セキュリティインシデントを乗り越えるために行ったマルチアカウントでの取り組みについて / AWS multi-account approach in Classi

Slide 1

Slide 1 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ୈೋճ"84ϚϧνΞΧ΢ϯτࣄྫࡇΓ ηΩϡϦςΟΠϯγσϯτΛ৐Γӽ͑ΔͨΊʹߦͬͨ ϚϧνΞΧ΢ϯτͰͷऔΓ૊Έʹ͍ͭͯ $MBTTJ$PSQ,FOSZP0NJOBNJ

Slide 2

Slide 2 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE $ whoami • ,FOSZP0NJOBNJ !LFOSZPPP • ௚ۙ೥͘Β͍͸#$αʔϏεΛத৺ʹ%#"ɺαʔό αΠυΤϯδχΞɺ43&Λܦݧɻ • $MBTTJʹ43&ͱͯ͠δϣΠϯɻ • ͜͜਺೥͸ΠϯϑϥηΩϡϦςΟྖҬΛத৺ʹۀ຿Λ ߦ͍ͬͯΔɻ

Slide 3

Slide 3 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE About Classi ʮ$MBTTJʯ͸ڭҭݱ৔Λࢧԉ͢Δ Ϋϥ΢υαʔϏε • શࠃͷߴߍͷˋ௒͕ಋೖ • ߴߍੜͷਓʹਓ͕ར༻ • ར༻ऀ਺ສਓ௒ • ઌੜɺੜెɺอޢऀ͕ܨ͕Δ ֶशࢧԉϓϥοτϑΥʔϜ

Slide 4

Slide 4 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ࿩͞ͳ͍͜ͱ • ೥݄ɺ݄ͷߴෛՙʹΑΔΞΫηεো֐ঢ়ଶʹؔ͢ΔऔΓ૊Έʹ͍ͭͯ • ͪ͜Βʹ͍ͭͯ͸ԼهΛ͝ཡ͍ͩ͘͞ • $MBTTJ։ൃऀϒϩά IUUQTUFDIDMBTTJKQ • %FWFMPQFST4VNNJU

Slide 5

Slide 5 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE [PR] Developers Summit 2021 IUUQTFWFOUTIPFJTIBKQEFWTVNJTFTTJPO

Slide 6

Slide 6 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 7

Slide 7 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 8

Slide 8 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ηΩϡϦςΟΠϯγσϯτʹ͍ͭͯ 4VO 4BU ֎෦ͷ߈ܸऀ͔Βෆਖ਼ΞΫηεΛड͚αʔϏεఀࢭ αʔϏε͸਺࣌ؒޙʹ෮چͰ͖ͨ΋ͷͷϢʔβʔ৘ใྲྀग़ͷՄೳੑΛ֬ೝ ͢΂ͯͷϢʔβʔͷύεϫʔυมߋ͕׬ྃ ֎෦αΠτʹͯɺྲྀग़ͨ͠ݸਓ৘ใͷ࿙ӮΛ֬ೝ ΠϯϑϥɺΞϓϦέʔγϣϯͱ΋ʹൈຊతͳηΩϡϦςΟͷݟ௚͠Λ࣮ࢪ

Slide 9

Slide 9 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 10

Slide 10 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ઓུͱධՁ • શମͷઓུ • "848FMM"SDIJUFDUFE'SBNFXPSL4FDVSJUZ1JMMBS • "84ΞΧ΢ϯτ؅ཧͷઓུ • #FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOT • ηΩϡϦςΟධՁ • "84ϓϩϑΣογϣφϧαʔϏεͷηΩϡϦςΟධՁ

Slide 11

Slide 11 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 12

Slide 12 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Classi Organizations -Before- 0SHBOJ[BUJPOT 3PPU 1SPEVDUJPOΞΧ΢ϯτ ؅ཧΞΧ΢ϯτ "[VSF"% #BTUJPOΞΧ΢ϯτ ։ൃ༻ΞΧ΢ϯτ ࿈ܞαʔϏε༻ 1SPEVDUJPOΞΧ΢ϯτ 4XJUDI3PMF -PH*O

Slide 13

Slide 13 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ໰୊఺ • 064$1Λར༻͍ͯ͠ͳ͍ • 1SPEVDUJPOΞΧ΢ϯτ͕0SHBOJ[BUJPOͷ؅ཧΞΧ΢ϯτͱͯ͠ઃఆ • ࠷΋ݫີʹ؅ཧ͍ͨ͠͸ͣͷΞΧ΢ϯτ͕؅ཧͰ͖ͳ͍ • #BTUJPOΞΧ΢ϯτ͸ɺ։ൃऀ͕4BOECPY؀ڥͱͯ͠΋ར༻ • 1SPEVDUJPOΞΧ΢ϯτ΁ϩάΠϯ͢ΔݩͷΞΧ΢ϯτ͕ηΩϡΞͰ͸ͳ͍

Slide 14

Slide 14 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • ؅ཧΞΧ΢ϯτͷ੾Γସ͑ • ؅ཧΞΧ΢ϯτΛ৽ن࡞੒ • طଘΞΧ΢ϯτ͸چ૊৫Λ཭୤ɺ՝ۚपΓͷઃఆΛ௥Ճ͠৽૊৫΁Ҡಈ େมʜ • 0SHBOJ[BUJPOTಋೖ࣌͸৽نʹ؅ཧΞΧ΢ϯτΛ࡞Γ·͠ΐ͏ʂ • 06ઃܭͱ഑ஔ • ʮ#FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOTʯ

Slide 15

Slide 15 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Classi Organizations -After- 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06 *OGSB@06 .BJOUFOBODF@06 4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY #FTU1SBDUJDFTGPS0SHBOJ[BUJPOBM6OJUTXJUI"840SHBOJ[BUJPOT IUUQTBXTBNB[PODPNKQCMPHTNUCFTUQSBDUJDFTGPSPSHBOJ[BUJPOBMVOJUTXJUIBXTPSHBOJ[BUJPOT

Slide 16

Slide 16 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organiztional Units 06 ༻్ 'PVOEBUJPOBM@06 1SPE4%-$ͷϫʔΫϩʔυͱڞ௨ج൫Λ಺แ͢Δ06 8PSLMPBET@06 1SPE4%-$ͷϫʔΫϩʔυΛ಺แ͢Δ06 1SPE@06 ຊ൪ΞΧ΢ϯτͷΈΛ಺แ͢Δ06 4%-$@06 4UBHJOH΍%FWɺ4BOECPYͳͲΛ಺แ͢Δ06 *OGSB@06 ڞ௨ج൫ ϩάू໿ΞΧ΢ϯτ΍ηΩϡϦςΟ؂ࠪΞΧ΢ϯτ Λ಺แ͢Δ06 1PMJDZ4UBHJOH@06 ૊৫ߏ଄ͷมߋ΍4$1ͷมߋͳͲͷݕূͰར༻͢Δ06 .BJOUFOBODF@06 ؂ࠪܥػೳͷϝϯςφϯεͳͲɺҰ࣌తʹ4$1Λҳ୤͢Δ࡞ۀΛߦ͏৔߹ʹར༻͢Δ06 4VTQFOEFE@06 ഇغ༧ఆͷ"84ΞΧ΢ϯτΛ಺แ͢Δ06

Slide 17

Slide 17 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 18

Slide 18 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE IDͱΞΫηε؅ཧ -Before- 0SHBOJ[BUJPOT 3PPU 1SPEVDUJPOΞΧ΢ϯτ ؅ཧΞΧ΢ϯτ "[VSF"% #BTUJPOΞΧ΢ϯτ ։ൃ༻ΞΧ΢ϯτ ࿈ܞαʔϏε༻ 1SPEVDUJPOΞΧ΢ϯτ 4XJUDI3PMF -PH*O Ϛωδϝϯτίϯιʔϧར༻ ֤"84ΞΧ΢ϯτͰݸผʹΞΫηεΩʔΛൃߦ

Slide 19

Slide 19 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE IDͱΞΫηε؅ཧ -Before- • ։ൃऀ޲͚ʹҎԼͷ௨ΓͰΞΫηεํ๏Λఏڙ • ϚωδϝϯτίϯιʔϧͰͷར༻ • ϩάΠϯํ๏(4VJUFͱ4".-࿈ܞ • #BTUJPOΞΧ΢ϯτΛܦͯɺ࡞ۀ͍ͨ͠ΞΧ΢ϯτʹ4XJUDI3PMF͢Δ • ϓϩάϥϜΞΫηεͰͷར༻ • ֤"84ΞΧ΢ϯτͰݸผʹΞΫηεΩʔΛൃߦ

Slide 20

Slide 20 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ໰୊఺ • 3PMFͱΞΫηεΩʔͷ؅ཧ • ผʑʹ؅ཧΛߦ͏ඞཁ͕͋Γ൥ࡶ • ΞΫηεΩʔ؅ཧ • ӬଓతͳΞΫηεΩʔͷ؅ཧ͕ར༻ऀ೚ͤ • 4XJUDI3PMFͷηΩϡϦςΟ • աڈɺεΠονઌ3PMFͷ1SJODJQBMઃఆϛεʹΑΓ૝ఆͯ͠ͳ͍ݖݶͰೖΓ์୊ʹ ͳ͍ͬͯͨ͜ͱ͕͋ͬͨ

Slide 21

Slide 21 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • ϩʔΧϧϚγϯͷରࡦ • BXTMBCTHJUTFDSFUTಋೖ • ΞΫηεΩʔͳͲͷػີ৘ใͷ(JUϦϙδτϦ΁ͷίϛοτΛ๷͙

Slide 22

Slide 22 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ΍ͬͨ͜ͱ • "84ଆͷରࡦ • "84440΁ͷҠߦ • ݄ʹ5PLZP3FHJPOͰϩʔϯνͨ͠λΠϛϯάͰҠߦ • "[VSF"%ͱ௚઀࿈ܞ͢Δ͜ͱͰΞΧ΢ϯτ؅ཧ͕γϯϓϧʹ • ΞΫηεΩʔͷ؅ཧ΋ෆཁʹ ˞4BB4޲͚ͷ΋ͷ͸আ͘

Slide 23

Slide 23 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06 *OGSB@06 .BJOUFOBODF@06 4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY "[VSF"% Ϛωδϝϯτίϯιʔϧ ΞΫηεΩʔ "844JOHMF4JHO0O ֤ΞΧ΢ϯτ΁ϩάΠϯ

Slide 24

Slide 24 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO Ҡߦ࣌ͷτϥϒϧ • ࣄ৅ • 4XJUDI3PMF࣌୅ͷ؅ཧऀ༻3PMFΛ࡟আͨ͠ͱ͜ΖɺαʔϏεͰར༻͍ͯ͠ Δ$.,͕ӾཡɺมߋෆՄೳʹͳͬͯ͠·ͬͨ • "ENJOJTUSBUPSݖݶϢʔβʔͰ΋SPPUͰ΋Ͳ͏ʹ΋Ͱ͖ͳ͍ • ݪҼ • ࡟আͨ͠؅ཧऀ3PMFͷΈ͕ΩʔϙϦγʔͱͯ͠ࢦఆ͞Ε͍ͯͨͨΊɺ࡟আ͠ ͨ࣌఺Ͱ؅ཧऀෆࡏͷΩʔʹͳΔ

Slide 25

Slide 25 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE AWS SSO Ҡߦ࣌ͷτϥϒϧ • ରԠ • "84ͷαϙʔτ΁໰͍߹ΘͤɺҰ࣌తͳϢʔβʔΛ࡞੒ɺ1VU,FZ1PMJDZݖݶ Λ෇༩ͯ͠΋Β͍ݩͷΩʔϙϦγʔΛ෮׆ͤ͞Δ͜ͱͰ෮چͨ͠ • ͨͩ͠ɺ࡞ۀλΠϛϯάͳͲίϯτϩʔϧͰ͖ͳ͍ཁૉ΋͋ΔͷͰɺΩʔϙϦ γʔͷ؅ཧऀͱͯ͠ෳ਺ͷ6TFS΋͘͠͸3PMFΛ෇༩͓ͯ͘͠ͷ͕Φεεϝ

Slide 26

Slide 26 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 27

Slide 27 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ༧๷తΨʔυϨʔϧ • 4$1ͷྫ • ෆ࢖༻Ϧʔδϣϯͷ੍ݶ • ؂ࠪܥૢ࡞ͷ੍ݶ • ؀ڥಛ༗ͷ੍ݶ ॏཁૢ࡞ͳͲ • શૢ࡞ͷېࢭ • FUD

Slide 28

Slide 28 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organizational Units and SCP 06 ༻్ 4$1 'PVOEBUJPOBM@06 1SPE4%-$ͷϫʔΫϩʔυͱڞ௨ج൫Λ಺แ͢Δ06 Ϧʔδϣϯ੍ݶɺ؂ࠪܥૢ࡞ͷ੍ݶ 8PSLMPBET@06 1SPE4%-$ͷϫʔΫϩʔυΛ಺แ͢Δ06 ։ൃऀ޲͚ͷ੍ݶ 1SPE@06 ຊ൪ΞΧ΢ϯτͷΈΛ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ 4%-$@06 4UBHJOH΍%FWɺ4BOECPYͳͲΛ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ *OGSB@06 ڞ௨ج൫ ϩάू໿ΞΧ΢ϯτ΍ηΩϡϦςΟ؂ࠪΞΧ΢ϯτ Λ಺แ͢Δ06 ؀ڥಛ༗ͷ੍ݶ 1PMJDZ4UBHJOH@06 ૊৫ߏ଄ͷมߋ΍4$1ͷมߋͳͲͷݕূͰར༻͢Δ06 ݕূ಺༰ʹΑͬͯ౎౓มߋ .BJOUFOBODF@06 ؂ࠪܥػೳͷϝϯςφϯεͳͲɺҰ࣌తʹ4$1Λҳ୤͢Δ࡞ۀΛߦ͏৔߹ʹར༻͢Δ06 ϝϯς಺༰ʹΑͬͯ౎౓มߋ 4VTQFOEFE@06 ഇغ༧ఆͷ"84ΞΧ΢ϯτΛ಺แ͢Δ06 શૢ࡞Λېࢭ

Slide 29

Slide 29 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Organizational Units and SCP 0SHBOJ[BUJPOT 'PVOEBUJPOBM@06 8PSLMPBET@06 1SPE@06 4%-$@06 *OGSB@06 .BJOUFOBODF@06 4VTQFOEFE@06 3PPU ϚελʔΞΧ΢ϯτ ܭըϝϯςφϯε༻ ഇغ༧ఆ 1PMJDZ4UBHJOH@06 ηΩϡϦςΟ ϙϦγʔมߋ༻ ֤छϩά 1SPEVDUJPO 4UBHJOH 4BOECPY Ϧʔδϣϯ੍ݶ ؂ࠪܥૢ࡞ͷ੍ݶ ։ൃऀ޲͚ͷ੍ݶ 1SPEʹ͓͚Δ ॏཁૢ࡞ͷ੍ݶ ڞ௨ج൫ಛ༗ͷ੍ݶ ౎౓มߋ ౎౓มߋ શૢ࡞ͷېࢭ

Slide 30

Slide 30 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ൃݟతΨʔυϨʔϧ • $MPVE5SBJMΑΔಛఆૢ࡞ͷ؂ࢹ • $POpH • (VBSE%VUZ • 4FDVSJUZ)VC • 5SVTUFE"EWJTPS ݕ஌ͨ͠಺༰ͷϑΟϧλϦϯάʹؔͯ͠͸ɺνϡʔχϯάΛਐΊ͍ͯΔ

Slide 31

Slide 31 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ൃݟతΨʔυϨʔϧ αʔϏε໊ 0SHBOJ[BUJPOTରԠ ϝϯόʔ΁ͷҕ೚ ϝϯόʔͷࣗಈ༗ޮԽ ิ଍ $POpH ˓ ˓ ✕ $MPVE'PSNBUJPO4UBDL4FUTΛར༻ͯ͠ɺ ϝϯόʔΞΧ΢ϯτͷ༗ޮԽΛࣗಈͰ࣮ࢪ (VBSE%VUZ ˓ ˓ ˓ 4FDVSJUZ)VC ˓ ˓ ˓ ·ͨɺൃݟతΨʔυϨʔϧͰར༻͢ΔҎԼͷαʔϏεʹؔͯ͠ɺ $POpH͚ͩ͸ࣗಈ༗ޮԽ͕Ͱ͖ͳ͔ͬͨͨΊ$'O4UBDL4FUTΛར༻͍ͯ͠Δ ૣ͘0SHBOJ[BUJPOTͱͷεϜʔζͳ౷߹͕࣮ݱͯ͠΄͍͠

Slide 32

Slide 32 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE Agenda • ηΩϡϦςΟΠϯγσϯτ • ઓུͱධՁ • "84ΞΧ΢ϯτ؅ཧ • *%ͱΞΫηε؅ཧ • ΨʔυϨʔϧ • ࠓޙ

Slide 33

Slide 33 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ࠓޙ • ൃݟతΨʔυϨʔϧͷνϡʔχϯά • $POpH3VMFTͷνϡʔχϯά • (VBSE%VUZ4FDVSJUZ)VCͷݕ஌಺༰ͷਫ਼ࠪ • ϩΪϯάͱϞχλϦϯάͷڧԽ • 4*&.ͷಋೖ 4*&.PO"NB[PO&4Λݕ౼த • ΠϯγσϯτϨεϙϯεͷڧԽ • )BSEFOJOHΠϕϯτ΁ͷࢀՃɺݚम

Slide 34

Slide 34 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ·ͱΊ • ΠϯγσϯτҎ߱ɺϚϧνΞΧ΢ϯτߏ੒Λ׆͔ͨ͠ܗͰରࡦΛ͢͢Ί͖ͯͨ • "84440Λར༻͢Δ͜ͱͰΞΧ΢ϯτ؅ཧίετ͕Լ͕ΓηΩϡΞʹͳͬͨ • ༧๷తɺൃݟతΨʔυϨʔϧͷಋೖͰΑΓηΩϡΞʹͳͬͨ ϚϧνΞΧ΢ϯτΛಋೖͯ͠ηΩϡΞͳ؀ڥΛखʹೖΕΑ͏

Slide 35

Slide 35 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ʘɹ8F"SF)JSJOHɹʗ IUUQTDPSQDMBTTJKQDBSFFST

Slide 36

Slide 36 text

$PQZSJHIU$MBTTJ$PSQ"MMSJHIUTSFTFSWFE ͓ΘΓ