Slide 1
Slide 1 text
αʔόϨεVulsΞʔΩςΫνϟ࠶ͼ
VulsࡇΓ #3
Shuichi Ohsawa (@ohsawa0515)
1/9
Slide 2
Slide 2 text
ࣗݾհ
• େᖒलҰ
• http://blog.jicoman.info/
• @shu1_0515
• Sansanגࣜձࣾ
• σʔλԽγεςϜͷΠϯϑϥΛ୲
• Πϯϑϥߏஙɾӡ༻ɾվળɺ։ൃج൫ͷվળͳͲ
2/9
Slide 3
Slide 3 text
લճͷVulsࡇΓͰαʔόϨεͰVulsεΩϟϯ
͢ΔΛ͠·ͨ͠
https://speakerdeck.com/ohsawa0515/vuls-serverless-
architecture
ࠓճͦͷଓ͖ʹ͍ͭͯ͠·͢ɻ
(εϥΠυݟ͍ͯͳ͍ਓཁνΣοΫ)
3/9
Slide 4
Slide 4 text
CloudFormationςϯϓϨʔτͭ͘Γ·ͨ͠ !
• https://github.com/ohsawa0515/serverless-vuls
• લճͷVulsࡇΓͷͱ͖ʹͳΔૣͰެ։͢Δͱݴ͍ͬͯ·͕ͨ͠
Α͏͘ެ։͠·ͨ͠ !
• READMEͱ͔ෆ͍ͯ͠Δͱ͜Ζ͕͋ΔͷͰޙʑه͍ͯ͠·
͢
4/9
Slide 5
Slide 5 text
5/9
Slide 6
Slide 6 text
KMSͰ҉߸Խɾ෮߸
• DBύεϫʔυɺSSHൿີ伴
• CloudFormationͷΧελϜϦιʔεͰ҉߸Խɾ෮߸ΛLambda
ؔͰ࣮ߦ
• εΩϟϯ༻Lambdaؔʹ҉߸Խ͞ΕͨσʔλΛڥมͰ͠
ͯɺLambdaؔͰ෮߸
6/9
Slide 7
Slide 7 text
Step FunctionsͰLambdaؔͷϧʔϓ࣮ߦ
• go-cve-dictionary ͰCVEใΛDBʹ֨ೲ͢Δ
• Lambdaͷ࣮ߦ࣌ؒ(5)Λ͑ͳ͍Α͏ʹ1ຖʹ࣮۠ͬͯߦ
7/9
Slide 8
Slide 8 text
ec2-vuls-config ͰεΩϟϯରΛબఆ
• https://github.com/ohsawa0515/ec2-vuls-config
• EC2λά(vuls:scan)Λ͚ͨΠϯελϯεใΛVulsͷίϯϑΟάϑΝΠ
ϧʹॻ͖ࠐΉ
• Vuls v0.4.0 ͔ΒσϑΥϧτͰ֎෦SSHΛ͏Α͏ʹͳΓɺϗετΩʔν
ΣοΫ͕ඞਢʹ
• සൟʹEC2Πϯελϯε͕ೖΕସΘΔڥʹ͓͍ͯ૬ੑ͕ѱ͍
• -ssh-native-insecure ͰϗετΩʔνΣοΫ͕ೖΒͳ͍
8/9
Slide 9
Slide 9 text
ͥͻࢼͯ͠Έ͍ͯͩ͘͞ !
• όά͕͋Γ·ͨ͠ΒPR͍͚ͨͩΔͱॿ͔Γ·͢ ! !
• αϯϓϧ༻ͷεΩϟϯڥ(VPCɺEC2ͳͲ)Λߏங͢Δ
CloudFormationςϯϓϨʔτ͋ΔͷͰ·ͬ͞ΒͳAWSڥͰ
ࢼ͢͜ͱ͕Ͱ͖·͢ʂ
9/9