AWS Lambdaにおけるセキュリティリスクと対策

ɹ"84-BNCEBʹ͓͚Δ ɹɹɹɹɹɹηΩϡϦςΟϦεΫͱରࡦ גࣜձࣾ'MBUU4FDVSJUZ ৿Ԭ༏ଠ:VUB.PSJPLB !TDHBKHF 4FDVSJUZ+"844FTTJPO

◦ ࢯ໊ ◦ ৿Ԭ༏ଠ:VUB.PSJPLB ◦ 4/4 ◦ NPSJPLB !TDHBKHF
◦ ॴଐ ◦ גࣜձࣾ'MBUU4FDVSJUZ ◦ ϓϩϑΣογϣφϧαʔϏεࣄۀ෦ ◦ ৘ใՊֶઐ໳ֶߍ ◦ ৘ใηΩϡϦςΟֶՊ ࣗݾ঺հ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF

גࣜձࣾ'MBUU4FDVSJUZͷ঺հ ։ൃऀͷͨΊͷ࣍ੈ୅ηΩϡϦςΟαʔϏεΛಧ͚ ੈքதͷϓϩμΫτ։ൃΛՃ଎͢Δ ηΩϡϦςΟ਍அɺηΩϡΞίʔσΟϯάڭҭɺαϓϥΠνΣʔ ϯηΩϡϦςΟͱ͍ͬͨྖҬͰɺಛʹΠϯϋ΢εͷ։ൃऀͷ ՝୊Λղܾ͢ΔΑ͏ͳαʔϏεΛఏڙ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF

גࣜձࣾ'MBUU4FDVSJUZͷ঺հ ϓϩϑΣογϣφϧ αʔϏεࣄۀ෦ ηΩϡϦςΟ਍அ 8FC .PCJMF *P5͔Β"84 ($1
"[VSF 'JSFCBTFͱ͍ͬͨ$MPVE؀ ڥ·Ͱ෯޿͘੬ऑੑ͕ͳ͍͔ௐࠪ ࣮ࡍʹ߈ܸ΍ίʔυͷमਖ਼Λߦ͏ԋ शʹΑΓɺ8FCΞϓϦέʔγϣϯͷ ηΩϡΞίʔσΟϯάΛֶͿ IUUQTGMBUUUFDIBTTFTTNFOUEFUBJM IUUQTGMBUUUFDILFOSP ιϑτ΢ΣΞαϓϥΠνΣʔϯʹؔ ࿈͢ΔηΩϡϦςΟ্ͷ໰୊ൃݟ͔ Βमਖ਼·ͰΛɺ൒ࣗಈతʹαϙʔτ ͢ΔηΩϡϦςΟϓϥοτϑΥʔϜ IUUQTTIJTIPEFWKQ ηΩϡϦςΟ ϓϩμΫτࣄۀ෦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF

ࠓճͷ಺༰

ࠓճͷ಺༰ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF IUUQTCMPHGMBUUUFDIFOUSZMBNCEB@BOE@TFSWFSMFTT@TFDVSJUZ IUUQTCMPHGMBUUUFDIFOUSZMBNCEB@MJCSBSZ@TFDVSJUZ

1.αʔόʔϨεͷηΩϡϦςΟϦεΫ 2."84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ 3."84-BNCEBͷηΩϡϦςΟϦεΫ 4."84-BNCEBͷηΩϡϦςΟରࡦ 5.·ͱΊ ֓ཁ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF

αʔόʔϨεͷηΩϡϦςΟϦεΫ

αʔόʔϨε 4FSWFSMFTT ͷఆٛ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF 1. 'BB4 'VODUJPOBTB4FSWJDF 1.
ؔ਺୯ҐͰσϓϩΠ΍࣮ߦ͕Ͱ͖ΔαʔϏε 1. "84-BNCEB (PPHMF$MPVE'VODUJPOT "[VSF'VODUJPOT 2. #BB4 #BDLFOEBTB4FSWJDF 1. ೝূ΍%#ͳͲͷΞϓϦέʔγϣϯ͕ඞཁͱ͢Δػೳ͕"1*Λ௨ͯ͡ར ༻Ͱ͖ΔαʔϏε 1. "NB[PO$PHOJUP 'JSFCBTF "VUI 2. "NB[PO%ZOBNP%# (PPHMF#JH2VFSZ "[VSF$PTNPT%# $/$' $MPVE/BUJWF$PNQVUJOH'PVOEBUJPO ʹΑΔఆٛ $/$'4FSWFSMFTT8IJUFQBQFSWIUUQTHJUIVCDPNDODGXHTFSWFSMFTTUSFFNBTUFSXIJUFQBQFSTTFSWFSMFTTPWFSWJFX

ηΩϡϦςΟϦεΫͷछྨ 4FSWFSMFTT TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF αʔόʔϨεͷओͳηΩϡϦςΟϦεΫ ◦ ར༻͢ΔαʔϏεͷઃఆෆඋʹΑΔϦεΫ ◦ ઃఆෆඋʹΑΔ௚઀తͳ߈ܸ ◦
ઃఆෆඋʹΑΔؒ઀తͳ߈ܸ ◦ ΞϓϦέʔγϣϯͷ੬ऑੑʹΑΔϦεΫ ◦ ։ൃͨ͠ΞϓϦέʔγϣϯ΁ͷ߈ܸ ◦ ར༻͢ΔϥΠϒϥϦ΁ͷ߈ܸ

08"414FSWFSMFTT5PQ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF αʔόʔϨεΞϓϦέʔγϣϯؚ͕Έ͏ΔॏେͳηΩϡϦςΟϦεΫ5PQ ΠϯδΣΫγϣϯ *OKFDUJPO ೝূͷෆඋ ػີσʔλͷެ։ 9.-֎෦ΤϯςΟςΟ
99& ΞΫηε੍ޚͷෆඋ ηΩϡϦςΟͷઃఆϛε $SPTT4JUF4DSJQUJOH 944 ҆શͰͳ͍σγϦΞϥΠθʔγϣϯ ʢ*OTFDVSF%FTFSJBMJ[BUJPOʣ ط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯτͷ ࢖༻ ෆे෼ͳϩΪϯάͱϞχλϦϯά 08"414FSWFSMFTT5PQIUUQTHJUIVCDPN08"414FSWFSMFTT5PQ1SPKFDU

$4" $MPVE4FDVSJUZ"MMJBODF TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF αʔόʔϨεΞϓϦέʔγϣϯͷ࠷΋ॏେͳͷϦεΫ IUUQTDMPVETFDVSJUZBMMJBODFPSHCMPHDSJUJDBMSJTLTTFSWFSMFTTBQQMJDBUJPOT ؔ਺ΠϕϯτɾσʔλΠϯδΣΫγϣϯ ೝূͷෆඋ ηΩϡΞͰͳ͍αʔόʔϨεɾσϓϩ Πͷߏ੒
ؔ਺΁ͷաܹͳݖݶͱ໾ׂͷ෇༩ ෆద੾ͳػೳͷϞχλϦϯάͱϩΪϯ ά ηΩϡΞͰ͸ͳ͍αʔυύʔςΟґଘ ηΩϡΞͰ͸ͳ͍ΞϓϦέʔγϣϯͷ ൿಗྖҬ αʔϏεڋ൱͓ΑͼϦιʔεͷރׇ αʔόʔϨεػೳ࣮ߦϑϩʔૢ࡞ ෆద੾ͳྫ֎ॲཧͱৄࡉͳΤϥʔϝο ηʔδ ഁյ͞Εͨؔ਺ ަ࣮ࠩߦσʔλͷӬଓੑ

ηΩϡϦςΟϦεΫͷछྨ 4FSWFSMFTT TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF αʔόʔϨεͷओͳηΩϡϦςΟϦεΫ 08"414FSWFSMFTT5PQ ར༻͢ΔαʔϏεͷઃఆෆඋ ◦ ೝূͷෆඋ ◦
ػີσʔλͷެ։ ◦ ΞΫηε੍ޚͷෆඋ ◦ ηΩϡϦςΟͷઃఆϛε ◦ ෆे෼ͳϩΪϯάͱϞχλϦϯά ΞϓϦέʔγϣϯͷ੬ऑੑ ◦ ΠϯδΣΫγϣϯ *OKFDUJPO ◦ 9.-֎෦ΤϯςΟςΟ 99& ◦ $SPTT4JUF4DSJQUJOH 944 ◦ ҆શͰͳ͍σγϦΞϥΠθʔγϣϯ ʢ*OTFDVSF%FTFSJBMJ[BUJPOʣ ◦ ط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯτͷ࢖ ༻

ػີσʔλͷެ։ ◦ ΞΫηε੍ޚͷෆඋ ◦ ηΩϡϦςΟͷઃఆϛε ◦ ෆे෼ͳϩΪϯάͱϞχλϦϯά ΞϓϦέʔγϣϯͷ੬ऑੑ ◦ ΠϯδΣΫγϣϯ *OKFDUJPO ◦ 9.-֎෦ΤϯςΟςΟ 99& ◦ $SPTT4JUF4DSJQUJOH 944 ◦ ҆શͰͳ͍σγϦΞϥΠθʔγϣϯ ʢ*OTFDVSF%FTFSJBMJ[BUJPOʣ ◦ ط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯτͷ࢖ ༻ ࠓճѻ͏ํ

ػີσʔλͷެ։ ◦ ΞΫηε੍ޚͷෆඋ ◦ ηΩϡϦςΟͷઃఆϛε ◦ ෆे෼ͳϩΪϯάͱϞχλϦϯά ΞϓϦέʔγϣϯͷ੬ऑੑ ◦ ΠϯδΣΫγϣϯ *OKFDUJPO ◦ 9.-֎෦ΤϯςΟςΟ 99& ◦ $SPTT4JUF4DSJQUJOH 944 ◦ ҆શͰͳ͍σγϦΞϥΠθʔγϣϯ ʢ*OTFDVSF%FTFSJBMJ[BUJPOʣ ◦ ط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯτͷ࢖ ༻ IUUQTCMPHGMBUUUFDIFOUSZDMPVE@TFDVSJUZ@BXT@DBTF

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ

"84-BNCEB TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ "84͕ఏڙ͢ΔΠϕϯτൃੜ࣌ʹίʔυ࣮ߦ͢ΔαʔϏε ◦ छྨͷϓϩάϥϛϯάݴޠʹରԠ͍ͯ͠Δ ◦ /PEFKT 1ZUIPO
+BWB 3VCZ $ (P 1PXFSTIFMM ◦ ར༻৔໘ྫ ◦ "1*(BUFXBZͱ࿈ܞͯ͠"1*ͱͯ͠׆༻͢Δ ◦ Ϣʔβʔ΍αʔόʔ͔ΒͷϦΫΤετʹԠͯ͡ॲཧ͢Δ ◦ 4ʹΦϒδΣΫτ͕Ξοϓϩʔυ͞ΕͨࡍʹΠϕϯτॲཧΛ͢Δ ◦ %ZOBNP%#ͷσʔλ͕ߋ৽͞ΕͨࡍʹΠϕϯτॲཧΛ͢Δ "84-BNCEB

"84-BNCEB TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ 8FCΞϓϦέʔγϣϯ͔ΒϑΝΠϧ΍ը૾͕Ξοϓϩʔυ͞Εɺ4όέοτʹ ֨ೲ͢Δ ◦ ֨ೲ͞ΕͨϑΝΠϧΛ-BNCEB͕ฤूɾղੳ͢Δ ◦ ֨ೲ͞Εͨը૾Λ-BNCEB͕ฤूɾՃ޻͢Δ
◦ 8FCΞϓϦέʔγϣϯ͔ΒͷϦΫΤετͰ-BNCEB͕ಛఆͷॲཧΛߦ͍ɺϨε ϙϯεΛฦ͢ ◦ ϦΫΤετʹؚ·ΕΔ৘ใΛ-BNCEB͕ղੳͯ͠ɺ%ZOBNP%#ʹ݁ՌΛอ ଘ͢Δ ◦ ϦΫΤετʹؚ·ΕΔ৘ใΛݩʹ-BNCEB͕ϑΝΠϧ 1%' ੜ੒͢Δ ࠓճ૝ఆ͢Δ-BNCEBͷ׆༻ྫ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ 04$PNNBOE*OKFDUJPOɿ$8& ◦ 9.-&YUFSOBM&OUJUZ 99& ɿ$8& ◦
*OTFDVSF%FTFSJBMJ[BUJPOɿ$8& ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ɿ$8& ◦ 3FNPUF$PEF&YFDVUJPO 3$& ɿ$8&FUD -BNCEBͷίʔυ΍Ϟδϡʔϧʹؚ·ΕΔϥΠϒϥϦ͕੬ऑͳ৔߹

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF -BNCEBͷίʔυ΍Ϟδϡʔϧʹؚ·ΕΔϥΠϒϥϦ͕੬ऑͳ৔߹ ◦ 04$PNNBOE*OKFDUJPO ◦ 08"414FSWFSMFTT5PQɿҐ ◦ 08"415PQɿҐ
◦ 9.-&YUFSOBM&OUJUZ 99& ◦ 08"414FSWFSMFTT5PQɿҐ ◦ 08"415PQɿҐ ◦ *OTFDVSF%FTFSJBMJ[BUJPO ◦ 08"414FSWFSMFTT5PQɿҐ ◦ 08"415PQɿҐ ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ◦ 08"414FSWFSMFTT5PQɿҐ ◦ 08"415PQɿҐ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF -BNCEBʹ࢖༻͢ΔϥΠϒϥϦࣗମͷηΩϡϦςΟϦεΫ ◦ 08"414FSWFSMFTT5PQ ◦ Ґɿط஌ͷ੬ऑੑΛ࣋ͭίϯϙʔωϯτͷ࢖༻ ◦ $4"5PQ
◦ ҐɿηΩϡΞͰ͸ͳ͍αʔυύʔςΟґଘ ◦ 08"415PQ ◦ Ґɿ੬ऑͰݹ͘ͳͬͨίϯϙʔωϯτ

"84-BNCEBʹ͓͚Δ੹೚ڞ༗Ϟσϧ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF "84-BNCEBͷηΩϡϦςΟʹ֓ཁɿIUUQTEBXTTUBUJDDPNTFSWFSMFTTKQ4FDVSJUZ0WFSWJFXPG"84-BNCEB@+1 QEG

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ αʔόʔϨεͳ-BNCEBͰ΋ηΩϡϦςΟϦεΫ͸ଘࡏͦ͠͏ ◦ ΞϓϦέʔγϣϯଆͷ੬ऑੑ ◦ ੬ऑͳιʔείʔυʹΑΔ ◦
੬ऑͳϥΠϒϥϦͷ࢖༻ʹΑΔ ◦ -BNCEBͷΞϓϦέʔγϣϯ ιʔείʔυ ◦ ηΩϡϦςΟʹର͢Δ੹೚͸ʮ͓٬༷ར༻͢Δ։ൃऀʯʹͳΔ খ·ͱΊ

"84-BNCEBͷηΩϡϦςΟϦεΫ

"84-BNCEBͷηΩϡϦςΟϦεΫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF 1. -BNCEBͷ؀ڥม਺͔Β*".3PMFͷΫϨσϯγϟϧΛऔಘ͞ΕΔ 2. -BNCEBͷιʔείʔυ͔ΒϋʔυίʔσΟϯά͞ΕͨΫϨσϯγϟϧΛ औಘ͞ΕΔ 3. -BNCEB3VOUJNF"1*ͳͲͷ಺෦"1*ʹΞΫηε͢Δ͜ͱʹΑΓػඍͳ৘ใ
Λऔಘ͞ΕΔ -BNCEBͰى͜Γ͏Δ੬ऑੑ߈ܸʹΑΔओͳϦεΫ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF -BNCEB͸*".3PMFͷΫϨσϯγϟϧΛ-BNCEB্ͷ؀ڥม਺ʹ֨ೲ͢Δ ◦ *".3PMF "84-BNCEB࣮ߦϩʔϧ ◦ "84αʔϏε΍Ϧιʔεʹରͯ͠ૢ࡞ݖݶΛ෇༩ͨ͠΋ͷ
◦ -BNCEBؔ਺͕ଞͷ"84αʔϏε 4΍%ZOBNP%#ͳͲ ʹΞΫηε͠ ͯૢ࡞͢Δ৔߹ɺ-BNCEBʹඞཁͳݖݶΛ*".3PMFͰ෇༩͢Δ ߈ܸऀ͕ೖख͢Δ͜ͱͰ෇༩͞Ε͍ͯΔݖݶΛࣗ༝ʹѱ༻Ͱ͖Δ -BNCEBͷ؀ڥม਺͔Β*".3PMFͷΫϨσϯγϟϧΛऔಘ͞ΕΔ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ 04$PNNBOE*OKFDUJPO ◦ ೚ҙͷίϚϯυΛ-BNCEB্Ͱ࣮ߦͤͯ͞औಘ͢Δ ◦ 9.-&YUFSOBM&OUJUZ 99&
◦ lQSPDTFMGFOWJSPOzΛಡΈࠐ·ͤͯऔಘ͢Δ ◦ *OTFDVSF%FTFSJBMJ[BUJPO ◦ ೚ҙίʔυ࣮ߦ 3$& ʹΑͬͯऔಘ͢Δ ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ◦ File schemaͰ“QSPDTFMGFOWJSPOzΛಡΈࠐ·ͤͯऔಘ͢Δ -BNCEBͷ؀ڥม਺͔Β*".3PMFͷΫϨσϯγϟϧΛऔಘ͞ΕΔ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ؀ڥม਺ͷIAM Role ◦ AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN -BNCEBͷ؀ڥม਺͔Β*".3PMFͷΫϨσϯγϟϧΛऔಘ͞ΕΔ

"84-BNCEBͷηΩϡϦςΟϦεΫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ ೖखͨ͠*".3PMF͕࣋ͭΞΫηεݖݶΛ࢖༻ͯ͠ɺଞͷ"84αʔϏε΍Ϧ ιʔεΛෆਖ਼ૢ࡞Ͱ͖Δ ◦ ྫ ػີੑͷߴ͍σʔλϕʔε΍ετϨʔδ΁ͷಡΈऔΓ΍ॻ͖ࠐΈ ◦
*".3PMFͷಛݖঢ֨ ◦ -BNCEB্ͰԾ૝௨՟ϚΠχϯάFUD ʮ৘ใ࿙Ӯɾվ͟Μʯʮݖݶঢ֨ʯʮଟֹͷ੥ٻʯ͕ ൃੜ͢ΔՄೳੑ͕͋Δ -BNCEBͰͷ੬ऑੑ߈ܸ͕੒ޭ͢Δ͜ͱʹΑΔߋͳΔϦεΫ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF -BNCEBͷιʔείʔεʹϋʔυίʔσΟϯά͞ΕΔΫϨσϯγϟϧྫ ◦ "1*,FZ ◦ %#ͷೝূ৘ใ ◦ ॻ͖ࠐΈઌͷ4όέοτ໊ɹɹɹɹFUD
߈ܸऀ͕ೖख͢Δ͜ͱͰѱ༻͞Εɺ ߋͳΔϦεΫʹܨ͕ΔՄೳੑ͋Γ -BNCEBͷιʔείʔυ͔Β ɹɹɹɹɹɹϋʔυίʔσΟϯά͞ΕͨΫϨσϯγϟϧΛऔಘ͞ΕΔ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ 04$PNNBOE*OKFDUJPO ◦ ೚ҙͷίϚϯυΛ-BNCEB্Ͱ࣮ߦͤͯ͞औಘ͢Δ ◦ 9.-&YUFSOBM&OUJUZ 99&
◦ lWBSUBTLIBOEMFSQZzͳͲΛಡΈࠐ·ͤͯऔಘ͢Δ ◦ *OTFDVSF%FTFSJBMJ[BUJPO ◦ ೚ҙίʔυ࣮ߦ 3$& ʹΑͬͯऔಘ͢Δ ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ◦ File schemaͰ“WBSUBTLIBOEMFSQZzͳͲΛಡΈࠐ·ͤͯऔಘ͢Δ -BNCEBͷιʔείʔυ͔Β ɹɹɹɹɹɹϋʔυίʔσΟϯά͞ΕͨΫϨσϯγϟϧΛऔಘ͞ΕΔ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF -BNCEB3VOUJNF"1* ◦ -BNCEBؔ਺ͷ಺෦"1*ͷҰͭ ◦ -BNCEBͷݺͼग़͠ΠϕϯτΛड͚औΔ ◦ ϨεϙϯεσʔλΛ-BNCEBͷ࣮ߦ؀ڥʹૹΓฦ͢
◦ -BNCEBؔ਺ʹ౉͞ΕΔΠϕϯτσʔλΛฦ͢ ɹɹɹɹɹɹɹɹϨεϙϯεʹػඍͳ৘ใؚ͕·Ε͍ͯΔՄೳੑ͕͋Δ IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHSVOUJNFTBQJIUNM -BNCEB3VOUJNF"1*ʹΞΫηε͢Δ͜ͱʹΑΓػඍͳ৘ใΛऔಘ͞ΕΔ

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHSVOUJNFTBQJIUNM -BNCEB3VOUJNF"1*ʹΞΫηε͢Δ͜ͱʹΑΓػඍͳ৘ใΛऔಘ͞ΕΔ ᶃ SFRVFTU ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443'
◦ d VSMIUUQMPDBMIPTUSVOUJNFJOWPDBUJPOOFYU

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHSVOUJNFTBQJIUNM -BNCEB3VOUJNF"1*ʹΞΫηε͢Δ͜ͱʹΑΓػඍͳ৘ใΛऔಘ͞ΕΔ ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ◦
d VSMIUUQMPDBMIPTUSVOUJNFJOWPDBUJPOOFYU ᶅ SFTQPOTF   Πϕϯτσʔλ ᶄ SFRVFTU

"84-BNCEBͰߟ͑ΒΕΔ੬ऑੑ߈ܸྫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHSVOUJNFTBQJIUNM -BNCEB3VOUJNF"1*ʹΞΫηε͢Δ͜ͱʹΑΓػඍͳ৘ใΛऔಘ͞ΕΔ ◦ 4FSWFS4JEF3FRVFTU'PSHFSZ 443' ◦
d VSMIUUQMPDBMIPTUSVOUJNFJOWPDBUJPOOFYU ɹɹɹɹɹɹɹɹϨεϙϯεʹػඍͳ৘ใؚ͕·Ε͍ͯΔՄೳੑ͕͋Δ ᶅ SFTQPOTF   Πϕϯτσʔλ

"84-BNCEBͷηΩϡϦςΟϦεΫ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ αʔόʔϨεͳ-BNCEBͰ΋ηΩϡϦςΟϦεΫ͸ଘࡏ͢Δ ◦ -BNECBʹ෇༩͞Ε͍ͯΔ*".3PMFͷΫϨσϯγϟϧͷ࿙Ӯ ◦ ϋʔυίʔσΟϯά͞ΕͨΫϨσϯγϟϧͷ࿙Ӯ ◦
"1*,FZ %#ͷೝূ৘ใͳͲ ◦ -BNCEB3VOUJNF"1*͔Βػඍͳ৘ใͷ࿙Ӯ ◦ ΫϨσϯγϟϧͷ࿙ӮʹΑΓෆਖ਼ʹ"84Ϧιʔε΁ͷΞΫηε͕Մೳ ◦ ػඍͳ৘ใΛؚΉ4΍%ZOBNP%#ͳͲ খ·ͱΊ

"84-BNCEBͷηΩϡϦςΟରࡦ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ ΞϓϦέʔγϣϯ ◦ ιʔείʔυ ϥΠϒϥϦ ◦ *".3PMF
ݖݶ ◦ ͦͷଞ ◦ ݕূ ϞχλϦϯά ؂ࠪ ◦ -BNCEB'VODUJPO63-T -BNCEBʹ͓͚ΔओͳηΩϡϦςΟରࡦ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ ηΩϡϦςΟతʹ҆શͳιʔείʔυΛ࣮૷͢Δ ηΩϡΞίʔσΟϯά ◦ ೖྗ஋ͷݕূ΍αχλΠζΛߦ͏ ◦
҆શͳσγϦΞϥΠζΛߦ͏FUD ◦ ίʔυ಺Ͱ࢖༻͢ΔΫϨσϯγϟϧʹ"844FDSFU.BOBHFSΛ׆༻͢Δ ◦ ϋʔυίʔσΟϯάʹ͓͚Δରࡦ ◦ HJUTFDSFUɿIUUQTHJUIVCDPNTPCPMFWOHJUTFDSFU ◦ HJUMFBLTɿIUUQTHJUIVCDPN[SJDFUIF[BWHJUMFBLT -BNCEBͷΞϓϦέʔγϣϯʹର͢Δରࡦ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF "844FDSFU.BOBHFS ◦ %#ೝূ৘ใ΍"1*,FZͳͲͷγʔΫϨοτ৘ใΛ؅ཧɾऔಘͰ͖ΔαʔϏε ◦ 4FDSFU.BOBHFSͷηΩϡϦςΟϕετϓϥΫςΟε ◦ 4FDSFU.BOBHFSΛ࢖༻ͯ͠-BNCEBؔ਺ʹೝূ৘ใΛఏڙ͢Δ
"844FDSFU.BOBHFS IUUQTEPDTBXTBNB[PODPNKB@KQTFDSFUTNBOBHFSMBUFTUVTFSHVJEFCFTUQSBDUJDFTIUNM

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ ϞδϡʔϧʹؚΊΔϥΠϒϥϦ͕ηΩϡΞͳ΋ͷΛ࢖༻͢Δ ◦ ࠷৽ͷόʔδϣϯ ◦ ৴པͰ͖ΔϥΠϒϥϦ ◦
ະ࢖༻ͷґଘؔ܎ͷ࡟আ ◦ ύοέʔδ؅ཧπʔϧͷ׆༻ ◦ OQN 1Z1* ◦ "84-BNCEB-BZFSTΛ׆༻ͯ͠ಉҰϥΠϒϥϦΛ؅ཧ͢Δ -BNCEBͷΞϓϦέʔγϣϯʹର͢Δରࡦ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF "84-BNCEB-BZFST ◦ ෳ਺ͷ-BNCEBؔ਺Ͱ֎෦ϥΠϒϥϦͳͲΛڞ༗Ͱ͖Δ࢓૊Έ ◦ ϝϦοτ ◦ ґଘؔ܎ΛύοέʔδԽͯ͠Ұׅ؅ཧͰ͖Δ
◦ मਖ਼͢Δ৔߹ʹख͕ؒল͚Δ ◦ ίʔυͷڞ༗ͱ੹೚ͷ෼཭Λଅਐ͠ɺϏδωεϩδοΫͷهड़ΛΑ Γਝ଎ʹ܁Γฦ͢͜ͱ͕Ͱ͖Δ "84-BNCEB-BZFST IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHDPOGJHVSBUJPOMBZFSTIUNM

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ -BNCEBʹ෇༩͢Δ*".3PMF͸ʮ࠷খݶͷݖݶʯʹઃఆ͢Δ ◦ *".ͰͷηΩϡϦςΟͷϕετϓϥΫςΟε ◦ IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEF CFTUQSBDUJDFTIUNM
◦ ࠷খݖݶ࣮ݱ΁ͷεςοϓΞϓϩʔν ◦ IUUQTBXTBNB[PODPNKQCMPHTOFXTTZTUFNBUJD BQQSPBDIGPSMFBTUQSJWJMFHFTKQ -BNCEBͷ*".3PMF ݖݶ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ -BNCEBͷίʔυʹରͯ͠σϓϩΠ࣌ʹίʔυॺ໊ΛݕূͰ͖Δػೳ ◦ ϝϦοτ ◦ վ᜵͞Εͨίʔυ΍৴པੑͷͳ͍ઌ͔ΒͷσϓϩΠΛݕূͰ͖Δ ◦
νΣοΫ߲໨ ◦ ੔߹ੑ ༗ޮظݶ ෆҰக ࣦޮ ◦ ݕূͰνΣοΫ͕ࣦഊͨ͠৔߹ͷΞΫγϣϯ ◦ ܯࠂ ڧ੍ ϒϩοΫ -BNCEBͷίʔυॺ໊ IUUQTEPDTBXTBNB[PODPNKB@KQMBNCEBMBUFTUEHDPOGJHVSBUJPODPEFTJHOJOHIUNM

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ "NB[PO$MPVE8BUDI ◦ "84$MPVE5SBJM ◦ "8493BZ ◦
"84$POGJH "84-BNCEBʹ͓͚ΔओͳϞχλϦϯά΍؂ࠪ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ "NB[PO$MPVE8BUDI ◦ -BNCEBͷϦΫΤετʹؔ͢ΔϝτϦΫεΛऩू͠ݕ஌Ͱ͖Δ ◦ "84$MPVE5SBJM ◦
-BNCEBͷ࣮ߦه࿥΍෇༩͞Ε͍ͯΔ*".3PMFͷಈ࡞Λه࿥Ͱ͖Δ ◦ "8493BZ ◦ -BNCEBͷ෼ੳ΍σόοάΛ͢Δ͜ͱͰύϑΥʔϚϯεΛଌΕΔ ◦ "84$POGJH ◦ -BNCEBͷઃఆมߋཤྺΛ؅ཧ͠ɺ௥੻΍ධՁΛ͢Δ͜ͱ͕Ͱ͖Δ "84-BNCEBʹ͓͚ΔओͳϞχλϦϯά΍؂ࠪ

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ -BNCEBʹ)5514ΤϯυϙΠϯτΛ௥Ճ͢Δ͜ͱͰ௚઀)5514ܦ༝Ͱ࣮ߦ ͢Δ͜ͱ͕Ͱ͖Δ৽ػೳ "1*(BUFXBZͳ͠Ͱ63-Λ࣋ͨͤΔ͜ͱ͕Մೳ ◦ ೝূλΠϓ
◦ "84*". /0/& ೝূͳ͠ύϒϦοΫ ◦ ߟ͑ΒΕΔϦεΫ ◦ ҙਤ͠ͳ͍ΤϯυϙΠϯτͷެ։ɾ์ஔ ◦ όοΫυΞͱͯ͠ͷѱ༻ ◦ ରࡦ ◦ *".ೝূΛ࢖༻͢Δ -BNCEB'VODUJPO63-T IUUQTBXTBNB[PODPNKQBCPVUBXTXIBUTOFXBXTMBNCEBGVODUJPOVSMTCVJMUJOIUUQTFOEQPJOUT

"84-BNCEBͷηΩϡϦςΟରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ -BNCEB ◦ ηΩϡΞίʔσΟϯά ιʔείʔυ ϥΠϒϥϦ
◦ "844FDSFU.BOBHFS "84-BNCEB-BZFST ίʔυॺ໊ ◦ *".3PMF ◦ ࠷খݶͷݖݶ ◦ ͦͷଞ ◦ "NB[PO$MPVE8BUDI "84$MPVE5SBJM "8493BZ "84$POGJH খ·ͱΊ

·ͱΊ

"84-BNCEBʹ͓͚Δ ɹɹɹɹɹɹηΩϡϦςΟϦεΫͱରࡦ TFDKBXTɹ"84-BNCEBʹ͓͚ΔηΩϡϦςΟϦεΫͱରࡦɹ!TDHBKHF ◦ αʔόʔϨεͳ-BNCEBͰ΋ηΩϡϦςΟϦεΫ͸ଘࡏ͢Δ ◦ *".3PMFͳͲͷΫϨσϯγϟϧͷ࿙Ӯ ◦ αʔόʔϨεͳ-BNCEBʹ΋ద੾ͳηΩϡϦςΟରࡦɾӡ༻Λߦ͏
◦ ΞϓϦέʔγϣϯଆ ιʔείʔυ ϥΠϒϥϦ ◦ ηΩϡΞίʔσΟϯά ੬ऑੑ਍அ΍ηΩϡϦςΟαʔϏεͳͲͷ׆༻ ◦ ݖݶઃఆ *".3PMF ◦ ࠷খݶͷݖݶ ◦ ϞχλϦϯά΍؂ࠪ ◦ ެࣜϕετϓϥΫςΟεͷ׆༻ ·ͱΊ

͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠

AWS Lambdaにおけるセキュリティリスクと対策

AWS Lambdaにおけるセキュリティリスクと対策

More Decks by morioka12

Other Decks in Technology

Featured

Transcript