IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた

Slide 1

Slide 1 text

*".ϩʔϧΛ ݸ࡞ͬͯ༡ΜͰ͍ͨΒ "84ར༻අ͕υϧΛ௒͍͑ͯͨ ઍ༿޾޺ʢνόϢΩʣ

Slide 2

Slide 2 text

ࠓ೔࣋ͪؼ͍͖͍ͬͯͨͩͨ͜ͱ ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ ʮAWS Conﬁg ͷϕετϓϥΫςΟεʯ ʁʁʁʁʁ

Slide 3

Slide 3 text

ࣗݾ঺հ ɾ2020೥1݄Ϋϥεϝιου ೖࣾ ɾITΤϯδχΞྺ7೥ऑɺ ɹɹ͏ͪAWSྺ6೥ऑ ɾAWSԿ΋Θ͔ΒΜɻɻ😇 ɾ࠲ӈͷ໏ɿ ɹʮIAM ϩʔϧ͸͓໘ͷΑ͏ͳ΋ͷʯ

Slide 4

Slide 4 text

ಥવͰ͕͢ ͜Μͳ͜ͱɺΑ͋͘Γ·ͤΜ͔ʁʁ

Slide 5

Slide 5 text

͋Γ;Εͨ೔ৗͷ෩ܠ

Slide 6

Slide 6 text

͋Γ;Εͨ೔ৗͷ෩ܠ ʮ͋ʔ……ʯ

Slide 7

Slide 7 text

͋Γ;Εͨ೔ৗͷ෩ܠ ʮIAMϩʔϧ ɹ1000ݸ ɹɹ࡞Γ͍ͨͳ……ʯ ʮ͋ʔ……ʯ

Slide 8

Slide 8 text

͋ʔʜʜ *".ϩʔϧ ɹݸ ࡞Γ͍ͨͳᴸᴸᴸ

Slide 9

Slide 9 text

͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ ʮͲ͏ͤ IAM ͬͯ ɹɹແྉͩ͠ͳʯ Θͨ͠

Slide 10

Slide 10 text

͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ ʮͲ͏ͤ IAM ͬͯ ɹɹແྉͩ͠ͳʯ ˛Կ͔͕ߦΘΕ͍ͯΔ༷ࢠ Կ͔Λ͢ΔΘͨ͠

Slide 11

Slide 11 text

શ༰͸ͪ͜ΒΛͲ͏ͧ Զୡ͸͍ͭ·Ͱ΋ཱͪਚ͘͠ ݟͭΊ͍ͯͨᴸᴸᴸ ਺ଟͷ*".ϩʔϧ͕ҠΖ͏Α͏ ʹ࿈࠯͍ͯ͘͠ɺͦͷ͞·Λɻ

Slide 12

Slide 12 text

:PV`WF(PU"/PUJpDBUJPO ✉ 💨💨💨

Slide 13

Slide 13 text

:PV`WF(PU"/PUJpDBUJPO

Slide 14

Slide 14 text

:PV`WF(PU"/PUJpDBUJPO 65.3υϧ

Slide 15

Slide 15 text

:PV`WF(PU"/PUJpDBUJPO 65.3υϧ 👁👁 👄 ͕ܲ౾మ๒ΛᷰΒͬͨΑ͏ͳإΛ͢ΔΘͨ͠

Slide 16

Slide 16 text

γϯΩϯάλΠϜ ʮߟ͑Ζᴸᴸߟ͑ΔΜͩᴸᴸᴸʜʜʯ

Slide 17

Slide 17 text

ʁʁ ʁʁ ݪҼ͸$POpHͰͨ͠ 👁 👁 ʮ*".ϩʔϧΛݸ࡞ͬͨΒ ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ ʁʁʁʁ ʁʁʁ ʁʁʁʁ

Slide 18

Slide 18 text

ݪҼ͸$POpHͰͨ͠ 👁 👁 ʮ*".ϩʔϧΛݸ࡞ͬͨΒ ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ

Slide 19

Slide 19 text

$POpH $POpH <ίϯϑΟά>

Slide 20

Slide 20 text

"84$POpHͱ͸ l"84$POpH͸ɺ"84ϦιʔεͷઃఆΛධՁɺ؂ࠪɺ৹ࠪͰ͖ΔαʔϏεͰ͢ɻ $POpHͰ͸ɺ"84Ϧιʔεͷઃఆ͕ܧଓతʹϞχλϦϯά͓Αͼه࿥͞Εɺ ๬·ΕΔઃఆʹର͢Δه࿥͞ΕͨઃఆͷධՁΛࣗಈతʹ࣮ߦͰ͖·͢ɻz https:// aws.amazon.com/jp/ conﬁg/ https://www.slideshare.net/ AmazonWebServicesJapan/ 20190618-aws-black-belt- online-seminar-aws-conﬁg

Slide 21

Slide 21 text

5SBJMͱ$POpHͷҧ͍ A͞Μ B͞Μ ΠϯελϯεA Πϯελϯε ৽ن࡞੒ Πϯελϯε λΠϓมߋ m5.xlarge m5.large

Slide 22

Slide 22 text

5SBJMͱ$POpHͷҧ͍ A͞Μ B͞Μ ΠϯελϯεA Πϯελϯε ৽ن࡞੒ Πϯελϯε λΠϓมߋ m5.xlarge m5.large Cloud Trail AWS Conﬁg

Slide 23

Slide 23 text

ͦΕΛ౿·͑ͯ Կ͕ى͍ͬͯͨ͜ͷ͔

Slide 24

Slide 24 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ͍ͬͪΐ ΍ͬͯΈ͔ͬʂ

Slide 25

Slide 25 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ϩʔϧΛ ͨ͘͞Μ ࡞Δͧʂ

Slide 26

Slide 26 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ϙϦγʔΛ ͦΕͧΕ ͚ͭΔͧʂ

Slide 27

Slide 27 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ͍ͬͨΜ ࡟আ͢Δͧʂ

Slide 28

Slide 28 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ϩʔϧΛ ͨ͘͞Μ ࡞Δͧʂ

Slide 29

Slide 29 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ϙϦγʔΛ ͦΕͧΕ ͚ͭΔͧʂ

Slide 30

Slide 30 text

Կ͕ى͍ͬͯͨ͜ͷ͔ ͍ͬͨΜ ࡟আ͢Δͧʂ

Slide 31

Slide 31 text

શ෦ه࿥ͯ͠·ͨ͠Α ώΟ શ෦ه࿥ ͯ͠·ͨ͠Α ౦ژͷ Conﬁg ʁʁʁ

Slide 32

Slide 32 text

ࢲ΋શ෦ه࿥ͯ͠·ͨ͠Α ώΟ ౦ژͷ Conﬁg ʁʁʁ όʔδχΞͷ Conﬁg ʁʁʁ ࢲ΋ શ෦ه࿥ ͯ͠·ͨ͠Α

Slide 33

Slide 33 text

ح۰ͩͳɺԶ΋ه࿥ͯͨ͠Α ώΟ ౦ژͷ Config ʁʁʁ όʔδχΞͷ Config ʁʁʁ ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ϜϯόΠͷ Config ʁʁʁ

Slide 34

Slide 34 text

ʮʮʮ͓͍͓͍ɺԶͨͪΛ๨ΕΔͳΑʜʁʯʯʯ ౦ژͷ Config ʁʁʁ όʔδχΞͷ Config ʁʁʁ ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ϜϯόΠͷ Config ʁʁʁ ֤Ϧʔδϣϯͷ Configͨͪ ʁʁʁ ώϡο ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ح۰ͩͳɺ Զ΋ه࿥ͯͨ͠Α ͓͍͓͍ɺ ԶͨͪΛ ๨ΕΔͳΑʜʁ ͓͍͓͍ɺ ԶͨͪΛ ๨ΕΔͳΑʜʁ

Slide 35

Slide 35 text

֤Ϧʔδϣϯʢݸʣͷ$POpH ౦ژͷ Config όʔδχΞͷ Config ϜϯόΠͷ Config ֤Ϧʔδϣϯͷ Configͨͪ ͋Γ͕ͱ͏ ͍͟͝·͢

Slide 36

Slide 36 text

νϦ΋ੵ΋Ε͹υϧ௒͑Δ 46υϧ 5υϧ 2021೥3݄શମ 2021೥4݄த० ʮ͓΅Ζ͛ͳ͕Β ු͔ΜͰ͖ͨΜͰ͢ɻʯ

Slide 37

Slide 37 text

$POpHͷྉۚ ɾه࿥͞Εͨઃఆ߲໨͝ͱʹ0.003USD ɾ1000ΠϕϯτͰ3USD ɾIAM ͸άϩʔόϧϦιʔεͳͷͰ ɹશϦʔδϣϯͷ Conﬁg ͕ه࿥ ͋Γ͕ͱ͏ ͍͟͝·͢

Slide 38

Slide 38 text

$POpH͚ͩ͡Όͳ͍ େྔͷAPIίʔϧ Ͳ͏ͨ͠ Ͳ͏ͨ͠ Ͳ͏ͨ͠ Ͳ͏ͨ͠ ֤Ϧʔδϣϯͷ Trail ֤Ϧʔδϣϯͷ GuardDuty

Slide 39

Slide 39 text

5SBJMͱ(VBSE%VUZͷྉۚ ௥Ճͷίϐʔ ഑৴͞Εͨ ؅ཧΠϕϯτ͋ͨΓ64% 6υϧ Trail 9υϧ GuardDuty ສΠϕϯτ͋ͨΓ64% ສΠϕϯτ͋ͨΓ64%

Slide 40

Slide 40 text

͘͠͡Βͳ͍ͨΊʹ Ͳ͏͢Ε͹ආ͚ΒΕͨͷ͔

Slide 41

Slide 41 text

̏ͭ͋Γ·͢ • ɹ • ɹ • ɹ

Slide 42

Slide 42 text

̏ͭ͋Γ·͢ • IAMϩʔϧͰ༡͹ͳ͍ • ɹ • ɹ

Slide 43

Slide 43 text

̏ͭ͋Γ·͢ • IAMϩʔϧͰ༡͹ͳ͍ • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ • ɹ

Slide 44

Slide 44 text

ྫ͑͹ • ੥ٻΞϥʔτ • AWS Budgets • ࡞ΓࠐΈʹΑΔఆظऔಘ https://dev.classmethod.jp/articles/ aws-budgets-alert-by-aws-chatbot/ https://dev.classmethod.jp/articles/ notify-slack-aws-billing/

Slide 45

Slide 45 text

ࢲ΋΍ͬͯ·͢ ͸͍ʜʜ

Slide 46

Slide 46 text

̏ͭ໨ • IAMϩʔϧͰ༡͹ͳ͍ • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ • ConﬁgͷϕετϓϥΫςΟεʹ ͷͬͱΔ

Slide 47

Slide 47 text

$POpHͷϕετϓϥΫςΟε https:// aws.amazon.com/jp/ blogs/news/aws- conﬁg-best-practices/ Conﬁg ϕετϓϥΫςΟε ϒϩά | ݕࡧ 20ݸͷϓϥΫςΟε

Slide 48

Slide 48 text

$POpHͷϕετϓϥΫςΟεʢൈਮʣ 1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Conﬁg Λ༗ޮʹ͢Δ 2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ 3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ 4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ ͳ S3 όέοτΛ࢖༻͢Δ 5. ……

Slide 49

Slide 49 text

ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ ౦ژͷ Conﬁg ֤Ϧʔδϣϯͷ Conﬁgͨͪ ࢲ͚͕ͩ ه࿥͠·͢ …… ͸͍ʜʜ

Slide 50

Slide 50 text

ҰํͰ

Slide 51

Slide 51 text

$POpHͷϕετϓϥΫςΟεʢൈਮʣ 1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Conﬁg Λ༗ޮʹ͢Δ 2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ 3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ 4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ ͳ S3 όέοτΛ࢖༻͢Δ 5. …… ͷͬͱΔͷ͕ ϚετͰ͸ͳ͍

Slide 52

Slide 52 text

$POpHͷه࿥ର৅ͷબ୒ https://docs.aws.amazon.com/ja_jp/ conﬁg/latest/developerguide/resource- conﬁg-reference.html ݸऑͷ ϦιʔελΠϓͷத͔Β ඞཁ෼ͷΈΛબ୒

Slide 53

Slide 53 text

ຊ౰ʹه࿥͕ඞཁʁίετΛҙࣝ͠Α͏ ྫʣAutoScaling ؔ࿈Ϧιʔε͕͢΂ͯه࿥ର৅ͱͳΔͨΊɺ සൟʹஔ͖׵͕͑ߦΘΕΔ৔߹ɺ ίετ͕ਹΉ͜ͱ΋ɻ Auto scaling Instance Elastic network interface Volume Security group શ෦ه࿥ʹ࢒͢ඞཁ ͋Δ͔ͳʁ

Slide 54

Slide 54 text

৽نରԠϦιʔε΋ه࿥ͯ͘͠ΕΔͷ͸خ͍͚͠ΕͲ 2021/2/26 •Conﬁgͷه࿥ର৅͕૿͑ͨ •ʮ͢΂ͯΛه࿥ʯͷ৔߹ɺ৽نͷର৅΋ࣗ ಈతʹه࿥։࢝ •͜Ε·Ͱൃੜ͍ͯ͠ͳ͔ͬͨίετ͕ٸʹ ૿͑ͨɺͱ͍͏͜ͱ΋ى͜Γ͏Δ

Slide 55

Slide 55 text

ه࿥͢Δ͜ͱΛݪଇͱͭͭ͠ίετ΋ҙࣝ • ه࿥Λ࢒͢ͷ͸େࣄ • ίετݟ߹͍Ͱऔࣺબ୒Λ Conﬁg Trail GuardDuty Ϧιʔεͷ ઃఆ಺༰Λ ه࿥͠·͢ ΠϕϯτΛ ه࿥͠·͢ ෆ৹ͳ ΞΫςΟϏςΟΛ ݕ஌͠·͢

Slide 56

Slide 56 text

·ͱΊ

Slide 57

Slide 57 text

࣋ͪؼ͍ͬͯͩ͘͞ ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ ʮAWS Conﬁg ͷϕετϓϥΫςΟεʯ

Slide 58

Slide 58 text

࣋ͪؼ͍ͬͯͩ͘͞ ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ ʮAWS Conﬁg ͷϕετϓϥΫςΟεʯ ʮIAMϩʔϧͰ༡ΜͰ͸͍͚ͳ͍ʯ