2020年4月25日開催の富山IT勉強会で発表した資料です https://toyama-it.connpass.com/event/162626/
IAMとAWSのセキュリティサービスを利用して、AWSのアカウントを守るにはどうすればよいのかという内容です
"84ΞΧϯτͷηΩϡϦςΟΛकΔ*".ฤ/3*ωοτίϜגࣜձࣾɹࠤʑࢁ*5ษڧձ#ࢁITษڧձ
View Slide
ࠤʑCMPHIUUQTCMPHUBLVSPTOFU5XJUUFS!ELGKࣗݾհ #ࢁITษڧձ
+BQBO"1/"NCBTTBEPSબग़͞Ε·ͨࣗ͠ݾհ #ࢁITษڧձ
ࠓ͢ςʔϚ"84ʹ͓͚Δ̐ͭͷηΩϡϦςΟͷ࣠*".େࣄͩΑηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ"84αʔϏε͓·͚#ࢁITษڧձ
"84ͱηΩϡϦςΟ
"84ͱηΩϡϦςΟ #ࢁITษڧձ͍Ζ͍ΖΔ͜ͱ͕ଟͯ͘ɺ͍͜͠ͱࢥͬͨ͜ͱ͋Γ·ͤΜ͔શମ૾ΛѲ͢ΔͨΊʹɺͬ͘͟Γͱྨͯ͠Έ·͠ΐ͏
"84ͱηΩϡϦςΟ #ࢁITษڧձ"84ͷηΩϡϦςΟͭͷ࣠Ͱߟ͑Δᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏεAWS ManagementConsoleRoleVPCAWS CloudSubnetInternet gatewayAmazon Simple StorageService (S3)VPN gatewayEndpointsUserૢ࡞ݖݶInstance Instance InstanceAWS LambdaRoleᶅ ᶄ ᶃAWS Command LineInterfaceAWS Config AWS Systems ManagerAWS Service Catalog AWS Trusted Advisor AWS CloudTrailᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔαʔϏε
ᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟ #ࢁITษڧձڞ༗Ϟσϧͷͷ෦ઃܭͷߟ͑ํΦϯϓϨͱେ͖͘ҧΘͳ͍͕ɺઃఆͷํ"84ͷྲّྀʹै͏ඞཁ͕͋ΔIUUQTBXTBNB[PODPNKQDPNQMJBODFTIBSFESFTQPOTJCJMJUZNPEFM
ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ͍ΘΏΔϚωʔδυαʔϏεϢʔβʔࣗͰΧόʔ͢Δൣғগͳ͍͕ɺαʔϏε͝ͱʹಛੑΛཧղ͢Δඞཁ͕͋Δ㱺·ͣɺ͏ͷ͚֮ͩ͑Εྑ͍IUUQTXXXTMJEFTIBSFOFU"NB[PO8FC4FSWJDFT+BQBOBXTXIJUFCFMUPOMJOFTFNJOBSBXT
ᶅ"84ͷૢ࡞ʹؔ͢Δݖݶʢ*".ʣ#ࢁITษڧձ"84ͷηΩϡϦςΟͷத֩ͷҰͭͲΜͳʹωοτϫʔΫαʔόʔͷηΩϡϦςΟΛڧݻʹ͍ͯͯ͠ɺ"84Λૢ࡞͞ΕΔͱ͕݀։͚ΒΕΔ"84ͷബ͍ຊɹ*".ͷϚχΞοΫͳIUUQTCPPUIQNKBJUFNT
ᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏε#ࢁITษڧձ"84ಠࣗͷ෦ར༻͠ͳͯ͘γεςϜΛηΩϡΞͳঢ়ଶΛҡ࣋Ͱ͖Δ͕ɺ্ख͘׆༻͢ΔͱࣗྗͰΔΑΓഒָʹͳΔ"84ͷബ͍ຊᶘΞΧϯτηΩϡϦςΟͷϕʔγοΫηΦϦʔIUUQTCPPUIQNKBJUFNT
ྨ͠ݴޠԽ͢Δ͜ͱʹΑΓཧղ͕ਐΉ#ࢁITษڧձ@kaitendaentaishttps://twitter.com/kaitendaentai/status/1052689241744896001
*".ͷઃܭΛݴޠԽ͢Δ
*".ͷϚχΞοΫͳͷհhttps://takuros.booth.pm/items/1563844
*".ͷϚχΞοΫͳɹ࣍͡Ίʹୈষ"84ͱ*".ୈষ*".ͷػೳୈষ*".νϡʔτϦΞϧୈষ*".ϙϦγʔͷσβΠϯύλʔϯୈষ*".άϧʔϓͷσβΠϯύλʔϯୈষ*".ͱηΩϡϦςΟୈষ*".ͷӡ༻ୈষ*".ͱ$MPVE'PSNBUJPOୈষ*".ͷςϯϓϨʔτूୈষ*".Ҏ֎ͷ"84αʔϏεͷ׆༻"ΞΧϯτ։ઃ࣌ͷઃఆνΣοΫϦετ#ࢁITษڧձ
*".ઃܭͷجຊํ
*".ઃܭͷجຊํ#ࢁITษڧձकΔ͖جຊํ͚̎ͭͩೝূใΛ౪·Εͳ͍Α͏ʹ͢Δӡ༻ઃܭΞΫηεΩʔʗγʔΫϨοτΞΫηεΩʔͰͳ͘ϩʔϧͷར༻HJUTFDSFUTͷར༻ೝূใ͕౪·ΕͯඃΛ࠷খݶʹ͢Δݖݶઃܭ.'"ඞਢԽ*1੍ݶͳͲͷར༻੍ݶ࠷খݖݶͷઃఆ
*".ϙϦγʔͷσβΠϯύλʔϯ
*".ϙϦγʔ*".ϙϦγʔͷσβΠϯύλʔϯ̏ͭϗϫΠτϦετɾύλʔϯϒϥοΫϦετɾύλʔϯϋΠϒϦοτɾύλʔϯ#ࢁITษڧձ
ڐՄ͢ΔݖݶͷΈ༩͍ͯ͘͠ύλʔϯɹɹ&$4ͱ͍ͬͨαʔϏε୯Ґɺߋʹࡉ͔͘ΞΫγϣϯ୯ҐͰ༩"84ཧϙϦγʔɺ͋ΔҙຯϗϫΠτϦετύλʔϯ˞Ͱɺͦͷ··͏ʹૈ͍#ࢁITษڧձϗϫΠτϦετɾύλʔϯFD%FTDSJCF4UPQ4UBSUಛఆͷαʔϏεɾΞΫγϣϯͷΈڐՄڋ൱ڐՄڐՄڐՄڋ൱ϝϦοτɹ࠷খݖݶͷઃܭ͕Ͱ͖Δཧղͯ͠࡞ΕɺҰ൪ηΩϡΞσϝϦοτɹઃܭ͕ਐ·ͳ͍ͱઃఆͰ͖ͳ͍ཧෛՙ͕ߴ͍
ڋ൱ΛՃ͍ͯ͘͠ύλʔϯɹɹڐՄ͍͚ͯ͠ͳ͍ݖݶΛണୣ͍ͯ͘͠#ࢁITษڧձϒϥοΫϦετɾύλʔϯڐՄ4&D*".ಛఆͷαʔϏεɾΞΫγϣϯͷΈڋ൱ڐՄڋ൱ڋ൱ڋ൱ϝϦοτɹઃܭ͕࠷খݶʹͰ͖Δࣗ༝͕ߴ͍σϝϦοτɹ༧ظͤ͵αʔϏε͕ಥવ͑ΔΑ͏ʹͳΔϦεΫ͕͋Δ
ϗϫΠτϦετɾϒϥοΫϦετͷΈ߹ΘͤݖݶΛ༩্ͨ͠Ͱɺېࢭ͍ͨ͠ݖݶΛΔ˞ݫີʹ͍͏ͱɺϒϥοΫϦετύλʔϯͯ͢ϋΠϒϦοτʹͳΔ#ࢁITษڧձϋΠϒϦοτɾύλʔϯڐՄ"ENJOJTUSBUPS"DDFTT &D࠷ॳʹݖݶΛ༩ͯ͠ɺෆཁͳݖݶΛΔϝϦοτɹ"84ཧϙϦγʔ͕͍͍ࣗ͢༝͕ߴ͘ઃܭָ͕σϝϦοτɹ͋·Γແ͍ɹ˞ॏͶ͕͚ํ๏ʹҙ*".ڋ൱
*".άϧʔϓͷσβΠϯύλʔϯ
*".άϧʔϓ*".άϧʔϓͷσβΠϯύλʔϯ̎ͭෳάϧʔϓʹॴଐάϧʔϓʹෳͷϙϦγʔ#ࢁITษڧձ
Ϣʔβʔ͕ෳͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆɹશࣾһ͚ͷڞ௨άϧʔϓͱׂผͷάϧʔϓ֊ߏΛ࡞Γ͍͢#ࢁITษڧձෳάϧʔϓʹॴଐ
Ϣʔβʔ͕ͭͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆϢʔβ͔ΒΈΔͱγϯϓϧͳߏݖݶͷݟ௨͕͠ྑ͍#ࢁITษڧձάϧʔϓʹෳϙϦγʔ
ύλʔϯͷݪଇΛ౿·্͑ͨͰ۩ମతͳઃܭʹམͱ͠ࠐΉ
ڞ௨Ͱར༻͢ΔϙϦγʔͰ·ͣݕ౼͢Δͷ͜ͷͭ.'"ඞਢԽඞͣ͢Δ͜ͱ*1੍ݶɺӡ༻ϙϦγʔͱ૬ஊɻ࡞ۀॴΛ੍ݶͰ͖Δͱ͍͏ޮՌ͕͋Δ#ࢁITษڧձ.'"ඞਢԽͱ*1੍ݶ\&⒎FDU%FOZ "DUJPO $POEJUJPO\/PU*Q"EESFTT\BXT4PVSDF*Q<>^^ 3FTPVSDF^\&⒎FDU%FOZ /PU"DUJPO<JBN> 3FTPVSDF $POEJUJPO\#PPM*G&YJTUT\BXT.VMUJ'BDUPS"VUI1SFTFOUGBMTF^^^
"ENJOݖݶΛ༩্ͨ͠Ͱ੍ݶΛՃ͑Δ.'"ඞਢˍ*1ΞυϨε੍ݶ*1੍ݶΛͳͨ͘͢Ίͷཧऀ༻ϩʔϧ#ࢁITษڧձཧऀݖݶͷઃܭ㱺εΠονલΛࢀরݖݶͷΈʹ͢Δͱ͍͏ઃܭΑ͋͘Δ
ϩάΠϯ࣌ࢀরݖݶͷΈࢀরݖݶͱ4XJUDI3PMFΛڐՄ͢ΔݖݶΛ༩εΠονϩʔϧ͢Δ͜ͱʹΑΓཧऀݖݶ͕ར༻ՄೳஈΫογϣϯΛஔ͘͜ͱʹΑΓɺΦϖϛεͷࢭޮՌΛૂ͏#ࢁITษڧձཧऀݖݶͷ҆શઃܭ
৬ػೳͷ"84ཧϙϦγʔͷ׆༻ಛఆͷ༻్͚ͷݖݶηοτʢ৬ػೳͷ"84ཧϙϦγʔʣFDͷݖݶɺΠϯελϯεͷૢ࡞ͱωοτϫʔΫૢ࡞ؚ͕·Ε͍ͯΔͷͰҙ͕ඞཁ#ࢁITษڧձωοτϫʔΫཧऀͷઃܭ
Ұ൪·͍͠ͷ͕։ൃऀ͚ݖݶ*".ϩʔϧͷ࡞ݖݶ͕ඞཁʹͳ͖͍ͬͯͯΔཧऀݖݶΛ༩্ͨ͠Ͱɺ1FSNJTTJPO#PVOEBSZͷ׆༻͔ʁ#ࢁITษڧձ։ൃऀͷઃܭ͋ͱ࡞ͬͨ*".ϩʔϧɾϙϦγʔͷςετํ๏ΛԿͱ͔͍ͨ͠
1SJODJQBMΛߜΒͳ͍ͱɺશϢʔβʔ͕εΠονͰ͖ΔσϑΥϧτςϯϓϨʔτͷઃఆɺΞΧϯτͷϢʔβʔʹରͯ͠ߜΔඞཁ͕͋ΓɺϢʔβʔࢦఆͰߜΔʢάϧʔϓͰ͖ͳ͍ʣผղͱͯ͠"TTVNF3PMFͷݖݶΛͯ͢ണୣͷ͏͑ͰɺඞཁͳϢʔβʔʹ༩͢Δͱ͍͏ํ๏͋Δ#ࢁITษڧձεΠονϩʔϧͷҙ\7FSTJPO 4UBUFNFOU<\&⒎FDU"MMPX 1SJODJQBM\"84BSOBXTJBNSPPU^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^^>^\7FSTJPO 4UBUFNFOU<\&⒎FDU"MMPX 1SJODJQBM\"84BSOBXTJBNVTFSUFTUVTFS^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^^>^
ϕετϓϥΫςΟε͚ͩͲɻɻɻઃܭ͕ݻ·্ͬͨͰɺ*".ʹؔ͢Δߴͳ͕ࣝඞཁϓϩάϥϜతͳར༻ʹ͍͍ͯΔ͕ɺ"84ίϯιʔϧ͔Βͷར༻͍͍ͯͳ͍৽نαʔϏεͷՃʹऑ͍ͦͦ"ENJOݖݶΛ͍࣋ͬͯΔਓ͔͠࠷খݖݶΛٻͰ͖ͳ͍ઃܭɾӡ༻͕େ͖͍ݱ࣮తͳӡ༻ఆܕతͳ࡞ۀʢ-BNCEBɾόονʣͷΈ࠷খݖݶΛ༩ਓؒܥͷ࡞ۀɺϒϥοΫϦετͷ׆༻ࢹʹηΩϡϦςΟࣄނΛى͜͞ͳ͍ͱ͍͏؍Ͱ࠷খݖݶΛ୳ٻ#ࢁITษڧձ࠷খݖݶͷδϨϯϚ
ηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ"84αʔϏε
ʲ࠶ܝʳ"84ͱηΩϡϦςΟ #ࢁITษڧձ"84ͷηΩϡϦςΟͭͷ࣠Ͱߟ͑Δᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏεAWS ManagementConsoleRoleVPCAWS CloudSubnetInternet gatewayAmazon Simple StorageService (S3)VPN gatewayEndpointsUserૢ࡞ݖݶInstance Instance InstanceAWS LambdaRoleᶅ ᶄ ᶃAWS Command LineInterfaceAWS Config AWS Systems ManagerAWS Service Catalog AWS Trusted Advisor AWS CloudTrailᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔαʔϏε
ΨόφϯεͷҝͷΨʔυϨʔϧ #ࢁITษڧձηΩϡϦςΟҰઃఆ͓ͯ͠ऴ͍Ͱͳ͍ɻڥશମʹܧଓతͳΨόφϯεΛఏڙ͢Δҝͷϧʔϧ͕ඞཁɻ"84ͦΕΛαϙʔτ͢ΔαʔϏεΛఏڙ͍ͯ͠Δᶃ༧ɹʜɹ*".4$1Ͱېࢭࣄ߲ͷૢ࡞ࣄ߲Λग़དྷͳ͘͢Δ͜ͱᶄݕɹʜɹېࢭࣄ߲ͷૢ࡞͕͞ΕͨΒؾ͕͚Δঢ়ଶʹ͢Δ͜ͱΨʔυϨʔϧؔॴ
#ࢁITษڧձ$MPVE5SBJMAWS ManagementConsoleUserAWS Command LineInterfaceAWS CloudTrailAmazon Simple StorageService (S3)Amazon CloudWatch"84Ϧιʔεͷૢ࡞ཤྺΛهɾ௨ᶃϚωδϝϯτίϯιʔϧͱ"1*ͷૢ࡞ཤྺΛ4ʹอଘᶄ$MPVE8BUDI-PHTΛར༻ͯ͠4/4ܦ༝Ͱ௨ՄೳAWSϦιʔε
#ࢁITษڧձ$POpHఆˍΠϕϯτൃੜ࣌ʹ"84ͷঢ়ଶΛهᶃ"84ͷঢ়ଶΛه͠ཧ͢ΔαʔϏεᶄ$POpH3VMFTΛར༻͢Δ͜ͱʹΑΓɺ͋Δ͖ঢ়ଶ͔Β֎Εͨ͜ͱΛݕ͢Δ͜ͱ͕Ͱ͖ΔAWS ConfigUserAWSϦιʔεͷߏมߋߏཧɾهͷอଘมߋޙͷߏͷධՁʢConfig RulesʣAmazon SimpleNotification Service
#ࢁITษڧձ(VBSE%VUZڴҖͷݕग़ᶃηΩϡϦςΟ؍͔ΒͷڴҖϦεΫΛݕग़ᶄϩάσʔλʢ71$'MPX-PHT $MPVE5SBJM&WFOU-PHT %/4-PHTʣΛੳᶅڴҖΛ"*ʹΑΓΠϯςϦδΣϯεʹݕग़ѱҙͷ͋ΔεΩϟϯΠϯελϯεͷڴҖΞΧϯτͷڴҖAmazon GuardDutyFlow logsEvent LogsDNS LogsϩάڴҖͷஅAmazon SimpleNotification ServiceAmazon CloudWatchEvents௨
#ࢁITษڧձ4FDVSJUZ)VChttps://aws.amazon.com/jp/security-hub/ηΩϡϦςΟΞϥʔτΛҰݩཧᶃ(VBSE%VUZ .BDJF *OTQFDUPSͷΞϥʔτΛ౷߹ͯ͠ཧᶄ֤छϩάΛݩʹίϯϓϥΠΞϯενΣοΫᶅαʔυύʔςΟπʔϧͱͷ࿈ܞɾෳ"84ΞΧϯτͷ౷߹Մೳ
#ࢁITษڧձ5SVTUFE"EWJTPS"84ͷར༻ঢ়گΛධՁᶃ̑ͭͷ؍ʢίετ࠷దԽɾύϑΥʔϚϯεɾηΩϡϦςΟɾϑΥʔϧττϨϥϯεɾαʔϏε੍ݶʣͰධՁᶄσϑΥϧτͰద༻͞Ε͍ͯΔͷͰɺҰݟͯΈΔ͜ͱᶅ௨ʢ&ϝʔϧͷΈʣՄೳ
#ࢁITษڧձ$POUSPM5PXFShttps://aws.amazon.com/jp/controltower/ෳΞΧϯτͷηΩϡϦςΟઃఆͱࢹᶃ"84ͷϕετϓϥΫςΟεΛΓࠐΜͩઃఆͰɺ"84ΞΧϯτͷߏஙᶄΞΧϯτͷϙϦγʔΛܧଓతʹཧͱՄࢹԽᶅݱঢ়ͷͱ͜ΖɺطଘͷΞΧϯτʹద༻Ͱ͖ͳ͍
#ࢁITษڧձϕετϓϥΫςΟεᶃదͳݖݶཧ͕࠷ॏཁʢ*".ͱ4$1ʣᶄ"84ͷαʔϏεΛͬͯݕͷػೳΛΓࠐΉᶅߏஙςϯϓϨʔτԽɻϚϧνΞΧϯτͰ͋Εɺ$MPVE'PSNBUJPO4UBDL4FUT0SHBOJ[BUJPOT͕ਆ
͓·͚
#ࢁITษڧձ͜Ε͚͓͚ͩͬͯ"84ΞΧϯτʹ࠷ݶɺԼهͷઃఆΛ͢ΔϧʔτΞΧϯτͷ.'"ઃఆཧऀ༻ͷ*".άϧʔϓͱ*".Ϣʔβʔͷ࡞*".ύεϫʔυϙϦγʔͷద༻$MPVE5SBJMͱ$POpH (VBSE%VUZͷ༗ޮԽ5SVTUFE"EWJTPUSͷ&ϝʔϧ௨ઃఆ$PTU6TBHF3FQPSUͷग़ྗ*".ϢʔβʔͷٻใͷΞΫηεڐՄࢧ͍௨՟Λຊԁʹมߋίετλάͷઃఆସ࿈བྷઌͷઃఆ
#ࢁITษڧձ͜ΕͬͪΌμϝ*".Ͱ͜ΕΛͬͪΌμϝϧʔτϢʔβʔͰӡ༻ར༻ऀશһɺ"ENJOݖݶཧऀҎ֎ʹ*".ݖݶΛ༩ڞ༻ͷ*".Ϣʔβʔͷ࡞ෳͷ$-*ɾϓϩάϥϜ͔Βͷ*".Ϣʔβʔʗϩʔϧͷڞ༻ιʔείʔυʹΫϨσϯγϟϧʢΞΫηεΩʔɾγʔΫϨοτΞΫηεΩʔʣͷຒΊࠐΈ-BNCEB'VMM"DDFTTͷ༩ωοτϫʔΫཧऀҎ֎ʹ&$'VMM"DDFTTͷ༩4ͷΞΫηείϯτϩʔϧΛ*".͚ͩͰߦ͏ʢόέοτϙϦγʔͷซ༻ඞਢʣ
·ͱΊ
ࠓͨ͠ςʔϚ"84ʹ͓͚Δ̐ͭͷηΩϡϦςΟͷ࣠*".େࣄͩΑηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ"84αʔϏε͓·͚#ࢁITษڧձ
takuros
no24oka
unclejoe
ytaisei
john_smith
k_koheyi
bengo4com
miyashino
nishiuma
edwardkenfox
pf_businessdivision
dahatake
hiashisan
bkeepers
aki_iinuma
chrisshort
mongodb
brettharned
rmw
marktimemedia
lemiorhan
stephaniewalter
jacobian
csswizardry
keathley