Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS CDKを用いたセキュアなCI/CDパイプラインの構築 / Build a secure...
Search
shiro seike
PRO
September 25, 2024
Programming
3
900
AWS CDKを用いたセキュアなCI/CDパイプラインの構築 / Build a secure CI/CD pipeline using AWS CDK
JAWS-UG CDK支部 #16 ~CDK Conference 2024 Extra~
https://jawsug-cdk.connpass.com/event/328676/
shiro seike
PRO
September 25, 2024
Tweet
Share
More Decks by shiro seike
See All by shiro seike
なぜ適用するか、移行して理解するClean Architecture 〜構造を超えて設計を継承する〜 / Why Apply, Migrate and Understand Clean Architecture - Inherit Design Beyond Structure
seike460
PRO
3
760
生成AIコーディングとの向き合い方、AIと共創するという考え方 / How to deal with generative AI coding and the concept of co-creating with AI
seike460
PRO
1
360
地方のPHPerもクラウドを使う理由 ~コストの最適化とチームに向き合う~ / Why even local PHPers use the cloud ~optimize costs and face the team
seike460
PRO
0
63
OpenTelemetryで始めるベンダーフリーなobservability / Vendor-free observability starting with OpenTelemetry
seike460
PRO
0
170
AIコーディングの本質は“コード“ではなく“構造“だった / The essence of AI coding is not “code” but "structure
seike460
PRO
2
1k
OpenTelemetryを活用したObservability入門 / Introduction to Observability with OpenTelemetry
seike460
PRO
1
640
Amazon Q Developer Proで効率化するAPI開発入門
seike460
PRO
0
310
Amazon Aurora DSQLパフォーマンスチェック / Amazon Aurora DSQL Performance Check
seike460
PRO
0
12
(再)ひとり技術広報からの脱却 / Re:Breaking away from one-man technical public relations
seike460
PRO
1
220
Other Decks in Programming
See All in Programming
Rubyでやりたい駆動開発 / Ruby driven development
chobishiba
1
670
Code as Context 〜 1にコードで 2にリンタ 34がなくて 5にルール? 〜
yodakeisuke
0
120
設計やレビューに悩んでいるPHPerに贈る、クリーンなオブジェクト設計の指針たち
panda_program
6
2k
ふつうの技術スタックでアート作品を作ってみる
akira888
1
500
Porting a visionOS App to Android XR
akkeylab
0
440
チームで開発し事業を加速するための"良い"設計の考え方 @ サポーターズCoLab 2025-07-08
agatan
1
350
AIともっと楽するE2Eテスト
myohei
2
760
猫と暮らす Google Nest Cam生活🐈 / WebRTC with Google Nest Cam
yutailang0119
0
110
データの民主化を支える、透明性のあるデータ利活用への挑戦 2025-06-25 Database Engineering Meetup#7
y_ken
0
350
ISUCON研修おかわり会 講義スライド
arfes0e2b3c
1
440
Team operations that are not burdened by SRE
kazatohiei
1
310
XP, Testing and ninja testing
m_seki
3
240
Featured
See All Featured
Building an army of robots
kneath
306
45k
How STYLIGHT went responsive
nonsquared
100
5.6k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
34
3.1k
Code Reviewing Like a Champion
maltzj
524
40k
KATA
mclloyd
30
14k
Reflections from 52 weeks, 52 projects
jeffersonlam
351
20k
Building Adaptive Systems
keathley
43
2.7k
Producing Creativity
orderedlist
PRO
346
40k
Site-Speed That Sticks
csswizardry
10
680
Thoughts on Productivity
jonyablonski
69
4.7k
Large-scale JavaScript Application Architecture
addyosmani
512
110k
Optimizing for Happiness
mojombo
379
70k
Transcript
©Fusic Co., Ltd.  1 AWS CDKΛ༻͍ͨ ηΩϡΞͳCI/CDύΠϓϥΠϯͷߏங 2024.09.25 @seike460
JAWS-UG CDKࢧ෦ #16 ~CDK Conference 2024 Extra~
©Fusic Co., Ltd. 2 ਗ਼Ո ࢙ @seike460 AWS Community Builder
Serverless ίϛϡχςΟ Fukuoka.php Fukuoka.go JAWS-UG Fukuoka Serverless Meetup Fukuoka Cloudflare Meetup Fukuoka JP_Stripes Fukuoka ࣗݾհ ͡Ίʹ גࣜձࣾFusic ϓϦϯγύϧΤϯδχΞ/ΤόϯδΣϦετ
©Fusic Co., Ltd. 3 CONTENTS ࣍ 1. AWS CDKͱηΩϡϦςΟ 2.
cdk-nagɺCheckov 3. ࣮ࡍͷಈ࡞ 4. ·ͱΊ
©Fusic Co., Ltd. 4 AWS CDKͱηΩϡϦςΟ 1
©Fusic Co., Ltd. 5 AWS CDK AWS CDKɺͱͯศརͰ͢ΑͶ YAMLJSONͰͷهड़ʹΘΓɺPythonɺTypeScriptͷ ϓϩάϥϛϯάݴޠΛͬͯɺίʔυͰAWSϦιʔεΛఆٛͰ͖·͢ɻ
→ෳࡶͳΠϯϑϥετϥΫνϟͷઃఆΛ؆୯ʹ͠ɺ ࠶ར༻ੑՄಡੑΛߴΊΔ͜ͱ͕Ͱ͖ɺ ։ൃऀʹͱͬͯΑΓޮతͳӡ༻͕ՄೳͱͳΓ·͢
©Fusic Co., Ltd. 6 ෳࡶͳߏʹରԠ ෳࡶͳߏΛϓϩάϥϛϯάͰ੍ޚ
©Fusic Co., Ltd. 7 ෳࡶͳߏʹରԠग़དྷΔ͕… ෳࡶͳߏΛϓϩάϥϛϯάͰ੍ޚ ग़དྷΔ͕… ٯʹࠨͷΑ͏ͳڊେͳߏ ࡞Ͱ͖ͯ͠·͍ɺ ͯ͢ΛঠѲग़དྷΔ͔·ͨผͷ
©Fusic Co., Ltd. 8 ͯ͢ΛঠѲͰ͖ͳ͍ͱ… ηΩϡϦςΟϦεΫࡏͷՄೳੑ ▪S3 όέοτ͕ύϒϦοΫΞΫηεՄೳ ▪IAM ϩʔϧʹաͳݖݶΛ༩
▪ϓϥΠϕʔτͳLambda ͕ؔ ɹVPC ʹஔ͞Ε͍ͯͳ͍ ▪Secrets Manager γʔΫϨοτ ɹࣗಈϩʔςʔγϣϯ͕ະઃఆ ▪KMS ΩʔϙϦγʔͷաʹڐՄ
©Fusic Co., Ltd. 9 ਓͷͰνΣοΫͰةݥ ఆ͚ͩͰ੍ޚ͢Δͷ͍͠ ͦ͜ͰCIͰνΣοΫΛߦ͍ɺ ηΩϡϦςΟϦεΫΛ ݮ͢Δํ๏Λߟ͑·͢
©Fusic Co., Ltd. 10 cdk-nag + Checkov 2
©Fusic Co., Ltd. 11 cdk-nag CDK Labs at AWSͷϦϙδτϦͰ͋Δ cdk-nag
AWS CDKͰఆٛ͞ΕͨϦιʔε͕ ηΩϡϦςΟӡ༻ͷϕετϓϥΫςΟεʹ ै͍ͬͯΔ͔Λݕূ͢ΔͨΊͷϥΠϒϥϦ ▪ϧʔϧϕʔεͷݕূ AWS͕ਪ͢ΔηΩϡϦςΟج४ ϕετϓϥΫςΟεʹج͍ͮͨϧʔϧηοτ ▪ΧελϚΠζՄೳ ϓϩδΣΫτͷχʔζʹ߹Θͤͯ ϧʔϧΛՃɾআ֎ɾΧελϚΠζՄೳ ▪CI/CD౷߹ GitHub ActionsͳͲͷCI/CDύΠϓϥΠϯʹ ౷߹ՄೳͰࣗಈతʹίʔυͷ࣭ΛνΣοΫ
©Fusic Co., Ltd. 12 AWSʹΑΔެࣜϒϩά ࢸΕΓͤ͘Γͳ༰ͷެࣜϒϩά - AWSʹΑΔAWS CDK ͱ
cdk-nag Λ౷߹ͯ͠ɺ IaCͷηΩϡϦςΟͱίϯϓϥΠΞϯεΛ ࣗಈతʹཧɾݕূ͢Δํ๏Λղઆ - ۩ମతͳಋೖखॱϧʔϧͷΧελϚΠζɺ Τϥʔͷमਖ਼ɾ੍ํ๏͕հ͞Ε͓ͯΓɺ TypeScriptΛ༻͍࣮ͨྫఏڙ - cdk-nag Λ୯ମςετCI/CDͱ࿈ܞ ܧଓతͳηΩϡϦςΟνΣοΫΛ࣮ݱ͢Δํ๏
©Fusic Co., Ltd. 13 Checkov CheckovIaCͷηΩϡϦςΟͱίϯϓϥΠΞϯεΛ ࣗಈతʹݕূ͢ΔͨΊͷOSSͷ੩తղੳπʔϧ TerraformɺAWS CloudFormationɺKubernetes YAMLɺ
ͦͯ͠AWS CDKͳͲͷઃఆϑΝΠϧΛରʹɺ ϕετϓϥΫςΟεηΩϡϦςΟج४ʹ ج͍ͮͨνΣοΫΛ࣮ߦ͠·͢ - ෯͍αϙʔτର - IaCπʔϧͷछྨɺΫϥυϓϩόΠμʔʹରԠ - ๛ͳϧʔϧηοτ - CISɺNISTɺPCI DSSͳͲͷۀքඪ४ʹج͍ͮͨϧʔϧఏڙ - CI/CD౷߹ - GitHub ActionsɺGitLab CIɺJenkinsͳͲओཁͳCI/CDπʔϧͱ౷߹
©Fusic Co., Ltd. 14 cdk-nag + Checkov ͜ͷ̎ͭΛΈ߹ΘͤΔ - แׅతͳηΩϡϦςΟΧόϨοδͷ্
- cdk-nagAWS CDKಛ༗ͷৄࡉͳηΩϡϦςΟνΣοΫΛఏڙ CheckovʹͯΠϯϑϥશମͷηΩϡϦςΟΛཏతʹݕূ - ૬ิతͳϧʔϧηοτͷ׆༻ - cdk-nagͱCheckovͦΕͧΕҟͳΔϧʔϧϕετϓϥΫςΟεΛ࣋ͭͨΊɺ ྆ऀΛซ༻͢Δ͜ͱͰΤϥʔݕग़ͷਫ਼্͕͠ɺݟམͱ͠Λ͙ - ଟతͳCI/CDύΠϓϥΠϯͷڧԽ - ྆πʔϧΛCI/CDύΠϓϥΠϯʹ౷߹͢Δ͜ͱͰɺ CI࣌ʹࣗಈత͔ͭଟ֯తͳηΩϡϦςΟνΣοΫΛ࣮ߦՄೳ
©Fusic Co., Ltd. 15 ࣮ࡍͷಈ࡞ 3
©Fusic Co., Ltd. 16 GitHub Actions GitHub Actions npx cdk
synthΛ࣮ߦ͢Δ͜ͱͰ Cdk-nagͷνΣοΫΛ࣮ߦ͢Δ͜ͱ͕ग़དྷΔ checkovίϚϯυtemplate.yamlΛࢦఆͯ͠ ࣮ߦ͢Δ͜ͱͰtemplate.yamlΛ࣮ߦ͢Δ͜ͱ͕Մೳ
©Fusic Co., Ltd. 17 cdk-nag cdk-nagͷmoduleΛ cdkͷAspectsʹ৯ΘͤΔ͜ͱͰ ରͷStackͷνΣοΫ͕Մೳ ୯ମςετͱ࣮ͯ͠ߦ͢ΔࣄՄ
©Fusic Co., Ltd. 18 cdk-nagϧʔϧͷ੍ NagSuppressionsͷ addResourceSuppressions ʹͯϧʔϧͷ੍Λߦ͏IDΛࢦఆ ରϧʔϧΛ੍͕Մೳ
©Fusic Co., Ltd. 19 Checkov ࣮ߦ͢Δ͜ͱͰ ಉ͡Α͏ʹΤϥʔදࣔͱ ݪҼΛදࣔͯ͘͠ΕΔ ΤϥʔʹରԠ͢Δ੍ .checkov.ymlʹॻ͘͜ͱͰରԠՄೳ
©Fusic Co., Ltd. 20 ·ͱΊ 4
©Fusic Co., Ltd. 21 ·ͱΊ CDKͱͯศརɺศར͔ͩΒͦ͜ཧͷരൃ͕ى͜ΔՄೳੑ Point 01 ਓͷͰνΣοΫೝෛՙ͕ߴ͍ɺCIʹͯνΣοΫΛߦ͍ɺCDͷσϓϩΠʹͭͳ͛Δ Point
02 cdk-nag + CheckovΛར༻͢Δ͜ͱͰཏతͳνΣοΫ͕Մೳ Point 03 ඞཁͳ༰ΛνΣοΫ͞ΕΔ͜ͱ͋Δɺͦͷ߹ϧʔϧͷ੍ͰରԠՄೳ Point 04
©Fusic Co., Ltd. 22 Thank You We are Hiring! https://recruit.fusic.co.jp/
͝ਗ਼ௌ͍͖ͨͩ͋Γ͕ͱ͏͍͟͝·ͨ͠