cdk deployに必要な権限ってなんだ？

by Kinyo

Slide 1

Slide 1 text

cdk deployʹ ඞཁͳݖݶͬͯͳΜͩʁ 2023/1/25 JAWS-UG CDKࢧ෦ #5

Slide 2

Slide 2 text

Kinyo    גࣜձࣾి௨ࠃࡍ৘ใαʔϏεʢISIDʣ  ηΩϡϦςΟΤϯδχΞʢ։ൃ΋গ͠ʣ        ࠓ೔ͷ಺༰ʹ͍ͭͯϒϩά΋ॻ͖·ͨ͠👉  ʮCDK Security And Safety Dev Guide ΛಡΜͰΈͨʯ    CDK Security And Safety Dev Guide ͷ಺༰Λࢀߟʹ͍ͯ͠·͢  https://github.com/aws/aws-cdk/wiki/Security-And-Safety-Dev-Guide    CDK v2 ͷ DefaultStackSynthesizer Λ࢖͏લఏͷ࿩Ͱ͢ ࣗݾ঺հ

Slide 3

Slide 3 text

cdk deploy͢Δͱ͖ʹ AdministratorAccessΛ࢖͍ͬͯ·ͤΜ͔ʁ

Slide 4

Slide 4 text

ආ͚͍ͨ͜ͱ • CDKͰΠϯϑϥߏங͢ΔͨΊͷAWSΫϨσϯγϟϧ͕࿙Εͨͱ͖ʹɺ  ڧ͍ݖݶ͕֎෦ʹ౉Δ͜ͱ CDK cdk deploy ։ൃऀ γεςϜ

Slide 5

Slide 5 text

CDK cdk deploy CloudFormation ϦιʔεσϓϩΠ Ϧιʔεૢ࡞Λ୲͏ͷ͸CloudFormation ඞཁͳݖݶ͸ʁ ڧ͍ݖݶ͕ඞཁ

Slide 6

Slide 6 text

ൿີ͸ cdk bootstrap ʹ͋Γ

Slide 7

Slide 7 text

cdk bootstrapͰ࡞੒͞ΕͨϦιʔεΛݟͯΈΑ͏ IAMϩʔϧ͕5ͭ࡞੒͞Ε͍ͯΔ ɾCloudFormationExecutionRole ɾDeploymentActionRole ɾFilePublishingRole ɾImagePublishingRole ɾLookupRole →কདྷͷcdk deployͰར༻͞ΕΔ Ξηοτ༻ͷECRϦϙδτϦ Ξηοτ༻ͷS3όέοτ

Slide 8

Slide 8 text

cdk deployͰى͍ͬͯ͜Δ͜ͱ CDK CloudFormation S3όέοτ ECRϦϙδτϦ LookupRole cdk deploy fromLookupͰ ϦιʔεΛࢀর͢Δ࣌ͳͲ PassRole ίϯςφΠϝʔδ ʢDockerImageAssetͳͲʣ CfnςϯϓϨʔτ΍ Lambdaؔ਺ίʔυ ࢀর ϦιʔεσϓϩΠ ࢀর File PublishingRole Image PublishingRole Deployment ActionRole CloudFormation ExecutionRole AssumeRole AssumeRole AssumeRole AssumeRole

Slide 9

Slide 9 text

ɾAWS؅ཧͷ ReadOnlyAccess ϙϦγʔ ɾΠϯϥΠϯͰ kms:Decrypt ͸ Deny ͞Ε͍ͯΔ ※Bootstrap v15 ࣌఺

Slide 10

Slide 10 text

ɾΞηοτ༻S3όέοτ΁ͷݖݶ ɾ҉߸Խ༻KMSΩʔ΁ͷݖݶ ɾΞηοτ༻ECRϦϙδτϦ΁ͷݖݶ ※Bootstrap v15 ࣌఺

Slide 11

Slide 11 text

ɾCloudFormationͷૢ࡞ݖݶʢStackɺChangeSetʣ ɾΫϩεΞΧ΢ϯτͰPipelineͷArtifactΛૢ࡞͢ΔݖݶʢS3ͱKMSʣ ɾΞηοτ༻S3όέοτͷಡΈऔΓݖݶ ɾParameter Store͔ΒCDK bootstrapόʔδϣϯͷಡΈऔΓݖݶ ɾɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ͷiam:PassRole CloudFormationExecutionRole ※Bootstrap v15 ࣌఺ CloudFormation ExecutionRole CloudFormation PassRole

Slide 12

Slide 12 text

AdministratorAccess ※Bootstrap v15 ࣌఺

Slide 13

Slide 13 text

ͭ·Γɺcdk deployʹඞཁͳݖݶ͸ʁ ͜ΕΒ΁ͷAssumeRoleݖݶ 🙅AssumeRoleෆཁ

Slide 14

Slide 14 text

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AssumeCDKRoles", "E ff ect": "Allow", "Action": "sts:AssumeRole", "Resource": [ "arn:aws:iam::111111111111:role/cdk-hnb659fds-deploy-role-111111111111-ap-northeast-1", "arn:aws:iam::111111111111:role/cdk-hnb659fds- fi le-publishing-role-111111111111-ap-northeast-1", "arn:aws:iam::111111111111:role/cdk-hnb659fds-image-publishing-role-111111111111-ap-northeast-1", "arn:aws:iam::111111111111:role/cdk-hnb659fds-lookup-role-111111111111-ap-northeast-1" ] } ] } cdk deploy͢ΔͨΊͷ࠷খݖݶIAMϙϦγʔ ෳ਺ϦʔδϣϯʹσϓϩΠ͢Δ৔߹ɺ ϩʔϧ͸Ϧʔδϣϯ͝ͱʹ͋Δ͜ͱʹ஫ҙ

Slide 15

Slide 15 text

cdk deploy͢Δݖݶ͕ ɾAdminݖݶΛ௚઀࣋ͨͳ͍ ɾAdminݖݶΛ࣋ͭϩʔϧΛAssumeͰ͖ͳ͍ ͜ͱͰϦεΫΛݮΒ͢

Slide 16

Slide 16 text

͞Βʹਂ۷Γ ͜ΕͰສશʁ🤔

Slide 17

Slide 17 text

ݫີͳ੍ݶ͸Ͱ͖͖ͯͳ͍ • ɹɹɹɹɹɹɹ͕CloudFormationελοΫΛ࡞Εͯɺ  AdminݖݶΛ౉ͤΔͷͰɺCloudFormationܦ༝Ͱ͍Ζ͍ΖͰ͖ͯ͠·͏  • ྫ͑͹ɾɾɾ • ಛఆͷ໊લͷڧݖݶͷRoleΛ࡞੒͠ɺAssume͢Δ  ʢAssumeΛڐՄ͢Δϩʔϧ໊ΛϫΠϧυΧʔυͰࢦఆ͍ͯ͠Δ৔߹ʣ • ɹɹɹɹɹɹɹࣗ਎ʹڧݖݶͷϙϦγʔΛ௥Ճ͢Δ Deployment ActionRole Deployment ActionRole

Slide 18

Slide 18 text

ݫີͳ੍ݶΛ͍ͨ͠৔߹͸ɺ ɹɹɹɹͷݖݶΛߜΔ CloudFormation ExecutionRole

Slide 19

Slide 19 text

cdk bootstrapͷΦϓγϣϯͰ ɹɹɹɹɹͷݖݶΛߜΔํ๏3ͭ • --cloudformation-execution-policies … ϙϦγʔΛ্ॻ͖ • https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-customizing • ؆୯ʹݖݶΛ੍ݶ͍ͨ͠৔߹ • --template … BootstrapςϯϓϨʔτΛϑϧΧελϚΠζ • https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-customizing-extended • --custom-permissions-boundary … Permissions boundaryΛ௥Ճʢv2.54.0~ʣ • https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/README.md#cdk-bootstrap • IAMϦιʔεͷ࡞੒ΛڐՄͭͭ͠ݖݶঢ֨Λ๷͍͗ͨ৔߹ CloudFormation ExecutionRole

Slide 20

Slide 20 text

݁࿦ bootstrapͨ͠ޙ͸ cdk deploy͢ΔݖݶΛݟ௚ͦ͏