Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS WAFのログが3時間しか見れないのでなんとかしてみる

C97900102deff1d3359eb64c9a00b080?s=47 Tmorinaga
February 14, 2017

AWS WAFのログが3時間しか見れないのでなんとかしてみる

Ops JAWS #10

C97900102deff1d3359eb64c9a00b080?s=128

Tmorinaga

February 14, 2017
Tweet

Transcript

  1. AWS WAFͷϩά͕ 3͔࣌ؒ͠ݟΕͳ͍ͷͰ ͳΜͱ͔ͯ͠ΈΔ Ϋϥεϝιουגࣜձࣾ ιϦϡʔγϣϯΞʔΩςΫτ ৿Ӭେࢤ

  2. ࣗݾ঺հ

  3. ɹɹɹɹɹɹ৿Ӭ େࢤ(@morimoritaitai) AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ ✦ झຯ : ήʔϜ / ञ

    / Χϝϥ ✦ ڵຯ : Security / OpsࣗಈԽ ✦ ޷͖:Config/CloudTrail/IAM/PHD ✦ ྘৭ͷαʔϏε͕޷͖ͳϑϨϯζ ✦ AWSೝఆࢿ֨5ף
  4. ձࣾ঺հ

  5. ϒϩάͷձࣾ

  6. AWS WAF࢖ͬͯ·͔͢ʁ

  7. AWS WAFͱ͸ • CloudFrontͱALBʹ࢓ࠐΊΔϚωʔδυWAF • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅͸ຬͨ ͤΔ • ͦΜͳʹෳࡶͳઃఆ͸ग़དྷͳ͍͚Ͳ؆қͳ

    WAF͕΄͍͠ͳΒ͘͢͝ศར
  8. AWS WAFศརͳΜͰ͕͢ɺ 1఺͍͚ͨͩͳ͍͜ͱ͕…

  9. Πϕϯτϩά͕3͔࣌ؒ͠ ݟΕͳ͍໰୊

  10. ४ϦΞϧλΠϜͷ ΠϯγσϯτରԠͱߟ͑Ε͹ ෼͔Βͳ͘͸ͳ͍

  11. Ͱ΋΍ͬͺΓΠϕϯτϩά͸ ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠

  12. ͳΜͱ͔ͯ͠ΈΔ

  13. ߏ੒Λߟ͑Δ • AWS WAFͷΠϕϯτ͸CloudWatchͰݕ஌ • CloudWatchͷΞϥʔτΛSNSͰൃใ • SNSͰLambdaΛൃՐ • Lambda͕AWS

    WAFͷϩάΛऔಘ͠S3΁อଘ
  14. ߏ੒ਤ ᶃ Πϕϯτൃੜ ᶄΞϥʔϜൃใ ᶅ SNS௨஌ ᶆ ϩάऔಘ ᶇ ϩάอ؅

    WAF CloudWatch SNS Lambda S3
  15. SNSτϐοΫ࡞੒

  16. CloudWatchΞϥʔτ࡞੒ 1ͭͰ΋ϒϩοΫ͕͋Ε͹ SNSͰ௨஌

  17. ϩάอ؅༻S3όέοτ࡞੒

  18. Lambda༻IAMϩʔϧ࡞੒ • AmazonS3FullAccess • AWSWAFReadOnlyAccess • AWSLambdaBasicExecutionRole

  19. LambdaϑΝϯΫγϣϯ࡞੒ • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py

  20. LambdaϑΝϯΫγϣϯ࡞੒ SNSΛΠϕϯτιʔεʹ

  21. LambdaϑΝϯΫγϣϯ࡞੒ ؀ڥม਺ͰS3όέοτ໊ࢦఆ ࡞੒ͨ͠IAM RoleΛࢦఆ

  22. ࢼ͢ Α͋͘ΔSQLΠϯδΣΫγϣϯྫ

  23. ࢼ͢ ϒϩοΫ͞Εͨ

  24. 5෼ޙ

  25. ࢼ͢ S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ

  26. ஫ҙ఺ • AWS WAFଆͷ࢓༷ͰPOSTͷத਎͸ݟΕͳ͍ • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ • Sample Requests͸100͔݅͠औΕͳ͍ͷͰɺ Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ

  27. ࠷ޙʹ • ͍ͭެࣜରԠͯ͠΋͓͔͘͠ͳ͍ͷͰυΩυ Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠ • POSTͷத਎Λه࿥͍ͨ͠…ʂ • ϓϧϦΫ͍ͩ͘͞ • https://github.com/Tmorinaga/aws-waf-

    logger/blob/master/aws-waf-logger.py
  28. JAWS DAYS2017ʹొஃ͠·͢ • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ೤͘ޠΓ·͢ • ଞʹ΋Sec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯ΋஻Γ·͢

  29. None