ざっくりわかるAmazon Macie

2017年8月24日(木)に開催されたSecurity-JAWS 第6回勉強会の登壇資料。

Transcript

1. ͬ͘͟ΓΘ͔Δ"NB[PO.BDJF
   ୈճ4FDVSJUZ+"84
   Ϋϥεϝιουגࣜձࣾ
   ࠤʑ໦ɹେี !TNPLFZNPOLFZ
   
   

   View Slide

2. ࣗݾ঺հ
   ࠤʑ໦େี !TNPLFZNPOLFZ
   
   w Ϋϥεϝιουגࣜձࣾ
   w "84ࣄۀ෦௕
   w ๺ւಓߐผࢢࡏॅ
   w ๺ւಓΤϦΞϚωʔδϟʔ
   w ΠϯϑϥΤϯδχΞྺ೥
   w +'"ެೝ$ڃίʔν
   w αοΧʔڃ৹൑
   w ϑοταϧڃ৹൑
   

   View Slide

3. Ϋϥεϝιουגࣜձࣾͱ͸
   ͲΜͳձ͔ࣾ
   ͝ଘ஌Ͱ͔͢ʁ
   

   View Slide

4. Ϋϥεϝιουגࣜձࣾͱ͸
   

   View Slide

5. Ϋϥεϝιουגࣜձࣾͱ͸
   ϒϩάͷ
   ձࣾͰ͢
   

   View Slide

6. ݄ؒສ17ΛތΔٕज़ϒϩάʮ%FWFMPQFST*0ʯ
   http://dev.classmethod.jp/
   8
   ݄ؒສ17ɺສ66ΛތΔɺࣾһ͕ࣥච͢Δ*5ٕज़ʹಛԽ͠
   ͨΦ΢ϯυϝσΟΞͰ͢ɻ
   "84ɺϏοάσʔλɺϞόΠϧɺ*P5ͳͲͷهࣄΛܝࡌதͰ͢ɻ
   Ϣʔβʹ༗ӹͳ৘ใͰ͋Ε͹ࣾ಺ͷϊ΢ϋ΢΋
   ༨͢ͱ͜Ζͳ͘هࣄԽ
   ݱࡏ ຊҎ্ͷهࣄΛܝࡌ
   ʢ೥݄ݱࡏʣ
   Աଌ΍ηΦϦʔ͚ͩͰͳ͘ɺ
   ࣮஍ݕূʹجͮ͘ʮ΍ͬͯΈͨʯهࣄΛެ։
   "84SF*OWFOUγϦʔζ
   ຊ
   
   ຖ೥ΞϝϦΧʹͯ։࠵͞ΕΔ"84
   SF*OWFOUɺ೥͸ࣾһ໊͕
   ࢀՃ͠ɺ"84ͷ৽αʔϏε΍࢖͍
   ํʹ͍͍ͭͯͪૣ͘هࣄΛެ։͠
   ·ͨ͠ɻ
   J04ެ։ه೦৽ػೳΛ໢ཏ͢
   ΔUJQT ຊ
   
   ೥݄J04ͷϦϦʔεΛ
   ه೦ͯ͠ɺJ04΍4XJGUɺ
   9DPEFͷ৽ػೳʹؔ͢ΔهࣄΛ
   Ұڍʹެ։͠·ͨ͠ɻ
   過去の記事特集
   

   View Slide

7. 
   ͬ͘͟ΓΘ͔Δ
   "NB[PO.BDJF
   

   View Slide

8. "NB[PO.BDJFͱ͸
   ݄೔ɺ"844VNNJU
   /FX:PSLʹͯൃද͞Εͨ৽αʔϏε
   ಡΈ͸ϝΠγʔ
   

   View Slide

9. w ػցֶशΛ࢖ͬͯ"84ʹอଘ͞Εͯ
   ͍ΔػີσʔλΛࣗಈతʹൃݟɺ෼
   ྨɺ௨஌͢Δ
   "NB[PO.BDJFͱ͸
   

   View Slide

10. 
    "NB[PO.BDJFͰ
    Ͱ͖Δ͜ͱ
    

    View Slide

11. "NB[PO.BDJFͰͰ͖Δ͜ͱ
    w ಛఆͷ4όέοτΛ؂ࢹͰ͖Δɻ
    w 4όέοτ಺ͷϑΝΠϧ ΦϒδΣΫτ
    ͷத਎
    ΛಡΈɺϦεΫΛ൑ผ͠ɺ෼ྨ͢Δɻ
    w ϑΝΠϧͷத਎͸ϝϞϦʹετϦʔϛϯάͯ͠
    ෼ੳ͢Δɻ
    w ෳࡶͰΑΓਂ͍෼ੳ͕ඞཁͳ৔߹͸ɺ׬શͳί
    ϐʔΛμ΢ϯϩʔυ͠ɺ෼ੳ͠ɺ෼ੳ͕ऴΘͬ
    ͨΒ࡟আ͞ΕɺϝλσʔλͷΈอ࣋͞ΕΔɻ
    w ׬શͳίϐʔ͕4Ҏ֎ͷ৔ॴʹ΋ Ұ࣌తʹ
    
    อ࣋͞ΕΔ͜ͱ͸ೝ͓͍ࣝͯͨ͠΄͏͕͍͍ɻ
    

    View Slide

12. "NB[PO.BDJFͰͰ͖Δ͜ͱ
    w ಛఆͷΞΧ΢ϯτͷ$MPVE5SBJMΛ؂
    ࢹͰ͖Δɻ
    w ه࿥͞Εͨ"1*ϩάΛ෼ྨ͢Δɻ
    

    View Slide

13. "NB[PO.BDJFͰͰ͖Δ͜ͱ
    w ҟৗΛݕ஌ͨ͠ΒܯࠂΛग़͢ɻ
    w $MPVE8BUDI&WFOUTʹؔ࿈෇͚ͯ
    ௨஌͕Ͱ͖Δɻ
    w $MPVE8BUDI&WFOUTܦ༝Ͱอޢ੍
    ޚ ΞΫηεऔΓফ͠ɺύεϫʔυ
    ϦηοτͳͲ
    ͕Ͱ͖Δɻ
    

    View Slide

14. "NB[PO.BDJFͰͰ͖Δ͜ͱ
    w όʔδχΞϦʔδϣϯͱΦϨΰϯϦʔ
    δϣϯͰ࢖͑Δɻ
    w ӳޠ޲͚ʹ࠷దԽ͞Ε͍ͯΔɻ
    

    View Slide

15. 
    "NB[PO.BDJFͰ
    Ͱ͖ͳ͍͜ͱ
    

    View Slide

16. "NB[PO.BDJFͰͰ͖ͳ͍͜ͱ
    w 4ͱ$MPVE5SBJMҎ֎͸؂ࢹͰ͖ͳ͍
    w ࠓ೥ޙ൒ʹଞͷσʔλετΞ΋αϙʔ
    τ༧ఆͱͷ͜ͱɻ
    w "NB[PO&$
    w "NB[PO%ZOBNP%#
    w "NB[PO3%4
    w "NB[PO&'4
    w "84(MVF
    

    View Slide

17. "NB[PO.BDJFͰͰ͖ͳ͍͜ͱ
    w ҟৗͷݕ஌͸Ͱ͖Δ͕อޢ͸Ͱ͖ͳ
    ͍ɻ
    w ͋͘·Ͱൃݟɺ෼ྨɺ௨஌ɻ
    w อޢ͸$MPVE8BUDI&WFOUTܦ༝Ͱ
    ߦ͏ɻ
    

    View Slide

18. "NB[PO.BDJFͰͰ͖ͳ͍͜ͱ
    w ݱ࣌఺Ͱ͸
    όʔδχΞϦʔδϣϯ
    ͱΦϨΰϯϦʔδϣϯҎ֎Ͱ͸࢖͑
    ͳ͍ɻ
    w ݱ࣌఺Ͱ͸
    ӳޠ͔͠࢖͑ͳ͍ɻ
    

    View Slide

19. 
    ࢖͍ํ
    

    View Slide

20. ࢖͍ํ
    

    View Slide

21. ࢖͍ํ
    

    View Slide

22. ࢖͍ํ
    

    View Slide

23. ࢖͍ํ
    

    View Slide

24. ࢖͍ํ
    

    View Slide

25. ࢖͍ํ
    

    View Slide

26. ࢖͍ํ
    

    View Slide

27. ࢖͍ํ
    

    View Slide

28. ࢖͍ํ
    

    View Slide

29. ࢖͍ํ
    

    View Slide

30. ࢖͍ํ
    

    View Slide

31. ࢖͍ํ
    

    View Slide

32. ࢖͍ํ
    

    View Slide

33. 
    ϑΝΠϧͷ෼ྨ
    

    View Slide

34. ίϯςϯπλΠϓ
    w ϑΝΠϧͷϔομʹຒΊࠐ·Ε͍ͯ
    ΔࣝผࢠʹΑͬͯϦεΫϨϕϧΛ
    ʹৼΓ෼͚Δ
    w <4FUUJOHT>UZQFT>Ͱ֬ೝ
    Մೳɻ
    w ίϯςϯπλΠϓͷ௥Ճ΍मਖ਼͸Ͱ
    ͖ͳ͍ɻ
    

    View Slide

35. ίϯςϯπλΠϓ
    

    View Slide

36. ֦ுࢠ
    w ֦ுࢠΛ֬ೝͯ͠ΦϒδΣΫτ෼ྨ
    Λߦ͏
    w <4FUUJOHT>FYUFOTJPOT>Ͱ֬ೝ
    Մೳɻ
    w ֦ுࢠͷ௥Ճ΍मਖ਼͸Ͱ͖ͳ͍
    

    View Slide

37. ֦ுࢠ
    

    View Slide

38. ςʔϚ
    w ༧Ί͍͔ͭ͘ͷςʔϚ Ωʔϫʔυ
    
    ͕༻ҙ͞Ε͍ͯΔ
    w ͦͷΩʔϫʔυΛݩʹϑΝΠϧΛݕ
    ࡧͯ͠ςʔϚ͝ͱʹͷϦεΫϨ
    ϕϧΛઃఆ͢Δ
    w <4FUUJOHT><5IFNFT>Ͱ֬ೝՄೳɻ
    w ςʔϚͷ௥Ճ΍मਖ਼͸Ͱ͖ͳ͍
    

    View Slide

39. ςʔϚ
    

    View Slide

40. ςʔϚ
    

    View Slide

41. ਖ਼نදݱ
    w .BDJF͕ਖ਼نදݱΛ༻͍ͯಛఆͷσʔ
    λύλʔϯΛݕग़ͯ͠ϦεΫϨϕϧ
    ΛৼΓ෼Δ
    w <4FUUJOHT><3FHFY>Ͱ֬ೝՄೳɻ
    w ਖ਼نදݱͷ௥Ճ΍मਖ਼͸Ͱ͖ͳ͍
    

    View Slide

42. ਖ਼نදݱ
    

    View Slide

43. ਖ਼نදݱ
    

    View Slide

44. 1FSTPOBMMZ*EFOUJpBCMF*OGPSNBUJPO 1**
    
    w /*45΍'*14ͳͲʹج͍ͮͨݸ
    ਓࣝผ͕ՄೳͳσʔλΛೝࣝ͢Δ
    w ࢯ໊
    w ༣ૹઌॅॴ
    w ϝʔϧΞυϨε
    w ΫϨδοτΧʔυ൪߸
    w *1ΞυϨεʢ*1W͓Αͼ*1Wʣ
    w ӡస໔ڐূ*%ʢถࠃʣ
    w ࠃࣝผ൪߸ʢถࠃʣ
    w ੜ೥݄೔
    

    View Slide

45. 1FSTPOBMMZ*EFOUJpBCMF*OGPSNBUJPO 1**
    
    w ೝࣝͨ͠ཁૉΛIJHINJEEMFMPXͷϦεΫʹৼΓ෼͚Δ
    w IJHI
    w ͭҎ্ͷϑϧωʔϜͱΫϨδοτΧʔυ൪߸
    w Ҏ্ͷ໊લ·ͨ͸ϝʔϧΞυϨεɺଞͷ೚ҙͷ૊Έ
    ߹Θͤ
    w NJEEMF
    w ͭҎ্ͷ໊લ·ͨ͸ϝʔϧΞυϨεɺଞͷ೚ҙͷ૊Έ
    ߹Θͤ
    w -08
    w ͭҎ্ͭະຬͷ໊લ·ͨ͸ϝʔϧΞυϨεɺଞͷ೚
    ҙͷ૊Έ߹Θͤ
    w ໊લ΍ϝʔϧΞυϨεҎ֎ͷ৘ใ
    

    View Slide

46. 4VQQPSU7FDUPS.BDIJOF#BTFEʢ47.ʣ෼ྨ
    w ϑΝΠϧͷϝλσʔλ υΩϡϝϯτ௕΍Τϯ
    ίʔσΟϯάɺϔομͳͲʣͱͦͷத਎ΛOά
    ϥϜ෼ੳ͠ɺ݁ՌΛݩʹϑΝΠϧΛ෼ྨ͢Δ
    w ిࢠॻ੶
    w ҉߸ԽΩʔ
    w &ϝʔϧ
    w ࡒ຿σʔλ
    w ΞϓϦέʔγϣϯϩά
    w %#μϯϓ
    w ιʔείʔυ
    

    View Slide

47. 
    ग़ྗ݁Ռ
    ʢҰ෦ʣ
    

    View Slide

48. 4PCKFDUT
    

    View Slide

49. 4PCKFDUTCZ1**
    

    View Slide

50. $MPVE5SBJMFWFOUT
    

    View Slide

51. "DUJWJUZ*41T
    

    View Slide

52. $MPVE5SBJMVTFSJEFOUJUZUZQFT
    

    View Slide

53. $SJUJDBMBTTFUT
    

    View Slide

54. $SJUJDBMBTTFUT
    

    View Slide

55. $SJUJDBMBTTFUT
    

    View Slide

56. 6TFST
    

    View Slide

57. "MFSUT
    

    View Slide

58. "MFSUT
    

    View Slide

59. "MFSUT
    

    View Slide

60. "MFSUT
    

    View Slide

61. 
    ௨஌͔Βͷอޢ
    

    View Slide

62. $MPVE8BUDI&WFOUTͷઃఆ
    http://dev.classmethod.jp/cloud/aws/notify-amazon-macie-alert-using-cloudwatchevents/
    

    View Slide

63. 
    Ϣʔεέʔε
    

    View Slide

64. Ϣʔεέʔε
    w ػີσʔλʹޡͬͯઃఆ͞ΕͨΞΫηεݖݶͷݕ஌
    w ιʔείʔυʹؚ·Εͨ"1*Ωʔͷݕ஌
    w ػີσʔλͷอଘ͓ΑͼΞΫηε͕ద੾ʹߦΘΕ͍ͯΔ͜ͱ
    ͷݕূ
    w σʔλΛอ؅͢Δ4όέοτͷݖݶͷෆਖ਼มߋͷݕ஌
    w ෆ஫ҙʹΑΔσʔλެ։
    w ಺෦ऀʹΑΔڴҖ
    w ର৅Λߜͬͨ߈ܸ
    w ௨ৗͱ͸ҟͳΔ*1ΞυϨε͔Βͷେྔͷػີσʔλμ΢ϯϩʔ
    υͷݕ஌
    w ௨ৗΞΫηε͠ͳ͍͸ͣͷϢʔβʔΞΧ΢ϯτ͔Βͷػີσʔ
    λμ΢ϯϩʔυͷݕ஌
    w اۀશମͰڞ༗͞Ε͍ͯΔϦεΫͷߴ͍υΩϡϝϯτʢݸਓ
    ৘ใɺ஌తࡒ࢈ɺ࿑຿৘ใͳͲʣͷෆਖ਼Ξοϓϩʔυͷݕ஌
    

    View Slide

65. 
    අ༻
    

    View Slide

66. අ༻
    w ίϯςϯπͷ෼ྨ
    w ࠷ॳͷ(#ແྉ
    w ͦΕҎ߱(#
    w $MPVE5SBJMΠϕϯτॲཧ
    w ࠷ॳͷ ݅ແྉ
    w ͦΕҎ߱ ݅
    w σʔλอ࣋
    w ࠷ॳͷ೔ؒແྉ
    w ͦΕҎ߱ॲཧ(#
    

    View Slide

67. 
    ·ͱΊ
    

    View Slide

68. ·ͱΊ
    w ϦεΫ෼ੳͷ؍఺͔ΒશϢʔβʔ༗
    ޮʹͨ͠΄͏͕ྑ͍
    w ଞͷϦʔδϣϯɺଞͷݴޠ΁ͷରԠ
    ʹظ଴େ
    w $MPVE8BUDI&WFOUT-BNCEB
    Ͱͷอޢύλʔϯ΋ࠓޙϊ΢ϋ΢͕
    ஝ੵ͞Ε͍ͯ͘͸ͣ
    w ͥͻ࢖ͬͯΈ͍ͯͩ͘͞ʂ
    

    View Slide

69. View Slide