$30 off During Our Annual Pro Sale. View Details »

Security-JAWS IAMの設計を言語化する

Takuro SASAKI
November 11, 2019

Security-JAWS IAMの設計を言語化する

2019年11月11日にSecurity-JAWSで発表した資料です
https://s-jaws.doorkeeper.jp/events/99569

Takuro SASAKI

November 11, 2019
Tweet

More Decks by Takuro SASAKI

Other Decks in Technology

Transcript

  1. *".ͷઃܭΛݴޠԽ͢Δ
    /3*ωοτίϜגࣜձࣾɹ
    ࠤʑ໦୓࿠

    4FDVSJUZ+"84ɹୈճ
    #secjaws

    View Slide

  2. ࠤʑ໦୓࿠
    CMPHIUUQTCMPHUBLVSPTOFU
    5XJUUFS!ELGK
    ࣗݾ঺հ #secjaws

    View Slide

  3. +BQBO"1/"NCBTTBEPS
    બग़͞Ε·ͨ͠
    ࣗݾ঺հ #secjaws

    View Slide

  4. ࠓ೔࿩͢ςʔϚ͸̐ͭ
    ෼ྨ্ͨ͠ͰݴޠԽ͢ΔͱԿͱͳ͘ղ͔Δ
    ઃܭ͢Δ্Ͱ͸ɺ·ͣσβΠϯύλʔϯΛ࡞Δ
    ۩ମతͳϙϦγʔͷઃܭྫ
    *".ͷ౾஌ࣝ
    #secjaws

    View Slide

  5. "84ͱηΩϡϦςΟ

    View Slide

  6. "84ͱηΩϡϦςΟ
    #secjaws
    ͍Ζ͍Ζ΍Δ͜ͱ͕ଟͯ͘ɺ
    ΍΍͍͜͠ͱࢥͬͨ͜ͱ͋Γ·ͤΜ͔
    શମ૾Λ೺Ѳ͢ΔͨΊʹɺͬ͘͟Γͱ
    ෼ྨͯ͠Έ·͠ΐ͏

    View Slide

  7. "84ͱηΩϡϦςΟ
    #secjaws
    "84ͷηΩϡϦςΟ͸ͭͷ࣠Ͱߟ͑Δ
    ᶃ"84಺ʹߏஙͨ͠ωοτϫʔΫͱαʔόʔͷηΩϡϦςΟ
    ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ
    ᶅ"84ૢ࡞ʹؔ͢Δݖݶʢ*".ʣ
    ᶆηΩϡϦςΟΛҡ࣋؅ཧ͢ΔͨΊͷ"84αʔϏε
    AWS Management
    Console
    Role
    VPC
    AWS Cloud
    Subnet
    Internet gateway
    Amazon Simple Storage
    Service (S3)
    VPN gateway
    Endpoints
    User
    ૢ࡞ݖݶ
    Instance Instance Instance
    AWS Lambda
    Role
    ᶅ ᶄ ᶃ
    AWS Command Line
    Interface
    AWS Config AWS Systems Manager
    AWS Service Catalog AWS Trusted Advisor AWS CloudTrail

    ηΩϡϦςΟΛҡ࣋
    ؅ཧ͢ΔαʔϏε

    View Slide

  8. ᶃ"84಺ʹߏஙͨ͠ωοτϫʔΫͱ
    αʔόʔͷηΩϡϦςΟ
    #secjaws
    ੹೚ڞ༗Ϟσϧͷ੺࿮ͷ෦෼
    ઃܭͷߟ͑ํ͸ΦϯϓϨͱେ͖͘ҧΘͳ͍͕ɺઃఆͷ࢓
    ํ͸"84ͷྲّྀʹै͏ඞཁ͕͋Δ
    IUUQTBXTBNB[PODPNKQDPNQMJBODFTIBSFESFTQPOTJCJMJUZNPEFM

    View Slide

  9. ᶄ"84ͷαʔϏε܈ͷઃܭɾઃఆ
    #secjaws
    ͍ΘΏΔϚωʔδυαʔϏε
    Ϣʔβʔࣗ਎ͰΧόʔ͢Δൣғ͸গͳ͍͕ɺαʔϏε͝
    ͱʹಛੑΛཧղ͢Δඞཁ͕͋Δ
    㱺·ͣ͸ɺ࢖͏΋ͷ͚֮ͩ͑Ε͹ྑ͍
    IUUQTXXXTMJEFTIBSFOFU"NB[PO8FC4FSWJDFT+BQBOBXTXIJUFCFMUPOMJOFTFNJOBSBXT

    View Slide

  10. ᶅ"84ͷૢ࡞ʹؔ͢Δݖݶʢ*".ʣ
    #secjaws
    "84ͷηΩϡϦςΟͷத֩ͷҰͭ
    ͲΜͳʹωοτϫʔΫ΍αʔόʔͷηΩϡϦςΟઃఆΛ͠
    ͍ͯͯ΋ɺ"84Λ௚઀ૢ࡞͞ΕΔͱ͕݀։͚ΒΕΔ
    ࠓ೔ͷςʔϚͰ͢ʂʂ

    View Slide

  11. ᶆηΩϡϦςΟΛҡ࣋؅ཧ͢Δ
    ͨΊͷ"84αʔϏε
    #secjaws
    "84ಠࣗͷ෦෼
    ར༻͠ͳͯ͘΋γεςϜΛηΩϡΞͳঢ়ଶΛҡ࣋Ͱ͖Δ͕ɺ
    ্ख͘׆༻͢ΔͱࣗྗͰ΍ΔΑΓഒָʹͳΔ
    ͷ+"846(ઍ༿Ͱɺ͜ͷςʔϚͰ࿩͢༧ఆͰ͢

    IUUQTKBXTVHDIJCBEPPSLFFQFSKQFWFOUT

    View Slide

  12. ෼ྨ͠ݴޠԽ͢Δ͜ͱʹΑΓ
    ཧղ͕ਐΉ
    #secjaws
    @kaitendaentais
    https://twitter.com/kaitendaentai/status/1052689241744896001

    View Slide

  13. *".ͷઃܭΛݴޠԽ͢Δ

    View Slide

  14. *".ͷϚχΞοΫͳ࿩ͷ঺հ
    https://takuros.booth.pm/items/1563844

    View Slide

  15. *".ͷϚχΞοΫͳ࿩ɹ໨࣍
    ͸͡Ίʹ
    ୈষ"84ͱ*".
    ୈষ*".ͷػೳ
    ୈষ*".νϡʔτϦΞϧ
    ୈষ*".ϙϦγʔͷσβΠϯύλʔϯ
    ୈষ*".άϧʔϓͷσβΠϯύλʔϯ
    ୈষ*".ͱηΩϡϦςΟ
    ୈষ*".ͷӡ༻
    ୈষ*".ͱ$MPVE'PSNBUJPO
    ୈষ*".ͷςϯϓϨʔτू
    ୈষ*".Ҏ֎ͷ"84αʔϏεͷ׆༻
    ෇࿥"ΞΧ΢ϯτ։ઃ࣌ͷઃఆνΣοΫϦετ
    #secjaws

    View Slide

  16. *".ઃܭͷجຊํ਑

    View Slide

  17. *".ઃܭͷجຊํ਑
    #secjaws
    कΔ΂͖جຊํ਑͸͚̎ͭͩ
    ೝূ৘ใΛ౪·Εͳ͍Α͏ʹ͢Δӡ༻ઃܭ
    ΞΫηεΩʔʗγʔΫϨοτΞΫηεΩʔͰ͸ͳ͘ϩʔϧͷར༻
    HJUTFDSFUTͷར༻
    ೝূ৘ใ͕౪·Εͯ΋ඃ֐Λ࠷খݶʹ͢Δݖݶઃܭ
    .'"ඞਢԽ΍*1੍ݶ΍ͳͲͷར༻੍ݶ
    ࠷খݖݶͷઃఆ

    View Slide

  18. *".ϙϦγʔͷσβΠϯύλʔϯ

    View Slide

  19. *".ϙϦγʔ
    *".ϙϦγʔͷσβΠϯύλʔϯ͸̏ͭ
    ϗϫΠτϦετɾύλʔϯ
    ϒϥοΫϦετɾύλʔϯ
    ϋΠϒϦοτɾύλʔϯ
    #secjaws

    View Slide

  20. ڐՄ͢ΔݖݶͷΈ෇༩͍ͯ͘͠ύλʔϯɹɹ
    &$΍4ͱ͍ͬͨαʔϏε୯Ґ΍ɺߋʹࡉ͔͘ΞΫγϣϯ୯ҐͰ෇༩
    "84؅ཧϙϦγʔ΋ɺ͋ΔҙຯϗϫΠτϦετύλʔϯ
    ˞Ͱ΋ɺͦͷ··࢖͏ʹ͸ૈ͍
    #secjaws
    ϗϫΠτϦετɾύλʔϯ
    FD
    %FTDSJCF

    4UPQ
    4UBSU
    ಛఆͷαʔϏεɾΞΫγϣϯͷΈڐՄ
    ڋ൱
    ڐՄ
    ڐՄ
    ڐՄ
    ڋ൱
    ϝϦοτɹ
    ࠷খݖݶͷઃܭ͕Ͱ͖Δ
    ཧղͯ͠࡞Ε͹ɺҰ൪ηΩϡΞ
    σϝϦοτɹ
    ઃܭ͕ਐ·ͳ͍ͱઃఆͰ͖ͳ͍
    ؅ཧෛՙ͕ߴ͍

    View Slide

  21. ڋ൱Λ௥Ճ͍ͯ͘͠ύλʔϯɹɹ
    ڐՄͯ͠͸͍͚ͳ͍ݖݶΛണୣ͍ͯ͘͠
    #secjaws
    ϒϥοΫϦετɾύλʔϯ
    ڐՄ
    4

    &D
    *".

    ಛఆͷαʔϏεɾΞΫγϣϯͷΈڋ൱
    ڐՄ
    ڋ൱
    ڋ൱
    ڋ൱
    ϝϦοτɹ
    ઃܭ͕࠷খݶʹͰ͖Δ
    ࣗ༝౓͕ߴ͍
    σϝϦοτɹ
    ༧ظͤ͵αʔϏε͕ಥવ࢖͑ΔΑ͏
    ʹͳΔϦεΫ͕͋Δ

    View Slide

  22. ϗϫΠτϦετɾϒϥοΫϦετͷ૊Έ߹Θͤ
    ݖݶΛ෇༩্ͨ͠Ͱɺېࢭ͍ͨ͠ݖݶΛ࡟Δ
    ˞ݫີʹ͍͏ͱɺϒϥοΫϦετύλʔϯ͸͢΂ͯϋΠϒϦοτʹͳΔ
    #secjaws
    ϋΠϒϦοτɾύλʔϯ
    ڐՄ
    "ENJOJTUSBUPS
    "DDFTT &D
    ࠷ॳʹݖݶΛ෇༩ͯ͠ɺෆཁͳݖݶΛ࡟Δ
    ϝϦοτɹ
    "84؅ཧϙϦγʔ͕࢖͍΍͍͢
    ࣗ༝౓͕ߴ͘ઃܭָ͕
    σϝϦοτɹ
    ͋·Γແ͍
    ɹ˞ॏͶ͕͚ํ๏ʹ͸஫ҙ
    *".

    ڋ൱

    View Slide

  23. *".άϧʔϓͷσβΠϯύλʔϯ

    View Slide

  24. *".άϧʔϓ
    *".άϧʔϓͷσβΠϯύλʔϯ͸̎ͭ
    ෳ਺άϧʔϓʹॴଐ
    άϧʔϓ಺ʹෳ਺ͷϙϦγʔ
    #secjaws

    View Slide

  25. Ϣʔβʔ͕ෳ਺ͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆɹ
    શࣾһ޲͚ͷڞ௨άϧʔϓͱ໾ׂผͷάϧʔϓ
    ֊૚ߏ଄Λ࡞Γ΍͍͢
    #secjaws
    ෳ਺άϧʔϓʹॴଐ

    View Slide

  26. Ϣʔβʔ͕ͭͷάϧʔϓʹଐ͢Δ͜ͱΛલఏʹݖݶઃఆ
    Ϣʔβ͔ΒΈΔͱγϯϓϧͳߏ੒
    ݖݶͷݟ௨͕͠ྑ͍
    #secjaws
    άϧʔϓ಺ʹෳ਺ϙϦγʔ

    View Slide

  27. ύλʔϯͷݪଇΛ౿·্͑ͨͰ
    ۩ମతͳઃܭʹམͱ͠ࠐΉ

    View Slide

  28. ڞ௨Ͱར༻͢ΔϙϦγʔͰ·ͣݕ౼͢Δͷ͸͜ͷͭ
    .'"ඞਢԽ͸ඞͣ͢Δ͜ͱ
    *1੍ݶ͸ɺӡ༻ϙϦγʔͱ૬ஊɻ࡞ۀ৔ॴΛ੍ݶͰ͖Δͱ͍͏ޮՌ͕͋Δ
    #secjaws
    .'"ඞਢԽͱ*1੍ݶ
    \
    &⒎FDU%FOZ
    "DUJPO
    $POEJUJPO\
    /PU*Q"EESFTT\
    BXT4PVSDF*Q<

    >
    ^
    ^
    3FTPVSDF
    ^
    \
    &⒎FDU%FOZ
    /PU"DUJPO<
    JBN
    >
    3FTPVSDF
    $POEJUJPO\
    #PPM*G&YJTUT\
    BXT.VMUJ'BDUPS"VUI1SFTFOUGBMTF
    ^
    ^
    ^

    View Slide

  29. "ENJOݖݶΛ෇༩্ͨ͠Ͱ੍ݶΛՃ͑Δ
    .'"ඞਢˍ*1ΞυϨε੍ݶ
    *1੍ݶΛͳͨ͘͢Ίͷ؅ཧऀ༻ϩʔϧ
    #secjaws
    ؅ཧऀݖݶͷઃܭ
    㱺εΠονલΛࢀরݖݶͷΈʹ͢Δͱ͍͏ઃܭ΋Α͋͘Δ

    View Slide

  30. ϩάΠϯ࣌͸ࢀরݖݶͷΈ
    ࢀরݖݶͱ4XJUDI3PMFΛڐՄ͢ΔݖݶΛ෇༩
    εΠονϩʔϧ͢Δ͜ͱʹΑΓ؅ཧऀݖݶ͕ར༻Մೳ
    ஈΫογϣϯΛஔ͘͜ͱʹΑΓɺΦϖϛεͷ๷ࢭޮՌΛૂ͏
    #secjaws
    ؅ཧऀݖݶͷ҆શઃܭ

    View Slide

  31. ৬຿ػೳͷ"84؅ཧϙϦγʔͷ׆༻
    ಛఆͷ༻్޲͚ͷݖݶηοτʢ৬຿ػೳͷ"84؅ཧϙϦγʔʣ
    FDͷݖݶ͸ɺΠϯελϯεͷૢ࡞ͱωοτϫʔΫૢ࡞ؚ͕·Ε͍ͯΔͷͰ
    ஫ҙ͕ඞཁ
    #secjaws
    ωοτϫʔΫ؅ཧऀͷઃܭ

    View Slide

  32. ౾஌ࣝT

    View Slide

  33. 1SJODJQBMΛߜΒͳ͍ͱɺશϢʔβʔ͕εΠονͰ͖Δ
    σϑΥϧτςϯϓϨʔτͷઃఆ͸ɺΞΧ΢ϯτ಺ͷϢʔβʔʹରͯ͠
    ߜΔඞཁ͕͋ΓɺϢʔβʔࢦఆͰߜΔʢάϧʔϓ͸Ͱ͖ͳ͍ʣ
    ผղͱͯ͠"TTVNF3PMFͷݖݶΛ͢΂ͯണୣͷ͏͑ͰɺඞཁͳϢʔβʔʹ
    ෇༩͢Δͱ͍͏ํ๏΋͋Δ
    #secjaws
    εΠονϩʔϧͷ஫ҙ఺
    \
    7FSTJPO
    4UBUFNFOU<
    \
    &⒎FDU"MMPX
    1SJODJQBM\
    "84BSOBXTJBN
    SPPU
    ^
    "DUJPOTUT"TTVNF3PMF
    $POEJUJPO\^
    ^
    >
    ^
    \
    7FSTJPO
    4UBUFNFOU<
    \
    &⒎FDU"MMPX
    1SJODJQBM\
    "84BSOBXTJBNVTFSUFTU
    VTFS
    ^
    "DUJPOTUT"TTVNF3PMF
    $POEJUJPO\^
    ^
    >
    ^

    View Slide

  34. ϕετϓϥΫςΟε͚ͩͲɻɻɻ
    ઃܭ͕ݻ·্ͬͨͰɺ*".ʹؔ͢Δߴ౓ͳ஌͕ࣝඞཁ
    ϓϩάϥϜతͳར༻ʹ͸޲͍͍ͯΔ͕ɺ"84ίϯιʔϧ͔Βͷར༻͸޲͍
    ͍ͯͳ͍
    ৽نαʔϏεͷ௥Ճʹऑ͍
    ͦ΋ͦ΋"ENJOݖݶΛ͍࣋ͬͯΔਓ͔͠࠷খݖݶΛ௥ٻͰ͖ͳ͍
    ઃܭɾӡ༻޻਺͕େ͖͍
    ݱ࣮తͳӡ༻
    ఆܕతͳ࡞ۀʢ-BNCEBɾόον౳ʣͷΈ࠷খݖݶΛ෇༩
    ਓؒܥͷ࡞ۀ͸ɺϒϥοΫϦετͷ׆༻΋ࢹ໺ʹ
    ηΩϡϦςΟࣄނΛى͜͞ͳ͍ͱ͍͏؍఺Ͱ࠷খݖݶΛ୳ٻ
    #secjaws
    ࠷খݖݶͷδϨϯϚ

    View Slide

  35. #secjaws
    ͜Ε͚ͩ͸΍͓͚ͬͯ
    "84ΞΧ΢ϯτʹ࠷௿ݶɺԼهͷઃఆΛ͢Δ
    ϧʔτΞΧ΢ϯτͷ.'"ઃఆ
    ؅ཧऀ༻ͷ*".άϧʔϓͱ*".Ϣʔβʔͷ࡞੒
    *".ύεϫʔυϙϦγʔͷద༻
    $MPVE5SBJMͱ$POpH (VBSE%VUZͷ༗ޮԽ
    5SVTUFE"EWJTPUSͷ&ϝʔϧ௨஌ઃఆ
    $PTU6TBHF3FQPSUͷग़ྗ
    *".Ϣʔβʔ΁ͷ੥ٻ৘ใͷΞΫηεڐՄ
    ࢧ෷͍௨՟Λ೔ຊԁʹมߋ
    ίετ഑෼λάͷઃఆ
    ୅ସ࿈བྷઌͷઃఆ

    View Slide

  36. #secjaws
    ͜Ε͸΍ͬͪΌμϝ
    *".Ͱ͜ΕΛ΍ͬͪΌμϝ
    ϧʔτϢʔβʔͰӡ༻
    ར༻ऀશһɺ"ENJOݖݶ
    ؅ཧऀҎ֎ʹ*".ݖݶΛ෇༩
    ڞ༻ͷ*".Ϣʔβʔͷ࡞੒
    ෳ਺ͷ$-*ɾϓϩάϥϜ͔Βͷ*".Ϣʔβʔʗϩʔϧͷڞ༻
    ιʔείʔυʹΫϨσϯγϟϧʢΞΫηεΩʔɾγʔΫϨοτΞ
    ΫηεΩʔʣͷຒΊࠐΈ
    -BNCEB'VMM"DDFTTͷ෇༩
    ωοτϫʔΫ؅ཧऀҎ֎ʹ&$'VMM"DDFTTͷ෇༩
    4ͷΞΫηείϯτϩʔϧΛ*".͚ͩͰߦ͏ʢόέοτϙϦγʔ
    ͷซ༻ඞਢʣ

    View Slide

  37. ·ͱΊ

    View Slide

  38. ࠓ೔࿩ͨ͠ςʔϚ
    ෼ྨ্ͨ͠ͰݴޠԽ͢ΔͱԿͱͳ͘ղ͔Δ
    ઃܭ͢Δ্Ͱ͸ɺ·ͣσβΠϯύλʔϯΛ࡞Δ
    ۩ମతͳϙϦγʔͷઃܭྫ
    *".ͷ౾஌ࣝ
    #secjaws

    View Slide

  39. ͓·͚
    *".ຊʢμ΢ϯϩʔυ൛ʣΛ
    ϓϨθϯτ
    #secjaws

    View Slide

  40. એ఻
    పఈ׆༻(PPHMFΞφϦςΟΫε
    σδλϧϚʔέςΟϯάΛ੒ޭʹ
    ಋ͘ղੳɾվળͷͨΊͷૢ࡞ΨΠυ
    IUUQTBN[OUP181M
    #secjaws

    View Slide