セキュリティパッチを支える サーバ家畜化技術の紹介

DevOpsDays Tokyo 2018登壇資料です。

セキュリティパッチを継続的に適用するためのパブリッククラウド前提のアーキテクチャ実例についてです。

Transcript

1. Copyright © 2009-2018 eureka, inc. All rights reserved. Takuya Onda / eureka, Inc. 2018-04-25 DevOpsDays Tokyo ηΩϡϦςΟύονΛࢧ͑Δ αʔόՈசԽٕज़ͷ঺հ
2. Introduction ▪ Takuya Onda – eureka, Inc. – SRE team Head
3. CONFIDENTIAL
5. About Us - IAC/Match Group
6. Agenda ▪ 1.ܧଓతͳ੬ऑੑ਍அख๏ͷ঺հ ▪ 2.੬ऑੑରԠͷ೔ৗԽ΁ͷ௅ઓ ▪ 3.αʔόՈசԽͷ࣮ફͱϕετϓϥΫςΟε ▪ 4.·ͱΊ
7. ܧଓతͳ੬ऑੑ਍அख๏ͷ঺հ
8. લఏ ▪ ੬ऑੑ਍அͷ໨త͸ձࣾϦεΫͷՄࢹԽ – ϗετܕ਍அͰΘ͔Δ੬ऑੑ͸ϦεΫͷ΄ΜͷҰଆ໘ ▪ ηΩϡϦςΟରԠʹۜͷ஄ؙ͸ͳ͍ – ܧଓతͳऔΓ૊Έ͕େࣄ
9. AWS Inspector x Lambda x CloudWatchʹΑΔఆظ਍அ Role : API Env : Prod Is_target : True εέδϡʔϧ ࣗಈൃՐ Ansible Golden AMI Packer Lambda Inspector ධՁ࣮ߦ Apply
10. ਍அ݁ՌͱϨϏϡʔ & ରԠαΠΫϧ Inspector ਍அ݁Ռ ରԠ༗ແͷ ൑அ νʔϜόοΫϩά΁ मਖ਼ ணख Patch & Build Apply Inspector
 ਍அఆظ࣮ߦ CVEݕग़ Best Practiceҳ୤ ϧʔϧύοέʔδ Golden AMI SRE
11. ੬ऑੑରԠͷ೔ৗԽ΁ͷ௅ઓ
12. ੬ऑੑ਍அͱରԠͷؒʹଘࡏ͢Δน ▪ ਍அΧόϨοδΛߴΊΔ – ਍அ—> ҙࢥܾఆ —> ࣮ߦ —> ࠶਍அͷαΠΫϧΛճ͢ – ҙࢥܾఆɿϦεΫͷ௿ݮ / อ༗ / ճආ / Ҡస ▪ ੬ऑੑରԠΛ೔ৗԽ͍ͨ͠ – ΍ΕΔ >> |น| >> Մೳ > ෆՄೳ – ϦεΫͷՄࢹԽ —> ରԠͷϦʔυλΠϜΛݮΒ͍ͨ͠
13. ੬ऑੑ਍அܗ֚Խ΁ͷಓ Inspector ਍அ݁Ռ ରԠ༗ແͷ ൑அ νʔϜόοΫϩά΁ मਖ਼ ணख Patch & Build Apply Inspector
 ਍அఆظ࣮ߦ ຊ൪΁ͷมߋ͕πϥΠͱ ୭΋ରԠ͠ͳ͘ͳΔ ରԠνέοτ͕ ͨͩͨͩੵ·Ε͍ͯ͘
14. αʔόՈசԽͷ໨త ▪ ՔಇதͷγεςϜ΁มߋΛՃ͑΍͘͢͢Δ – Deployͱಉ͡ɻૣ͘খࣦ͘͞ഊ͠΍͘͢ – ຊ൪΁ͷมߋΛ೔ৗԽ ▪ αʔόͷަ׵ੑΛߴ͘͠ɺଘ໋ظؒΛ୹͘͢Δ – ަ׵ > ܧ͗଍͠ – ImmutableͳServer Configuration
15. αʔόՈசԽͷ࣮ફͱϕετϓϥΫςΟε
16. Tips1:઴ਐతͳαʔόϩʔϧΞ΢τ ▪ খ͘͞ࢼͤΕ͹ා͘ͳ͍ – ΧφϦΞαʔό / xx%ϦϦʔεͱখ͞ͳࣦഊ Patched AMI Update LaunchConfig 1/xx ϦϦʔε
17. Tips2:ୀ࿏ͷ֬อ ▪ ͙͢ؾ͚ͮΔ & ͙͢໭ͤΔ – SLOͷՄࢹԽͱΰʔϧσϯΠϝʔδͷόʔδϣχϯά Golden AMI’s Update LaunchConfig Πϝʔδ͝ͱ
 ੾Γ໭͠
18. Tips3:εςʔτϨεԽͱεέδϡʔϦϯά͞Εͨୀ໾ ▪ αʔόϩʔςʔτͷखஈͱͯ͠ͷAuto Scaling – αʔόͷࣗಈୀ໾ > ϫʔΫϩʔυͷௐ੔ Scheduling Rotate API Bastion
19. Tips4:࠶ݱੑͷߴ͍εςʔδϯά؀ڥ ▪ ಉ͡ϓϩϏδϣχϯάϓϩηεͱٕज़ελοΫ – ݕূਫ਼౓ΛߴΊΔͨΊͷInfrastructure as Codeͷపఈ Production Staging Production
 Capacity Less
 Capacity
20. Tips5:ϚωʔδυαʔϏεͷੵۃ׆༻ ▪ ঢ়ଶΛอͭαʔό͸ަ׵͕େม – ڊਓ(AWS)ͷݞʹ৐Δɻ؅ཧର৅ΛݮΒ͢Ξϓϩʔν S3 Aurora Dynamo ElastiCache SQS
21. ·ͱΊ
22. ·ͱΊ ▪ ੬ऑੑ਍அΧόϨοδΛߴΊΔධՁࣗಈԽ – AWS Inspector x Lambda x CloudWatchʹΑΔఆظ࣮ߦ ▪ ੬ऑੑରԠΛ೔ৗԽ͢Δ – มߋΛՃ͑΍͍͢ΞʔΩςΫνϟ = αʔόՈசԽͷ࣮ફ ▪ αʔόՈசԽϕετϓϥΫςΟεͷ঺հ – ࠶ݱੑ/઴ਐతϦϦʔε/ୀ࿏ͷ֬อ/ࣗಈୀ໾/Ϛωʔδυར༻
23. ͦͷଞ ▪ ੬ऑੑ਍அͷ໨త͸ձࣾϦεΫͷՄࢹԽ – ϗετܕ਍அͰΘ͔Δ੬ऑੑ͸ϦεΫͷ΄ΜͷҰଆ໘ ▪ ηΩϡϦςΟରԠʹۜͷ஄ؙ͸ͳ͍ – ܧଓతͳऔΓ૊Έ͕େࣄ
24. CONFIDENTIAL Thank you :) Thank you :)
25. Any Questions??