Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
JAWSUG千葉支部 Vol.7 AWSアカウントのセキュリティを守る
Takuro SASAKI
November 23, 2019
Technology
0
1.4k
JAWSUG千葉支部 Vol.7 AWSアカウントのセキュリティを守る
JAWSUG千葉支部 Vol.7で発表した『AWSアカウントのセキュリティを守る』の資料です
https://jawsug-chiba.doorkeeper.jp/events/99430
Takuro SASAKI
November 23, 2019
Tweet
Share
More Decks by Takuro SASAKI
See All by Takuro SASAKI
takuros
3
2.3k
takuros
0
4.2k
takuros
2
4k
takuros
4
3.6k
takuros
0
2.5k
takuros
10
4.7k
takuros
0
1.7k
takuros
2
3.3k
takuros
0
5.3k
Other Decks in Technology
See All in Technology
myajiri
0
310
1stship
0
240
mito201
1
1.1k
yshr1200
0
170
yamamuteki
2
520
kanaugust
PRO
0
150
thockin
3
860
mii3king
0
410
pohjus
1
740
kawaguti
2
410
adhorn
0
340
norioikedo
0
210
Featured
See All Featured
shpigford
165
19k
colly
188
14k
jnunemaker
PRO
40
4.6k
lara
172
9.6k
bermonpainter
342
26k
trishagee
23
2.5k
bryan
100
11k
bkeepers
408
58k
bkeepers
52
4.2k
dougneiner
119
7.9k
jponch
103
5k
samlambert
237
10k
Transcript
"84ΞΧϯτͷ ηΩϡϦςΟΛकΔ /3*ωοτίϜגࣜձࣾɹ ࠤʑ +"846(ઍ༿ࢧ෦ɹୈճ #jawsug
ࠤʑ CMPHIUUQTCMPHUBLVSPTOFU 5XJUUFS!ELGK ࣗݾհ #jawsug
+BQBO"1/"NCBTTBEPS બग़͞Ε·ͨ͠ ࣗݾհ #jawsug
ࠓ͢ςʔϚ "84ʹ͓͚Δ̐ͭͷηΩϡϦςΟͷ࣠ *".େࣄͩΑ ηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ"84αʔϏε ͓·͚ #jawsug
"84ͱηΩϡϦςΟ
"84ͱηΩϡϦςΟ #jawsug ͍Ζ͍ΖΔ͜ͱ͕ଟͯ͘ɺ ͍͜͠ͱࢥͬͨ͜ͱ͋Γ·ͤΜ͔ શମ૾ΛѲ͢ΔͨΊʹɺͬ͘͟Γͱ ྨͯ͠Έ·͠ΐ͏
"84ͱηΩϡϦςΟ #jawsug "84ͷηΩϡϦςΟͭͷ࣠Ͱߟ͑Δ ᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟ ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ ᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣ ᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏε AWS Management Console
Role VPC AWS Cloud Subnet Internet gateway Amazon Simple Storage Service (S3) VPN gateway Endpoints User ૢ࡞ݖݶ Instance Instance Instance AWS Lambda Role ᶅ ᶄ ᶃ AWS Command Line Interface AWS Config AWS Systems Manager AWS Service Catalog AWS Trusted Advisor AWS CloudTrail ᶆ ηΩϡϦςΟΛҡ࣋ ཧ͢ΔαʔϏε
ᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱ αʔόʔͷηΩϡϦςΟ #jawsug ڞ༗Ϟσϧͷͷ෦ ઃܭͷߟ͑ํΦϯϓϨͱେ͖͘ҧΘͳ͍͕ɺઃఆͷ ํ"84ͷྲّྀʹै͏ඞཁ͕͋Δ IUUQTBXTBNB[PODPNKQDPNQMJBODFTIBSFESFTQPOTJCJMJUZNPEFM
ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ #jawsug ͍ΘΏΔϚωʔδυαʔϏε ϢʔβʔࣗͰΧόʔ͢Δൣғগͳ͍͕ɺαʔϏε͝ ͱʹಛੑΛཧղ͢Δඞཁ͕͋Δ 㱺·ͣɺ͏ͷ͚֮ͩ͑Εྑ͍ IUUQTXXXTMJEFTIBSFOFU"NB[PO8FC4FSWJDFT+BQBOBXTXIJUFCFMUPOMJOFTFNJOBSBXT
ᶅ"84ͷૢ࡞ʹؔ͢Δݖݶʢ*".ʣ #jawsug "84ͷηΩϡϦςΟͷத֩ͷҰͭ ͲΜͳʹωοτϫʔΫαʔόʔͷηΩϡϦςΟΛڧݻʹ ͍ͯͯ͠ɺ"84Λૢ࡞͞ΕΔͱ͕݀։͚ΒΕΔ IUUQTCMPHUBLVSPTOFUFOUSZ ͷ4FDVSJUZ+"84Ͱɺ͜ͷςʔϚͰ͠·ͨ͠
ᶆηΩϡϦςΟΛҡ࣋ཧ͢Δ ͨΊͷ"84αʔϏε #jawsug "84ಠࣗͷ෦ ར༻͠ͳͯ͘γεςϜΛηΩϡΞͳঢ়ଶΛҡ࣋Ͱ͖Δ͕ɺ ্ख͘׆༻͢ΔͱࣗྗͰΔΑΓഒָʹͳΔ ࠓͷςʔϚͰ͢ʂʂ
ྨ͠ݴޠԽ͢Δ͜ͱʹΑΓ ཧղ͕ਐΉ #jawsug @kaitendaentais https://twitter.com/kaitendaentai/status/1052689241744896001
*".ͷઃܭΛݴޠԽ͢Δ
*".ͷϚχΞοΫͳͷհ https://takuros.booth.pm/items/1563844
*".ͷϚχΞοΫͳɹ࣍ ͡Ίʹ ୈষ"84ͱ*". ୈষ*".ͷػೳ ୈষ*".νϡʔτϦΞϧ ୈষ*".ϙϦγʔͷσβΠϯύλʔϯ ୈষ*".άϧʔϓͷσβΠϯύλʔϯ ୈষ*".ͱηΩϡϦςΟ ୈষ*".ͷӡ༻ ୈষ*".ͱ$MPVE'PSNBUJPO
ୈষ*".ͷςϯϓϨʔτू ୈষ*".Ҏ֎ͷ"84αʔϏεͷ׆༻ "ΞΧϯτ։ઃ࣌ͷઃఆνΣοΫϦετ #jawsug
*".ઃܭͷجຊํ
*".ઃܭͷجຊํ #jawsug कΔ͖جຊํ͚̎ͭͩ ೝূใΛ౪·Εͳ͍Α͏ʹ͢Δӡ༻ઃܭ ΞΫηεΩʔʗγʔΫϨοτΞΫηεΩʔͰͳ͘ϩʔϧͷར༻ HJUTFDSFUTͷར༻ ೝূใ͕౪·ΕͯඃΛ࠷খݶʹ͢Δݖݶઃܭ .'"ඞਢԽ*1੍ݶͳͲͷར༻੍ݶ ࠷খݖݶͷઃఆ
*".ϙϦγʔͷσβΠϯύλʔϯ
*".ϙϦγʔ *".ϙϦγʔͷσβΠϯύλʔϯ̏ͭ ϗϫΠτϦετɾύλʔϯ ϒϥοΫϦετɾύλʔϯ ϋΠϒϦοτɾύλʔϯ #jawsug
ڐՄ͢ΔݖݶͷΈ༩͍ͯ͘͠ύλʔϯɹɹ &$4ͱ͍ͬͨαʔϏε୯Ґɺߋʹࡉ͔͘ΞΫγϣϯ୯ҐͰ༩ "84ཧϙϦγʔɺ͋ΔҙຯϗϫΠτϦετύλʔϯ ˞Ͱɺͦͷ··͏ʹૈ͍ #jawsug ϗϫΠτϦετɾύλʔϯ FD %FTDSJCF 4UPQ 4UBSU
ಛఆͷαʔϏεɾΞΫγϣϯͷΈڐՄ ڋ൱ ڐՄ ڐՄ ڐՄ ڋ൱ ϝϦοτɹ ࠷খݖݶͷઃܭ͕Ͱ͖Δ ཧղͯ͠࡞ΕɺҰ൪ηΩϡΞ σϝϦοτɹ ઃܭ͕ਐ·ͳ͍ͱઃఆͰ͖ͳ͍ ཧෛՙ͕ߴ͍
ڋ൱ΛՃ͍ͯ͘͠ύλʔϯɹɹ ڐՄ͍͚ͯ͠ͳ͍ݖݶΛണୣ͍ͯ͘͠ #jawsug ϒϥοΫϦετɾύλʔϯ ڐՄ 4 &D *". ಛఆͷαʔϏεɾΞΫγϣϯͷΈڋ൱ ڐՄ
ڋ൱ ڋ൱ ڋ൱ ϝϦοτɹ ઃܭ͕࠷খݶʹͰ͖Δ ࣗ༝͕ߴ͍ σϝϦοτɹ ༧ظͤ͵αʔϏε͕ಥવ͑ΔΑ͏ ʹͳΔϦεΫ͕͋Δ
ϗϫΠτϦετɾϒϥοΫϦετͷΈ߹Θͤ ݖݶΛ༩্ͨ͠Ͱɺېࢭ͍ͨ͠ݖݶΛΔ ˞ݫີʹ͍͏ͱɺϒϥοΫϦετύλʔϯͯ͢ϋΠϒϦοτʹͳΔ #jawsug ϋΠϒϦοτɾύλʔϯ ڐՄ "ENJOJTUSBUPS "DDFTT &D ࠷ॳʹݖݶΛ༩ͯ͠ɺෆཁͳݖݶΛΔ
ϝϦοτɹ "84ཧϙϦγʔ͕͍͍͢ ࣗ༝͕ߴ͘ઃܭָ͕ σϝϦοτɹ ͋·Γແ͍ ɹ˞ॏͶ͕͚ํ๏ʹҙ *". ڋ൱
*".άϧʔϓͷσβΠϯύλʔϯ
*".άϧʔϓ *".άϧʔϓͷσβΠϯύλʔϯ̎ͭ ෳάϧʔϓʹॴଐ άϧʔϓʹෳͷϙϦγʔ #jawsug
Ϣʔβʔ͕ෳͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆɹ શࣾһ͚ͷڞ௨άϧʔϓͱׂผͷάϧʔϓ ֊ߏΛ࡞Γ͍͢ #jawsug ෳάϧʔϓʹॴଐ
Ϣʔβʔ͕ͭͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆ Ϣʔβ͔ΒΈΔͱγϯϓϧͳߏ ݖݶͷݟ௨͕͠ྑ͍ #jawsug άϧʔϓʹෳϙϦγʔ
ύλʔϯͷݪଇΛ౿·্͑ͨͰ ۩ମతͳઃܭʹམͱ͠ࠐΉ
ڞ௨Ͱར༻͢ΔϙϦγʔͰ·ͣݕ౼͢Δͷ͜ͷͭ .'"ඞਢԽඞͣ͢Δ͜ͱ *1੍ݶɺӡ༻ϙϦγʔͱ૬ஊɻ࡞ۀॴΛ੍ݶͰ͖Δͱ͍͏ޮՌ͕͋Δ #jawsug .'"ඞਢԽͱ*1੍ݶ \ &⒎FDU%FOZ "DUJPO
$POEJUJPO\ /PU*Q"EESFTT\ BXT4PVSDF*Q< > ^ ^ 3FTPVSDF ^ \ &⒎FDU%FOZ /PU"DUJPO< JBN > 3FTPVSDF $POEJUJPO\ #PPM*G&YJTUT\ BXT.VMUJ'BDUPS"VUI1SFTFOUGBMTF ^ ^ ^
"ENJOݖݶΛ༩্ͨ͠Ͱ੍ݶΛՃ͑Δ .'"ඞਢˍ*1ΞυϨε੍ݶ *1੍ݶΛͳͨ͘͢Ίͷཧऀ༻ϩʔϧ #jawsug ཧऀݖݶͷઃܭ 㱺εΠονલΛࢀরݖݶͷΈʹ͢Δͱ͍͏ઃܭΑ͋͘Δ
ϩάΠϯ࣌ࢀরݖݶͷΈ ࢀরݖݶͱ4XJUDI3PMFΛڐՄ͢ΔݖݶΛ༩ εΠονϩʔϧ͢Δ͜ͱʹΑΓཧऀݖݶ͕ར༻Մೳ ஈΫογϣϯΛஔ͘͜ͱʹΑΓɺΦϖϛεͷࢭޮՌΛૂ͏ #jawsug ཧऀݖݶͷ҆શઃܭ
৬ػೳͷ"84ཧϙϦγʔͷ׆༻ ಛఆͷ༻్͚ͷݖݶηοτʢ৬ػೳͷ"84ཧϙϦγʔʣ FDͷݖݶɺΠϯελϯεͷૢ࡞ͱωοτϫʔΫૢ࡞ؚ͕·Ε͍ͯΔͷͰ ҙ͕ඞཁ #jawsug ωοτϫʔΫཧऀͷઃܭ
Ұ൪·͍͠ͷ͕։ൃऀ͚ݖݶ *".ϩʔϧͷ࡞ݖݶ͕ඞཁʹͳ͖͍ͬͯͯΔ ཧऀݖݶΛ༩্ͨ͠Ͱɺ1FSNJTTJPO#PVOEBSZͷ׆༻͔ʁ #jawsug ։ൃऀͷઃܭ IUUQTUFDICPPLGFTUPSHFWFOUUCG ͋ͱ࡞ͬͨ*".ϩʔϧɾϙϦγʔͷςετํ๏ΛԿͱ͔͍ͨ͠
1SJODJQBMΛߜΒͳ͍ͱɺશϢʔβʔ͕εΠονͰ͖Δ σϑΥϧτςϯϓϨʔτͷઃఆɺΞΧϯτͷϢʔβʔʹରͯ͠ ߜΔඞཁ͕͋ΓɺϢʔβʔࢦఆͰߜΔʢάϧʔϓͰ͖ͳ͍ʣ ผղͱͯ͠"TTVNF3PMFͷݖݶΛͯ͢ണୣͷ͏͑ͰɺඞཁͳϢʔβʔʹ ༩͢Δͱ͍͏ํ๏͋Δ #jawsug εΠονϩʔϧͷҙ \ 7FSTJPO
4UBUFNFOU< \ &⒎FDU"MMPX 1SJODJQBM\ "84BSOBXTJBN SPPU ^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^ ^ > ^ \ 7FSTJPO 4UBUFNFOU< \ &⒎FDU"MMPX 1SJODJQBM\ "84BSOBXTJBNVTFSUFTU VTFS ^ "DUJPOTUT"TTVNF3PMF $POEJUJPO\^ ^ > ^
ϕετϓϥΫςΟε͚ͩͲɻɻɻ ઃܭ͕ݻ·্ͬͨͰɺ*".ʹؔ͢Δߴͳ͕ࣝඞཁ ϓϩάϥϜతͳར༻ʹ͍͍ͯΔ͕ɺ"84ίϯιʔϧ͔Βͷར༻͍ ͍ͯͳ͍ ৽نαʔϏεͷՃʹऑ͍ ͦͦ"ENJOݖݶΛ͍࣋ͬͯΔਓ͔͠࠷খݖݶΛٻͰ͖ͳ͍ ઃܭɾӡ༻͕େ͖͍ ݱ࣮తͳӡ༻ ఆܕతͳ࡞ۀʢ-BNCEBɾόονʣͷΈ࠷খݖݶΛ༩ ਓؒܥͷ࡞ۀɺϒϥοΫϦετͷ׆༻ࢹʹ
ηΩϡϦςΟࣄނΛى͜͞ͳ͍ͱ͍͏؍Ͱ࠷খݖݶΛ୳ٻ #jawsug ࠷খݖݶͷδϨϯϚ
ηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ "84αʔϏε
ʲ࠶ܝʳ"84ͱηΩϡϦςΟ #jawsug "84ͷηΩϡϦςΟͭͷ࣠Ͱߟ͑Δ ᶃ"84ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟ ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ ᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣ ᶆηΩϡϦςΟΛҡ࣋ཧ͢ΔͨΊͷ"84αʔϏε AWS Management Console
Role VPC AWS Cloud Subnet Internet gateway Amazon Simple Storage Service (S3) VPN gateway Endpoints User ૢ࡞ݖݶ Instance Instance Instance AWS Lambda Role ᶅ ᶄ ᶃ AWS Command Line Interface AWS Config AWS Systems Manager AWS Service Catalog AWS Trusted Advisor AWS CloudTrail ᶆ ηΩϡϦςΟΛҡ࣋ ཧ͢ΔαʔϏε
ΨόφϯεͷҝͷΨʔυϨʔϧ #jawsug ηΩϡϦςΟҰઃఆ͓ͯ͠ऴ͍Ͱͳ͍ɻ ڥશମʹܧଓతͳΨόφϯεΛఏڙ͢Δҝͷϧʔϧ͕ඞ ཁɻ"84ͦΕΛαϙʔτ͢ΔαʔϏεΛఏڙ͍ͯ͠Δ ᶃ༧ ᶄݕग़
#jawsug $MPVE5SBJM AWS Management Console User AWS Command Line Interface
AWS CloudTrail Amazon Simple Storage Service (S3) Amazon CloudWatch "84Ϧιʔεͷૢ࡞ཤྺΛهɾ௨ ᶃϚωδϝϯτίϯιʔϧͱ"1*ͷૢ࡞ཤྺΛ4ʹอଘ ᶄ$MPVE8BUDI-PHTΛར༻ͯ͠4/4ܦ༝Ͱ௨Մೳ AWSϦιʔε
#jawsug $POpH ఆˍΠϕϯτൃੜ࣌ʹ"84ͷঢ়ଶΛه ᶃ"84ͷঢ়ଶΛه͠ཧ͢ΔαʔϏε ᶄ$POpH3VMFTΛར༻͢Δ͜ͱʹΑΓɺ͋Δ͖ঢ়ଶ͔Β֎Ε ͨ͜ͱΛݕ͢Δ͜ͱ͕Ͱ͖Δ AWS Config User AWSϦιʔε
ͷߏมߋ ߏཧɾه ͷอଘ มߋޙͷߏͷ ධՁ ʢConfig Rulesʣ Amazon Simple Notification Service
#jawsug (VBSE%VUZ ڴҖͷݕग़ ᶃηΩϡϦςΟ؍͔ΒͷڴҖϦεΫΛݕग़ ᶄϩάσʔλʢ71$'MPX-PHT $MPVE5SBJM&WFOU-PHT %/4 -PHTʣΛੳ ᶅڴҖΛ"*ʹΑΓΠϯςϦδΣϯεʹݕग़ ѱҙͷ͋ΔεΩϟϯ
ΠϯελϯεͷڴҖ ΞΧϯτͷڴҖ Amazon GuardDuty Flow logs Event Logs DNS Logs ϩά ڴҖͷஅ Amazon Simple Notification Service Amazon CloudWatch Events ௨
#jawsug 4FDVSJUZ)VC https://aws.amazon.com/jp/security-hub/ ηΩϡϦςΟΞϥʔτΛҰݩཧ ᶃ(VBSE%VUZ .BDJF *OTQFDUPSͷΞϥʔτΛ౷߹ͯ͠ཧ ᶄ֤छϩάΛݩʹίϯϓϥΠΞϯενΣοΫ ᶅαʔυύʔςΟπʔϧͱͷ࿈ܞɾෳ"84ΞΧϯτͷ౷߹ Մೳ
#jawsug 5SVTUFE"EWJTPS "84ͷར༻ঢ়گΛධՁ ᶃ̑ͭͷ؍ʢίετ࠷దԽɾύϑΥʔϚϯεɾηΩϡϦςΟɾ ϑΥʔϧττϨϥϯεɾαʔϏε੍ݶʣͰධՁ ᶄσϑΥϧτͰద༻͞Ε͍ͯΔͷͰɺҰݟͯΈΔ͜ͱ ᶅ௨ʢ&ϝʔϧͷΈʣՄೳ
#jawsug $POUSPM5PXFS https://aws.amazon.com/jp/controltower/ ෳΞΧϯτͷηΩϡϦςΟઃఆͱࢹ ᶃ"84ͷϕετϓϥΫςΟεΛΓࠐΜͩઃఆͰɺ"84ΞΧ ϯτͷߏங ᶄΞΧϯτͷϙϦγʔΛܧଓతʹཧͱՄࢹԽ ᶅݱঢ়ͷͱ͜ΖɺطଘͷΞΧϯτʹద༻Ͱ͖ͳ͍
#jawsug ϕετϓϥΫςΟε ࡧத ᶃෳΞΧϯτཧ͕લఏ ᶄࢹͱӡ༻ͷσβΠϯύλʔϯ ᶅߏஙςϯϓϨʔτ IUUQTUFDICPPLGFTUPSHFWFOUUCG ٕज़ॻయʢ ʣͰ ൦༧ఆ
͓·͚
#jawsug ͜Ε͚͓͚ͩͬͯ "84ΞΧϯτʹ࠷ݶɺԼهͷઃఆΛ͢Δ ϧʔτΞΧϯτͷ.'"ઃఆ ཧऀ༻ͷ*".άϧʔϓͱ*".Ϣʔβʔͷ࡞ *".ύεϫʔυϙϦγʔͷద༻ $MPVE5SBJMͱ$POpH (VBSE%VUZͷ༗ޮԽ 5SVTUFE"EWJTPUSͷ&ϝʔϧ௨ઃఆ $PTU6TBHF3FQPSUͷग़ྗ
*".ϢʔβʔͷٻใͷΞΫηεڐՄ ࢧ͍௨՟Λຊԁʹมߋ ίετλάͷઃఆ ସ࿈བྷઌͷઃఆ
#jawsug ͜ΕͬͪΌμϝ *".Ͱ͜ΕΛͬͪΌμϝ ϧʔτϢʔβʔͰӡ༻ ར༻ऀશһɺ"ENJOݖݶ ཧऀҎ֎ʹ*".ݖݶΛ༩ ڞ༻ͷ*".Ϣʔβʔͷ࡞ ෳͷ$-*ɾϓϩάϥϜ͔Βͷ*".Ϣʔβʔʗϩʔϧͷڞ༻ ιʔείʔυʹΫϨσϯγϟϧʢΞΫηεΩʔɾγʔΫϨοτΞ ΫηεΩʔʣͷຒΊࠐΈ
-BNCEB'VMM"DDFTTͷ༩ ωοτϫʔΫཧऀҎ֎ʹ&$'VMM"DDFTTͷ༩ 4ͷΞΫηείϯτϩʔϧΛ*".͚ͩͰߦ͏ʢόέοτϙϦγʔ ͷซ༻ඞਢʣ
·ͱΊ
ࠓͨ͠ςʔϚ "84ʹ͓͚Δ̐ͭͷηΩϡϦςΟͷ࣠ *".େࣄͩΑ ηΩϡϦςΟΛҡ࣋͢ΔͨΊͷ"84αʔϏε ͓·͚ #jawsug
એ పఈ׆༻(PPHMFΞφϦςΟΫε σδλϧϚʔέςΟϯάΛޭʹ ಋ͘ղੳɾվળͷͨΊͷૢ࡞ΨΠυ IUUQTBN[OUP181M #jawsug
͓·͚ *".ຊʢμϯϩʔυ൛ʣΛ ϓϨθϯτ #jawsug