AWS WAFのログが3時間しか見れないのでなんとかしてみる

Ops JAWS #10

Transcript

1. AWS WAFͷϩά͕
   3͔࣌ؒ͠ݟΕͳ͍ͷͰ
   ͳΜͱ͔ͯ͠ΈΔ
   Ϋϥεϝιουגࣜձࣾ
   ιϦϡʔγϣϯΞʔΩςΫτ ৿Ӭେࢤ
   

   View Slide

2. ࣗݾ঺հ
   

   View Slide

3. ɹɹɹɹɹɹ৿Ӭ େࢤ(@morimoritaitai)
   AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ
   ✦ झຯ : ήʔϜ / ञ / Χϝϥ
   ✦ ڵຯ : Security / OpsࣗಈԽ
   ✦ ޷͖:Config/CloudTrail/IAM/PHD
   ✦ ྘৭ͷαʔϏε͕޷͖ͳϑϨϯζ
   ✦ AWSೝఆࢿ֨5ף
   

   View Slide

4. ձࣾ঺հ
   

   View Slide

5. ϒϩάͷձࣾ
   

   View Slide

6. AWS WAF࢖ͬͯ·͔͢ʁ
   

   View Slide

7. AWS WAFͱ͸
   • CloudFrontͱALBʹ࢓ࠐΊΔϚωʔδυWAF
   • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ
   γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅͸ຬͨ
   ͤΔ
   • ͦΜͳʹෳࡶͳઃఆ͸ग़དྷͳ͍͚Ͳ؆қͳ
   WAF͕΄͍͠ͳΒ͘͢͝ศར
   

   View Slide

8. AWS WAFศརͳΜͰ͕͢ɺ
   1఺͍͚ͨͩͳ͍͜ͱ͕…
   

   View Slide

9. Πϕϯτϩά͕3͔࣌ؒ͠
   ݟΕͳ͍໰୊
   

   View Slide

10. ४ϦΞϧλΠϜͷ
    ΠϯγσϯτରԠͱߟ͑Ε͹
    ෼͔Βͳ͘͸ͳ͍
    

    View Slide

11. Ͱ΋΍ͬͺΓΠϕϯτϩά͸
    ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠
    

    View Slide

12. ͳΜͱ͔ͯ͠ΈΔ
    

    View Slide

13. ߏ੒Λߟ͑Δ
    • AWS WAFͷΠϕϯτ͸CloudWatchͰݕ஌
    • CloudWatchͷΞϥʔτΛSNSͰൃใ
    • SNSͰLambdaΛൃՐ
    • Lambda͕AWS WAFͷϩάΛऔಘ͠S3΁อଘ
    

    View Slide

14. ߏ੒ਤ
    ᶃ Πϕϯτൃੜ
    ᶄΞϥʔϜൃใ
    ᶅ SNS௨஌
    ᶆ ϩάऔಘ
    ᶇ ϩάอ؅
    WAF CloudWatch SNS
    Lambda
    S3
    

    View Slide

15. SNSτϐοΫ࡞੒
    

    View Slide

16. CloudWatchΞϥʔτ࡞੒
    1ͭͰ΋ϒϩοΫ͕͋Ε͹
    SNSͰ௨஌
    

    View Slide

17. ϩάอ؅༻S3όέοτ࡞੒
    

    View Slide

18. Lambda༻IAMϩʔϧ࡞੒
    • AmazonS3FullAccess
    • AWSWAFReadOnlyAccess
    • AWSLambdaBasicExecutionRole
    

    View Slide

19. LambdaϑΝϯΫγϣϯ࡞੒
    • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py
    

    View Slide

20. LambdaϑΝϯΫγϣϯ࡞੒
    SNSΛΠϕϯτιʔεʹ
    

    View Slide

21. LambdaϑΝϯΫγϣϯ࡞੒
    ؀ڥม਺ͰS3όέοτ໊ࢦఆ
    ࡞੒ͨ͠IAM RoleΛࢦఆ
    

    View Slide

22. ࢼ͢
    Α͋͘ΔSQLΠϯδΣΫγϣϯྫ
    

    View Slide

23. ࢼ͢
    ϒϩοΫ͞Εͨ
    

    View Slide

24. 5෼ޙ
    

    View Slide

25. ࢼ͢
    S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ
    

    View Slide

26. ஫ҙ఺
    • AWS WAFଆͷ࢓༷ͰPOSTͷத਎͸ݟΕͳ͍
    • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ
    • Sample Requests͸100͔݅͠औΕͳ͍ͷͰɺ
    Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ
    

    View Slide

27. ࠷ޙʹ
    • ͍ͭެࣜରԠͯ͠΋͓͔͘͠ͳ͍ͷͰυΩυ
    Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠
    • POSTͷத਎Λه࿥͍ͨ͠…ʂ
    • ϓϧϦΫ͍ͩ͘͞
    • https://github.com/Tmorinaga/aws-waf-
    logger/blob/master/aws-waf-logger.py
    

    View Slide

28. JAWS DAYS2017ʹొஃ͠·͢
    • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ೤͘ޠΓ·͢
    • ଞʹ΋Sec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯ΋஻Γ·͢
    

    View Slide

29. View Slide