AWS Config의 멀티 어카운트 적용 (feat. Terraform)

Transcript

1. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS Test & Go ੉ਊ ࢎ۹ AWS Con fi g੄ ݣ౭য஠਍౟ ੸ਊ PoC (feat. Terraform) ߅ ߽૓ (Byungjin Park) · ௿۽٘ (Claud) · Site Reliability Engineer @ ׼Ӕಕ੉ AWS Test & Go ೐۽Ӓ۔ ࣗѐ ਝ࠺ա Mar 18, 2022
2. speaker ߊ಴੗ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. ߅߽૓ / @posquit0 / ௿۽٘ (Claud) (അ) Site Reliability Engineer @ ׼Ӕಕ੉ (੹) Director of Infrastructure Division @ ஠ࢎ௏ܻই (੹) Software Architect @ ১פযझ 
 (੹) Co-founder & Software Engineer @ ஠೒ۖ Ҵઁ೧ఊ؀ഥ DEFCON CTF ࠄࢶ 6ഥ ૓୹ ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ ਍৔ AWS Community Builder ೠҴ੄ য়೑ࣗझ ઺ GitHub 10,000ѐ ੉࢚੄ झఋܳ ߉਷ ೐۽ં౟
3. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. intro
4. intro Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. Test & Go ೐۽Ӓ۔ न୒ AWS ӂഌ޷ ݒפ੷ש੄ ೐۽Ӓ۔ ࣗѐ ੹੗Әਲ਼ ࠁউ ੉ग۽ AWS੄ ৈ۞ ࠁউ ࢲ࠺झܳ పझ౟ೞ؍ दӝ AWS੄ ࠁউ ࢲ࠺झੋ Guard Duty / Con fi g / CloudTrail / Inspector / Security Hub ী ؀ೞৈ పझ౟ ௼ۨ٪ न୒
5. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. concept
6. concept Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS Con fi g Record and evaluate con fi gurations of your AWS resources AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸ - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸ - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ
7. concept Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS Con fi g AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸ - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸ - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ Record and evaluate con fi gurations of your AWS resources
8. concept Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS Con fi g ҳࢿਃࣗ (1) AWS Con fi g Recorder Aggregator S3 Bucket SNS Topic / EventBridge അ੤ ҅੿ ܻࣗझ ӝ۾ Account Aggregator Organization Aggregator ׮ܲ ҅੿ ܻࣗझ ӝ۾ ࠂࢎ ܻࣗझ ҳࢿ ӝ۾ ܻࣗझ ߸҃ࢎ೦ ঌۈ
9. concept Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS Con fi g ҳࢿਃࣗ (2) AWS Con fi g Rule AWS Managed Rule Custom Rule AWS Managed 
 Lambda Function AWS ҙܻ ӏ஗ User De fi ned 
 Lambda Function Remediation AWS Con fi g Rule . 
 . Conformance Pack ࢎਊ੗ ੿੄ ӏ஗
10. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. problem solving
11. problem solving Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. పۄಬ ݽٕ ߂ ௏٘ ੘ࢿ https://github.com/tedilabs/terraform-aws-security con fi g-recorder AWS Con fi g੄ Recorder / Aggregator ా೤ ҙܻ S3 ߡఉ / SNS ష೗ী ؀ೠ ؘ੉ఠ ੹׳ ࢸ੿ ҙܻ con fi g-managed-rule AWS Con fi g੄ ҙܻഋ ӏ஗ ҙܻ ҅੿ ױਤ / ઑ૒ ױਤ ࢸ੿ оמ ҙܻഋ ӏ஗ী ؀ೠ झః݃ ઁҕ
12. problem solving Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. ݣ౭ য஠਍౟ AWS Con fi g ੸ਊ AWS Organization ઑ૒ ղ - п য஠਍౟ী Con fi g Recorder ز੘ - ࠁউ ҅੿ী Organization Aggregator ز੘ - ׮ܲ য஠਍౟੄ AWS ܻࣗझ ҳࢿ ӝ۾ ࠂઁ - ࠁউ ҅੿ীࢲ Organization ۨ߰ AWS ҙܻഋ ӏ஗ ࢸ੿ पઁ పۄಬ ௏٘ী ॳ੉ח ؘ੉ఠ
13. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. summary
14. summary Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. AWS ܻࣗझ ఋ੐ۄੋ ࠭ ഛࠁ
15. summary Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. Organization ۨ߰ AWS Con fi g ੸ਊ
16. summary Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. Organization ۨ߰ AWS ҙܻഋ ӏ஗ ੸ਊ
17. summary Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. ؊ ݆਷ ղਊ੉ ҾӘೞद׮ݶ? ׼Ӕ SRE ޿স 1ഥ: AWS Con fi g۽ द੘ೞח ஹ೒ۄ੉঱झ ӝ߈ ܻࣗझ ҙܻ 
 (׼Ӕ݃௄ SRE౱, ઑ଻ো)
18. summary ࣁ ઴ ਃড Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. పۄಬ ݽٕਸ ా೧ AWS Con fi gܳ ࣚ औѱ ҙܻೡ ࣻ ੓঻যਃ. AWS Con fi g ҙܻഋ ӏ஗ਵ۽ب ୽࠙൤ ઑ૒ ղ ݆਷ ஹ೒ۄ੉঱झ ળࣻ ৈࠗܳ ୶੸ೡ ࣻ ੓যਃ. AWS Con fi gо ઁҕೞח AWS ܻࣗझ ఋ੐ۄੋ ࠭ח ੢গ ਗੋ ୶੸ী ബਯ੸੉ীਃ. ݃૑݄ਵ۽…
19. ࣻಣ੸ੋ ࣗా — ૒ә X / ৔য੉ܴ / न܉৬ ୽ج / ైݺೠ ੿ࠁ ҕਬ ੗ਯҗ ଼੐ — מز੸ সޖ ࣻ೯ / ੗ਯ੸ ౸ױ ૌѩѱ ࢿ੢ — աࠁ׮ ڪযդ زܐ / ౱ ਕ௼ / ૌѢ਑ ࢎਊ੗ ઺ब ࢎҊ — ࢎਊ੗ о஖ ୭਋ࢶ / ࢎਊ੗৬ ੿ࢲ੸ োѾ recruiting SRE ౱ীࢲ ଻ਊ઺੉ীਃ! 👋 Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. ੗ࣁೠ ղਊ਷ daangn.teamਸ ߑޙ೧઱ࣁਃ! :) ਋ܻח ੉ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ૑ ੗ਬ۽਍ ോо / ਬো ୹ృӔ ߂ ੤ఖӔޖ / धࢎ ߂ ׮নೠ рध ઁҕ झగ٬ ؘझ௼৬ ೲݢ޻۞ ੄੗ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ૑ਗ
20. Byungjin Park · posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!