AWS IAMの属人的な管理からの脱却【DeNA TechCon 2021】/techcon2021-19

by DeNA_Tech

Slide 1

Slide 1 text

"84*".ͷ ଐਓతͳ؅ཧ͔Βͷ୤٫ ,FOUB4BUP !LBSVQBOFSVSB %F/" $P-5%

Slide 2

Slide 2 text

!LBSVQBOFSVSB %F/"ೝূೝՄج൫पลαʔϏε։ൃɾӡ༻ +BQBO1FSM"TTPDJBUJPO୅දཧࣄ 1FSM(P+BWB5ZQF4DSJQU.Z42-FUD 5XJUUFS(JUIVC!LBSVQBOFSVSB

Slide 3

Slide 3 text

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

Slide 4

Slide 4 text

࿩͞ͳ͍͜ͱ w ηΩϡϦςΟͷجૅ w "84΍*".ͷجૅ w ֤छ"84αʔϏε w *".؅ཧͷৄ͍͠ӡ༻ํ๏ w "84ΞΧ΢ϯτͷϚϧνΞΧ΢ϯτ؅ཧ w "84$%,ͳͲͷ࢓૊Έͷৄࡉ

Slide 5

Slide 5 text

͸͍

Slide 6

Slide 6 text

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾํ๏ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

Slide 7

Slide 7 text

*".؅ཧͷ ϕετϓϥΫςΟε

Slide 8

Slide 8 text

*".ͰͷηΩϡϦςΟͷϕετϓϥΫςΟε IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNM

Slide 9

Slide 9 text

ಛʹେࣄͳͱ͜Ζ ࠓճͷ࿩Λཧղ͢Δ্Ͱ

Slide 10

Slide 10 text

*".ͰͷηΩϡϦςΟͷϕετϓϥΫςΟε IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNM

Slide 11

Slide 11 text

࠷খݶͷಛݖΛೝΊΔ w ඞཁҎ্ͷݖݶΛ͚ͭͳ͍ w ࠷খݶͷΞΫηεݖݶ͔Βঃʑʹҭ͍ͯͯ͘ Կނ͔ʁ ˠඞཁҎ্ͷݖݶ͕෇༩͞Εͨঢ়ଶͷৗଶԽΛ๷͙ͨΊ ඞཁҎ্ʹݖݶΛ࣋ͭͱೝূ৘ใͷ࿙Ӯ࣌ͷϦεΫ͕ߴ͘ͳΔ

Slide 12

Slide 12 text

ΞΫηεΩʔΛڞ༗͠ͳ͍ w ಉҰ*".ϢʔβʔͷΞΫηεΩʔΛෳ਺ՕॴͰڞ༗͠ͳ͍ w *".ϩʔϧͷར༻Λਪ঑͢Δ Կނ͔ʁ ˠΞΫηεΩʔΛ࣋ͭγεςϜΛ૿΍͞ͳ͍ͨΊ ΞΫηεΩʔΛ࢖͏Օॴ͕૿͑Ε͹࿙Ӯ͢ΔՄೳੑ΋૿͑Δ

Slide 13

Slide 13 text

ͭ·Γ

Slide 14

Slide 14 text

*".؅ཧͷϕετϓϥΫςΟε w ݸʑݸผͷࣄ৘ʹ߹Θͤͨ࠷খݶͷݖݶΛ࣋ͭ*".ϩʔϧΛ࢖͏ w ඞཁҎ্ͷݖݶΛ͚ͭͳ͍ w *".Ϣʔβʔ͸γεςϜϢʔεͰ͸ݪଇͱͯ͠࢖Θͳ͍ w ($1͔Βར༻͢Δ৔߹ͳͲ͸ผ

Slide 15

Slide 15 text

͸͍

Slide 16

Slide 16 text

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

Slide 17

Slide 17 text

*".؅ཧͷ೉͠͞

Slide 18

Slide 18 text

*".ϙϦγʔ͸ෳࡶԽ͕ͪ͠ w 3FTPVSDF΍$POEJUJPOʹΑΔॊೈͰࡉ͔͍ݖݶ؅ཧ͕Մೳ w ୯७ʹ"DUJPOΛ෇͚Δ͚ͩͰ͸े෼ʹݖݶΛߜΕͳ͍ w 4΍,.4ͷར༻Ͱ͸࣮༻্3FTPVSDFͷ੍ݶ΋ඞཁʹͳΔ w "84؅ཧϙϦγʔʹ͸Ϧιʔε੍ݶ͕ແ͍ w ݖݶΛे෼ʹߜΔʹ͸ࣗ෼ͰϙϦγʔΛ࡞Δ΄͏͕ྑ͍ w ݁Ռతʹ*".ϙϦγʔ؅ཧʹ͸ϊ΢ϋ΢͕ඞཁʹͳΔ

Slide 19

Slide 19 text

ݖݶΛ؅ཧ͢Δݖݶ͕ඞཁʹͳΔ w ʮ*".Λ؅ཧ͢Δݖݶʯ͸ʮݖݶΛ؅ཧ͢ΔݖݶʯͰ͋Δ w ͭ·Γࣗ෼ࣗ਎ͷݖݶ΋ίϯτϩʔϧͰ͖Δ w ࣮࣭తʹ͢΂ͯͷݖݶΛ࣋ͭ͜ͱʹ΄΅౳͍͠ঢ়ଶ w ແҋʹશһ͕͜ΕΛ࣋ͭͱݖݶ؅ཧ͢Δҙຯ͕ͳ͘ͳͬͯ͠·͏ w Ұ෦ͷϝϯόʔ͚͕ͩ*".؅ཧݖݶΛ࣋ͭΑ͏ʹ͢Ε͹ղܾ͢Δ w Ұൠతʹ͸ґཔ੍ νέοτ੍ ͱͳΔ͜ͱ͕ଟͦ͏

Slide 20

Slide 20 text

%FW0QTͷڥ໨͕ᐆດ w Ϋϥ΢υΠϯϑϥʹ͓͍ͯ͸%FWͱ0QTͷڥ໨͸ᐆດ w *BB4͔Β཭Ε͍͚ͯ͹͍͘΄Ͳ͜Ε͸ݦஶʹͳ͍ͬͯ͘ w %FWͷจ຺Ͱ৽͍͠ΠϯϑϥετϥΫνϟΛ࡞Δ͜ͱʹͳΔ w ͦΕʹ߹Θͤͯ৽͍͠ݖݶηοτ͕ඞཁʹͳΔ͜ͱ͕ଟ͍ w -BNCEB΍'JSFIPTFʹ෇༩͢Δ*".ϩʔϧͳͲ w ։ൃن໛͕޿͘ଟ༷Խ͢Δͱɺґཔ੍Ͱ͸ᴥᴪ͕ى͖΍͘͢ͳΔ

Slide 21

Slide 21 text

͓Θ͔Γ ͍͚ͨͩͨͩΖ͏͔ʜ

Slide 22

Slide 22 text

΋͏Ұ౓͝ཡ͍ͨͩ͜͏ʜ

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

ແ਺ʹൃੜ͢Δ ݸʑݸผͷ*".ϩʔϧ

Slide 26

Slide 26 text

ͦΕΒΛશͯ؅ཧ͢Δ Ұ෦ͷϝϯόʔ

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

։ൃن໛ʹରͯ͠ ؅ཧ͕εέʔϧͰ͖ͳ͍

Slide 29

Slide 29 text

ʘ ?P? ʗ

Slide 30

Slide 30 text

Ͳ͏͢Ε͹ྑ͍ͷ͔

Slide 31

Slide 31 text

ղܾํ๏

Slide 32

Slide 32 text

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

Slide 33

Slide 33 text

*".؅ཧͷ෦෼తͳҕৡ

Slide 34

Slide 34 text

ͦ΋ͦ΋ͷ໰୊ w *".ϦιʔεશମΛ؅ཧ͢Δ͔Ұ੾؅ཧ͠ͳ͍͔ͷۃ୺ͳೋ୒ w ։ൃن໛͕εέʔϧͯ͠΋*".؅ཧऀ͕εέʔϧͰ͖ͳ͍ w Ұ෦ͷݸਓ͕؅ཧ୲౰ऀͱͯͦ͠ΕΛ΍Δ͔͠ͳ͍ҝ w ݁Ռతʹ*".Ϣʔβʔ΍*".ϩʔϧͷ࢖͍·Θ͠Ͱଥڠ͕ͪ͠ w ΋ͪΖΜજࡏతͳηΩϡϦςΟʔϦεΫ͕෇͖·ͱ͏

Slide 35

Slide 35 text

Slide 36

Slide 36 text

෼୲͸͍͚ͨ͠ΕͲ શݖ࣋ͬͨਓ͕૿͑͗ͯ͢΋ࠔΔ

Slide 37

Slide 37 text

ʮ͜ͷ-BNCEB͋ͨΓͷݖݶ͸ ͦͬͪͰΑ͠ͳʹ؅ཧͯ͠Ͷʯ Έ͍ͨʹ෼୲͍ͨ͠

Slide 38

Slide 38 text

"MMPS/PUIJOH͸ࠔΔ

Slide 39

Slide 39 text

΋͠෦෼తͳ؅ཧΛҕৡͯ͠ ෼୲͢Δ͜ͱ͕Ͱ͖ͨΒʜʁ

Slide 40

Slide 40 text

ղܾͦ͠͏

Slide 41

Slide 41 text

Ͳ͏΍ͬͯʁ

Slide 42

Slide 42 text

෦෼తͳ*".ݖݶૢ࡞͕Ͱ͖Δݖݶ ͳΜͯ࡞ΕΔͷ͔ʁ

Slide 43

Slide 43 text

ͭ͘Ε·͢

Slide 44

Slide 44 text

1FSNJTTJPOT#PVOEBSZ w ݖݶͷڥքΛఆΊΔ͜ͱ͕Ͱ͖Δػೳ w Ұൠతʹ͸૊৫ؒͰ*".؅ཧݖݶͷҰ෦ΛҕৡͷͨΊʹ࢖ΘΕΔ w *".Ϣʔβʔ΍*".ϩʔϧʹઃఆ͢Δ͜ͱ͕Ͱ͖Δ w ͜Ε͕ઃఆ͞Ε͍ͯΔ*".Ϧιʔε͸ɺͲͷΑ͏ͳݖݶΛ࣋ͬͯ ͍ͯ΋ɺ͜ͷڥքΛ௒͑ͨݖݶΛߦ࢖͢Δ͜ͱ͸Ͱ͖ͳ͘ͳΔ w Τϥʔ͸୯ʹݖݶΛ͍࣋ͬͯͳ͍ͱ͖ͱಉ͡΋ͷ͕ൃੜ͢Δ IUUQTEPDTBXTBNB[PODPN*".MBUFTU6TFS(VJEFBDDFTT@QPMJDJFT@CPVOEBSJFTIUNM

Slide 45

Slide 45 text

ͲͷΑ͏ʹݖݶͷڥքΛఆΊΔͷ͔ w ࣮ଶͱͯ͠͸ී௨ͷҰൠతͳ؅ཧϙϦγʔ w 1FSNJTTJPOT#PVOEBSZͱͯ͠෇༩ͨ͠৔߹ʹಛघͳಇ͖Λ͢Δ w 1FSNJTTJPOT#PVOEBSZͰڐՄ͞Ε͍ͯͳ͍"DUJPO͸࢖͑ͳ͘ͳΔ w ΠϯϥΠϯϙϦγʔͳͲͰڐՄ͞Ε͍ͯͯ΋ͦΕ͸࢖͑ͳ͘ͳΔ w ୯ʹڐՄ͍ͯ͠ͳ͍ͱ͖ͱൃੜ͢ΔΤϥʔ͸มΘΒͳ͍ w ౰ͨΓલ͕ͩ ͜͜Ͱ*".Ϧιʔεͷૢ࡞ݖݶΛڐՄ͢Δͱݖݶঢ͕֨Ͱ͖ΔͷͰຊ຤స౗ʹͳͬͯ͠·͏ɻ΍ͬͯ͸͍͚ͳ͍

Slide 46

Slide 46 text

ͲͷΑ͏ʹݖݶͷڥքΛఆΊΔͷ͔ w Ұൠతʹ͸αʔϏε୯ҐͰࢦఆ͢ Δ͜ͱ͕ଟ͍ w ӈͷྫͷϙϦγʔΛ1FSNJTTJPOT #PVOEBSZʹࢦఆͨ͠৔߹͸ɺ4 ͱ$MPVE8BUDIʹؔ܎͢Δݖݶͩ ͚͕ػೳ͢Δ { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:*", "cloudwatch:*" ], "Resource": "*" } ] }

Slide 47

Slide 47 text

ͭ·Γ

Slide 48

Slide 48 text

୯ʹ*".Ϧιʔεͷݖݶ͚͕ͩ͋Δঢ়ଶ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ

Slide 49

Slide 49 text

1FSNJTTJP OT#PVOEBSZ ͦ͜ʹ1FSNJTTJPOT#PVOEBSZ͕ͭ͘ͱ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ

Slide 50

Slide 50 text

1FSNJTTJP OT#PVOEBSZ ࣮ࡍʹ࢖͑ΔݖݶΛ੍ݶͰ͖Δ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ ࣮ࡍʹ ࢖͑Δ ݖݶ

Slide 51

Slide 51 text

2෇͚ͳ͔ͬͨΓ֎͞ΕͨΓ͠ͳ͍ʁ

Slide 52

Slide 52 text

"෇༩Λڧ੍͢Ε͹Α͍

Slide 53

Slide 53 text

1FSNJTTJPOT#PVOEBSZͷ෇༩Λڧ੍ w *".$POEJUJPOͰ͋ΔJBN1FSNJTTJPOT#PVOEBSZΛ࢖͏ w ࢦఆͨ͠1FSNJTTJPOT#PVOEBSZΛ෇༩ͨ͠*".ϦιʔεͷΈʹ ରͯ͠ͷΈར༻Ͱ͖ΔݖݶΛදݱͰ͖Δ w ࣮࣭తʹಛఆͷ1FSNJTTJPOT#PVOEBSZͷ෇༩Λڧ੍Ͱ͖Δ w ࢦఆͨ͠1FSNJTTJPOT#PVOEBSZΛ෇༩͠ͳ͍Ϧιʔεʹରͯ͠ ͷૢ࡞Λڋ൱Ͱ͖Δ

Slide 54

Slide 54 text

1FSNJTTJP OT#PVOEBSZ ࣮ࡍʹ࢖͑Δݖݶͷ੍ݶΛڧ੍Ͱ͖Δ 1FSNJTTJPOT #PVOEBSZͷ ݖݶ *".Ϧιʔεͷ ݖݶ ࣮ࡍʹ ࢖͑Δ ݖݶ ֎ͤͳ͍ʂ

Slide 55

Slide 55 text

ͲͷΑ͏ʹ࢖͏͔

Slide 56

Slide 56 text

*".ݖݶ؅ཧͷ෦෼తͳҕৡͷ࣮ݱ ݖݶൣғΛදݱ͢Δ1FSNJTTJPOT#PVOEBSZ༻؅ཧϙϦγʔΛ࡞Δ ෦෼తͳ*".؅ཧݖݶΛ༩͍͑ͨ*".Ϧιʔεʹର͠ JBN1FSNJTTJPOT#PVOEBSZͰ্هͷ1FSNJTTJPOT#PVOEBSZ Ͱ੍ݶͨ͠*".ૢ࡞ݖݶΛ෇༩͢Δ ඞཁͳΒ ࣗ෼ࣗ਎ͷ*".Ϧιʔεʹର͢Δૢ࡞΋ېࢭ͢Δ

Slide 57

Slide 57 text

Ͱ͖·ͨ͠

Slide 58

Slide 58 text

͜ΕͰ*".؅ཧΛ ෼୲͠΍͘͢ͳͬͨ

Slide 59

Slide 59 text

΍Γ·ͨ͠Ͷ

Slide 60

Slide 60 text

͔͠͠

Slide 61

Slide 61 text

·ͩ໰୊͸࢒͍ͬͯΔʜ

Slide 62

Slide 62 text

ࢥ͍ग़ͯ͠Έ·͠ΐ͏

Slide 63

Slide 63 text

Slide 64

Slide 64 text

ݸਓͰͳ͘૊৫ͱͯ͠ *".؅ཧϊ΢ϋ΢Λ ஝ੵ͍ͨ͠

Slide 65

Slide 65 text

ཧ૝

Slide 66

Slide 66 text

૊৫Ͱ؅ཧ͢Δཧ૝ͷ*".؅ཧ؀ڥ w ඞཁ࠷খݶͷਓ͕؅ཧݖݶΛ͍࣋ͬͯΔ w ͜ͷਓ਺Λن໛ʹ߹Θͤͯ૿ݮͰ͖Δ w ࡞ۀऀ͸୭Ͱ΋มߋΛϦΫΤετͰ͖Δ w มߋ಺༰͸٬؍తʹᴥᴪͷແ͍දݱͰهࡌͰ͖Δ w ͍ͭͩΕ͕ͳΜͷͨΊʹͲͷΑ͏ͳมߋΛͨ͠ͷ͔Λ௥੻Ͱ͖Δ w มߋͷࡍʹؾΛ͚ͭΔ΂͖ϊ΢ϋ΢͕஝ੵͰ͖Δ

Slide 67

Slide 67 text

͓΍

Slide 68

Slide 68 text

*OGSBTUSVDUVSFBTDPEF Ͱղܾͦ͠͏

Slide 69

Slide 69 text

૊৫Ͱ؅ཧ͢Δཧ૝ͷ*".؅ཧ؀ڥ w ඞཁ࠷খݶͷਓ͕؅ཧݖݶΛ͍࣋ͬͯΔˠ(JUIVC3FWJFX w ͜ͷਓ਺Λن໛ʹ߹Θͤͯ૿ݮͰ͖Δˠ(JUIVC5FBN w ࡞ۀऀ͸୭Ͱ΋มߋΛϦΫΤετͰ͖Δˠ1VMM3FRVFTU w มߋ಺༰͸٬؍తʹᴥᴪͷແ͍දݱͰهࡌͰ͖Δˠ$PEF w ͍ͭͩΕ͕ͳΜͷͨΊʹͲͷΑ͏ͳมߋΛͨ͠ͷ͔Λ௥੻Ͱ͖Δ w มߋͷࡍʹؾΛ͚ͭΔ΂͖ϊ΢ϋ΢͕஝ੵͰ͖Δˠ(JU

Slide 70

Slide 70 text

1VMM3FRVFTUग़ͯ͠ ϨϏϡʔͯ͠Ϛʔδͯ͠ $*Ͱࣗಈಉظ

Slide 71

Slide 71 text

͍ͨ͠

Slide 72

Slide 72 text

΍Γ·͠ΐ͏

Slide 73

Slide 73 text

࿩͢͜ͱ w *".؅ཧͷϕετϓϥΫςΟεͷ͓͞Β͍ w *".؅ཧͷ೉͠͞ͱͦͷ໰୊ w *".؅ཧͷ෦෼తͳҕৡʹΑΔղܾ w ͦΕΛԠ༻ͨ͠؅ཧͷ*B$Խ

Slide 74

Slide 74 text

*B$

Slide 75

Slide 75 text

1VMM3FRVFTUग़ͯ͠ ϨϏϡʔͯ͠Ϛʔδͯ͠ $*Ͱࣗಈಉظ

Slide 76

Slide 76 text

Kick Job Github Enterprise Server Sync CI Create Developer Review Reviewer Pull-Request Merge AWS IAM ֓೦ਤ

Slide 77

Slide 77 text

Αͬ͠Ό ΍͍ͬͯͧ͘ʂʂʂʂʂ

Slide 78

Slide 78 text

ͦͷલʹʜ

Slide 79

Slide 79 text

*".มߋద༻ΛࣗಈԽ͢ΔϦεΫ w $*+PC͕*".؅ཧݖݶΛ࣋ͭ͜ͱʹͳΔ w *".ͷશݖΛ࣋ͭͱ಺෦ෆਖ਼ߦҝऀʹѱ༻͞ΕͨࡍͷϦεΫ͕ߴ͍ w ෦෼తͳ*".؅ཧݖݶΛ࣋ͭ৔߹͸ͦͷϦεΫ͸ݶఆత w ϦϙδτϦʹΞΫηεݖݶ͕͋Ε͹୭Ͱ΋มߋͰ͖Δ w ϨϏϡʔ͕βϧͩͱѱҙͷ͋ΔݖݶΛݟམͱ͔͠Ͷͳ͍ w $*ͷߏ੒ࣗମʹ੬ऑੑ͕ແ͍ݶΓ͸֎෦͔Β߈ܸ͢Δ༨஍͸ͳ͍

Slide 80

Slide 80 text

ϦεΫʹର͢Δߟ͑ํ w ಺෦ෆਖ਼ߦҝऀͷ༨஍͔͠ͳ͍ࣗಈԽͤͣͱ΋ৗʹ͋ΔϦεΫ w *".؅ཧݖݶΛ͍࣋ͬͯΔਓ͕ډΔݶΓ͸ى͜ΓಘΔ w ෆਖ਼ߦҝΛ͠ʹ͘͘͢Δ࢓૊ΈΛ࡞Δ͜ͱͰϦεΫΛԼ͛ΒΕΔ w $MPVE5SBJMͷ*"."1*ΠϕϯτΛ4MBDLʹ௨஌ w *".ϦιʔεͷมߋͳͲΛݕ஌प஌͢Δ w มߋػձ͸ൺֱతগͳ͍ͷͰมͳૢ࡞͕͋ͬͯ΋ؾ͖ͮ΍͍͢ w 1FSNJTTJPOT#PVOEBSZͰൣғΛݶఆ͠ඃ֐ϦεΫΛԼ͛ΒΕΔ

Slide 81

Slide 81 text

࢓૊Έ࣍ୈͰ े෼ʹϦεΫΛԼ͛ΒΕΔ

Slide 82

Slide 82 text

Αͬ͠Ό ΍͍ͬͯͧ͘ʂʂʂʂʂ

Slide 83

Slide 83 text

ཧ૝ͷ*B$ʹΑΔ*".؅ཧ w (JUIVCʹ1VMM3FRVFTU 13 Λ࡞ΓϚʔδ͞ΕͨΒ$*Ͱࣗಈಉظ w ίʔυ ઃఆ Λਖ਼ͱͯࠩ͠෼ಉظ͍ͨ͠ w શಉظͰ͸4%,ͳͲͷεϩοτϧֻ͕͔Γ͕࣌ؒͱͯ΋ֻ͔Δ w ఆظతʹ"84ଆΛਖ਼ͱͨࠩ͠෼ಉظΛऔΓࠐΈ͍ͨ w ۓٸ࣌ͳͲʹߦͬͨ௚ͷมߋ͕ҙਤͤͣר͖໭͞Εͳ͍Α͏ʹ w -JOUFSΛ༻ҙͯ͠ϙϦγʔͳͲͷෆඋΛࣗಈϨϏϡʔ͍ͨ͠ w ϊ΢ϋ΢Λ13͚ͩͰ͸ͳ͘ίʔυͱͯ͠΋஝ੵͰ͖Δ

Slide 84

Slide 84 text

Ͳ͏΍ͬͯಉظ͢Δ͔ʁ

Slide 85

Slide 85 text

ಉظखஈͷબ୒ࢶ w 5FSSBGPSN w QSPTJNQPSU΋Մೳಠࣗ%4-Ͱࣗ༝౓͕ߴ͗͢ͳ͍ w DPOTTUBUFͷ؅ཧ͕ඞཁ w "84$%, $GO$MPVE'PSNBUJPO w QSPTTUBUFͷ؅ཧ͕ෆཁ w DPOTESJGUൃੜ࣌ʹखͰݕ஌ɾमਖ਼͕ඞཁࣗ༝౓͕ߴ͗͢Δ

Slide 86

Slide 86 text

هड़ͷࣗ༝౓ͷӨڹ w "84ଆͷঢ়ଶΛਖ਼ͱͨࠩ͠෼औΓࠐΈͷ͠΍͢͞ w هड़ͷࣗ༝౓͕௿͍΄ͲςΩετͰͷࠩ෼͕ग़ʹ͍͘ w ϑΥʔϚολʔͳͲ͕͋Ε͹Ϛγ͕ͩʜ w ͨͱ͑͹5ZQF4DSJQUͷίʔυʹམͱ͞Εͯ΋ࠩ෼͕େม w ७ਮͳ+40/ͷΑ͏ͳ୯ͳΔߏ଄ମ͕Ұ൪ྑ͍

Slide 87

Slide 87 text

طଘ*B$ιϦϡʔγϣϯͷTUBUF؅ཧ w $GO΍5FSSBGPSNͳͲͷ*B$Ͱ͸TUBUFΛ࣋ͬͯͦΕͱͷࠩ෼ΛऔΔ w ࣮ଶͱTUBUF͸ဃ཭͠ಘΔ ͜ͷဃ཭ΛESJGUͱݺͿ w Ұൠతͳߏ੒؅ཧͰ͸ESJGU͸Ͳͷঢ়ଶ͕ਖ਼͍͔͠౎౓൑அ͕ඞཁ w "84ଆͷঢ়ଶΛਖ਼ͱͨ͠*".Λදݱ͢Δίʔυ ઃఆ ΁ͷࠩ෼औΓ ࠐΈΛ͢ΔͨΊʹ͸TUBUF͸अຐʹͳΔ

Slide 88

Slide 88 text

Ͳ͏͢Δ͔ʁ

Slide 89

Slide 89 text

ࣗ࡞͠·ͨ͠

Slide 90

Slide 90 text

࣮૷ w ࠩ෼ݕग़͠"844%,Ͱ*"."1*Λద੾ʹୟ͘ײ͡ͷ࣮૷ w +40/Ͱ*".Ϣʔβʔ΍*".ϩʔϧͷઃఆ಺༰Λهड़ w ΠϯϥΠϯϙϦγʔͳͲ΋ͦͷ··هࡌͰ͖Δ w 5ZQF4DSJQUͰ࣮૷ w "84$%,ΛಋೖࡁΈͩͬͨͷͰ։ൃݴޠΛ߹Θ͔ͤͨͬͨ w JPUTͰόϦσʔγϣϯ͢Δ͜ͱͰ؆୯ͳUZQPͳͲ΋ݕग़Մೳ

Slide 91

Slide 91 text

ఆٛྫ { "UserName": "foo", "Tags": {}, "PermissionBoundary": "arn:aws:iam::012345678901:policy/OurPermissionsBoundary", "InlinePolicies": { "Bar": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket" }, { "Effect": "Allow", "Action": [ "s3:GetObject",

Slide 92

Slide 92 text

"Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:ap-northeast-1:012345678901:foo-bucket/*" } ] } }, "AttachedPolicies": [] } ఆٛྫ

Slide 93

Slide 93 text

13ྫ

Slide 94

Slide 94 text

ӡ༻ͨͦ͠ͷޙ

Slide 95

Slide 95 text

تͼͷ੠ w ʮ*".पΓΛ୲౰ऀʹґཔ͢Δඞཁ͕ͳ͘ͳָͬͯʹͳͬͨʯ w ʮศརʯ w ͕ͬͭΓ࢖ΘΕ͍ͯ·͢

Slide 96

Slide 96 text

ى͖ͨτϥϒϧ

Slide 97

Slide 97 text

τϥϒϧ w *"."1*ͷো֐Ͱಉظ͕ࢭ·Δ w ଘࡏ͠ͳ͍"DUJPOΛࢦఆͯ͠ಉظΤϥʔ w ଘࡏ͠ͳ͍ϢʔβʔΛ"TTVNF3PMF1PMJDZͰ৴པ͠Α͏ͱͯ͠ಉظ Τϥʔ w 1FSNJTTJPOT#PVOEBSZͰڐՄ͍ͯ͠ͳ͍΋ͷΛ௥Ճͯ͠ϋϚΔ ͍ͣΕ΋मਖ਼΍ϦτϥΠͰղܾࡁ

Slide 98

Slide 98 text

ΊͰͨ͠

Slide 99

Slide 99 text

·ͱΊ

Slide 100

Slide 100 text

·ͱΊ w *".؅ཧ͸೉͍͠ w ϕετϓϥΫςΟε͸͋Δ͕࣮ફʹ͸࿑ྗతͳ՝୊͕ଟ͍ w 1FSNJTTJPOT#PVOEBSZΛ͏·͘࢖͏ͱղܾͰ͖Δ w *".؅ཧϊ΢ϋ΢͸૊৫ʹ஝ੵ͢Δ࢓૊ΈΛ࡞Δͱ٢ w (JUIVCͰ1VMM3FRVFTUϕʔεͰ*".ϦιʔεΛ؅ཧ͢Δಓ΋͋Δ w ϦεΫ͕ड͚ೖΕΒΕͦ͏ͳΒݕ౼ͷՁ஋ΞϦ

Slide 101

Slide 101 text

͋Γ͕ͱ͏͍͟͝·ͨ͠ ࣭ٙԠ౴:PVUVCFίϝϯτཝʹͯ