*".Ͳ͏͠·͠ΐ͏

CZ
LFOTDBM 

*".ͳʹ΋Θ͔ΒΜ 

ࠓ೔ͷ໨త 

LFOTDBM͕*".पΓΛ࿩͢ 

LFOTDBM͕࿩͢
*".पΓͷ૬ஊΛ͍ͨ͠
ڭ͑ͯ΄͍͠ 

BQQTMJEPFWFOU R[PW 

4MJEP
%FNP BQQTMJEPFWFOUR[PW 

 *EFOUJUZ
"OE
"DDFTT
.BOBHFNFOU
 "84
440
 *EFOUJUZ
"OE
"DDFTT
.BOBHFNFOU
 *".
1PMJDZ
 JEFOUJUZCBTFE
1PMJDZ
 SFTPVSDFCBTFE
QPMJDZ
 QFSNJTTJPO
CPVOEBSJFT
 4$1T"$-T
 TFTTJPO
QPMJDJFT ࠓ೔ͷϑΥʔΧε
*". 

 ౰ͨΓલʹ΍Δ͜ͱ
 3PPU޶΁ͷ.'"ઃఆ
 ύεϫʔυϙϦγʔͷઃఆ
 *E1ͱͷ440
 *".Ϣʔβʔ ਓؒ ͸ͦ΋ͦ΋࢖Θͳ͍
 ϚϧνΞΧ΢ϯτɾ0SHBOJ[BUJPOߏ੒
લఏ 

લఏ
ߏ੒ 

*".
1PMJDJFT

WT

3FTPVSDF
1PMJDJFT 

1PMJDZ
%FDJTJPOϑϩʔ https://aws.amazon.com/jp/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/ 

*".
1PMJDJFT

3FTPVSDF
1PMJDJFT { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Principal": { "AWS": “arn:aws:iam::xxxxx:root"}, "Action": [ "s3:*", "s3:List*", "s3:Get*"], "Resource": [ "arn:aws:s3:::secure-brigade-test", "arn:aws:s3:::secure-brigade-test/*"] }] } { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Action": [ "s3:*", "s3:List*", "s3:Get*"], "Resource": [ "arn:aws:s3:::secure-brigade-test", "arn:aws:s3:::secure-brigade-test/*"] }] } Կʹରͯ͠ԿΛͰ͖Δ͔ ୭͕ԿΛͰ͖Δ͔ 

*".
1PMJDJFT 3FTPVSDF
1PMJDJFT 

"Principal": { “AWS": “arn:aws:iam::xxxxx:role/roleA“} } "Principal": { “AWS": “arn:aws:iam::xxxxx:role/roleB“} } “Effect": “Allow”, “Action": [“s3:*”], “Resource": [“arn:aws:s3:::bucketA” “arn:aws:s3:::bucketA/*”], "Principal": { “AWS": “arn:aws:iam::xxxxx:role/roleA“} } 

"Principal": { “AWS": [ “arn:aws:iam::xxxxx:role/roleA“, “arn:aws:iam::xxxxx:role/roleB“] } “Effect": “Allow”, “Action": [“s3:*”], “Resource": [“arn:aws:s3:::bucketA” “arn:aws:s3:::bucketA/*”] “Effect": “Allow”, “Action": [“s3:*”], “Resource": [“arn:aws:s3:::bucketB” “arn:aws:s3:::bucketB/*”] “Effect": “Allow”, “Action": [“s3:*”], “Resource": [“arn:aws:s3:::bucketC” “arn:aws:s3:::bucketC/*”] 

*".
1PMJDJFTͱ3FTPVSDF
1PMJDJFTͷ࢖͍෼͚  ݁ہ"/%৚݅ͳͷͰ྆ํఆٛ͠ͳ͚Ε͹ ͳΒͳ͍
 Ͱ͸ɺجຊํ਑͸ʁ
 LFOTDBMͷݸਓతݟղ
*".
1PMJDZଆͷ ੍ޚʹΑͤΔ 

࠷ॳ͸͜͏ࢥͬͯͨ { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Principal": { "AWS": “arn:aws:iam::xxxxx:arn/roleA“} "Action": [“s3:List”, “s3:Get”], "Resource": [ "arn:aws:s3:::secure-brigade-test", "arn:aws:s3:::secure-brigade-test/*"] }] } { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Action": ["s3:*"], "Resource": [ "*"] }] } *".ͱ͍͏ʮೖΓޱʯΛ
֤छϦιʔεʹґଘͤͨ͘͞ͳ͍ ϦιʔεଆͰറΔ 

ࠓ͸͜͏ { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Principal": { "AWS": “arn:aws:iam::xxxxx:root"}, "Action": ["s3:*"], "Resource": [ "arn:aws:s3:::secure-brigade-test", "arn:aws:s3:::secure-brigade-test/*"] }] } { "Version": "2012-10-17", "Id": "Policy1581347975270", "Statement": [{ "Sid": "Stmt1581347973356", "Effect": "Allow", "Action": [ "s3:List*", "s3:Get*"], "Resource": [ "arn:aws:s3:::secure-brigade-test", "arn:aws:s3:::secure-brigade-test/*"] }] } ࡉ੍͔͍ޚ͸*".
1PMJDZͰ Ϧιʔεଆ͸؇͘ɻ
"84޶Λ·ΔͬͱڐՄ
 *EFOUJUZ΁ͷೝՄͱ͍͏ҙຯͰɺ*".ଆʹઃఆΛ͚ͭΔͷ ͕ɺࢥ૝తʹͨͩͦ͠͏
 5BH౳Λ͔ͭͬͨৄࡉͳ੍ޚ͸*".ଆ͔Β͔͠Ͱ͖ͳ͍
 Ϧιʔεຖͷ੍ޚ͸ӡ༻తʹେม 

*".ͳʹ΋Θ͔ΒΜ 

1FSNJTTJPO
#PVOEBSZ 

1FSNJTTJPO
#PVOEBSZͷ࢖͍ಓ  ׂͱ࢖͍ॴ͕Θ͔Βͳ͍ 

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html { "Sid": "Stmt1581347973356", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::xxx:role/roleA"]}, "Action": [“s3:*"], "Resource": [ "arn:aws:s3:::bucketA", "arn:aws:s3:::bucketA/*"] } { "Effect": “Allow", "Action": [“s3:List*”, “s3:Get*”], "Resource": [“*”] } { "Effect": “Allow", "Action": [“*”], "Resource": [“*”] } #VDLFU
"΁ͷ
શ"DUJPO͕ڐՄ 

No content

1FSNJTTJPO
#PVOEBSZͷ࢖͍ಓ  ԿΛ%FMFHBUF͍ͨ͠ͷ͔Θ͔ͬͯΔͳΒɺ࠷ॳ͔Β*EFOUJUZ #BTFEʹ͢Ε͹͍͍ͷͰ͸ʁ
 *EFOUJUZͰ΋3FTPVSDFͰ΋΍Βͤͨ͘ͳ͍1FSNJTTJPOΛఆٛ ʹ࢖͏ͷͰ͋Ε͹ɺͦΕ͸*EFOUJUZ಺ʹఆٛͩͬͨ͜ͱ͔͠ͳ͍
 ํ਑
جຊతʹ࢖Θͣɺ*EFOUJUZ#BTFE
1PMJDZΛ࠷ॳ͔Βར༻ ͢Δʁ 

*".ͳʹ΋Θ͔ΒΜ 

5BH
#BTFE
"DDFTT 

{ "Sid": "VisualEditor1", "Effect": "Allow", "Action": eadBucket","s3:ListAllMyBuckets","s3:ListBucket*","s3:GetBucket*"], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/Owner": "frontend", "s3:ExistingObjectTag/Confidentiality": "public" } } }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": ["s3:PutObject","s3:PutObjectTagging"], "Resource": "*", "Condition": { "StringEquals": { "s3:RequestObjectTag/Owner": "frontend", "s3:RequestObjectTag/Confidentiality": "public" } } } 0XOFS
GSPOUFOE
$POp
QVCMJD 0XOFS
GSPOUFOE
$POp
TFOTJUJWF 0XOFS

GSPOUFOE


{ "Sid": "VisualEditor1", "Effect": "Allow", "Action": eadBucket","s3:ListAllMyBuckets","s3:ListBucket*","s3:GetBucket*"], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/Owner": "frontend", "s3:ExistingObjectTag/Confidentiality": "public" } } }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": ["s3:PutObject","s3:PutObjectTagging"], "Resource": "*", "Condition": { "StringEquals": { "s3:RequestObjectTag/Owner": "frontend", "s3:RequestObjectTag/Confidentiality": "public" } } } 0XOFS
GSPOUFOE
$POp
QVCMJD 0XOFS

GSPOUFOE
0XOFS
GSPOUFOE
$POp
TFOTJUJWF 

{ "Sid": "VisualEditor1", "Effect": "Allow", "Action": adBucket","s3:ListAllMyBuckets","s3:ListBucket*","s3:GetBucket*"], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/Owner": "backend", "s3:ExistingObjectTag/Confidentiality": "public" } } }, { "Sid": "VisualEditor4", "Effect": "Allow", "Action": ["s3:PutObject","s3:PutObjectTagging"], "Resource": "*", "Condition": { "StringEquals": { "s3:RequestObjectTag/Owner": "backend", "s3:RequestObjectTag/Confidentiality": [ “confidential”,“public”,”sensitive”] }, “ForAllValues:StringEquals": { “s3:RequestObjectTagKeys”:[ “Owner”, “Confidentiality”, ”Description”] }, } } 0XOFS
CBDLFOE
$POp
TFOTJUJWF 0XOFS
CBDLFOE
$POp
TFOTJUJWF
%FTD
OBOEFNP


࣮ࡍͷӡ༻  "#"$΍͍͖͍ͬͯͨؾ࣋ͪ͸͋Δ
 "#"$ͦͷ΋ͷΑΓλάӡ༻͕ॏཁ

खؒͦ͏
 λάͷϧʔϧ
 λάʹ͚ͭΔ஋
 λάܯ࡯ര஀ͷػӡ
 0SHBOJ[BUJPOͷ5BH
1PMJDJFTͱηοτͰ΍Βͳ͍ͱ͍͚ͳͦ͞͏
 &$4λεΫͷ3PMFʹ4FSWJDFλά͚ͭͯɺ3%4ΞΫηεΛλά੍ޚ͢Δͱເ͕޿͕Δ
 4FTTJPOλά͸ͪΐͬͱௐ΂͖Εͳ͔ͬͨɺ͢·ͳ͍ 

d*".ͳʹ΋Θ͔ΒΜd

͜͜͸Θ͔ͬͨ 

"84
440
WT
"84
*". 

ೖΓޱ ϙʔλϧ͕༻ҙ *E1ଆͷઃఆํ๏ʹґଘ ೝূํࣜ 4".- 4".- ϓϩϏδϣ χϯά ͋Γ ͳ͠ 1FSNJTTJPO ܗࣜ 1FSNJTTJPO
4FUT
ׂΓ౰ͯͨ"84ΞΧ΢ϯτʹ3PMFΛࣗಈతʹੜ ੒ *".
3PMF 3FHJPO BQOPSUIFBTUͳ͠ ͋Γ $-* DMJͰ"DDFTT
,FZ
5PLFO
4FTTJPOΛҰൃͰͱΕͳ ͍ ͱΕΔ 

ೖΓޱ ϙʔλϧ͕༻ҙ *E1ଆͷઃఆํ๏ʹґଘ ೝূํࣜ 4".- 4".- ϓϩϏδϣ χϯά ͋Γ ͳ͠ 1FSNJTTJPO ܗࣜ 1FSNJTTJPO
4FUT
ׂΓ౰ͯͨ"84ΞΧ΢ϯτʹ3PMFΛࣗಈతʹੜ ੒ *".
3PMF 3FHJPO BQOPSUIFBTUͳ͠ ͋Γ $-* DMJͰ"DDFTT
,FZ
5PLFO
4FTTJPOΛҰൃͰͱΕͳ ͍ ͱΕΔ 

No content

No content

ೖΓޱ ϙʔλϧ͕༻ҙ *E1ଆͷઃఆํ๏ʹґଘ ೝূํࣜ 4".- 4".- ϓϩϏδϣ χϯά ͋Γ ͳ͠ 1FSNJTTJP Oܗࣜ 1FSNJTTJPO
4FUT
ׂΓ౰ͯͨ"84ΞΧ΢ϯτʹ3PMFΛࣗಈతʹੜ ੒ *".
3PMF 3FHJPO BQOPSUIFBTUͳ͠ ͋Γ $-* DMJͰ"DDFTT
,FZ
5PLFO
4FTTJPOΛҰൃͰͱΕͳ ͍ ͱΕΔ 

"84
440಺Ͱ1FSNJTTJPOΛҰݴ ؅ཧͰ͖Δ͕ 

1PMJDZ
%PDVNFOU
XJUI *B$࢖͑͹ɺ"84
440Ͱͳ͘ͱ΋
Ұݩ؅ཧՄೳ 

No content

$VTUPN
1PMJDZ͸
1FSNJTTJPO SPMF ͱ 

ೖΓޱ ϙʔλϧ͕༻ҙ *E1ଆͷઃఆํ๏ʹґଘ ೝূํࣜ 4".- 4".- ϓϩϏδϣ χϯά ͋Γ ͳ͠ 1FSNJTTJPO ܗࣜ 1FSNJTTJPO
4FUT
ׂΓ౰ͯͨ"84ΞΧ΢ϯτʹ3PMFΛࣗಈతʹੜ ੒ *".
3PMF 3FHJPO BQOPSUIFBTUͳ͠ ͋Γ $-* DMJͰ"DDFTT
,FZ
5PLFO
4FTTJPOΛҰൃͰͱΕͳ ͍

ͱΕΔ मਖ਼ ͱΕΔ 

$ aws sso login --profile AdministratorAccess-master $ aws sso get-role-credentials --role-name "AdministratorAccess" --account-id "xxxx" --access- token $(cat ~/.aws/sso/cache/SOMETHING.json | jq -r ".accessToken") --region ap-southeast-1 { "roleCredentials": { "accessKeyId": “ACCESS_KEY_ID”, "secretAccessKey": “SECRET_ACCESS_KEY”, "sessionToken": “SESSION_TOKEN”, "expiration": 1581669130000 } } ################ 2020/02/15 मਖ਼ɻaws version 2Ͱ͸ࣗಈͰ΍ͬͯ͘ΕΔ $ aws sso login --profile AdministratorAccess-master $ aws s3 ls s3://secure-brigade-test-main --profile AdministratorAccess-master 

 BXT
DMJͷॆ࣮
 DVTUPN
QFSNJTTJPO
QPMJDZͷςϯϓϨԽ
 DVTUPN
QFSNJTTJPO
QPMJDZͷෳ਺ར༻
 "1*؅ཧ͕Ͱ͖ΔΑ͏ʹͳͬͨ"84
440
 ݱ࣌఺ͷϕετ͸ɺ"84ͷதͷਓͷߟ͑Λฉ͔ͳ͍ͱͳΜͱ΋
 ֎෦ϑΣσϨʔγϣϯΛ*".
3PMFʹ͍ͨ͠ͷ͔ɺ"84
440ʹ͍ͨ͠ͷ͔
 ࢥ૝Λฉ͖͍ͨ
 ݸਓͰ͸ͱΓ͋͑ͣ྆ํηοτΞοϓͯ͠Δ কདྷతͳϕετʢཁ๬ʣ 

*".ͳʹ΋Θ͔ΒΜ 

ͱ͍͏Θ͚Ͱ 

*". 

ͳʹ΋ 

Θ͔ΒΜ 

*".ͳʹ΋Θ͔ΒΜ ऴ
੍࡞ɾஶ࡞
ᴸᴸᴸᴸᴸ
ɹɹɹ 

͓·͚ 

3PPU޶ͷ)8σόΠεෳ਺ొ࿥·ͩʁʁʁ 

ऴ
੍࡞ɾஶ࡞
ᴸᴸᴸᴸᴸ
ɹɹɹɹɹɹɹɹɹɹ