セキュリティパッチを支える サーバ家畜化技術の紹介

Transcript

1. Copyright © 2009-2018 eureka, inc. All rights reserved. Takuya Onda

   / eureka, Inc. 2018-04-25 DevOpsDays Tokyo ηΩϡϦςΟύονΛࢧ͑Δ αʔόՈசԽٕज़ͷ঺հ

2. Introduction ▪ Takuya Onda – eureka, Inc. – SRE team

   Head

3. CONFIDENTIAL

4. None

5. About Us - IAC/Match Group

6. Agenda ▪ 1.ܧଓతͳ੬ऑੑ਍அख๏ͷ঺հ ▪ 2.੬ऑੑରԠͷ೔ৗԽ΁ͷ௅ઓ ▪ 3.αʔόՈசԽͷ࣮ફͱϕετϓϥΫςΟε ▪ 4.·ͱΊ

7. ܧଓతͳ੬ऑੑ਍அख๏ͷ঺հ

8. લఏ ▪ ੬ऑੑ਍அͷ໨త͸ձࣾϦεΫͷՄࢹԽ – ϗετܕ਍அͰΘ͔Δ੬ऑੑ͸ϦεΫͷ΄ΜͷҰଆ໘ ▪ ηΩϡϦςΟରԠʹۜͷ஄ؙ͸ͳ͍ – ܧଓతͳऔΓ૊Έ͕େࣄ

9. AWS Inspector x Lambda x CloudWatchʹΑΔఆظ਍அ Role : API Env

   : Prod Is_target : True εέδϡʔϧ ࣗಈൃՐ Ansible Golden AMI Packer Lambda Inspector ධՁ࣮ߦ Apply

10. ਍அ݁ՌͱϨϏϡʔ & ରԠαΠΫϧ Inspector ਍அ݁Ռ ରԠ༗ແͷ ൑அ νʔϜόοΫϩά΁ मਖ਼ ணख

    Patch & Build Apply Inspector
 ਍அఆظ࣮ߦ CVEݕग़ Best Practiceҳ୤ ϧʔϧύοέʔδ Golden AMI SRE

11. ੬ऑੑରԠͷ೔ৗԽ΁ͷ௅ઓ

12. ੬ऑੑ਍அͱରԠͷؒʹଘࡏ͢Δน ▪ ਍அΧόϨοδΛߴΊΔ – ਍அ—> ҙࢥܾఆ —> ࣮ߦ —> ࠶਍அͷαΠΫϧΛճ͢

    – ҙࢥܾఆɿϦεΫͷ௿ݮ / อ༗ / ճආ / Ҡస ▪ ੬ऑੑରԠΛ೔ৗԽ͍ͨ͠ – ΍ΕΔ >> |น| >> Մೳ > ෆՄೳ – ϦεΫͷՄࢹԽ —> ରԠͷϦʔυλΠϜΛݮΒ͍ͨ͠

13. ੬ऑੑ਍அܗ֚Խ΁ͷಓ Inspector ਍அ݁Ռ ରԠ༗ແͷ ൑அ νʔϜόοΫϩά΁ मਖ਼ ணख Patch &

    Build Apply Inspector
 ਍அఆظ࣮ߦ ຊ൪΁ͷมߋ͕πϥΠͱ ୭΋ରԠ͠ͳ͘ͳΔ ରԠνέοτ͕ ͨͩͨͩੵ·Ε͍ͯ͘

14. αʔόՈசԽͷ໨త ▪ ՔಇதͷγεςϜ΁มߋΛՃ͑΍͘͢͢Δ – Deployͱಉ͡ɻૣ͘খࣦ͘͞ഊ͠΍͘͢ – ຊ൪΁ͷมߋΛ೔ৗԽ ▪ αʔόͷަ׵ੑΛߴ͘͠ɺଘ໋ظؒΛ୹͘͢Δ –

    ަ׵ > ܧ͗଍͠ – ImmutableͳServer Configuration

15. αʔόՈசԽͷ࣮ફͱϕετϓϥΫςΟε

16. Tips1:઴ਐతͳαʔόϩʔϧΞ΢τ ▪ খ͘͞ࢼͤΕ͹ා͘ͳ͍ – ΧφϦΞαʔό / xx%ϦϦʔεͱখ͞ͳࣦഊ Patched AMI Update

    LaunchConfig 1/xx ϦϦʔε

17. Tips2:ୀ࿏ͷ֬อ ▪ ͙͢ؾ͚ͮΔ & ͙͢໭ͤΔ – SLOͷՄࢹԽͱΰʔϧσϯΠϝʔδͷόʔδϣχϯά Golden AMI’s Update

    LaunchConfig Πϝʔδ͝ͱ
 ੾Γ໭͠

18. Tips3:εςʔτϨεԽͱεέδϡʔϦϯά͞Εͨୀ໾ ▪ αʔόϩʔςʔτͷखஈͱͯ͠ͷAuto Scaling – αʔόͷࣗಈୀ໾ > ϫʔΫϩʔυͷௐ੔ Scheduling Rotate

    API Bastion

19. Tips4:࠶ݱੑͷߴ͍εςʔδϯά؀ڥ ▪ ಉ͡ϓϩϏδϣχϯάϓϩηεͱٕज़ελοΫ – ݕূਫ਼౓ΛߴΊΔͨΊͷInfrastructure as Codeͷపఈ Production Staging Production


    Capacity Less
 Capacity

20. Tips5:ϚωʔδυαʔϏεͷੵۃ׆༻ ▪ ঢ়ଶΛอͭαʔό͸ަ׵͕େม – ڊਓ(AWS)ͷݞʹ৐Δɻ؅ཧର৅ΛݮΒ͢Ξϓϩʔν S3 Aurora Dynamo ElastiCache SQS

21. ·ͱΊ

22. ·ͱΊ ▪ ੬ऑੑ਍அΧόϨοδΛߴΊΔධՁࣗಈԽ – AWS Inspector x Lambda x CloudWatchʹΑΔఆظ࣮ߦ

    ▪ ੬ऑੑରԠΛ೔ৗԽ͢Δ – มߋΛՃ͑΍͍͢ΞʔΩςΫνϟ = αʔόՈசԽͷ࣮ફ ▪ αʔόՈசԽϕετϓϥΫςΟεͷ঺հ – ࠶ݱੑ/઴ਐతϦϦʔε/ୀ࿏ͷ֬อ/ࣗಈୀ໾/Ϛωʔδυར༻

23. ͦͷଞ ▪ ੬ऑੑ਍அͷ໨త͸ձࣾϦεΫͷՄࢹԽ – ϗετܕ਍அͰΘ͔Δ੬ऑੑ͸ϦεΫͷ΄ΜͷҰଆ໘ ▪ ηΩϡϦςΟରԠʹۜͷ஄ؙ͸ͳ͍ – ܧଓతͳऔΓ૊Έ͕େࣄ

24. CONFIDENTIAL Thank you :) Thank you :)

25. Any Questions??