サーバーレス化を支える認証認可の話

by Takuro SASAKI

Slide 1

Slide 1 text

αʔόʔϨεԽΛࢧ͑Δ ೝূೝՄͷ࿩ /3*ωοτίϜגࣜձࣾɹ ࠤʑ໦୓࿠ +"846(͍ͨ͞·ࢧ෦ɹୈճษڧձ ʙ೥ॳΊ೔ຊͰҰ൪ૣ͍SF$BQ৽೥ձʙ

Slide 2

Slide 2 text

ࠤʑ໦୓࿠ ϫΠϯ޷͖ͳ"84ΤϯδχΞ CMPHIUUQCMPHUBLVSPTOFU UXJUUFS!ELGK ࣗݾ঺հ

Slide 3

Slide 3 text

ͪΐͬͱએ఻ "NB[PO8FC4FSWJDFT ۀ຿γεςϜઃܭɾҠߦΨΠυ Ұ൪େ੾ͳ஌ࣝͱٕज़͕਎ʹͭ͘ IUUQBN[OUPNK0*B9 ೥݄೔ൃച։࢝ʂʂ

Slide 4

Slide 4 text

΋͏̍ͭએ఻ "NB[PO8FC4FSWJDFT ύλʔϯผߏஙɾӡ༻ΨΠυ Ұ൪େ੾ͳ஌ࣝͱٕज़͕਎ʹͭ͘ IUUQBN[OUP#-J:D0 "84ͷೋ൪໨ʹ෼ް͍ຊ ʢେ༰ྔϖʔδʣ

Slide 5

Slide 5 text

·ͩ·ͩએ఻ "NB[PO8FC4FSWJDFT Ϋϥ΢υωΠςΟϒɾΞϓϦέʔγϣϯ։ൃٕ๏ Ұ൪େ੾ͳ஌ࣝͱٕज़͕਎ʹͭ͘ IUUQBN[OUP3ZZ-Z "84ͷΞϓϦຊ ʢେ༰ྔϖʔδʣ

Slide 6

Slide 6 text

αʔόϨεΞʔΩςΫνϟͰߏங͢Δࡍͷ ೝূೝՄɺΞΫηε੍ݶͷύλʔϯΛ Կͱͳ͘஌ͬͯ໯͍·͢ ࠓ೔ͷ໨త

Slide 7

Slide 7 text

αʔόϨεΞʔΩςΫνϟʁ ར༻Ͱ͖ΔਓΛ੍ݶ͍ͨ͠৔߹͸ʁ API Gateway Lambda DynamoDB ΫϥΠΞϯτ ϞόΠϧ CloudFront S3 ίϯςϯπͷ औಘ ϩδοΫ WebαΠτΛαʔόϨεԽͨ͠ྫ

Slide 8

Slide 8 text

ೝূೝՄͱΞΫηε੍ݶ

Slide 9

Slide 9 text

ᶃ*% 1BTTXPSE౳ ར༻ऀ ᶄਖ਼౰ੑͷ֬ೝ ೝূہ ᶅຊਓੑͷอূ ᶆϦιʔεͷׂ౰ αʔϏε ೝূ ʢ"VUIFOUJDBUJPOʣ ೝՄ ʢ"VUIPSJ[BUJPOʣ ೝূͱೝՄ ࣮ࡍ͸ɺೝূೝՄ͕ηοτʹͳ͍ͬͯΔࣄ͕ଟ͍ ୭Ͱ͋Δ͔ʁ ୭͕୭ʹ ԿͷݖݶΛ༩͑Δ͔

Slide 10

Slide 10 text

"1*ͷੈքͰ͸ʁ τʔΫϯͷӡ༻ΛͲ͏͢Δ͔ɺ৭ʑͳઃܭํ๏͕͋Δ ೝূɾೝՄγεςϜ "1*܈ ར༻ऀ ᶃ*% 1BTTXPSE౳ ᶄΞΫηετʔΫϯ ᶅʙϦΫΤετXJUIτʔΫϯ ॳճΞΫηεɿ*% 1BTTXPSE ೋճ໨Ҏ߱ɹɿτʔΫϯ 㱺ೝূ࿈ܞʢϑΣσϨʔγϣϯʣ

Slide 11

Slide 11 text

*%࿈ܞٕज़ʢ0"VUI 0QFO*% 4".-ʣ 0QFO*%ೝূͷϓϩτίϧ *EFOUJUZ "VUIFOUJDBUJPO 0"VUI0QFO*%$POOFDU 0"VUIೝՄͷϓϩτίϧ اۀ಺ͷγεςϜؒ࿈ܞ͸ɺ 4".-͕ଟ͍

Slide 12

Slide 12 text

ͪΌΜͱ஌Γ͍ͨਓ͸ɺ͜ΕΛಡΜͰ͍ͩ͘͞ IUUQTXXXTMJEFTIBSFOFUULVEPPBVUIPJEDBQJTFDVSJUZZV[BXBXT

Slide 13

Slide 13 text

ΞΫηε੍ݶ ΞΫηεݩ৘ใʹΑΔΞΫηε੍ݶ ɾ*1"EESFTT ɾϔομʔ৘ใʢϢʔβʔΤʔδΣϯτ౳ʣ ɾભҠݩʹΑΔ੍ݶʢϦϑΝϥʔʣ ɾFUD ϢʔβʔೝূʹΑΔΞΫηε੍ݶ ɾ*%ɺύεϫʔυ ɾτʔΫϯ ɾFUD ຊਓೝূͳ͠ͰɺϦιʔεͷར༻Λ੍ݶ͢Δ͜ͱ΋͋Δ

Slide 14

Slide 14 text

"84ͷ৔߹ͷ࣮ݱํ๏͸ʁ ·ͣ͸ɺ"1*(BUFXBZͱ$PHOJUPͷ ػೳ঺հ

Slide 15

Slide 15 text

$PHOJUP ೝূೝՄͷαʔϏεɻ "1*ͱ૬ੑͽͬͨΓ $PHOJUP6TFS1PPM Ϣʔβʔ؅ཧʢ%#ʣαʔϏε αΠϯΠϯɾαΠϯΞ΢τͳͲೝূΛ୲౰ .'"΍ύεϫʔυϙϦγʔ౳ɺҰ௨Γͷػೳ͕ଗ͍ͬͯΔ $PHOJUP'FEFSBUFE*EFOUJUJFT ೝূ෦෼͸ɺ֎෦ϓϩόΠμʹҠৡɻೝՄͷαʔϏε ֎෦ϓϩόΠμͱͯ͠ɺ'BDFCPPL΍5XJUUFS౳͕ར༻Մೳ ೝূͨ͠ϢʔβʔʹҰ࣌తͳ"84ͷར༻ݖݶΛ෇༩ "84454Λ؆୯ʹ࢖͑ΔΑ͏ʹͨ͠΋ͷ

Slide 16

Slide 16 text

*EFOUJUZ1SPWJEFST 'BDFCPPL (PPHMF 5XJUUFS FUD ΫϥΠΞϯτ୺຤ *% 1BTTXPSE τʔΫϯ $PHOJUP Ұ࣌తূ໌ͷ ෇༩ τʔΫϯ*% Ұ࣌త ར༻ݖݶ "84ͷ ֤छϦιʔε ݖݶʹԠͯ͡ ར༻Մೳ ೝՄ ೝূ $PHOJUPͷಈ࡞Πϝʔδ

Slide 17

Slide 17 text

"1*(BUFXBZ 8FC"1*ͷ࡞੒ɾอޢɾӡ༻ͱ ެ։Λ؅ཧ͢ΔαʔϏε 3&45"1*ͷ࡞੒αʔϏε -BNCEB )5511SPYZ "841SPYZ -BNCEBݺͼग़͠ API Gateway Lambda EC2 )5511SPYZ "841SPYZ AWSαʔϏε ֤छ

Slide 18

Slide 18 text

"1*(BUFXBZͷೝূػೳ ೝূํ๏ "*".ΞΫηεݖݶ #ΧελϜΦʔαϥΠβʔ $$PHOJUPϢʔβʔϓʔϧ API Gateway Lambda Cognito User Pool ΫϥΠΞϯτ "*".ΞΫηεݖݶ #ΧελϜ ΦʔαϥΠβʔ $$PHOJUP Ϣʔβʔϓʔϧ

Slide 19

Slide 19 text

"1*(BUFXBZͷΞΫηε੍ݶ ੍ݶํ๏ "ΫϥΠΞϯτূ໌ॻ #"1*Ωʔ $ϦΫΤετͷݕূ API Gateway ΫϥΠΞϯτ "ΫϥΠΞϯτূ໌ॻ #"1*Ωʔ vKC5ZoO1tz7WH H6dfuZdd3zq9ShZ TnJzaCNONs9v $ϦΫΤετݕূ ϔομʔɺ ຊจ etc

Slide 20

Slide 20 text

"1*(BUFXBZͷ*1ΞυϨεʹΑΔ੍ݶ "848"'$MPVE'SPOU 8"'ͷ*1.BUDI$POEJUJPOΛར༻ 8"'Λར༻͢ΔͨΊʹɺ$MPVE'SPOU΋ར༻ API Gateway ΫϥΠΞϯτ WAF CloudFront ΫϥΠΞϯτ *1.BUDI$POEJUJPOͰ൑ఆ 999:::;;;""" """:::;;;999 ̋ ❌ $MPVE'SPOU"1*(BUFXBZͱ͍͏ແବͳଆ໘΋

Slide 21

Slide 21 text

"1*(BUFXBZͷ*1ΞυϨεʹΑΔ੍ݶᶃ *".ʹΑΔ੍ݶ "1*(BUFXBZͷೝূͰɺ*".Λར༻͢Δ *".ͷ$POEJUJPOͰɺ*1੍ݶΛֻ͚Δ ར༻ऀ͕"84ϢʔβͷΈͰ͋Ε͹खஈͷ̍ͭ API Gateway ΫϥΠΞϯτ ಛఆͷ৔ॴͷΈ༗ޮͳ伴

Slide 22

Slide 22 text

Ϣʔεέʔε͝ͱͷ ΞʔΩςΫνϟ $PHOJUPฤ

Slide 23

Slide 23 text

৽نͰαʔϏεͷ্ཱͪ͛ $PHOJUP6TFS1PPM͕͓קΊ "1*(BUFXBZͷೝূͰɺ*".Λར༻͢Δ *".ͷ$POEJUJPOͰɺ*1੍ݶΛֻ͚Δ API Gateway ΫϥΠΞϯτ Cognito User Pool Lambda ೝূ ॲཧ

Slide 24

Slide 24 text

طଘͷγεςϜʹ"1*௥Ճ ΧελϜΦʔαϥΠβʔͰطଘ%#Λࢀর -BNCEBͰࣗલͰೝূॲཧΛ࣮૷ طଘγεςϜʹ*%ɾύεϫʔυͷਖ਼౰ੑΛ໰͍߹Θͤ API Gateway ΫϥΠΞϯτ ΧελϜ ΦʔαϥΠβʔ ೝূ طଘγεςϜ ໰͍߹Θͤ Lambda ॲཧ

Slide 25

Slide 25 text

طଘγεςϜΛ$PHOJUP6TFS1PPMʹҠߦ͍ͨ͠ ͭΒ͍ $PHOJUP6TFS1PPMʹ͸ɺσʔλΠϯϙʔτػೳ͸͋Δ ͨͩ͠ɺύεϫʔυ͸ҠߦͰ͖ͳ͍ ύεϫʔυͷ࠶ൃߦͷ࢓૊ΈͰɺॳճϩάΠϯ࣌มߋΛଅ͢ େن໛Ҡߦͷ࣌ʹɺͭΒ͍ ΞϓϦͷ࡞ΓࠐΈͰɺճආ͢Δํ๏͸͋Δ΋ͷͷɻɻɻɻ Ͳ͏ͨ͠Βྑ͍ͷͰ͠ΐ͏Ͷʁ

Slide 26

Slide 26 text

$PHOJUP6TFS1PPMͷσʔλΛόοΫΞοϓ͍ͨ͠ Ͱ͖ͳ͍ ݱࡏɺ6TFS1PPMͷόοΫΞοϓʗΤΫεϙʔτ͕Ͱ͖ͳ͍ σʔλ͸"84͕੹೚࣋ͬͯकͬͯΔͱ ඞਢͷ৔߹͸ɺ%ZOBNP%#౳ʹϢʔβ৘ใΛอଘ "84͞Μɺ͓ئ͍ʂʂ

Slide 27

Slide 27 text

8PSME8JEFͳαʔϏεͰ$PHOJUP࢖͍͍ͨ ݱঢ়ͷ$PHOJUP͸ϦʔδϣϯؒͰͷϨϓϦέʔγϣϯػೳͳ͠ 8PSME8JEFͰ୯Ұͷ$PHOJUPͩͱೝূͷϨΠςϯγ͕໰୊ %ZOBNP%#ΫϩεϦʔδϣϯϨϓϦέʔγϣϯͰղܾʁ ϢʔβʔσʔλΛ%ZOBNP%#ʹอଘ ඞཁͳϦʔδϣϯʹ$PHOJUP'FEFSBUFE*EFOUJUJFTΛ༻ҙ͢Δ "84͞Μɺ͓ئ͍ʂʂ

Slide 28

Slide 28 text

"1*(BUFXBZͰͷࠔΓࣄ ͱ͍͏͔Ξϯνύλʔϯ

Slide 29

Slide 29 text

4/*ඇରԠΫϥΠΞϯτʹରԠ͢Δ "1*(BUFXBZͷ4/*ϕʔεͷ44-5-4 ݹ͍ϒϥ΢β΍ɺϓϩάϥϜݴޠ͸4/*ʹରԠ͍ͯ͠ͳ͍৔߹ ΋ ໰୊ʹͳΓ΍͍͢ͷ͸ɺ+BWBҎલ ରԠࡦ "1*(BUFXBZͰ͸ͳ͘ɺ௚઀-BNCEBΛݺͼग़͢ "1*(BUFXBZͷલʹɺ&-#&$Λ͓͘ ࣅͨΑ͏ͳ໰୊ʹɺIUUQͰ"1*(BUFXBZʹΞΫηε͍ͨ͠ͱ͔ ͲΕ΋ΠϚΠνͳͷͰɺΫϥΠΞϯτଆͷߋվ͕ྑ͍

Slide 30

Slide 30 text

71$಺Ͱར༻͍ͨ͠ "1*(BUFXBZ͸ɺ71$಺ʹ഑ஔ͸ग़དྷͳ͍ -BNCEB͸ɺ71$಺Ͱ΋ىಈ͸Մೳ 4UFQ'VODUJPOTͱซ༻ͰτϦοΩʔͳىಈ͸Մೳ 71$ϦϯΫ/-#Ͱɺ71$಺ͷϦιʔε͕ར༻Մೳ API Gateway Step Functions Lambda Network Load Balancer VPCϦϯΫ

Slide 31

Slide 31 text

"1*(BUFXBZܦ༝ͰόονతॲཧΛΩοΫ͍ͨ͠ "1*(BUFXBZͷ౷߹ͷλΠϜΞ΢τ͸ඵ όοΫΤϯυͷॲཧ͕௕͍৔߹͸஫ҙ ۩ମతʹ͸ɺόονతͳॲཧΛݺͼग़͢৔߹ ରԠࡦ όοΫΤϯυͱͷ౷߹Λඇಉظܕʹ͢Δ ݺͼग़͠੒ޭ࣌ʹɺϦΫΤετ*%౳Λฦ٫͢Δ ͦ΋ͦ΋"1*(BUFXBZ͔ΒΩοΫ͢Δඞཁ͕͋Δͷ͔ߟ͑Δ API Gateway AWSͷ֤छϦιʔε ᶃϦΫΤετ ᶄϨεϙϯε ΫϥΠΞϯτ ᶅඇಉظݺͼग़͠

Slide 32

Slide 32 text

$PHOJUPɺ"1*(BUFXBZ͸ Ԟ͕ਂ͍

Slide 33

Slide 33 text

ిࢠॻ੶ɺࣥචͷػӡ IUUQTUPHFUUFSDPNMJ

Slide 34

Slide 34 text

SF$BQ

Slide 35

Slide 35 text

͝੩ௌɺ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ