Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS CDKを用いたセキュアなCI/CDパイプラインの構築 / Build a secure...
Search
shiro seike
PRO
September 25, 2024
Programming
3
620
AWS CDKを用いたセキュアなCI/CDパイプラインの構築 / Build a secure CI/CD pipeline using AWS CDK
JAWS-UG CDK支部 #16 ~CDK Conference 2024 Extra~
https://jawsug-cdk.connpass.com/event/328676/
shiro seike
PRO
September 25, 2024
Tweet
Share
More Decks by shiro seike
See All by shiro seike
実践サーバーレスパフォーマンスチューニング ~その実力に迫る~ / Practical Serverless Performance Tuning ~A Close Look at its Power~
seike460
PRO
2
170
PHPを書く理由、PHPを書いていて良い理由 / Reasons to write PHP and why it is good to write PHP
seike460
PRO
5
470
いまあるチームにフィットさせる Serverless そして Platform Engineeringへの挑戦 / Serverless Fits the Team You Have and Platform Engineering
seike460
PRO
2
1.6k
いまあるチームにフィットさせる Serverless / Serverless fits in with the team you have now.
seike460
PRO
2
140
地方こそサーバーレス! チームにフィットさせるサーバーレス / Rural areas are serverless! Serverless to Fit Your Team
seike460
PRO
1
93
AWS X-Rayを利用したサーバーレスのパフォーマンス分析 / Serverless performance analysis using AWS X-Ray
seike460
PRO
2
140
Cloudflare Workers x AWS Lambdaの組み合わせユースケース / Cloudflare Workers x AWS Lambda Combination Use Case
seike460
PRO
2
440
技術力を高め合う “開けた”企業間コミュニティの形成 / Formation of an "open" inter-company community to enhance technological capabilities
seike460
PRO
1
81
有効な使い方を正しく理解して実装する PHP8.3の最新機能の「ウラ側」 / Understanding and Implementing Effective Usage Correctly The "Uraside" of PHP 8.3's Latest Features
seike460
PRO
1
140
Other Decks in Programming
See All in Programming
ポケモンで考えるコミュニケーション / Communication Lessons from Pokémon
mackey0225
4
180
色んなオートローダーを覗き見る #phpcon_okinawa
o0h
PRO
5
400
2024-10-02 dev2next - Application Observability like you've never heard before
jonatan_ivanov
0
180
2024-10-01 dev2next - Observability for Modern JVM Applications
jonatan_ivanov
0
130
実践Dash - 手を抜きながら本気で作るデータApplicationの基本と応用 / Dash for Python and Baseball
shinyorke
2
590
モジュラモノリス、その前に / Modular monolith, before that
euglena1215
6
710
空間の中でアイドルとレッスンする技術 - 1st "Vision" / Spatial Lesson technologies with my idol - 1st "Vision"
banjun
PRO
0
140
App Router 悲喜交々
quramy
7
380
現場から考えるソフトウェアエンジニアリングの価値と実験
nomuson
1
130
クラウドサービスの 利用コストを削減する技術 - 円安の真南風を感じて -
pyama86
3
400
CSC509 Lecture 02
javiergs
PRO
0
160
Subclassing, Composition, Python, and You
hynek
3
170
Featured
See All Featured
WebSockets: Embracing the real-time Web
robhawkes
59
7.3k
The Invisible Side of Design
smashingmag
297
50k
Designing for Performance
lara
604
68k
Intergalactic Javascript Robots from Outer Space
tanoku
268
27k
Web Components: a chance to create the future
zenorocha
310
42k
Keith and Marios Guide to Fast Websites
keithpitt
408
22k
Robots, Beer and Maslow
schacon
PRO
157
8.2k
The Cost Of JavaScript in 2023
addyosmani
43
5.9k
From Idea to $5000 a Month in 5 Months
shpigford
381
46k
Adopting Sorbet at Scale
ufuk
73
9k
Designing the Hi-DPI Web
ddemaree
280
34k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
3
230
Transcript
©Fusic Co., Ltd.  1 AWS CDKΛ༻͍ͨ ηΩϡΞͳCI/CDύΠϓϥΠϯͷߏங 2024.09.25 @seike460
JAWS-UG CDKࢧ෦ #16 ~CDK Conference 2024 Extra~
©Fusic Co., Ltd. 2 ਗ਼Ո ࢙ @seike460 AWS Community Builder
Serverless ίϛϡχςΟ Fukuoka.php Fukuoka.go JAWS-UG Fukuoka Serverless Meetup Fukuoka Cloudflare Meetup Fukuoka JP_Stripes Fukuoka ࣗݾհ ͡Ίʹ גࣜձࣾFusic ϓϦϯγύϧΤϯδχΞ/ΤόϯδΣϦετ
©Fusic Co., Ltd. 3 CONTENTS ࣍ 1. AWS CDKͱηΩϡϦςΟ 2.
cdk-nagɺCheckov 3. ࣮ࡍͷಈ࡞ 4. ·ͱΊ
©Fusic Co., Ltd. 4 AWS CDKͱηΩϡϦςΟ 1
©Fusic Co., Ltd. 5 AWS CDK AWS CDKɺͱͯศརͰ͢ΑͶ YAMLJSONͰͷهड़ʹΘΓɺPythonɺTypeScriptͷ ϓϩάϥϛϯάݴޠΛͬͯɺίʔυͰAWSϦιʔεΛఆٛͰ͖·͢ɻ
→ෳࡶͳΠϯϑϥετϥΫνϟͷઃఆΛ؆୯ʹ͠ɺ ࠶ར༻ੑՄಡੑΛߴΊΔ͜ͱ͕Ͱ͖ɺ ։ൃऀʹͱͬͯΑΓޮతͳӡ༻͕ՄೳͱͳΓ·͢
©Fusic Co., Ltd. 6 ෳࡶͳߏʹରԠ ෳࡶͳߏΛϓϩάϥϛϯάͰ੍ޚ
©Fusic Co., Ltd. 7 ෳࡶͳߏʹରԠग़དྷΔ͕… ෳࡶͳߏΛϓϩάϥϛϯάͰ੍ޚ ग़དྷΔ͕… ٯʹࠨͷΑ͏ͳڊେͳߏ ࡞Ͱ͖ͯ͠·͍ɺ ͯ͢ΛঠѲग़དྷΔ͔·ͨผͷ
©Fusic Co., Ltd. 8 ͯ͢ΛঠѲͰ͖ͳ͍ͱ… ηΩϡϦςΟϦεΫࡏͷՄೳੑ ▪S3 όέοτ͕ύϒϦοΫΞΫηεՄೳ ▪IAM ϩʔϧʹաͳݖݶΛ༩
▪ϓϥΠϕʔτͳLambda ͕ؔ ɹVPC ʹஔ͞Ε͍ͯͳ͍ ▪Secrets Manager γʔΫϨοτ ɹࣗಈϩʔςʔγϣϯ͕ະઃఆ ▪KMS ΩʔϙϦγʔͷաʹڐՄ
©Fusic Co., Ltd. 9 ਓͷͰνΣοΫͰةݥ ఆ͚ͩͰ੍ޚ͢Δͷ͍͠ ͦ͜ͰCIͰνΣοΫΛߦ͍ɺ ηΩϡϦςΟϦεΫΛ ݮ͢Δํ๏Λߟ͑·͢
©Fusic Co., Ltd. 10 cdk-nag + Checkov 2
©Fusic Co., Ltd. 11 cdk-nag CDK Labs at AWSͷϦϙδτϦͰ͋Δ cdk-nag
AWS CDKͰఆٛ͞ΕͨϦιʔε͕ ηΩϡϦςΟӡ༻ͷϕετϓϥΫςΟεʹ ै͍ͬͯΔ͔Λݕূ͢ΔͨΊͷϥΠϒϥϦ ▪ϧʔϧϕʔεͷݕূ AWS͕ਪ͢ΔηΩϡϦςΟج४ ϕετϓϥΫςΟεʹج͍ͮͨϧʔϧηοτ ▪ΧελϚΠζՄೳ ϓϩδΣΫτͷχʔζʹ߹Θͤͯ ϧʔϧΛՃɾআ֎ɾΧελϚΠζՄೳ ▪CI/CD౷߹ GitHub ActionsͳͲͷCI/CDύΠϓϥΠϯʹ ౷߹ՄೳͰࣗಈతʹίʔυͷ࣭ΛνΣοΫ
©Fusic Co., Ltd. 12 AWSʹΑΔެࣜϒϩά ࢸΕΓͤ͘Γͳ༰ͷެࣜϒϩά - AWSʹΑΔAWS CDK ͱ
cdk-nag Λ౷߹ͯ͠ɺ IaCͷηΩϡϦςΟͱίϯϓϥΠΞϯεΛ ࣗಈతʹཧɾݕূ͢Δํ๏Λղઆ - ۩ମతͳಋೖखॱϧʔϧͷΧελϚΠζɺ Τϥʔͷमਖ਼ɾ੍ํ๏͕հ͞Ε͓ͯΓɺ TypeScriptΛ༻͍࣮ͨྫఏڙ - cdk-nag Λ୯ମςετCI/CDͱ࿈ܞ ܧଓతͳηΩϡϦςΟνΣοΫΛ࣮ݱ͢Δํ๏
©Fusic Co., Ltd. 13 Checkov CheckovIaCͷηΩϡϦςΟͱίϯϓϥΠΞϯεΛ ࣗಈతʹݕূ͢ΔͨΊͷOSSͷ੩తղੳπʔϧ TerraformɺAWS CloudFormationɺKubernetes YAMLɺ
ͦͯ͠AWS CDKͳͲͷઃఆϑΝΠϧΛରʹɺ ϕετϓϥΫςΟεηΩϡϦςΟج४ʹ ج͍ͮͨνΣοΫΛ࣮ߦ͠·͢ - ෯͍αϙʔτର - IaCπʔϧͷछྨɺΫϥυϓϩόΠμʔʹରԠ - ๛ͳϧʔϧηοτ - CISɺNISTɺPCI DSSͳͲͷۀքඪ४ʹج͍ͮͨϧʔϧఏڙ - CI/CD౷߹ - GitHub ActionsɺGitLab CIɺJenkinsͳͲओཁͳCI/CDπʔϧͱ౷߹
©Fusic Co., Ltd. 14 cdk-nag + Checkov ͜ͷ̎ͭΛΈ߹ΘͤΔ - แׅతͳηΩϡϦςΟΧόϨοδͷ্
- cdk-nagAWS CDKಛ༗ͷৄࡉͳηΩϡϦςΟνΣοΫΛఏڙ CheckovʹͯΠϯϑϥશମͷηΩϡϦςΟΛཏతʹݕূ - ૬ิతͳϧʔϧηοτͷ׆༻ - cdk-nagͱCheckovͦΕͧΕҟͳΔϧʔϧϕετϓϥΫςΟεΛ࣋ͭͨΊɺ ྆ऀΛซ༻͢Δ͜ͱͰΤϥʔݕग़ͷਫ਼্͕͠ɺݟམͱ͠Λ͙ - ଟతͳCI/CDύΠϓϥΠϯͷڧԽ - ྆πʔϧΛCI/CDύΠϓϥΠϯʹ౷߹͢Δ͜ͱͰɺ CI࣌ʹࣗಈత͔ͭଟ֯తͳηΩϡϦςΟνΣοΫΛ࣮ߦՄೳ
©Fusic Co., Ltd. 15 ࣮ࡍͷಈ࡞ 3
©Fusic Co., Ltd. 16 GitHub Actions GitHub Actions npx cdk
synthΛ࣮ߦ͢Δ͜ͱͰ Cdk-nagͷνΣοΫΛ࣮ߦ͢Δ͜ͱ͕ग़དྷΔ checkovίϚϯυtemplate.yamlΛࢦఆͯ͠ ࣮ߦ͢Δ͜ͱͰtemplate.yamlΛ࣮ߦ͢Δ͜ͱ͕Մೳ
©Fusic Co., Ltd. 17 cdk-nag cdk-nagͷmoduleΛ cdkͷAspectsʹ৯ΘͤΔ͜ͱͰ ରͷStackͷνΣοΫ͕Մೳ ୯ମςετͱ࣮ͯ͠ߦ͢ΔࣄՄ
©Fusic Co., Ltd. 18 cdk-nagϧʔϧͷ੍ NagSuppressionsͷ addResourceSuppressions ʹͯϧʔϧͷ੍Λߦ͏IDΛࢦఆ ରϧʔϧΛ੍͕Մೳ
©Fusic Co., Ltd. 19 Checkov ࣮ߦ͢Δ͜ͱͰ ಉ͡Α͏ʹΤϥʔදࣔͱ ݪҼΛදࣔͯ͘͠ΕΔ ΤϥʔʹରԠ͢Δ੍ .checkov.ymlʹॻ͘͜ͱͰରԠՄೳ
©Fusic Co., Ltd. 20 ·ͱΊ 4
©Fusic Co., Ltd. 21 ·ͱΊ CDKͱͯศརɺศར͔ͩΒͦ͜ཧͷരൃ͕ى͜ΔՄೳੑ Point 01 ਓͷͰνΣοΫೝෛՙ͕ߴ͍ɺCIʹͯνΣοΫΛߦ͍ɺCDͷσϓϩΠʹͭͳ͛Δ Point
02 cdk-nag + CheckovΛར༻͢Δ͜ͱͰཏతͳνΣοΫ͕Մೳ Point 03 ඞཁͳ༰ΛνΣοΫ͞ΕΔ͜ͱ͋Δɺͦͷ߹ϧʔϧͷ੍ͰରԠՄೳ Point 04
©Fusic Co., Ltd. 22 Thank You We are Hiring! https://recruit.fusic.co.jp/
͝ਗ਼ௌ͍͖ͨͩ͋Γ͕ͱ͏͍͟͝·ͨ͠