Secure Serverless Architecture

by shiro seike

Slide 1

Slide 1 text

©Fusic Co., Ltd. 1 Secure Serverless Architecture 2024.05.23 @seike460 Security-JAWSʲୈ33ճʳ

Slide 2

Slide 2 text

©Fusic Co., Ltd. 2 ਗ਼Ո ࢙࿠ @seike460 AWS Community Builder Serverless ίϛϡχςΟ Fukuoka.php Fukuoka.go JAWS-UG Fukuoka Serverless Meetup Fukuoka Cloudflare Meetup Fukuoka JP_Stripes Fukuoka ࣗݾ঺հ ͸͡Ίʹ גࣜձࣾFusic ϓϦϯγύϧΤϯδχΞ/ΤόϯδΣϦετ

Slide 3

Slide 3 text

©Fusic Co., Ltd. 3 CONTENTS ໨࣍ 1. αʔόʔϨεΞʔΩςΫνϟͷར఺ͱ՝୊ 2. Amazon API GatewayɺAWS LambdaͷηΩϡϦςΟ 3. Amazon CloudFrontɺAmazon S3ͷηΩϡϦςΟ 4. Amazon DynamoDBͷηΩϡϦςΟ 5. ·ͱΊ

Slide 4

Slide 4 text

©Fusic Co., Ltd. 4 αʔόʔϨεΞʔΩςΫνϟͷར఺ͱ՝୊ 1

Slide 5

Slide 5 text

©Fusic Co., Ltd. 5 αʔόʔϨεͱ͸ͳΜͳͷ͔ 言 Cloud Native Computing Foundation CNCF Serverless Whitepaper v 1 . 0 行 https://github.com/cncf/wg-serverless/tree/master/whitepapers/serverless-overview

Slide 6

Slide 6 text

©Fusic Co., Ltd. 6 αʔόʔϨεΞʔΩςΫνϟͷར఺ - - 自 - - 用金 - 用 - - - - 高用 - AWS 自長

Slide 7

Slide 7 text

©Fusic Co., Ltd. 7 αʔόʔϨεΞʔΩςΫνϟͷ՝୊ - ηΩϡϦςΟͷෳࡶੑ - αʔόʔϨε؀ڥಛ༗ͷηΩϡϦςΟϦεΫͱରࡦ͕ඞཁ - ϞχλϦϯάͱτϥϒϧγϡʔςΟϯάͷ೉͠͞ - ෼ࢄΞʔΩςΫνϟͷͨΊɺτϥϒϧγϡʔςΟϯά͕ෳࡶԽ - ґଘؔ܎ͷ؅ཧ - ෳ਺ͷϚΠΫϩαʔϏεؒͰͷґଘؔ܎ͱͦͷ؅ཧ - ίʔϧυελʔτ - ؔ਺ͷॳճݺͼग़࣌͠ʹൃੜ͢Δ஗Ԇ - ϕετϓϥΫςΟεͷਐԽ - ٕज़ͷਐలʹ൐͍ɺ࠷৽ͷϕετϓϥΫςΟεΛৗʹֶͼଓ͚Δඞཁੑ

Slide 8

Slide 8 text

©Fusic Co., Ltd. 8 αʔόʔϨεΞʔΩςΫνϟͷ՝୊ - ηΩϡϦςΟͷෳࡶੑ - αʔόʔϨε؀ڥಛ༗ͷηΩϡϦςΟϦεΫͱରࡦ͕ඞཁ - ϞχλϦϯάͱτϥϒϧγϡʔςΟϯάͷ೉͠͞ - ෼ࢄΞʔΩςΫνϟͷͨΊɺτϥϒϧγϡʔςΟϯά͕ෳࡶԽ - ґଘؔ܎ͷ؅ཧ - ෳ਺ͷϚΠΫϩαʔϏεؒͰͷґଘؔ܎ͱͦͷ؅ཧ - ίʔϧυελʔτ - ؔ਺ͷॳճݺͼग़࣌͠ʹൃੜ͢Δ஗Ԇ - ϕετϓϥΫςΟεͷਐԽ - ٕज़ͷਐలʹ൐͍ɺ࠷৽ͷϕετϓϥΫςΟεΛৗʹֶͼଓ͚Δඞཁੑ

Slide 9

Slide 9 text

©Fusic Co., Ltd. 9 ηΩϡϦςΟͷॏཁੑ - σʔλ࿙ӮϦεΫ - ݸਓ৘ใ΍ػີ৘ใͷ࿙Ӯ͸اۀͷ৴པΛଛͳ͏ - αΠόʔ߈ܸͷ૿Ճ - Ϋϥ΢υ؀ڥΛૂͬͨ߈ܸ͕૿Ճ͓ͯ͠Γɺରࡦ͕ෆՄܽ - ίϯϓϥΠΞϯε९क - GDPR΍HIPAAͳͲͷن੍ʹରԠ͢ΔͨΊͷηΩϡϦςΟાஔ - Ϗδωεܧଓੑ - ηΩϡϦςΟΠϯγσϯτ͕ൃੜ͢Δͱ ϏδωεͷܧଓʹࢧোΛ͖ͨ͢Մೳੑ

Slide 10

Slide 10 text

©Fusic Co., Ltd. 10 ηΩϡϦςΟରࡦͷΞϓϩʔν - ༧๷ - ΞΫηε੍ޚ΍σʔλ҉߸ԽʹΑΔ༧๷ࡦ - ݕ஌ - ҟৗݕ஌΍ϩά؂ࢹʹΑΔϦΞϧλΠϜͷ؂ࢹ - ରԠ - Πϯγσϯτൃੜ࣌ͷਝ଎ͳରԠͱ෮چखॱ - ෮چ - σʔλόοΫΞοϓͱϦετΞϓϩηεͷཱ֬

Slide 11

Slide 11 text

©Fusic Co., Ltd. 11 ηΩϡϦςΟରࡦͷΞϓϩʔν - ༧๷ - ΞΫηε੍ޚ΍σʔλ҉߸ԽʹΑΔ༧๷ࡦ - ݕ஌ - ҟৗݕ஌΍ϩά؂ࢹʹΑΔϦΞϧλΠϜͷ؂ࢹ - ରԠ - Πϯγσϯτൃੜ࣌ͷਝ଎ͳରԠͱ෮چखॱ - ෮چ - σʔλόοΫΞοϓͱϦετΞϓϩηεͷཱ֬

Slide 12

Slide 12 text

©Fusic Co., Ltd. 12 ର৅ͱ͢ΔAWS αʔϏε - Amazon API Gateway - AWS Lambda - Amazon CloudFront - Amazon S3 - Amazon DynamoDB

Slide 13

Slide 13 text

©Fusic Co., Ltd. 13 Amazon API GatewayɺAWS LambdaͷηΩϡϦςΟ 2

Slide 14

Slide 14 text

©Fusic Co., Ltd. 14 Amazon API GatewayͷηΩϡϦςΟ ·ͣ͸ϦΫΤετͷೖΓޱͷ෦෼ʹ஫໨͠·͢ Ұൠతʹ͸͜ͷೖޱ෦෼ʹରͯ͠߈ܸΛड͚ΔՄೳੑ͕͋Γ·͢ɻ ೖΓޱ͔ΒόοΫΤϯυʹߦ͚ͳ͚Ε͹ɺ جຊతʹ߈ܸ͸੒ޭ͠·ͤΜɻ

Slide 15

Slide 15 text

©Fusic Co., Ltd. 15 Amazon API GatewayͷηΩϡϦςΟ - ೝূͱೝՄ - τϥϑΟοΫͷอޢ - ωοτϫʔΫηΩϡϦςΟ

Slide 16

Slide 16 text

©Fusic Co., Ltd. 16 Amazon API GatewayͷηΩϡϦςΟʢೝূͱೝՄʣ - API KEYೝূ - IAMೝূ - CognitoϢʔβʔϓʔϧΛ௨ͨ͠ೝূʢ಺෦తʹ͸IAMೝূʣ

Slide 17

Slide 17 text

©Fusic Co., Ltd. 17 Amazon API GatewayͷηΩϡϦςΟʢೝূͱೝՄʣ - API KEYೝূ - ΫϥΠΞϯτ͕৴༻Ͱ͖Δ৔߹ͷΈ༗ޮ - ύϒϦοΫʹެ։͞ΕͨHTML΍JavaScriptʹຒΊࠐΉͷ͸ඇਪ঑ - ࣗ෼PC΍ɺۀ຿༻PCͳͲ͔Βར༻͢Δ৔߹

Slide 18

Slide 18 text

©Fusic Co., Ltd. 18 Amazon API GatewayͷηΩϡϦςΟʢೝূͱೝՄʣ - IAMೝূ - ηΩϡΞͳ৔ॴʹ഑ஔͨ͠ΞΫηεΩʔγʔΫϨοτΩʔΛར༻ ॺ໊෇͖ϦΫΤετΛੜ੒ (ύϒϦοΫNGͳͷ͸ݴΘͣ΋͕ͳ) - AWS Signature Version 4Λ࢖༻ͯ͠ϦΫΤετʹॺ໊ - όοΫΤϯυʹ഑ஔ͢Δͷ͕Ұൠత

Slide 19

Slide 19 text

©Fusic Co., Ltd. 19 Amazon API GatewayͷηΩϡϦςΟʢೝূͱೝՄʣ - CognitoϢʔβʔϓʔϧΛ௨ͨ͠ೝূʢ಺෦తʹ͸IAMೝূʣ - ϢʔβʔϓʔϧΛ࢖༻͠ϢʔβʔೝূΛߦ͍JWTτʔΫϯΛൃߦ - ൃߦ͞ΕͨΞΫηετʔΫϯΛ࢖༻ͯ͠API GatewayʹΞΫηε - API Gateway͸ΞΫηετʔΫϯΛݕূ ಺෦తʹ͸IAMϩʔϧΛ࢖༻ͯ͠ೝՄΛߦ͏

Slide 20

Slide 20 text

©Fusic Co., Ltd. 20 ೝূͱೝՄʢCognitoೝূʣ ■Ϣʔβʔ ↓ᶃϩάΠϯʢϢʔβʔϓʔϧೝূʣ ■CognitoϢʔβʔϓʔϧ ↓ᶄτʔΫϯൃߦʢIDτʔΫϯɺΞΫηετʔΫϯɺϦϑϨογϡτʔΫϯʣ ■ΫϥΠΞϯτΞϓϦέʔγϣϯ ↓ᶅΞΫηετʔΫϯΛ࢖༻ͯ͠API GatewayʹϦΫΤετ ■API Gateway ↓ᶆτʔΫϯݕূ ↓ᶇIdentity PoolΛ࢖༻ͯ͠IAMϩʔϧΛऔಘ ■Cognito Identity Pool ↓ᶈҰ࣌తͳIAMೝূ৘ใΛൃߦ ■API Gateway ↓ᶉόοΫΤϯυͷAWSϦιʔεʹΞΫηεʢIAMೝূʣ ■Lambdaؔ਺

Slide 21

Slide 21 text

©Fusic Co., Ltd. 21 Amazon API GatewayͷηΩϡϦςΟʢτϥϑΟοΫͷอޢʣ - WAFͷಋೖ - AWS WAFΛ࢖༻ͯ͠SQL InjectionɺXSSͳͲͷ߈ܸ͔Βอޢ - Ϩʔτ੍ݶͱεϩοτϦϯά - Ϩʔτ੍ݶͱεϩοτϦϯάΛઃఆ͠ɺDDoS߈ܸΛରࡦ

Slide 22

Slide 22 text

©Fusic Co., Ltd. 22 Amazon API GatewayͷηΩϡϦςΟʢωοτϫʔΫηΩϡϦςΟʣ - VPCϦϯΫ - API Gateway͔ΒVPC಺ͷϦιʔεʹΞΫηε͢ΔͨΊͷϝΧχζϜ - NLB΍ALBΛ࢖༻ͯ͠API Gateway͔ΒVPC಺ʹ҆શʹ઀ଓ - VPC ΤϯυϙΠϯτ - VPC ΤϯυϙΠϯτΛ௨ͯ͠VPC͔Β API GatewayʹΞΫηεΛߦ͏

Slide 23

Slide 23 text

©Fusic Co., Ltd. 23 AWS LambdaͷηΩϡϦςΟ AWS Lambda͕ಛʹؾΛ͚ͭΔ΂͖͸IAMͷݖݶͰ͢ αʔόʔϨεͷίΞ͔ͩΒͦ͜ɺ༷ʑͳ໾ׂΛ୲͍·͢ͷͰ ࣮֬ʹʮIAM࠷খݖݶͷݪଇʯΛҙࣝ͠·͠ΐ͏

Slide 24

Slide 24 text

©Fusic Co., Ltd. 24 AWS LambdaͷηΩϡϦςΟ - ؔ਺ͷݖݶઃఆʢIAMϩʔϧʣ - ؀ڥม਺ͷ؅ཧͱηΩϡϦςΟ - VPCઃఆͱηΩϡϦςΟάϧʔϓ

Slide 25

Slide 25 text

©Fusic Co., Ltd. 25 ؔ਺ͷݖݶઃఆʢIAMϩʔϧʣ - ࠷খݖݶͷݪଇɿඞཁ࠷௿ݶͷݖݶͷ෇༩ - IAMϙϦγʔͷ࡞੒ͱద༻ ɹɹྫʣS3όέοτ΁ͷಡΈऔΓݖݶͷΈ౉͢ { "Version": "2012-10-17", "Statement": [ { ᴽ "Effect": "Allow", ᴽ "Action": "s3:GetObject", ᴽ "Resource": “arn:aws:s3:::seike460-bucket/*" } ] }

Slide 26

Slide 26 text

©Fusic Co., Ltd. 26 ؀ڥม਺ͷ؅ཧͱηΩϡϦςΟ - KMSʹΑΔ҉߸Խ - ؀ڥม਺ʹػີ৘ใΛ֨ೲ͢Δࡍͷ҉߸Խͱ෮߸Խ - SAM Template಺Ͱ؀ڥม਺Ληοτ͢Δ࣌ʹར༻ - AWS Secrets Managerͷར༻ - γʔΫϨοτʢࢿ֨৘ใɺAPI KEY౳ʣΛ҆શʹ؅ཧɾऔಘ - ίʔυͰRDSͷ઀ଓ৘ใͳͲΛऔಘ͢Δͱ͖ʹར༻

Slide 27

Slide 27 text

©Fusic Co., Ltd. 27 VPCઃఆͱηΩϡϦςΟάϧʔϓ - VPC಺ͷLambdaؔ਺ - ϓϥΠϕʔτϦιʔε΁ͷΞΫηεΛఏڙ - RDSʹ઀ଓ͍ͨ͠৔߹౳ʹར༻ - ίʔϧυελʔτɺVPC಺ͷIP਺ʹ஫ҙ͕ඞཁ - ηΩϡϦςΟάϧʔϓͷϕετϓϥΫςΟε - ࠷খݶͷΞΫηεΛڐՄ͢ΔϙϦγʔઃఆ - VPCͷ௨ৗͷӡ༻ͱಉ༷

Slide 28

Slide 28 text

©Fusic Co., Ltd. 28 Amazon CloudFrontɺAmazon S3ͷηΩϡϦςΟ 3

Slide 29

Slide 29 text

©Fusic Co., Ltd. 29 Amazon CloudFrontͷηΩϡϦςΟ ΦϦδϯʹͳΔʢࣄ͕ଟ͍ʣAmazon S3ΛͲ͏อޢ͢Δ͔ Ұ൪લʹཱͭ͜ͱʹͳΔͷͰɺAWS WAFͳͲͰकΔ͜ͱΛࢹ໺ʹೖΕΔ

Slide 30

Slide 30 text

©Fusic Co., Ltd. 30 Amazon CloudFrontͷηΩϡϦςΟ - ΦϦδϯαʔόʔͷอޢ - HTTPSͷڧ੍ͱSSL/TLSͷઃఆ - AWS WAFͷઃఆ

Slide 31

Slide 31 text

©Fusic Co., Ltd. 31 Amazon CloudFrontͷηΩϡϦςΟ(ΦϦδϯαʔόʔͷอޢ) - ΦϦδϯΞΫηεΞΠσϯςΟςΟʢOAIʣ - S3όέοτʹର͢Δ௚઀ΞΫηεΛ๷͗ɺ CloudFrontܦ༝ͷΞΫηεͷΈΛڐՄ - ॺ໊෇͖URL͓Αͼॺ໊෇͖ΫοΩʔ - ࢦఆ͞ΕͨϢʔβʔͷΈ͕ΞΫηεՄೳͳURL΍ΫοΩʔΛੜ੒

Slide 32

Slide 32 text

©Fusic Co., Ltd. 32 Amazon CloudFrontͷηΩϡϦςΟ(HTTPSͷڧ੍ͱSSL/TLSͷઃఆ) - HTTPSͷڧ੍ઃఆ - HTTPϦΫΤετΛHTTPSʹϦμΠϨΫτ - ΧελϜSSLূ໌ॻ - AWS Certificate Manager (ACM)Ͱऔಘͨ͠ূ໌ॻͷར༻

Slide 33

Slide 33 text

©Fusic Co., Ltd. 33 Amazon CloudFrontͷηΩϡϦςΟ(AWS WAFͷઃఆ) - AWS WAF - SQLΠϯδΣΫγϣϯɺXSSɺDDoS߈ܸͳͲ͔Βͷ๷ޚ - WAFϧʔϧͷ࡞੒ͱద༻ - ෆਖ਼ϦΫΤετΛϑΟϧλϦϯά͠ɺϒϩοΫ

Slide 34

Slide 34 text

©Fusic Co., Ltd. 34 Amazon S3ͷηΩϡϦςΟ Amazon S3ͷΞΫηείϯτϩʔϧΛద੾ʹ͢Δ͜ͱ ·ͨެ։͞ΕΔ͜ͱΛҙࣝͯ͠ެ։͢ΔHTMLɺCSSɺJSʹؔͯ͠͸ ʮઈରʹʯΞΫηεΩʔɺγʔΫϨοτΩʔͳͲͷॏཁ৘ใΛ഑ஔ͠ͳ͍

Slide 35

Slide 35 text

Slide 36

Slide 36 text

©Fusic Co., Ltd. 36 Amazon S3ͷηΩϡϦςΟ(όέοτϙϦγʔͱΞΫηείϯτϩʔϧϦετ) - όέοτϙϦγʔ - JSONܗࣜͰఆٛ͞Εɺόέοτ͓ΑͼͦͷΦϒδΣΫτʹର͢Δ ΞΫηε੍ޚΛ؅ཧωοτϫʔΫΞΫηε੍ޚ - ΞΫηείϯτϩʔϧϦετʢACLʣ - όέοτ͓ΑͼΦϒδΣΫτϨϕϧͰͷΞΫηε੍ޚ ྫ) όέοτΛެ։͢ΔACL { "Version": "2012-10-17", "Statement": [ { ᴽ "Effect": "Allow", ᴽ "Principal": "*", ᴽ "Action": "s3:GetObject", ᴽ "Resource": "arn:aws:s3:::example-bucket/*" } ] }

Slide 37

Slide 37 text

©Fusic Co., Ltd. 37 Amazon S3ͷηΩϡϦςΟ(αʔόʔαΠυ҉߸Խ) - SSE-S3 - Amazon S3؅ཧͷΩʔʹΑΔ҉߸Խ - SSE-KMS - AWS KMS؅ཧͷΩʔʹΑΔ҉߸Խ - SSE-C - ސ٬؅ཧͷΩʔʹΑΔ҉߸Խ

Slide 38

Slide 38 text

©Fusic Co., Ltd. 38 Amazon S3ͷηΩϡϦςΟ(ωοτϫʔΫΞΫηε੍ޚ) - VPCΤϯυϙΠϯτ - ϓϥΠϕʔτωοτϫʔΫ಺ͰͷS3ΞΫηεΛఏڙ - VPC಺͔ΒAWS LambdaΛར༻͢Δ৔߹͸ઃఆਪ঑ - ύϒϦοΫΞΫηεϒϩοΫ - όέοτ΍ΞΧ΢ϯτϨϕϧͰͷύϒϦοΫΞΫηε੍ޚ - ύϒϦοΫΞΫηεͷඞཁ͕ͳ͍ͱ͖͸ɺύϒϦοΫΞΫηεOFF

Slide 39

Slide 39 text

©Fusic Co., Ltd. 39 Amazon S3ͷηΩϡϦςΟ(AWS CloudTrail) - CloudTrailʹΑΔ؂ࠪϩά - S3όέοτͷૢ࡞ϩάΛه࿥ - ϩάͷ؂ࢹͱΞϥʔτ - CloudWatchͱͷ࿈ܞͰҟৗΛݕ஌

Slide 40

Slide 40 text

Slide 41

Slide 41 text

©Fusic Co., Ltd. 41 Amazon DynamoDBͷηΩϡϦςΟ Amazon DynamoDBͷΞΫηείϯτϩʔϧΛద੾ʹ͢Δ͜ͱ σʔλอޢʹ͍ͭͯ͸جຊతʹࣗಈతʹ͞ΕΔͷͰ ಛผͳࣄ৘͕ͳ͍͔͗Γղআ͠ͳ͍Α͏ʹ͢Δ

Slide 42

Slide 42 text

Slide 43

Slide 43 text

©Fusic Co., Ltd. 43 Amazon DynamoDBͷηΩϡϦςΟ(σʔλอޢ) - αʔόʔαΠυ҉߸Խ - อଘσʔλΛ҉߸Խ͢ΔͨΊʹAWS KMSΛ࢖༻ - ҉߸Խ͸σϑΥϧτͰ༗ޮɺಡΈग़࣌͠ʹࣗಈతʹ෮߸Խ͞ΕΔ

Slide 44

Slide 44 text

©Fusic Co., Ltd. 44 Amazon DynamoDBͷηΩϡϦςΟ(ΞΫηε੍ޚ) - IAMϙϦγʔ - IAMϙϦγʔΛ࢖༻ͯ͠ɺಛఆͷϢʔβʔ΍ϩʔϧʹର͢Δ DynamoDBϦιʔε΁ͷΞΫηεΛ੍ޚ - CRUDૢ࡞ʹର͢Δࡉ͔͍ݖݶ؅ཧ - ඞཁ࠷খݶͷݖݶΛ෇༩͠ɺա৒ͳΞΫηεΛ๷ࢭ - IAMϩʔϧͷར༻ - ΞΫηε͢ΔΞϓϦέʔγϣϯʹɺ࠷খݖݶͷIAMϩʔϧΛ෇༩ - Lambdaؔ਺ʹIAMϩʔϧΛ෇༩ͯ͠DynamoDBʹΞΫηε

Slide 45

Slide 45 text

©Fusic Co., Ltd. 45 Amazon DynamoDBͷηΩϡϦςΟ(ωοτϫʔΫηΩϡϦςΟ) - VPCΤϯυϙΠϯτ - VPCΤϯυϙΠϯτΛ࢖༻ͯ͠ɺ VPC಺͔ΒDynamoDB΁ͷ҆શͳϓϥΠϕʔτΞΫηεΛఏڙ - ΠϯλʔωοτΛܦ༝ͤͣʹDynamoDBʹΞΫηεՄೳ

Slide 46

Slide 46 text

©Fusic Co., Ltd. 46 ϩάͱϞχλϦϯά - CloudWatchɺAWS CloudTrail - ϝτϦΫε - ϝτϦΫεΛCloudWatchͰ؂ࢹ - ϩά - ֤छϦιʔεͷৄࡉΛϩάʹه࿥ - ΞΫηεཤྺ - ΞϥʔϜ - ҟৗτϥϑΟοΫ΍ΤϥʔϨʔτʹରͯ͠ΞϥʔϜΛઃఆ - ҟৗݕग़࣌ʹSNSΛ࢖༻ͯ͠௨஌Λड͚औΔ

Slide 47

Slide 47 text

Slide 48

Slide 48 text

©Fusic Co., Ltd. 48 ·ͱΊ αʔόʔϨεʹͳ͔ͬͨΒɺηΩϡϦςΟ্͕͕ΔΘ͚Ͱ͸ͳ͍͠ɺෳࡶੑ͸্͕ͬͯ͠·͏ Point 01 ೖޱΛ͔ͬ͠ΓकΔ͜ͱ͸ͱͯ΋ॏཁɻ·ͨೖޱʹηΩϡΞͳ৘ใΛஔ͘ͷ͸ઈରʹආ͚·͠ΐ͏ Point 02 ͲΜͳଐੑͷ΋ͷΛɺͳΜͷ໨తͰɺͲ͜ʹɺͲͷΑ͏ʹ഑ஔ͢Δͷ͔Λཧղ͢Δ Point 03 ηΩϡΞͳӡ༻Λߦ͏ͨΊʢ΋͘͠͸ཁ݅ʹԠͯ͡ʣʹ͸VPCͷར༻΋૝ఆ͢Δ͜ͱ΋ߟ͑·͠ΐ͏ Point 04