JAWS-UG初心者支部 第35回の登壇資料です IAMの「あ」ということで、基本的なところの解説です
*".ͷʮɹɹʯ/3*ωοτίϜגࣜձࣾɹࠤʑ+"846(ॳ৺ऀࢧ෦-5େձʂʂ#jawsug_bgnr͋
View Slide
ࠤʑCMPHIUUQTCMPHUBLVSPTOFU5XJUUFS!ELGKࣗݾհ #jawsug_bgnr
+BQBO"1/"NCBTTBEPSબग़͞Ε·ͨࣗ͠ݾհ #jawsug_bgnr
4""ͷରࡦຊ͕վగ͞Ε·ͨ͠"84ೝఆࢿ֨ࢼݧςΩετ"84ೝఆιϦϡʔγϣϯΞʔΩςΫτΞιγΤΠτվగୈ൛IUUQTBN[OUP,R;WK,"84ೝఆιϦϡʔγϣϯΞʔΩςΫτΞιγͷษڧͷํͱ"84ͷೖͷํΛࣥචʢͨͭ͠Γʣൃച։࢝ʂʂ#jawsug_bgnr
ΞτϓοτΛ͠Α͏ࢁΞτϓοτͨ͠ਓʹϓϨθϯτຊதͰɺϋογϡλά͖ͰπΠʔτͨ͠ਓʢ্Ґ໊̑ʣϒϩάͰ·ͱΊͨਓɹઌண໊̑#jawsug_bgnrࣗݾਃࠂͰ5XJUUFSͰϝϯγϣϯ͍ͩ͘͞
ࠓ͢ςʔϚ"84ͱηΩϡϦςΟ"84ΞΧϯτͱ*".*".ͷػೳઃܭํͱ࠷খݖݶ͓·͚#jawsug_bgnr
"84ͱηΩϡϦςΟ
"84ͱηΩϡϦςΟ #jawsug_bgnr͍Ζ͍ΖΔ͜ͱ͕ଟͯ͘ɺ͍͜͠ͱࢥͬͨ͜ͱ͋Γ·ͤΜ͔શମ૾ΛѲ͢ΔͨΊʹɺͬ͘͟Γͱྨͯ͠Έ·͠ΐ͏
"84ͱηΩϡϦςΟ #jawsug_bgnr"84ͷηΩϡϦςΟͭͷ࣠Ͱߟ͑Δᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏεAWS ManagementConsoleRoleVPCAWS CloudSubnetInternet gatewayAmazon Simple StorageService (S3)VPN gatewayEndpointsUserૢ࡞ݖݶInstance Instance InstanceAWS LambdaRoleᶅ ᶄ ᶃAWS Command LineInterfaceAWS Config AWS Systems ManagerAWS Service Catalog AWS Trusted Advisor AWS CloudTrailᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔαʔϏε
ᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟ #jawsug_bgnrڞ༗Ϟσϧͷͷ෦ઃܭͷߟ͑ํΦϯϓϨͱେ͖͘ҧΘͳ͍͕ɺઃఆͷํ"84ͷྲّྀʹै͏ඞཁ͕͋ΔIUUQTBXTBNB[PODPNKQDPNQMJBODFTIBSFESFTQPOTJCJMJUZNPEFM
ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ͍ΘΏΔϚωʔδυαʔϏεϢʔβʔࣗͰΧόʔ͢Δൣғগͳ͍͕ɺαʔϏε͝ͱʹಛੑΛཧղ͢Δඞཁ͕͋Δ㱺·ͣɺ͏ͷ͚֮ͩ͑Εྑ͍IUUQTXXXTMJEFTIBSFOFU"NB[PO8FC4FSWJDFT+BQBOBXTXIJUFCFMUPOMJOFTFNJOBSBXT
ᶅ"84ͷૢ࡞ʹؔ͢Δݖݶʢ*".ʣ#jawsug_bgnr"84ͷηΩϡϦςΟͷத֩ͷҰͭͲΜͳʹωοτϫʔΫαʔόʔͷηΩϡϦςΟΛڧݻʹ͍ͯͯ͠ɺ"84Λૢ࡞͞ΕΔͱ͕݀։͚ΒΕΔ"84ͷബ͍ຊɹ*".ͷϚχΞοΫͳIUUQTCPPUIQNKBJUFNT
ᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏε#jawsug_bgnr"84ಠࣗͷ෦ར༻͠ͳͯ͘γεςϜΛηΩϡΞͳঢ়ଶΛҡ࣋Ͱ͖Δ͕ɺ্ख͘׆༻͢ΔͱࣗྗͰΔΑΓഒָʹͳΔ"84ͷബ͍ຊᶘΞΧϯτηΩϡϦςΟͷϕʔγοΫηΦϦʔIUUQTCPPUIQNKBJUFNT
"84ΞΧϯτͱ*".
"84ͷ̎ͭͷΞΧϯτཧ #jawsug_bgnr"84ΞΧϯτʢ3PPUϢʔβʔʣ"84ΞΧϯτ࡞࣌ʹར༻ॳظઃఆ͕ऴΘΕར༻͠ͳ͍ͷ͕ݪଇ*".ʢ͜ΕΛ͏ʣ"84ͷΞΫηεཧͷ؊ϢʔβʔɾϓϩάϥϜɾଞͷϦιʔε͔Β"84Λѻ͏ࣄ͕Ͱ͖Δ"84Λ͏ʹɺ·ͣ*".Λཧղ͢Δඞཁ͕͋Δ
"84ΞΧϯτ #jawsug_bgnr"84ΞΧϯτʢ3PPUϢʔβʔʣ̍ΞΧϯτʹ̍ͭͷΈͰɺΞΧϯτͷશͯͷૢ࡞͕Ͱ͖Δ*".ͷੜલɺ"84ΞΧϯτͰૢ࡞͢Δͱ͍͏Վతͳ࣌ͩͬͨΞΧϯτ୯ମͰɺ"84ΞΧϯτͷૢ࡞ͷ੍ݶ͕Ͱ͖ͳ͍㱺*1ΞυϨεʹΑΔଓݩ੍ݶ͕Ͱ͖ͳ͍ݫີʹӡ༻͢Δ߹ɺཧ.'"Λઃఆۚ͠ݿͰཧ͢Δ߹͋Δ˞"840SHBOJ[BUJPOTͰ࡞ͬͨ"84ΞΧϯτɺɹͦͦύεϫʔυ͕ൃߦ͞Εͣɺ"84440Λར༻લఏͩͬͨΓ͢Δ
#jawsug_bgnr"84ϦιʔεͷΞΫηεཧ*".ͱʁ
*".ͷجຊػೳ
ᶃ*% 1BTTXPSEར༻ऀᶄਖ਼ੑͷ֬ೝೝূہᶅຊਓੑͷอূᶆϦιʔεͷׂαʔϏε*".ͷઆ໌ͷલʹೝূͱೝՄೝূ"VUIFOUJDBUJPOʣೝՄʢ"VUIPSJ[BUJPOʣ୭Ͱ͋Δ͔ʁԿΛΘͤΔͷ͔ʁ
*".ͷجຊػೳ #jawsug_bgnr*".୭ʹԿΛ͑Δͷ͔ཧ͢Δػೳ*".Ϣʔβʔ ʜ ར༻ऀͷೝূ*".άϧʔϓ ʜ *".ϢʔβʔͷάϧʔϓԽ*".ϩʔϧ ʜ ਓؒҎ֎ʹҰ࣌తͳૢ࡞ݖݶΛ༩͢ΔΈ*".ϙϦγʔ ʜ ༩͢ΔݖݶΛهड़ͨ͠ͷར༻ऀ֎෦Ϧιʔε"84Ϧιʔε*".άϧʔϓ*".Ϣʔβʔ*".ϩʔϧ*".ϙϦγʔ"84Ϧιʔε୭ʹʁ ԿΛڐՄېࢭ͢Δ
*".Ϣʔβʔ #jawsug_bgnr*".Ϣʔβʔͷೝূͷํ*%ύεϫʔυΞΫηεΩʔγʔΫϨοτΞΫηεΩʔ㱺ͲͪΒݫີʹཧ͢Δඞཁ͕͋ΔɻɹϚϧν"84ΞΧϯτ͕ҰൠԽͨ͠࠷ۙͰɺɹ͍͔ʹ*".ϢʔβʔΛ࡞Βͳ͍ͰઃܭʹͰ͖Δ͔͕ϙΠϯτʹͳΔ
*".ϩʔϧ #jawsug_bgnr*".ϩʔϧͱʁʢར༻ऀ͕ҙࣝͤͣʹʣҰ࣌తͳݖݶΛऔಘ͢ΔΈ"84Ϧιʔε֎෦Ϧιʔε͔Β"84ϦιʔεΛར༻͢Δ߹ʹ༻"84440Ͱ*".Ϣʔβʔͷସ͢Δ߹ʹ*".ϩʔϧΛ༻RoleAWS STSΫϨσϯγϟϧϓϩάϥϜ*".Ϣʔβʔͷ߹ *".ϩʔϧͷ߹EC2ΠϯελϯεϓϩάϥϜEC2ΠϯελϯεΠϯελϯεʹΞΫηεΩʔɾγʔΫϨοτΞΫηεΩʔΛຒΊࠐΉඞཁ͕͋Δ*".ϩʔϧ͕Ұ࣌తͳೝূใΛऔಘ͢Δɻ
ઃܭํͱ࠷খݖݶ
*".ઃܭͷجຊํ #jawsug_bgnrकΔ͖جຊํ͚̎ͭͩೝূใΛ౪·Εͳ͍Α͏ʹ͢Δӡ༻ઃܭΞΫηεΩʔʗγʔΫϨοτΞΫηεΩʔͰͳ͘ϩʔϧͷར༻HJUTFDSFUTͷར༻ݕ౼ೝূใ͕౪·ΕͯඃΛ࠷খݶʹ͢Δݖݶઃܭ.'"ඞਢԽ*1੍ݶͳͲͷར༻੍ݶ࠷খݖݶͷઃఆ
ύλʔϯͷݪଇΛ౿·্͑ͨͰ۩ମతͳઃܭʹམͱ͠ࠐΉ
ڞ௨Ͱར༻͢ΔϙϦγʔͰ·ͣݕ౼͢Δͷ͜ͷͭ.'"ඞਢԽඞͣ͢Δ͜ͱ*1੍ݶɺӡ༻ϙϦγʔͱ૬ஊɻ࡞ۀॴΛ੍ݶͰ͖Δͱ͍͏ޮՌ͕͋Δ#jawsug_bgnr.'"ඞਢԽͱ*1੍ݶ\&⒎FDU%FOZ "DUJPO $POEJUJPO\/PU*Q"EESFTT\BXT4PVSDF*Q<>^^ 3FTPVSDF^\&⒎FDU%FOZ /PU"DUJPO<JBN> 3FTPVSDF $POEJUJPO\#PPM*G&YJTUT\BXT.VMUJ'BDUPS"VUI1SFTFOUGBMTF^^^
"ENJOݖݶΛ༩্ͨ͠Ͱ੍ݶΛՃ͑Δ.'"ඞਢˍ*1ΞυϨε੍ݶ*1੍ݶΛͳͨ͘͢Ίͷཧऀ༻ϩʔϧ#jawsug_bgnrཧऀݖݶͷઃܭ㱺εΠονલΛࢀরݖݶͷΈʹ͢Δͱ͍͏ઃܭΑ͋͘Δ
ϩάΠϯ࣌ࢀরݖݶͷΈࢀরݖݶͱ4XJUDI3PMFΛڐՄ͢ΔݖݶΛ༩εΠονϩʔϧ͢Δ͜ͱʹΑΓཧऀݖݶ͕ར༻ՄೳஈΫογϣϯΛஔ͘͜ͱʹΑΓɺΦϖϛεͷࢭޮՌΛૂ͏#jawsug_bgnrཧऀݖݶͷ҆શઃܭ
Ұ൪·͍͠ͷ͕։ൃऀ͚ݖݶ"84ͷ։ൃʹ*".ϩʔϧͷ࡞ݖݶ͕ඞཁʹͳ͖͍ͬͯͯΔཧऀݖݶΛ༩্ͨ͠Ͱɺ1FSNJTTJPO#PVOEBSZͷ׆༻͔ʁαϯυϘοΫεΞΧϯτͷํָ͕ͩͬͨΓʁ#jawsug_bgnr։ൃऀͷઃܭ͋ͱ࡞ͬͨ*".ϩʔϧɾϙϦγʔͷςετํ๏ΛԿͱ͔͍ͨ͠
1SJODJQBMΛߜΒͳ͍ͱɺશϢʔβʔ͕εΠονͰ͖ΔσϑΥϧτςϯϓϨʔτͷઃఆɺΞΧϯτͷϢʔβʔʹରͯ͠ߜΔඞཁ͕͋ΓɺϢʔβʔࢦఆͰߜΔʢάϧʔϓͰ͖ͳ͍ʣผղͱͯ͠"TTVNF3PMFͷݖݶΛͯ͢ണୣͷ͏͑ͰɺඞཁͳϢʔβʔʹ༩͢Δͱ͍͏ํ๏͋Δ#jawsug_bgnrεΠονϩʔϧͷҙ\7FSTJPO 4UBUFNFOU<\&⒎FDU"MMPX 1SJODJQBM\"84BSOBXTJBNSPPU^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^^>^\7FSTJPO 4UBUFNFOU<\&⒎FDU"MMPX 1SJODJQBM\"84BSOBXTJBNVTFSUFTUVTFS^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^^>^
ϕετϓϥΫςΟε͚ͩͲɻɻɻઃܭ͕ݻ·্ͬͨͰɺ*".ʹؔ͢Δߴͳ͕ࣝඞཁϓϩάϥϜతͳར༻ʹ͍͍ͯΔ͕ɺ"84ίϯιʔϧ͔Βͷར༻͍͍ͯͳ͍৽نαʔϏεͷՃʹऑ͍ͦͦ"ENJOݖݶΛ͍࣋ͬͯΔਓ͔͠࠷খݖݶΛٻͰ͖ͳ͍ઃܭɾӡ༻͕େ͖͍ݱ࣮తͳӡ༻ఆܕతͳ࡞ۀʢ-BNCEBɾόονʣͷΈ࠷খݖݶΛ༩ਓؒܥͷ࡞ۀɺϒϥοΫϦετͷ׆༻ࢹʹηΩϡϦςΟࣄނΛى͜͞ͳ͍ͱ͍͏؍Ͱ࠷খݖݶΛ୳ٻ#jawsug_bgnr࠷খݖݶͷδϨϯϚ