
  13. Operation Lab ӡ༻ઃܭϥϘ *".ϩʔϧͰࢦఆͯ͠΋Α͍ϓϦϯγύϧ 22 QSJODJQBM@CMPDL 1SJODJQBMc/PU1SJODJQBM  *cQSJODJQBM@NBQ QSJODJQBM@NBQ\QSJODJQBM@NBQ@FOUSZ

    QSJODJQBM@NBQ@FOUSZ ^ QSJODJQBM@NBQ@FOUSZ "84c'FEFSBUFEc4FSWJDFc$BOPOJDBM6TFS <QSJODJQBM@JE@TUSJOH QSJODJQBM@JE@TUSJOH > *".ϩʔϧϓϦϯγύϧ *".ϢʔβϓϦϯγύϧ 1SJODJQBM\"84BSOBXTJBNSPMFSPMFOBNF^ 1SJODJQBM\"84BSOBXTJBNVTFSVTFSOBNF^ 1SJODJQBM\'FEFSBUFEDPHOJUPJEFOUJUZBNB[POBXTDPN^ 0*%$ϑΣσϨʔςουϓϦϯγύϧ 1SJODJQBM\$BOPOJDBM6TFSBEGCFEBFGCBDFEGEFEFBDGGEFDEFGCF^ ਖ਼نϢʔβʔ*% 1SJODJQBM\4FSWJDF<FDBNB[POBXTDPN>^ "84αʔϏεϓϦϯγύϧ จ๏͔ΒݟΔʮ*".ϩʔϧͷϓϦϯγύϧʯࢦఆ
  14. Operation Lab ӡ༻ઃܭϥϘ ϓϦϯγύϧͷࢦఆ͸શ෦ݸผࢦఆ 24 1SJODJQBM\ "84< BSOBXTJBNSPMFBXTSFTFSWFETTPBNB[POBXTDPNBQOPSUIFBTU"843FTFSWFE440@EFWFMPQQFSNJTTJPOTFU@CGCDCG  BSOBXTJBNVTFSIBOETPODMJTJHOJOVTFS

    > ^ ʮϓϦϯγύϧʯ͸ɺର৅Λશ෦ྻڍ͠ͳ͖Ό͍͚ͳ͍ɻ *".ϩʔϧϓϦϯγύϧ *".ϢʔβϓϦϯγύϧ 1SJODJQBM\"84BSOBXTJBNSPMFSPMFOBNF^ 1SJODJQBM\"84BSOBXTJBNVTFSVTFSOBNF^ 1SJODJQBM\'FEFSBUFEDPHOJUPJEFOUJUZBNB[POBXTDPN^ 0*%$ϑΣσϨʔςουϓϦϯγύϧ 1SJODJQBM\$BOPOJDBM6TFSBEGCFEBFGCBDFEGEFEFBDGGEFDEFGCF^ ਖ਼نϢʔβʔ*% 1SJODJQBM\4FSWJDF<FDBNB[POBXTDPN>^ "84αʔϏεϓϦϯγύϧ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  15. Operation Lab ӡ༻ઃܭϥϘ ϓϦϯγύϧʹΑ͋͘Δཁ๬ 25 *".άϧʔϓΛࢦఆ͍ͨ͠ ෦෼ҰகΛࢦఆ͍ͨ͠ ʮϓϦϯγύϧʯ͸ɺର৅Λશ෦ྻڍ͠ͳ͖Ό͍͚ͳ͍ɻ໘౗͍͘͞ɻ *".ϩʔϧϓϦϯγύϧ *".ϢʔβϓϦϯγύϧ

    1SJODJQBM\"84BSOBXTJBNSPMFSPMFOBNF^ 1SJODJQBM\"84BSOBXTJBNVTFSVTFSOBNF^ 1SJODJQBM\ "84< BSOBXTJBNSPMFBXTSFTFSWFETTPBNB[POBXTDPNBQOPSUIFBTU"843FTFSWFE440@EFWFMPQQFSNJTTJPOTFU@CGCDCG  BSOBXTJBNVTFSIBOETPODMJTJHOJOVTFS > ^ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  16. Operation Lab ӡ༻ઃܭϥϘ ϓϦϯγύϧʹΑ͋͘Δཁ๬ ͨͿΜ࣮૷͞Εͳ͍ 26 *".άϧʔϓΛࢦఆ͍ͨ͠ ෦෼ҰகΛࢦఆ͍ͨ͠ ͨͿΜ࣮૷͞Εͳ͍ 1SJODJQBM\

    "84< BSOBXTJBNSPMFBXTSFTFSWFETTPBNB[POBXTDPNBQOPSUIFBTU"843FTFSWFE440@EFWFMPQQFSNJTTJPOTFU@CGCDCG  BSOBXTJBNVTFSIBOETPODMJTJHOJOVTFS > ^ ʮϓϦϯγύϧʯ͸ɺର৅Λશ෦ྻڍ͠ͳ͖Ό͍͚ͳ͍ɻ໘౗͍͘͞ɻ *".ϩʔϧϓϦϯγύϧ *".ϢʔβϓϦϯγύϧ 1SJODJQBM\"84BSOBXTJBNSPMFSPMFOBNF^ 1SJODJQBM\"84BSOBXTJBNVTFSVTFSOBNF^ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  17. Operation Lab ӡ༻ઃܭϥϘ ೝূͱͯ͠ͷʮϓϦϯγύϧʯͷॏཁੑ 27 ೝূओޠΛܾఆ͢Δ ར༻ऀ ୭͔ ೝূ "VUIFOUJDBUJPO

    ೝՄ "VUIPSJ[BUJPO ԿΛڐՄڋ൱ ͢Δ͔ Ϧιʔε ϦΫΤετ Կ͔͕ຊ෺ɺݱ࣮ɺ·ͨ͸ਅ࣮Ͱ͋Δ͜ͱΛূ໌͢Δߦҝ ୭͔͕ಛఆͷਓ෺Ͱ͋Δ͜ͱΛূ໌͢Δߦҝ "VUIFOUJDBUJPO ग़యΦοΫεϑΥʔυݱ୅ӳӳࣙయୈ൛Λ຋༁ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  18. Operation Lab ӡ༻ઃܭϥϘ ʮϓϦϯγύϧʯΛᐆດʹͯ͠͸͍͚ͳ͍ 28 ೝূओޠΛܾఆ͢Δ ϓϦϯγύϧ ओޠ୭ʹڐՄ͍ͯ͠Δͷ͔  ͕ᐆດʹͳΔ

    ୭͔͕ಛఆͷਓ෺Ͱ͋Δ͜ͱΛূ໌͢Δߦҝ *".άϧʔϓΛࢦఆ͍ͨ͠ ෦෼ҰகΛࢦఆ͍ͨ͠ ϩʔϧΛ࢖͑Δਓ΍ϦιʔεΛ ϩʔϧͷೝূઃఆΛม͑ͣʹࣄޙతʹ௥ՃͰ͖Δ ૝ఆ֎ͷϓϦϯγύϧʹར༻͞Εɺ ࣄނ ηΩϡϦςΟϛε ʹͳΔ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  19. Operation Lab ӡ༻ઃܭϥϘ ʮ*".άϧʔϓʯ͸ೝূʹؔ༩͠ͳ͍ 29 ೝূओޠΛܾఆ͢Δ ୭͔͕ಛఆͷਓ෺Ͱ͋Δ͜ͱΛূ໌͢Δߦҝ *".άϧʔϓΛࢦఆ͍ͨ͠ ෦෼ҰகΛࢦఆ͍ͨ͠ *".άϧʔϓ͸ɺೝূͷػೳͰ͸ͳ͘

    ೝՄͷػೳ *".άϧʔϓ͸ɺ*".ϢʔβΛάϧʔϐϯάͯ͠ *".ϙϦγʔͱͷؔ࿈෇͚Λ୲͏ ར༻ऀ ֎෦ Ϧιʔε *".Ϣʔβʔ *".άϧʔϓ *".ϙϦγʔ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  20. Operation Lab ӡ༻ઃܭϥϘ *".άϧʔϓͰʮϓϦϯγύϧʯΛᐆດʹͯ͠͸͍͚ͳ͍ 30 ೝূओޠΛܾఆ͢Δ ϓϦϯγύϧ ओޠ୭ʹڐՄ͍ͯ͠Δͷ͔  ͕ᐆດʹͳΔ

    ୭͔͕ಛఆͷਓ෺Ͱ͋Δ͜ͱΛূ໌͢Δߦҝ ϩʔϧΛ࢖͑Δਓ΍ϦιʔεΛ *".ϩʔϧͷೝূઃఆΛม͑ͣʹࣄޙతʹ௥ՃͰ͖Δ ૝ఆ֎ͷϓϦϯγύϧʹར༻͞Εɺ ࣄނ ηΩϡϦςΟϛε ʹͳΔ *".άϧʔϓΛࢦఆ͍ͨ͠ ෦෼ҰகΛࢦఆ͍ͨ͠ *".ϩʔϧͷ؅ཧऀͷ஌Βͳ͍ͱ͜ΖͰ উखʹϓϦϯγύϧ͕૿͍͑ͯΔ ͜Εࣗମ͕ɺ͋ΔҙຯΠϯγσϯτ ͳͥɺ*".ϩʔϧͷϓϦϯγύϧʹ ʹΑΔ෦෼Ϛονϯά͕࢖͑ͳ͍ͷ͔
  21. Operation Lab ӡ༻ઃܭϥϘ ·ͱΊԋ៷తʹߟ͑Δͱɺ݁࿦͸͜͏ͳΔ 32 ϋλϊ͞Μ *".ϩʔϧͷϓϦϯγύϧͬͯɺΞΧ΢ϯτશମࢦఆͷ ͸࢖͑Δ͚Ͳɺ ෦෼Ұகͷ ͬͯ࢖͑ͳ͍͡Όͳ͍Ͱ͔͢

     ͋ΕͬͯɺͲ͏ͯ͠ͳΜͰ͔͢Ͷ͐ ೝূ͸ɺ୭͔͕ಛఆͷਓ෺Ͱ͋Δ͜ͱ ϓϦϯγύϧ Λূ໌͢Δߦҝ ϓϦϯγύϧ ओޠ୭ʹڐՄ͍ͯ͠Δͷ͔ ͕ ᐆດʹͳΔΑ͏ͳࢦఆ͸Ͱ͖ͳ͍ ࣄނ๷ࢭ؍఺ ·ͱΊ