AWS Config의 멀티 어카운트 적용 (feat. Terraform)

Transcript

1. Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   AWS Test & Go ੉ਊ ࢎ۹
   
   
   AWS Con
   fi
   g੄ ݣ౭য஠਍౟ ੸ਊ PoC (feat. Terraform)
   ߅ ߽૓ (Byungjin Park) · ௿۽٘ (Claud) · Site Reliability Engineer @ ׼Ӕಕ੉
   AWS Test & Go ೐۽Ӓ۔ ࣗѐ ਝ࠺ա
   Mar 18, 2022
   

   View Slide

2. speaker
   ߊ಴੗ ࣗѐ
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   ߅߽૓ / @posquit0 / ௿۽٘ (Claud)
   (അ) Site Reliability Engineer @ ׼Ӕಕ੉
   
   
   (੹) Director of Infrastructure Division @ ஠ࢎ௏ܻই
   
   
   (੹) Software Architect @ ১פযझ
   

   (੹) Co-founder & Software Engineer @ ஠೒ۖ
   Ҵઁ೧ఊ؀ഥ DEFCON CTF ࠄࢶ 6ഥ ૓୹
   
   
   ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ ਍৔
   
   
   AWS Community Builder
   
   
   ೠҴ੄ য়೑ࣗझ ઺ GitHub 10,000ѐ ੉࢚੄ झఋܳ ߉਷ ೐۽ં౟
   

   View Slide

3. Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   intro
   

   View Slide

4. intro
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   Test & Go ೐۽Ӓ۔ न୒
   AWS ӂഌ޷ ݒפ੷ש੄ ೐۽Ӓ۔ ࣗѐ
   ੹੗Әਲ਼ ࠁউ ੉ग۽ AWS੄ ৈ۞ ࠁউ ࢲ࠺झܳ పझ౟ೞ؍ दӝ
   AWS੄ ࠁউ ࢲ࠺झੋ Guard Duty / Con
   fi
   g / CloudTrail / Inspector / Security Hub ী ؀ೞৈ పझ౟ ௼ۨ٪ न୒
   

   View Slide

5. Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   concept
   

   View Slide

6. concept
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   AWS Con
   fi
   g
   Record and evaluate con
   fi
   gurations of your AWS resources
   AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ
   
   
   - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸
   
   
   - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸
   
   
   - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ
   
   
   - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ
   

   View Slide

7. concept
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   AWS Con
   fi
   g
   AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ
   
   
   - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸
   
   
   - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸
   
   
   - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ
   
   
   - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ
   Record and evaluate con
   fi
   gurations of your AWS resources
   

   View Slide

8. concept
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   AWS Con
   fi
   g ҳࢿਃࣗ (1)
   AWS Con
   fi
   g
   Recorder
   Aggregator
   S3 Bucket
   SNS Topic / EventBridge
   അ੤ ҅੿ ܻࣗझ ӝ۾
   Account Aggregator
   Organization Aggregator
   ׮ܲ ҅੿ ܻࣗझ ӝ۾ ࠂࢎ
   ܻࣗझ ҳࢿ ӝ۾
   ܻࣗझ ߸҃ࢎ೦ ঌۈ
   

   View Slide

9. concept
   Byungjin Park · posquit0.com · posquit0
   Copyright © 2022 All Rights Reserved.
   AWS Con
   fi
   g ҳࢿਃࣗ (2)
   AWS Con
   fi
   g Rule
   AWS Managed Rule
   Custom Rule
   AWS Managed
   

   Lambda Function
   AWS ҙܻ ӏ஗
   User De
   fi
   ned
   

   Lambda Function
   Remediation
   AWS Con
   fi
   g Rule
   .
   

   .
   Conformance
   Pack
   ࢎਊ੗ ੿੄ ӏ஗
   

   View Slide

10. Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    problem solving
    

    View Slide

11. problem solving
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ ߂ ௏٘ ੘ࢿ
    https://github.com/tedilabs/terraform-aws-security
    con
    fi
    g-recorder
    AWS Con
    fi
    g੄ Recorder / Aggregator ా೤ ҙܻ
    
    
    S3 ߡఉ / SNS ష೗ী ؀ೠ ؘ੉ఠ ੹׳ ࢸ੿ ҙܻ
    con
    fi
    g-managed-rule
    AWS Con
    fi
    g੄ ҙܻഋ ӏ஗ ҙܻ
    
    
    ҅੿ ױਤ / ઑ૒ ױਤ ࢸ੿ оמ
    
    
    ҙܻഋ ӏ஗ী ؀ೠ झః݃ ઁҕ
    

    View Slide

12. problem solving
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ݣ౭ য஠਍౟ AWS Con
    fi
    g ੸ਊ
    AWS Organization ઑ૒ ղ
    
    
    - п য஠਍౟ী Con
    fi
    g Recorder ز੘
    
    
    - ࠁউ ҅੿ী Organization Aggregator ز੘
    
    
    - ׮ܲ য஠਍౟੄ AWS ܻࣗझ ҳࢿ ӝ۾ ࠂઁ
    
    
    - ࠁউ ҅੿ীࢲ Organization ۨ߰ AWS ҙܻഋ ӏ஗ ࢸ੿
    पઁ పۄಬ ௏٘ী ॳ੉ח ؘ੉ఠ
    

    View Slide

13. Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    summary
    

    View Slide

14. summary
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS ܻࣗझ ఋ੐ۄੋ ࠭ ഛࠁ
    

    View Slide

15. summary
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Organization ۨ߰ AWS Con
    fi
    g ੸ਊ
    

    View Slide

16. summary
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Organization ۨ߰ AWS ҙܻഋ ӏ஗ ੸ਊ
    

    View Slide

17. summary
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ؊ ݆਷ ղਊ੉ ҾӘೞद׮ݶ?
    ׼Ӕ SRE ޿স 1ഥ: AWS Con
    fi
    g۽ द੘ೞח ஹ೒ۄ੉঱झ ӝ߈ ܻࣗझ ҙܻ
    

    (׼Ӕ݃௄ SRE౱, ઑ଻ো)
    

    View Slide

18. summary
    ࣁ ઴ ਃড
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕਸ ా೧ AWS Con
    fi
    gܳ ࣚ औѱ ҙܻೡ ࣻ ੓঻যਃ.
    AWS Con
    fi
    g ҙܻഋ ӏ஗ਵ۽ب ୽࠙൤ ઑ૒ ղ ݆਷ ஹ೒ۄ੉঱झ ળࣻ ৈࠗܳ ୶੸ೡ ࣻ ੓যਃ.
    AWS Con
    fi
    gо ઁҕೞח AWS ܻࣗझ ఋ੐ۄੋ ࠭ח ੢গ ਗੋ ୶੸ী ബਯ੸੉ীਃ.
    ݃૑݄ਵ۽…
    

    View Slide

19. ࣻಣ੸ੋ ࣗా — ૒ә X / ৔য੉ܴ / न܉৬ ୽ج / ైݺೠ ੿ࠁ ҕਬ
    
    
    ੗ਯҗ ଼੐ — מز੸ সޖ ࣻ೯ / ੗ਯ੸ ౸ױ
    
    
    ૌѩѱ ࢿ੢ — աࠁ׮ ڪযդ زܐ / ౱ ਕ௼ / ૌѢ਑
    
    
    ࢎਊ੗ ઺ब ࢎҊ — ࢎਊ੗ о஖ ୭਋ࢶ / ࢎਊ੗৬ ੿ࢲ੸ োѾ
    recruiting
    SRE ౱ীࢲ ଻ਊ઺੉ীਃ! 👋
    Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ੗ࣁೠ ղਊ਷ daangn.teamਸ ߑޙ೧઱ࣁਃ! :)
    ਋ܻח ੉ۧѱ ੌ೧ਃ
    ഌఖ ߂ ࠂ૑
    ੗ਬ۽਍ ോо / ਬো ୹ృӔ ߂ ੤ఖӔޖ / धࢎ ߂ ׮নೠ рध ઁҕ
    
    
    झగ٬ ؘझ௼৬ ೲݢ޻۞ ੄੗ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ૑ਗ
    

    View Slide

20. Byungjin Park · posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    End of Document
    Visit my AMA (https://github.com/posquit0/ama) for any question!
    

    View Slide