Tweet
Tweet

Slide 1

Slide 1 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWSʹ͓͚ΔΫϥ΢υωΠςΟϒͰ ηΩϡΞͳূ݊γεςϜͷӡ༻ Satoshi Tajima Twitter: @s_tajima Lead Developer Finatext Holdings Ltd. L 2 - 0 3 Atsushi Ishibashi Twitter: @bashi0501 Lead Developer Finatext Holdings Ltd.

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T 1. STREAMͷγεςϜ 2. Ϋϥ΢υωΠςΟϒͱθϩτϥετͷ࣮ફ • Opsαʔό • ೝূ • ঝೝ • ηΩϡϦςΟϞχλϦϯά 3. ࠓޙͷల๬ Agenda

Slide 6

Slide 6 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. STREAMͷγεςϜ

Slide 7

Slide 7 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͢΂ͯͷγεςϜ͕ ΞϚκϯ ΢Σϒ αʔϏε(AWS) ্ͰՔಇ • ढ़හੑͷ͋ΔαʔόϦιʔεௐୡ͕Մೳ • ਺ΫϦοΫ or ਺ίϚϯυͰ৽͍͠αʔόϦιʔε͕ར༻Մೳʹ • ࣄۀͷঢ়گ͕೔ʑେ͖͘มԽ͢Δϕϯνϟʔاۀʹͱͬͯ͜ͷढ़හੑ͸ෆՄܽ • αʔόϦιʔεͷಈతͳ૿ݮ͕Մೳ • ূ݊γεςϜ͸βϥ৔தͱβϥ৔֎ͰγεςϜͷෛՙ͕େ͖͘มಈ͢Δ • βϥ৔֎Ͱ͸ෆཁͳαʔόϦιʔεΛఀࢭ͢Δ͜ͱͰίετ࡟ݮ͕Մೳ • ӡ༻ෛ୲ܰݮͱੜ࢈ੑͷ޲্͕Մೳ • ੹೚ڞ༗Ϟσϧ΍ɺଟ͘ͷϚωʔδυαʔϏεʹΑΓɺγεςϜͷӡ༻ෛՙ͕ܰݮ • ϏδωεͷίΞͳ෦෼ͷ։ൃʹ஫ྗͰ͖Δ STREAMͷγεςϜ

Slide 8

Slide 8 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • FISCʹΑΔʮ҆શରࡦج४ɾղઆॻʯʹैͬͨγεςϜ • ਖ਼ࣜʹ͸ʮۚ༥ػؔ౳ίϯϐϡʔλγεςϜͷ҆શରࡦج४ɾղઆॻʯ • ۚ༥ػؔ౳ͷ৘ใγεςϜͷ҆શରࡦʹؔ͢ΔσϑΝΫτελϯμʔυ • ࠷৽ͷୈ9൛ʹ͓͍ͯ͸ɺϦεΫϕʔεΞϓϩʔνΛऔΓೖΕΔ͜ͱΛਪ঑͍ͯ͠Δ • શͯͷϦεΫΛθϩʹ͢Δͷ͸ඞͣ͠΋߹ཧతͰ͸ͳ͘ɺ
 ঢ়گʹ߹Θͤͯద੾ͳରԠΛߟ͑·͠ΐ͏ͱ͍͏΋ͷ • ͋Β͔͡ΊఆΊΒΕͨըҰతͳ΍Γํʹै͍ͬͯΔ͚ͩͰ͍͍Θ͚Ͱ͸ͳ͘ɺ
 ࣗΒͷ؀ڥʹͱͬͯద੾ͳITΨόφϯεΛݕ౼͢Δඞཁ͕͋Δ STREAMͷγεςϜ

Slide 9

Slide 9 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • AWS্Ͱͷద੾ͳITΨόφϯε • AWS FinTech ϦϑΝϨϯεɾΞʔΩςΫνϟʔ 
 (https://aws.amazon.com/jp/blogs/news/aws-fintech-architecture-jp/) Λࢀߟʹ • Ϋϥ΢υωΠςΟϒ΍θϩτϥετͷߟ͑ํΛऔΓೖΕΔ͜ͱͰ
 ࣗΒͷ؀ڥʹͱͬͯద੾ Ͱ ϦεΫϕʔεΞϓϩʔν ͳγεςϜΛߏங STREAMͷγεςϜ

Slide 10

Slide 10 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒ • ΦϯϓϨϛε؀ڥΛલఏͱͨ͠ैདྷͷγεςϜߏஙͷํ๏࿦ʹറΒΕͣɺΫϥ΢υͷಛੑΛे ෼ʹ׆͔ͨ͠γεςϜΛߏங͢Δ͜ͱ • ୯ʹΫϥ΢υΛ࢖͍ͬͯΔ͚ͩͷঢ়گΛࢦ͢Θ͚Ͱ͸ͳ͍
 • θϩτϥετ • ڴҖ͸͍͔ͳΔ৔ॴʹ΋ଘࡏ͠ɺ͢΂ͯͷ؀ڥ͸߈ܸɾ৵֐͞Ε͏Δͱ͍͏લఏʹཱͭ • ରࡦʹ࢖͑ΔϦιʔε͸༗ݶͰ͋Δ͜ͱΛೝΊɺ͋ΒΏΔڴҖʹ׬શͳରࡦΛߦ͏ͷͰ͸ͳ ͘ɺඅ༻ରޮՌΛҙࣝͨ͠ࢪࡦΛ࣮ࢪ͢΂͖ STREAMͷγεςϜ

Slide 11

Slide 11 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒ × θϩτϥετ • ʮϦιʔεΛ࢖͍ࣺͯʹͯ͠ఆظతʹ࠶ߏங͠ɺ؀ڥΛΫϦʔϯʹอͭʯ • ʮݖݶΛಈతʹ෇༩͠ɺΫϨσϯγϟϧ͸୹ظؒͰࣦޮͤ͞Δʯ • ʮϚωʔδυαʔϏεΛੵۃతʹ࢖͍ɺඅ༻ରޮՌͷߴ͍ηΩϡϦςΟࢪࡦΛ࣮ࢪ͢Δʯ STREAMͷγεςϜ

Slide 12

Slide 12 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Ϋϥ΢υωΠςΟϒͱ θϩτϥετͷ࣮ફ

Slide 13

Slide 13 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Opsαʔό

Slide 14

Slide 14 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Opsαʔό (Operationsαʔό) ͱ͸ • ຊ൪؀ڥʹର͢ΔΦϖϨʔγϣϯΛ͢ΔͨΊͷαʔό • Ұൠతʹ͸ɺ౿Έ୆αʔόɾήʔτ΢ΣΠαʔό౳ͱݺ͹ΕΔ͜ͱ͕ଟ͍ • ͳͥඞཁ͔ • ϓϥΠϕʔτͳωοτϫʔΫ಺ͷϦιʔε΁ͷΞΫηεͷதܧ • ෺ཧతͳฆࣦ΍౪೉ͷϦεΫͷߴ͍୺຤ʹॏཁͳσʔλΛ࢒͞ͳ͍ͨΊ • ॏཁͳσʔλͷऔΓѻ͍Λޮ཰తʹ؂ࠪ͢ΔͨΊ • ୭Ͱ΋؆୯ʹར༻Ͱ͖ΔωοτϫʔΫճઢ͔ΒॏཁͳσʔλʹΞΫηεͤ͞ͳ͍ͨΊ • ෳ਺ͷ࡞ۀऀͷ؀ڥΛ౷Ұ͢ΔͨΊ Opsαʔό

Slide 15

Slide 15 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • ʮৗઃʯͰʮڞ༗ʯͷOpsαʔό Opsαʔό

Slide 16

Slide 16 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ʮৗઃʯ • ຊ൪؀ڥ΁ͷܦ࿏͕ৗʹ͍͍͋ͯΔঢ়ଶ • Ұ౓Ϛϧ΢ΣΞʹײછͯ͠͠·͏ͱɺ௕ظؒͦͷ··ʹͳͬͯ͠·͏ • Ϛγϯ্ʹॏཁͳσʔλ͕஝ੵͯ͠͠·͏ • ʮڞ༗ʯ • ΞΫηεͰ͖ΔϦιʔεΛ࡞ۀऀຖʹ੍ݶ͢Δͷ͕೉͍͠ • ଞͷ࡞ۀऀͷσʔλʹΞΫηεͰ͖ͯ͠·͏/͞Εͯ͠·͏ (ݖݶઃఆͷෆඋ/ݖݶঢ֨) Opsαʔό

Slide 17

Slide 17 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ʮ࢖͍ࣺͯʯͰʮઐ༻ʯͷOpsαʔό Opsαʔό

Slide 18

Slide 18 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMʹ͓͚Δӡ༻ • Opsαʔόઐ༻ͷAWSΞΧ΢ϯτΛ༻ҙ • ຊ൪؀ڥͷVPCͱVPC PeeringͰ࿈ܞ • ࡞ۀऀݸਓຖʹ1୆ͷEC2ΠϯελϯεΛOpsαʔόͱׂͯ͠Γ౰ͯ • Opsαʔό͸ඞཁͳͱ͖ʹࣗ෼ࣗ਎Ͱىಈ͢Δ • Security GroupͱIAMͷInstance Profile΋ɺ࡞ۀऀຖʹݸผʹ࡞੒ • ىಈ࣌ͷΠϯελϯεઃఆ͸ Launch Template ʹΑ੍ͬͯݶ (ଞਓ༻ͷઃఆͰͷىಈΛ๷͙) • ࢖༻ޙʹ͸ຖճλʔϛωʔτ͞ΕΔ Opsαʔό

Slide 19

Slide 19 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Launch Templateͱ͸ • EC2ΠϯελϯεΛىಈ͢ΔͨΊͷઃఆ৘ใͷςϯϓϨʔτ • AMI ID, ΠϯελϯελΠϓ, ωοτϫʔΫઃఆ౳Λࢦఆ͢Δ͜ͱ͕Ͱ͖Δ • IAMͷConditionΛࢦఆ͢Δ͜ͱͰɺ
 ʮࢦఆͷLaunch TemplateΛ࢖ͬͨ৔߹ͷΈΠϯελϯεͷىಈΛڐՄʯ
 ͱ੍͍ͬͨݶ͕Ͱ͖Δ Opsαʔό

Slide 20

Slide 20 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • ಛఆͷLaunch Templateࢦఆ࣌ͷΈRunInstanceͰ͖ΔIAM Policy { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:LaunchTemplate": “" }, "Bool": { "ec2:IsLaunchTemplateResource": "true"} } } Opsαʔό

Slide 21

Slide 21 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ʮ࢖͍ࣺͯʯ • ຊ൪؀ڥ΁ͷܦ࿏͕ඞཁͳͱ͖Ҏ֎͸ด͍ͯ͡Δঢ়ଶ • Ϛϧ΢ΣΞʹײછͯ͠͠·ͬͯ΋͙͢ʹࣺͯΒΕΔͷͰӨڹ͕খ͍͞ • ॏཁͳσʔλ͕Ϛγϯ্ʹ஝ੵͯ͠͠·͏͜ͱΛ๷͙ • ʮઐ༻ʯ • ΞΫηεͰ͖ΔϦιʔεΛ࡞ۀऀຖʹ੍ݶ͢Δ͜ͱ͕Ͱ͖Δ • ଞͷ࡞ۀऀͷσʔλʹΞΫηεͰ͖Δ/͞Εͯ͠·͏ϦεΫ͕ͳ͍ Opsαʔό

Slide 22

Slide 22 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ೝূ

Slide 23

Slide 23 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ೝূͱ͸ • γεςϜͷར༻ऀ͕ɺҙਤͨ͠௨Γͷຊਓͩͱ͔֬ΊΔ͜ͱ • ࠓճ͸ओʹOpsαʔό΁ͷSSHΞΫηε࣌ͷೝূʹ͍ͭͯ ೝূ

Slide 24

Slide 24 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇθϩτϥετͳख๏ͷྫ • ެ։伴ೝূ • ΫϥΠΞϯτ͕ੜ੒ͨ͠ΩʔϖΞͷ͏ͪɺެ։伴Λαʔόʹొ࿥͓ͯ͘͠ • ΫϥΠΞϯτ͸ൿີ伴Λ࢖ͬͯαʔόʹ઀ଓ͢Δ ೝূ

Slide 25

Slide 25 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ΫϥΠΞϯτ͕อ࣋͢Δൿີ伴ͷ؅ཧ͕೉͍͠ • αʔό͕૿͑Δͱൿີ伴΋૿͑Δ • ిࢠతͳ౪೉ (·ͨɺ౪·Εͯ΋ؾ෇͖ʹ͍͘) • ҙਤ͠ͳ͍ڞ༗΍࢖͍ճ͠ • ୀ৬ऀʹΑΔ࣋ͪग़͠ • αʔόʹઃఆ͢Δެ։伴 (authorized_keys) ͷ؅ཧ͕໘౗ • ΫϥΠΞϯτ͕૿͑Δͱެ։伴΋૿͑Δ • ϝϯόʔୀ৬࣌ʹେྔͷαʔόͷઃఆΛߋ৽͢Δඞཁ ೝূ

Slide 26

Slide 26 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • θϩτϥετͳख๏ • SSHΫϥΠΞϯτূ໌ॻೝূ • X.509ͷPKIʹΑΔূ໌ॻΛSSHͷೝূʹར༻͢Δ (RFC6187) • ূ໌ॻൃߦ༻ͷCA(ೝূہ)Λ༻ҙ͢Δ (Ұൠతʹ͸ϓϥΠϕʔτͳCAΛ༻ҙ͢Δ) • αʔόʹ͸CAͷূ໌ॻ(ެ։伴) Λొ࿥͓ͯ͘͠ • CA͔ΒΫϥΠΞϯτূ໌ॻΛൃߦ͢Δ (ͦͷࡍʹద੾ͳೝূΛڬΉ) • ΫϥΠΞϯτূ໌ॻʹ͸ɺ༗ޮظݶΛࢦఆ͢Δ͜ͱ͕Ͱ͖Δ • ΫϥΠΞϯτ͸ɺΫϥΠΞϯτূ໌ॻΛར༻ͯ͠αʔόʹ઀ଓ͢Δ ೝূ

Slide 27

Slide 27 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • θϩτϥετͳख๏ͷߏ੒ਤ ೝূ

Slide 28

Slide 28 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • Pritunl Zero (https://zero.pritunl.com/) Λ࢖͏ • Pritunl Zero͕ɺCAͱΫϥΠΞϯτূ໌ॻൃߦ࣌ͷೝূͱϢʔβ؅ཧΛ୲͏ • ΫϥΠΞϯτূ໌ॻͷൃߦ͸ɺύεϫʔυ + U2F ʹΑͬͯೝূ • U2F༻ͷσόΠε͸YubiKeyΛ࢖༻ • ΫϥΠΞϯτূ໌ॻ͸ɺ1࣌ؒͰࣦޮ͢Δઃఆ ೝূ

Slide 29

Slide 29 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Pritunl Zeroͱ͸ • θϩτϥετͳγεςϜΛߏங͢ΔͨΊͷOSS • ओʹҎԼͷ2ͭͷػೳ͕ར༻Ͱ͖Δ • WebαʔϏε༻ͷProxy • SSH ূ໌ॻ༻ͷCA (ࠓճ͸ͪ͜ΒͷػೳΛར༻) • Proxy΁ͷΞΫηε΍ূ໌ॻͷൃߦʹɺೝূΛڬΉ͜ͱ͕Ͱ͖Δ • ೝূ༻ͷΞΧ΢ϯτ͸ɺϩʔΧϧϢʔβ΋͘͠͸֤छΫϥ΢υαʔϏεͷSSO͕ར༻Մೳ • U2F΍Smart CardʹΑΔ2ཁૉೝূʹ΋ରԠ ೝূ

Slide 30

Slide 30 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • U2F (Universal 2nd Factor) ͱ͸ • 2ཁૉೝূΛڧݻʹ͠ɺ͔ͭ؆୯ʹ͢ΔͨΊͷඪ४࢓༷ • 2ཁૉ໨ͷೝূʹɺUSBσόΠε΍NFCσόΠεͱ͍ͬͨ෺ཧσόΠεΛ༻͍Δ͜ͱ͕Ͱ͖Δ • U2FͷUSBσόΠεͱͯ͠͸YubiKey͕༗໊ • YubiKeyͷ৔߹͸ɺೝূ࣌ʹσόΠεΛ෺ཧతʹλον͢Δ͜ͱͰೝূ͕ߦ͑Δ • ࠓͩͱޙܧͷ FIDO 2.0 ͱ͍͏࢓༷΋ग़͖͍ͯͯΔ ೝূ

Slide 31

Slide 31 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ͷߏ੒ਤ ೝূ

Slide 32

Slide 32 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. σϞಈը (ެ։ͷͨΊʹը૾ʹࠩ͠ସ͑)

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ΫϥΠΞϯτূ໌ॻ͸ɺిࢠతʹ౪೉͞Εͯ΋ɺҙਤ͠ͳ͍ڞ༗΍࢖͍ճ͠Λ͞Εͯ΋ɺ
 ୀ৬ऀʹ࣋ͪग़͞Εͯ΋ɺҰఆظؒͰࣦޮ͢ΔͷͰӨڹ͕গͳ͍ • αʔόʹ͸ɺCAͷެ։伴Λ഑ஔ͢Δ͚ͩͰΑ͍ • ύεϫʔυ͸ɺύεϫʔυϚωʔδϟΛ࢖͏͜ͱͰൿີ伴ΑΓ΋؅ཧָ͕ʹͳΔ • U2FʹΑͬͯɺೝূΛ௨ͨ͢Ίʹ͸෺ཧσόΠε(ͭ·ΓYubiKey)͕ඞཁͰ͋ΓɺΦϯϥΠϯͷ ߈ܸ͚ͩ͸ෆਖ਼ΞΫηε͢Δ͜ͱ͕Ͱ͖ͳ͍ • ΋͠΋෺ཧσόΠε͕෺ཧతʹ౪·Εͨ৔߹͸ɺൺֱత͙͢ʹؾͮ͘͜ͱ͕Ͱ͖Δ ೝূ

Slide 42

Slide 42 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ঝೝ

Slide 43

Slide 43 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ঝೝͱ͸ • ઃఆมߋ࡞ۀͷ಺༰͕ਖ਼౰Ͱ͋Δ͜ͱΛ͔֬Ίͯɺ࣮ࢪΛೝΊͯڐՄ͢Δ͜ͱ • ͳͥඞཁ͔ • ͋Δ࡞ۀʹରͯ͠ผͷਓ͕ϨϏϡʔΛ͢Δ͜ͱͰෆద੾ͳมߋ͕ߦΘͳ͍Α͏ʹ͢ΔͨΊ • Ұਓͷ࡞ۀऀ͕ѱҙΛ࣋ͬͨ৔߹ʹɺ୯ಠͰຊ൪؀ڥ΁ͷӨڹΛ༩͑ΒΕͳ͍Α͏ʹ͢ΔͨΊ • Ծʹ୭͔Ұਓͷ࡞ۀऀͷೝূ৘ใ͕౪·Εͨ৔߹ʹɺຊ൪؀ڥ΁ͷӨڹΛ๷͙ͨΊ ঝೝ

Slide 44

Slide 44 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • ࡞ۀऀ͕ɺࣄલʹ࡞ۀͷ಺༰ΛจষͰهड़͠ɺਃ੥Λߦ͏ • ঝೝऀ͕ɺਃ੥͞Εͨ࡞ۀ಺༰ʹج͖ͮɺ࡞ۀ༻ͷ؀ڥ४උ(ΞΧ΢ϯτͷൃߦ౳)ΛखಈͰߦ ͏ • ͜ͷख๏ͷ໰୊఺ • ঝೝऀ͕ɺखಈͰ࡞ۀ༻ͷ؀ڥΛ༻ҙ͍ͯ͠ΔͨΊɺঝೝ·Ͱʹ༨ܭͳ͕͔͔࣌ؒΔ • ਃ੥͞Εͨ࡞ۀҎ֎ͷૢ࡞͕ߦΘΕͳ͍͜ͱΛอূ͢Δͷ͕೉͍͠ • ਃ੥௨Γͷ࡞ۀ͕ͳ͞Εͨ͜ͱΛอূ͢Δ͜ͱ͕೉͍͠ • ۓٸ࣌ʹ͸ɺීஈͲ͓ΓͷঝೝϑϩʔΛεΩοϓͯ͠࡞ۀͯ͠͠·͍͕ͪʹͳΔ ঝೝ

Slide 45

Slide 45 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ࣗಈԽ͞ΕͨঝೝϑϩʔΛ࣮ݱ͢Δ • ࡞ۀʹඞཁͳ࠷খݶͷݖݶ΍௨৴ڐՄΛɺΦϯσϚϯυʹ෇༩͢Δ ঝೝ

Slide 46

Slide 46 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • ChatOpsʹΑͬͯঝೝϑϩʔΛ࣮ݱ͢Δ • ਃ੥ऀ͸ɺSlackΛ࢖ͬͯ࡞ۀ಺༰ͷਃ੥Λߦ͏ • ਃ੥ͷ಺༰ʹɺඞཁͳIAMͷݖݶ΍ɺ௨৴ઌͷ৘ใΛهड़͢Δ • ঝೝऀ͸ɺSlack্Ͱ಺༰Λ֬ೝ͠ɺਃ੥಺༰͕ద੾Ͱ͋Ε͹ঝೝ͢Δ • ঝೝͷ಺༰Λ΋ͱʹɺݖݶͷ෇༩ͱ௨৴ͷڐՄΛΞϓϦέʔγϣϯ͕ࣗಈͰߦ͏ • ࡞ۀͷऴྃ࣌ʹɺ෇༩͞Εͨݖݶͱ௨৴ͷڐՄͷࣗಈ࡟আΛߦ͏ ঝೝ

Slide 47

Slide 47 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T ঝೝ • STREAMͰͷӡ༻ͷߏ੒ਤ

Slide 48

Slide 48 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ࣗಈԽʹΑΓɺঝೝͷӡ༻ͷ࣌ؒͱख͕ؒ࡟ݮ͞ΕΔ • ӡ༻ͷख͕ؒখ͍͞ͷͰɺۓٸ࣌ʹྫ֎ӡ༻Λ͢Δ͜ͱͳ͘ରԠ͕ՄೳͱͳΔ • ࡞ۀʹඞཁͳ࠷খݶͷݖݶͱ௨৴ڐՄʹ੍ݶ͢Δ͜ͱͰɺ
 ਃ੥͞Εͨ࡞ۀҎ֎ͷૢ࡞͕ߦΘΕΔϦεΫΛ࠷খԽͰ͖Δ • ఆظతʹࣗಈ࡟আΛ͢Δ͜ͱͰෆඞཁͳݖݶ΍௨৴ڐՄ͕࢒ͬͯ͠·͏͜ͱΛ๷͙ • ঝೝ͕νϟοτͷՄࢹԽ͞Εͨ؀ڥͰߦΘΕΔͨΊɺۓٸ࣌ʹ΋ॊೈͳରԠ͕ূ੻Λ࢒্ͨ͠ ͰՄೳͱͳΔ ঝೝ

Slide 49

Slide 49 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ηΩϡϦςΟϞχλϦϯά

Slide 50

Slide 50 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ηΩϡϦςΟϞχλϦϯάͱ͸ • ෆਖ਼ΞΫηεΛൃݟ͢ΔͨΊɺෆ৹ͳΞΫςΟϏςΟΛ؂ࢹ͢Δ͜ͱ • ͢΂ͯͷϦεΫΛࣄલʹ೺Ѳ͠༧๷͢Δ͜ͱ͸Ͱ͖ͳ͍ͱ͍͏ߟ͑ʹجͮ͘ ηΩϡϦςΟϞχλϦϯά

Slide 51

Slide 51 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • αʔό΍ωοτϫʔΫػثͷϩάΛɺಉҰσʔληϯλ಺ͷू໿αʔόʹసૹ • ू໿αʔό্ʹ؂ࢹϓϩάϥϜΛσϓϩΠ • ҰఆִؒͰ؂ࢹϓϩάϥϜΛ࣮ߦͯ͠ෆ৹ͳΞΫςΟϏςΟ͕ͳ͍͔ΛνΣοΫ • ΞυϗοΫͳௐࠪ΍෼ੳ͸ɺू໿αʔό্ͷϩάʹରͯ͠awk΍grep౳ͷίϚϯυΛ࣮ߦ ηΩϡϦςΟϞχλϦϯά

Slide 52

Slide 52 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷΠϝʔδ ηΩϡϦςΟϞχλϦϯά

Slide 53

Slide 53 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ؂ࢹ͕ਖ਼͘͠Քಇ͍ͯ͠Δ͜ͱΛอূ͢ΔͨΊͷଟ͘ͷखؒ • ग़ྗͷఀࢭͷݕ஌ • ϩάͷվ͟Μͷݕ஌ • ؂ࢹϓϩάϥϜͷվ͟Μͷݕ஌ • ෆ৹ͳΞΫςΟϏςΟͷݕ஌·Ͱͷ͕࣌ؒ௕Ҿ͖͗ͯ͢͠·͏ • grep΍awkͰϩάͷߴ౓ͳௐࠪ΍෼ੳΛ͢Δͷ͸େม ηΩϡϦςΟϞχλϦϯά

Slide 54

Slide 54 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ϩάΛΫϥ΢υετϨʔδʹอଘ • ؂ࢹϓϩάϥϜΛ “Function as a Service” ͳ؀ڥʹσϓϩΠ • ΠϕϯτυϦϒϯͰͷ؂ࢹ ηΩϡϦςΟϞχλϦϯά

Slide 55

Slide 55 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • ϩάอଘઐ༻ͷAWSΞΧ΢ϯτΛ༻ҙ • ͜ͷAWSΞΧ΢ϯτͷIAMͷݖݶ͸ɺଞͷAWSΞΧ΢ϯτΑΓ΋ݫ͘͠؅ཧ • ֤छϩάΛɺΫϩεΞΧ΢ϯτΞΫηεͰอଘ • S3্ͷϩά͸ɺ S3 Object LockʹΑΓ࡟আ΍্ॻ͖ΛෆՄೳʹ • ϩά؂ࢹ༻ͷϓϩάϥϜΛLambda Functionͱͯ͠σϓϩΠ • CodeSha256Λ࢖ͬͯվ͟ΜΛ֬ೝ • CloudTrail ΍ AWS Config ͷ௨஌ΛSNSͰड৴ͯ͠ɺ؂ࢹ༻ͷϓϩάϥϜΛ࣮ߦ • S3 Bucketͷϩάʹରͯ͠ΫΤϦΛ͔͚ΔͨΊͷAthenaͷςʔϒϧΛ༻ҙ ηΩϡϦςΟϞχλϦϯά

Slide 56

Slide 56 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • S3 Object Lock ͱ͸ • ࢦఆͨ͠อ࣋ظؒதɺS3ͷΦϒδΣΫτ͕࡟আ͞Εͳ͍Α͏ʹ͢Δػೳ • ͍ΘΏΔ WORM (Write Once Read Many) ͳετϨʔδͱͯ͠S3Λར༻Ͱ͖Δ • ٻΊΒΕΔσʔλͷอޢͷϨϕϧʹԠͯ͡2ͭͷϞʔυ͕ར༻Մೳ • ΨόφϯεϞʔυ • ϧʔτΞΧ΢ϯτ౳ɺݖݶ͕͋Ε͹Object LockࣗମΛղআ͢Δ͜ͱ͕Մೳ • ΑͬͯΦϒδΣΫτΛ࡟আ͢Δ͜ͱ͕Մೳ • ίϯϓϥΠΞϯεϞʔυ: • ͍͔ͳΔϢʔβ΋Object Lockͷղআ͸ෆՄೳ • ΑͬͯઈରʹΦϒδΣΫτ͸࡟আ͢Δ͜ͱ͕Ͱ͖ͳ͍ ηΩϡϦςΟϞχλϦϯά

Slide 57

Slide 57 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • CodeSha256 ͱ͸ • Lambda Functionʹొ࿥͞ΕͨίʔυͷSHA256ͷϋογϡ஋ • खݩͷਖ਼͍͠ίʔυͱൺֱ͢Δ͜ͱͰɺվ͟ΜΛݕ஌Ͱ͖Δ $ aws lambda list-functions \ —query "Functions[*].[FunctionName,CodeSha256,LastModified]" \ —output table ------------------------------------------------------------------------------------------------------- | ListFunctions | +-----------------------+----------------------------------------------+------------------------------+ | root-activity-monitor | mVlZR3E2rvLT0ALp8WyUo8bmbV/6qx1t2Dow9hmkLII= | 2019-05-04T15:51:38.210+0000 | | aws-config-monitor | CSi58x6MPRtSJPwtG/m70rsY6ybrXXadGqCcj51/+PU= | 2019-05-10T06:58:02.772+0000 | +-----------------------+----------------------------------------------+------------------------------+ $ shasum -a 256 root-activity-monitor.zip | awk '{print $1}' | xxd -r -p | base64 mVlZR3E2rvLT0ALp8WyUo8bmbV/6qx1t2Dow9hmkLII= ηΩϡϦςΟϞχλϦϯά

Slide 58

Slide 58 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ͷߏ੒ਤ ηΩϡϦςΟϞχλϦϯά

Slide 59

Slide 59 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ϩάͷվ͟Μ΍࡟আΛ๷͙͜ͱ͕؆୯ • IAMͷݖݶͷ؅ཧ΍S3 Object LockʹΑΔԸܙ • ؂ࢹϓϩάϥϜͷվ͟ΜΛݕ஌͢Δ͜ͱ͕؆୯ • CodeSha256ʹΑΔԸܙ • ϋʔυ΢ΣΞ΍OS΍ϥϯλΠϜͷϨΠϠʔͷվ͟Μ͸ࣗ෼͕ͨͪέΞ͠ͳͯ͘Α͍ • ෆਖ਼ΞΫηεΛૣظʹൃݟͰ͖Δ͜ͱ͕ظ଴͞ΕΔ • AthenaʹΑͬͯɺෳࡶͳௐࠪ΍෼ੳ΋؆୯ʹ࣮ࢪͰ͖Δ ηΩϡϦςΟϞχλϦϯά

Slide 60

Slide 60 text

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ࠓޙͷల๬

Slide 61

Slide 61 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • OpsαʔόͷϢʔβϏϦςΟ޲্ • ݱࡏ͸ɺOpsαʔόͷىಈ͔Βຊ൪؀ڥ΁ͷΞΫηε·Ͱͷ࡞ۀऀͷεςοϓ਺͕গ͠ଟ͍ • ΋͏গ͠γʔϜϨεʹ࢖͑ΔΑ͏ͳ࢓૊ΈΛ༻ҙ͍ͨ͠ • ۓٸ࣌ͷରԠͷεϐʔυΞοϓ • ࡞ۀऀͷମݧΛ޲্ • Pritunl ZeroͷWebαʔϏε༻Proxyͷར༻ • STREAMʹ͸ɺγεςϜͷߏ੒্ෳ਺ͷ͞·͟·ͳ؅ཧը໘͕ଘࡏ͢Δ • ͦΕΒͷ؅ཧը໘ͷΞΫηείϯτϩʔϧͷϕʔεϥΠϯ͕Ҿ্͖͛ΒΕΔ ࠓޙͷల๬

Slide 62

Slide 62 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Atsushi Ishibashi Twitter: @bashi0501 Satoshi Tajima Twitter: @s_tajima