Upgrade to Pro — share decks privately, control downloads, hide ads and more …

レガシーシステムの監視運用を楽にするためにやってきたこと @ JAWS-UG Sapporo

SimSta
December 15, 2023
170

レガシーシステムの監視運用を楽にするためにやってきたこと @ JAWS-UG Sapporo

SimSta

December 15, 2023
Tweet

More Decks by SimSta

Transcript

  1. ϨΨγʔΛҠߦ͠·ͨ͠ Web ʢEC2ʣ Application Migration Service (MGN) サポートがギリギリなOS なんとか⽣きているミドルウェア 1台に複数のWordPressが同居

    もちろんオールインワンな単体系 別々の制作会社、別々の管理者 STGが同居してたりしてなかったり 所々に乱雑に置かれたoldやbk 秘伝のタレみたいなhttpd.conf リダイレクト迷路な.htaccess GoTo⽂より迷うシンボリックリンク ͱΓ͋͑ͣ ظݶ·ͰʹҠߦ͍ͨ͠ͷͰ શ෦ͦͷ·· ϦϑτΞϯυγϑτͰ ࣋ͬͯ͘Ε͹Ϥγʂ 8FC
  2. ϨΨγʔΛҠߦ͠·ͨ͠ OHJOYϓϩΩγ ϞϊϦεͳ8FCαʔόͨͪ Application Load 
 Balancer NAT gateway Web

    Web Web Web Bastion CloudFront WAF ओཁαʔϏεͷΈਤࣔɺ"-#͸ڞ༗ɺ࣮ࡍ͸8FC໿୆ 04͝ͱϞϊϦεͳ7.Λͦͷ··.(/ͰҠߦ Application Migration Service (MGN) ϧʔςΟϯά *1੍ݶ #BTJDೝূ
  3. ӡ༻Λָʹ͍ͨ͠ʂ ͦ͏͍͑͹ʜ ɾ؂ࢹӡ༻αʔϏεΛఏڙ͢Δձࣾʹ͍ͨ ɾϝΠϯ͸ߏங͚ͩͬͨͲҰ෦ӡ༻΋ͨ͠ ɾࢥ͑͹༗ਓରԠ͹͔ͬͰඇޮ཰ͩͬͨ ɾ΋͏ͪΐָ͍ʹ؂ࢹӡ༻Ͱ͖Ε͹ͳ͊ લ৬ͷهԱ Πϯϑϥͷӡ༻୲౰͕ΦϯϓϨͷϕϯμ͔Β ಺෦ʢ͓٬༷ͱฐࣾͳͲ#1ʣʹҠΔͷͰɺ ͳΔ΂͘εϚʔτʹӡ༻Ͱ͖ΔΑ͏ʹ͍ͨ͠

    ྫ͑͹"NB[PO$POOFDUͷ൪߸Λ࢖ͬͯ ٳ೔໷ؒʹࣗಈͰίʔϧͱ͔Ͱ͖ͳ͍ʁ ʢ۩ମతʹͲ͏͢Δ͔͸஌ΒΜ͚Ͳʣ 5-͔ΒͷΦʔμʔ ࣗಈԽͰ͖Δ෦෼͸ͯ͠͠·͓͏ʂ Ϟνϕʔγϣϯ ҰԠࣗಈίʔϧ࣮ݱͰ͖ͦ͏͔ͩΒ΍ͬͯΈΔ ͍ͭͰʹඇޮ཰͸ͲΜͲΜ࡟ݮָ͍ͯͨ͠͠
  4. ࣗಈ࠶ىಈɹߏ੒ਤ Application Load 
 Balancer NAT gateway Lambda EventBridge CloudTrail

    CloudWatch Systems Manager Run Command EC2 Instance ؂ࢹ SNS ୲౰ऀ ϓϩηε࠶ىಈ Πϯελϯε࠶ىಈ ΞϥʔϜ ௨஌ ΞϥʔϜ Πϕϯτ ݕ஌ ىಈ ݺͼग़͠ ࣮ߦ
  5. ࣗಈ࠶ىಈɹॲཧ֓ཁ ᶃ $MPVE8BUDI͕ϓϩηεͷҟৗʢ"HFOUܦ༝ʣ΍ 
 ΠϯελϯεͷҟৗΛݕ஌͠ɺΞϥʔϜൃใ 
 ᶄ $MPVE5SBJM͕"-"3.΁ͷঢ়ଶมԽΛه࿥ 
 ᶅ

    &WFOU#SJEHF͕ঢ়ଶมԽΠϕϯτΛݕ஌ͯ͠ 
 -BNCEBΛୟ͘ 
 ᶆ -BNCEB͕4ZTUFNT.BOBHFSυΩϡϝϯτͷ 
 3VO$PNNBOEΛݺͼग़͢ 
 ᶇ B 3VO$PNNBOEʹΑͬͯ&$Πϯελϯεʹ 
 ɹϓϩηε࠶ىಈίϚϯυ͕ૹ৴͞ΕΔ 
 
 C 3VO$PNNBOEʹΑͬͯ&$Πϯελϯεͷ 
 ɹ࠶ىಈ͕࣮ߦ͞ΕΔ ᶃ ᶄ ᶅ ᶆ ᶇ
  6. ࣗಈ࠶ىಈɹ޻෉ͨۤ͠࿑ͨ͠ϙΠϯτ &WFOU#SJEHFͷݕ஌ͱύϥϝʔλ౉͠ͷํ๏ $MPVE8BUDIͷΞϥʔϜΠϕϯτ͔Β&WFOU#SJEHFʹ࿈ܞͰ͖ͦ͏ͳ߲໨͸ "MBSN/BNFͱ"MBSN%FTDSJQUJPOͷͭ Ұํɺ࠶ىಈΛߦ͏ͨΊʹඞཁͳύϥϝʔλ͸ ʮΠϯελϯε*%ʯͱʮϓϩηε໊ʯͷͭ Πϯελϯεҟৗͷ৔߹͸ͭ  ͕ͨͬͯ͠ɺ"MBSN/BNFͷ઀ඌࣙ 4VGGJY

    ͱ&WFOU#SJEHFϧʔϧΛରԠͤ͞ɺ "MBSN%FTDSJQUJPOʹΠϯελϯε*%ΛೖΕΔܗͰΞϥʔϜΛ࡞੒ ΍΍ΰϦԡ͠ &WFOU#SJEHFϧʔϧ -BNCEB 999IUUQESFTUBSU 999DXBHFOUSFTUBSU 999NZTRMESFTUBSU 999SFCPPU J "MBSN/BNF "MBSN%FTDSJQUJPO ϓϩηε໊ Πϯελϯε*%
  7. ࣗಈ࠶ىಈɹ޻෉ͨۤ͠࿑ͨ͠ϙΠϯτ &WFOU#SJEHFͷݕ஌ͱύϥϝʔλ౉͠ͷํ๏ $MPVE8BUDIͷΞϥʔϜΠϕϯτ͔Β&WFOU#SJEHFʹ࿈ܞͰ͖ͦ͏ͳ߲໨͸ "MBSN/BNFͱ"MBSN%FTDSJQUJPOͷͭ Ұํɺ࠶ىಈΛߦ͏ͨΊʹඞཁͳύϥϝʔλ͸ ʮΠϯελϯε*%ʯͱʮϓϩηε໊ʯͷͭ Πϯελϯεҟৗͷ৔߹͸ͭ  ͕ͨͬͯ͠ɺ"MBSN/BNFͷ઀ඌࣙ 4VGGJY

    ͱ&WFOU#SJEHFϧʔϧΛରԠͤ͞ɺ "MBSN%FTDSJQUJPOʹΠϯελϯε*%ΛೖΕΔܗͰΞϥʔϜΛ࡞੒ ΍΍ΰϦԡ͠ &WFOU#SJEHFϧʔϧ -BNCEB 999IUUQESFTUBSU 999DXBHFOUSFTUBSU 999NZTRMESFTUBSU 999SFCPPU J "MBSN/BNF "MBSN%FTDSJQUJPO ϓϩηε໊ Πϯελϯε*% ΞοϓσʔτͰϧʔϧʹϫΠϧυΧʔυʢ ʣ͕ ࢦఆͰ͖ΔΑ͏ʹͳͬͨͷͰ ΞϥʔϜ໊ͷͲ͔͜ʹಛఆϫʔυΛೖΕ͓͚ͯ͹ Θ͟Θ͟1SFGJY͔4VGGJYΛἧ͑ͳͯ͘΋ &WFOU#SJEHF͕र͑ΔΑ͏ʹͳΓ·ͨ͠ʂ
  8. ࣗಈϦετΞɹߏ੒ਤ Application Load 
 Balancer NAT gateway EventBridge CloudTrail CloudWatch

    Copied Instance ؂ࢹ ϦετΞ ΞϥʔϜ Πϕϯτ ݕ஌ ىಈ ىಈ Step Functions DynamoDB Parameter Store AMI Step Functions Backup EventBridge CloudTrail Πϕϯτ ݕ஌ EC2 Instance ࡞੒ Πϕϯτ ".**% อ؅ ࢀর ࢀর SNS ୲౰ऀ ௨஌ ΞϥʔϜ ࢦఆ
  9. ࣗಈϦετΞॲཧ֓ཁ1IBTF ᶃ #BDLVQ͕εέδϡʔϧʹج͍ͮͯ 
 όοΫΞοϓͱͯ͠".*Λ࡞੒ 
 ᶄ $MPVE5SBJM͕$SFBUF*NBHFΠϕϯτΛه࿥ 
 ᶅ

    &WFOU#SJEHF͕ঢ়ଶมԽΠϕϯτΛݕ஌ͯ͠ 
 4UFQ'VODUJPOTΛୟ͘ 
 ᶆ 4UFQ'VODUJPOT͕1BSBNFUFS4UPSFʹ 
 Πϯελϯε*%ͱ".**%ͷϖΞΛอ؅ 
 ᶃ ᶄ ᶅ ᶆ
  10. ࣗಈϦετΞॲཧ֓ཁ1IBTF ᶇ $MPVE8BUDI͕ɺ࠶ىಈΠϕϯτͰ෮چ͠ͳ͔ͬͨ 
 ΠϯελϯεͷҟৗΛݕ஌͠ɺΞϥʔϜൃใ 
 ᶈ $MPVE5SBJM͕"-"3.΁ͷঢ়ଶมԽΛه࿥ 
 ᶉ

    &WFOU#SJEHF͕ঢ়ଶมԽΠϕϯτΛݕ஌ͯ͠ 
 4UFQ'VODUJPOTΛୟ͘ 
 ᶊ 4UFQ'VODUJPOT͕1BSBNFUFS4UPSFͷ".**%ͱ 
 %ZOBNP%#ͷΠϯελϯεύϥϝʔλΛࢀর 
 ᶋ 4UFQ'VODUJPOT͕όοΫΞοϓͷ".*Λ࢖༻ͯ͠ 
 ΠϯελϯεΛىಈ͠ɺλʔήοτάϧʔϓʹొ࿥ 
 ᶇ ᶈ ᶉ ᶊ ᶋ
  11. ϦετΞΛ࣮ࢪ͢ΔεςʔτϚγϯ Πϯελϯε*%Λड͚औͬͨεςʔτϚγϯ͕ҎԼΛ࣮ߦ ᶃ 1BSBNFUFS4UPSF͔ΒΠϯελϯε*%ʹରԠ͢Δ 
 ࠷৽ͷ".**%Λऔಘ 
 ᶄ %ZOBNP%#ʹอ؅ͯ͋͠ΔΠϯελϯε࡞੒༻ͷ 


    ֤छύϥϝʔλΛऔಘ 
 ᶅ 7PMVNF4J[F͕*OUܕͰͳ͚Ε͹ͳΒͳ͍ͨΊ 
 %ZOBNP%#͔Βͷ/VNCFSܕΛ-BNCEBͰ*OUܕʹม׵ 
 ᶆ औಘͨ͠".**%ͱ֤छύϥϝʔλ͔ΒΠϯελϯεΛ࡞੒ 
 ᶇ গ͠ͷ࣌ؒ଴ػ͠ɺλʔήοτάϧʔϓʹొ࿥ ᶃ ᶄ ᶅ ᶆ ᶇ
  12. ࣗಈϦετΞɹ޻෉ͨۤ͠࿑ͨ͠ϙΠϯτ ύϥϝʔλอ؅ʹ͓͚Δ࢖͍෼͚ w ରͰϢχʔΫʹରԠ͢Δύϥϝʔλͷ૊͸1BSBNFUFS4UPSFʹอ؅ 
 Πϯελϯε*%ͱ࠷৽ͷ".**%ͳͲ  w ෳ਺ͷ,FZ7BMVFΛؚΉσʔλͷҰࣜ͸%ZOBNP%#ʹอ؅ 


    ֤Πϯελϯεͷ෮ݩʹඞཁͳύϥϝʔλͳͲ  4UFQ'VODUJPOT͸ศར͕ͩɺΑ͘ϋϚΔ w %ZOBNP%#͔ΒऔΓग़ͨ͠/VNCFSܕͷ஋Λͦͷ··*OUܕʹೖྗͰ͖ͳ͍ 
 ˠ4UFQ'VODUJPOTͰ͸ॲཧͰ͖ͳ͍ͷͰɺ-BNCEBʹ೚ͤΔ w ͍͍ͨͯͷ͜ͱ͸ϩʔίʔυͰઃఆͰ͖Δ͕ɺ+40/ͷ഑ྻͳͲ 
 ࡉ͔͍෦෼Ͱ༥௨͕ޮ͔ͣΤϥʔʹͳΔ͜ͱ͕͋Δ 
 ˠ4UFQ'VODUJPOTͰ࢖͏ݴޠʢ"4-ʣ͕ͪΐͬͱʢ͔ͳΓʣཧղʹۤ͠Ή w Ͱ΋༨ܭͳʢάϧʔίʔυͱͯ͠ͷ4%,ୟ͚ͩ͘ͳʣ-BNCEBͷ਺͸ 
 ࣮֬ʹݮΒͤΔͷͰ4UFQ'VODUJPOT͸ਆ 74 74
  13. ࣗಈίʔϧɹߏ੒ਤ Application Load 
 Balancer NAT gateway Lambda CloudWatch EC2

    Instance ؂ࢹ SNS ୲౰ऀ ࢀর ϑϥάߋ৽ ΞϥʔϜ ىಈ ݺͼग़͠ $53഑৴ SQS Step Functions DynamoDB Amazon Connect Kinesis 
 Data Streams Lambda ݺͼग़͠ ىಈ ࿈ܞ ݺͼग़͠ ࣌ࠁ൑அ ϝʔϧ௨஌ ίʔϧ
  14. ࣗಈίʔϧॲཧ֓ཁ1IBTF ᶃ $MPVE8BUDI͕ಛఆͷΞϥʔϜΛݕ஌͠ɺ 
 4/4τϐοΫΛૹ৴ 
 ᶄ 4/4͕424΁഑৴͠ɺ424͕݅ͣͭ 
 -BNCEBΛݺͼग़͢ʢಉ࣌ଟൃίʔϧΛ཈੍ʣ

    
 ᶅ -BNCEB͕Ӧۀ࣌ؒ֎͓Αͼ࿈ଓΛ൑ఆ͠ɺ 
 4UFQ'VODUJPOTΛىಈ͢Δ 
 ʢฏ೔ͷӦۀ࣌ؒଳ΍ɺO෼Ҏ಺ʹ࿈ଓͰ 
 ɹݺͼग़͞Εͨࡍ͸ॲཧΛऴྃ͢Δʣ 
 ᶆ 4UFQ'VODUJPOT͕%ZOBNP%#͔Βϑϥάͱ 
 ి࿩൪߸Λऔಘ͠ɺ"NB[PO$POOFDUͷ 
 4UBSU0VUCPVOE7PJDF$POUBDU"1*Λ࣮ߦ͠ 
 ୲౰ऀʹίʔϧ͢Δ ᶃ ᶄ ᶅ ᶆ
  15. ࣗಈίʔϧॲཧ֓ཁ1IBTF̎ ᶇ "NB[PO$POOFDUʹΑΔൃ৴݁Ռ͕ 
 $POUBDU5SBDF3FDPSEʢ$53ʣͱͯ͠഑৴ 
 ᶈ $53Λ,JOFTJT%BUB4USFBNT͕Ωϟϓνϟ͠ 
 ΠϕϯττϦΨʔͱͯ͠-BNCEBΛىಈ

    
 ᶉ -BNCEB͕$53͔Βൃ৴݁ՌΛൈਮͯ͠ 
 4UFQ'VODUJPOTʹ౉͢ 
 ᶊ 4UFQ'VODUJPOT͕ൃ৴݁ՌΛ΋ͱʹ 
 %ZOBNP%#ͷϑϥάΛߋ৽ͭͭ͠ 
 ࠶ൃ৴PSྠ൪PSॲཧऴྃͷ͍ͣΕ͔Λ࣮ߦ 
 Ϧετͷશһʹܨ͕Βͳ͔ͬͨ৔߹͸ 
 4/4τϐοΫܦ༝Ͱ&ϝʔϧΛૹ৴ 
 ᶇ ᶈ ᶉ ᶊ
  16. "NB[PO$POOFDUͷ໰͍߹Θͤϑϩʔ ˞ݸਓͰ$POOFDUΠϯελϯεΛ࢖͍ͬͯͳ͍ͷͰ௒؆୯ͳུ֓ਤͰ͢ 4UBSU w దٓɺ܁Γฦ͠΍ແԠ౴ɺΤϥʔʹର͢ΔॲཧΛೖΕΔ w ೖྗͨ͠ύϥϝʔλʹैͬͯԻ੠Λൃ࿩ͤ͞Δ͜ͱ΍ɺ-BNCEBΛτϦΨʔͯ͠ 
 ଞαʔϏεͱͷ࿈ܞͳͲ͋ΒΏΔॲཧΛߦ͏͜ͱ͕Մೳ w

    ड࿩ऀ͸$POOFDUଆ͕ऴ࿩͢ΔͷΛ଴ͭඞཁ͕͋Δ 
 ˠड࿩ऀଆ͔Β੾ͬͨ৔߹ɺΛԡͨ͠ޙͰ΋௨࿩݁Ռ͕ෆࡏͱಉ͡ѻ͍ʹͳΔ 
 ɹʢ$6450.&3@%*4$0//&$5ʣ ͔̋̋Β͓஌ΒͤͰ͢ɻ "MBSN/BNFͱ͍͏ ΞϥʔϜ͕ൃੜ͠·ͨ͠ɻ ֬ೝͨ͠ΒΛɺ΋͏Ұ౓ฉ͘ ৔߹͸Λԡ͍ͯͩ͘͠͞ɻ &OE $53഑৴ ֬ೝ͠·ͨ͠ɻ ௨࿩Λऴྃ͠·͢ɻ Ի੠Λઃఆ
  17. ࣗಈίʔϧΛߦ͏εςʔτϚγϯ ड͚औͬͨ$53͔ΒॲཧΛܾఆ ᶃॳճൃੜʢ*/*5*"-ʣ 
 1BSBNFUFS4UPSFʹΞϥʔϜ໊Λอ؅͠ɺ 
 ϑϥάΛϦηοτͯ͠൪໨ͷి࿩൪߸Λ 
 औಘͯ͠ίʔϧ ᶄਖ਼ৗऴྃʢ$0/5"$5@'-08@%*4$0//&$5ʣ

    
 ϑϥάΛϦηοτͯ͠ॲཧΛऴྃ ᶅҟৗऴྃʢ5&-&$0.@130#-&.ʣ 
 ಉ͡ϑϥάͰ΋͏Ұ౓ίʔϧ ᶆෆࡏɺ௨࿩தஅͳͲʢ$6450.&3@%*4$0//&$5ʣ 
 ϑϥάΛΠϯΫϦϝϯτ͠ɺ࣍ͷి࿩൪߸ʹίʔϧ Τϥʔ࣌͸4/4Ͱ&ϝʔϧ௨஌ޙɺϑϥάΛϦηοτ ᶃ ᶄ ᶅ ᶆ
  18. ̏ͭͷࣗಈԽ·ͱΊ • Ͱ͖Δ͚ͩϨΨγʔγεςϜͷӡ༻Λָʹ͢ΔͨΊʹ 
 ͳΜͪΌͬͯαʔόʔϨεͰࣗಈԽγεςϜΛߏங͠·ͨ͠ • 4UFQ'VODUJPOT͸ΦʔέετϨʔγϣϯπʔϧͱͯ͠ͱͯ΋༏ल 
 ͨͩສೳͰ͸ͳ͘ɺϋϚΔϙΠϯτ΋ͦͦ͜͜ଟ͍ͷͰ׳Ε͕ඞཁ •

    ରͰରԠ͢Δσʔλ΍ঢ়ଶΛѻ͏ͳΒ1BSBNFUFS4UPSF 
 ෳ਺ͷ,FZ7BMVFΛؚΉσʔλ΍ঢ়ଶΛѻ͏ͳΒ%ZOBNP%# • "NB[PO$POOFDU͸"1*ʹΑΔൃ৴͕Ͱ͖Δɺ݁ՌΛ഑৴΋Ͱ͖Δ • ϞϊϦεͰ΋͋Δఔ౓ͷϨδϦΤϯε͸֬อͰ͖ͨؾ͕͢Δ͚Ͳɺ 
 ·ͩ·ͩվળͰ͖Δ෦෼͸ͨ͘͞Μ͋Δͱࢥ͏
  19. ༨ஊʙϨΨγʔΛͪΐͬͱϞμφΠζ͠·ͨ͠ʙ Application Load 
 Balancer NAT gateway CMS Web Bastion

    CloudFront WAF ͳΜͱ͔Ұ෦8FCαΠτͰίϯςϯπͱ%#Λμ΢ϯλΠϜͳ͠Ͱ෼཭੒ޭͯ͠εςʔτϨεʹʂʢൃද࣌ظະఆʣ Application Load 
 Balancer NAT gateway CMS Web Bastion CloudFront WAF Web EFS RDS