Share
Embed
Slide 1
Slide 1 text
© NTT TechnoCross Corporation
Slide 2
Slide 2 text
© NTT TechnoCross Corporation
2
Slide 3
Slide 3 text
© NTT TechnoCross Corporation
3
Slide 4
Slide 4 text
© NTT TechnoCross Corporation
4
Slide 5
Slide 5 text
© NTT TechnoCross Corporation
5
Slide 6
Slide 6 text
© NTT TechnoCross Corporation
6
Slide 7
Slide 7 text
© NTT TechnoCross Corporation
7
Slide 8
Slide 8 text
© NTT TechnoCross Corporation
8
Slide 9
Slide 9 text
© NTT TechnoCross Corporation
9
Slide 10
Slide 10 text
© NTT TechnoCross Corporation
10
Slide 11
Slide 11 text
© NTT TechnoCross Corporation
11
Slide 12
Slide 12 text
© NTT TechnoCross Corporation
12
Slide 13
Slide 13 text
© NTT TechnoCross Corporation
13
Slide 14
Slide 14 text
© NTT TechnoCross Corporation
14
Slide 15
Slide 15 text
© NTT TechnoCross Corporation
15
Slide 16
Slide 16 text
© NTT TechnoCross Corporation
16
Slide 17
Slide 17 text
© NTT TechnoCross Corporation
17
Slide 18
Slide 18 text
【New】五男 Crew
© NTT TechnoCross Corporation
18
Slide 19
Slide 19 text
© NTT TechnoCross Corporation
19
Slide 20
Slide 20 text
© NTT TechnoCross Corporation
20
Slide 21
Slide 21 text
© NTT TechnoCross Corporation
21
Slide 22
Slide 22 text
© NTT TechnoCross Corporation
22
Slide 23
Slide 23 text
© NTT TechnoCross Corporation
23
Slide 24
Slide 24 text
# ~/.kiro/settings/permissions.yaml … 全プロジェクトに適用
rules:
# ---- 拒否（最優先。どのスコープのallowでも上書きできない）---- capability: fs_read
effect: deny
match: ["**/.env", "**/.env.*", "**/*.pem", "**/*.key", "secrets/**"]
- capability: shell
effect: deny
match: ["rm -rf *", "sudo *"]
# ---- 許可 ---- capability: fs_read
effect: allow
- capability: fs_write
effect: allow
match: ["src/**", "tests/**"]
# npmは許可、ただし公開だけは除外
- capability: shell
effect: allow
match: ["npm *", "npx *", "git *"]
exclude: ["npm publish*"]
- capability: mcp
effect: allow
match: ["awslabs.aws-documentation-mcp-server/*"]
© NTT TechnoCross Corporation
24
Slide 25
Slide 25 text
# ~/.kiro/settings/permissions.yaml
rules:
- capability: fs_read
effect: deny
match: ["**/.env"] #・・・・・②
© NTT TechnoCross Corporation
25
Slide 26
Slide 26 text
# ~/.kiro/settings/permissions.yaml
# npmコマンドは許可。ただし公開だけは除く
rules:
- capability: shell
effect: allow #・・・・・②
match: [“npm *"]
exclude: ["npm publish*"]
© NTT TechnoCross Corporation
26
Slide 27
Slide 27 text
© NTT TechnoCross Corporation
27
Slide 28
Slide 28 text
© NTT TechnoCross Corporation
28
Slide 29
Slide 29 text
© NTT TechnoCross Corporation
29
Slide 30
Slide 30 text
© NTT TechnoCross Corporation
30
Slide 31
Slide 31 text
© NTT TechnoCross Corporation
31
Slide 32
Slide 32 text
・・・①
・・・②
・・・③
・・・④
© NTT TechnoCross Corporation
32
Slide 33
Slide 33 text
© NTT TechnoCross Corporation
33
Slide 34
Slide 34 text
© NTT TechnoCross Corporation
34
Slide 35
Slide 35 text
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "q.amazonaws.com"
},
"Action": [
"sts:AssumeRole",
"sts:SetSourceIdentity"
],
© NTT TechnoCross Corporation
35
Slide 36
Slide 36 text
© NTT TechnoCross Corporation
36
Slide 37
Slide 37 text
© NTT TechnoCross Corporation
37
Slide 38
Slide 38 text
© NTT TechnoCross Corporation
38
Slide 39
Slide 39 text
ACP（Agent Client Protocol）
kiro-cli(v2系)
設定ファイル:~/.kiro/agents/kirocrew.json(Kiro Crewが生成した)
LLM(Bedrock)
© NTT TechnoCross Corporation
39
Slide 40
Slide 40 text
© NTT TechnoCross Corporation
40
Slide 41
Slide 41 text
© NTT TechnoCross Corporation
41
Slide 42
Slide 42 text
© NTT TechnoCross Corporation
42
Slide 43
Slide 43 text
© NTT TechnoCross Corporation
43
Slide 44
Slide 44 text
© NTT TechnoCross Corporation
44
Slide 45
Slide 45 text
© NTT TechnoCross Corporation
45
Slide 46
Slide 46 text
© NTT TechnoCross Corporation
46
Slide 47
Slide 47 text
•
•
•
•
•
© NTT TechnoCross Corporation
47
Slide 48
Slide 48 text
© NTT TechnoCross Corporation
48
Slide 49
Slide 49 text
© NTT TechnoCross Corporation
49
Slide 50
Slide 50 text
© NTT TechnoCross Corporation
50
Slide 51
Slide 51 text
© NTT TechnoCross Corporation
51
Slide 52
Slide 52 text
© NTT TechnoCross Corporation
52
Slide 53
Slide 53 text
© NTT TechnoCross Corporation
53
Slide 54
Slide 54 text
{
"version": 1,
"boot": { "fail_closed": true },
"network": {
"egress": {
"mode": "allow",
"allow": ["*.amazonaws.com", "*.kiro.dev", "management.*.kiro.dev", "runtime.*.kiro.dev"]
}
},
"commands": {
"mode": "deny",
"deny": ["curl*://*", "wget*://*", "nc *", "ncat *"]
}
}
© NTT TechnoCross Corporation
54
Slide 55
Slide 55 text
© NTT TechnoCross Corporation
55
Slide 56
Slide 56 text
© NTT TechnoCross Corporation
56
Slide 57
Slide 57 text
© NTT TechnoCross Corporation
57
Slide 58
Slide 58 text
# ~/.kiro/crew/ security_policy.json
"mcp": {
"mode": "deny",
"deny": ["@kirocrew-computer"]
}
© NTT TechnoCross Corporation
58
Slide 59
Slide 59 text
© NTT TechnoCross Corporation
59
Slide 60
Slide 60 text
{
"version": 1,
"boot": { "fail_closed": true },
"network": {
"egress": {
"mode": "allow",
"allow": ["*.amazonaws.com", "*.kiro.dev", "management.*.kiro.dev", "runtime.*.kiro.dev"]
}
},
"commands": {
"mode": "deny",
"deny": ["curl*://*", "wget*://*", "nc *", "ncat *", "ssh *", "scp *", "python -c*", "python3 -c*"]
},
"capabilities": {
"telemetry": { "enabled": false },
"publish":
{ "enabled": false },
"theme_install": { "enabled": false }
},
"filesystem": {
"write": {
"mode": "allow",
"allow": ["~/work/**", "/tmp/**"]
}
},
}
"mcp": {
"mode": "deny",
"deny": ["@kirocrew-computer"]
}
© NTT TechnoCross Corporation
60
Slide 61
Slide 61 text
© NTT TechnoCross Corporation
61
Slide 62
Slide 62 text
© NTT TechnoCross Corporation
62