Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS WAFのログが3時間しか見れないのでなんとかしてみる

Tmorinaga
February 14, 2017

AWS WAFのログが3時間しか見れないのでなんとかしてみる

Ops JAWS #10

Tmorinaga

February 14, 2017
Tweet

More Decks by Tmorinaga

Other Decks in Technology

Transcript

  1. AWS WAFͷϩά͕
    3͔࣌ؒ͠ݟΕͳ͍ͷͰ
    ͳΜͱ͔ͯ͠ΈΔ
    Ϋϥεϝιουגࣜձࣾ
    ιϦϡʔγϣϯΞʔΩςΫτ ৿Ӭେࢤ

    View full-size slide

  2. ɹɹɹɹɹɹ৿Ӭ େࢤ(@morimoritaitai)
    AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ
    ✦ झຯ : ήʔϜ / ञ / Χϝϥ
    ✦ ڵຯ : Security / OpsࣗಈԽ
    ✦ ޷͖:Config/CloudTrail/IAM/PHD
    ✦ ྘৭ͷαʔϏε͕޷͖ͳϑϨϯζ
    ✦ AWSೝఆࢿ֨5ף

    View full-size slide

  3. ϒϩάͷձࣾ

    View full-size slide

  4. AWS WAF࢖ͬͯ·͔͢ʁ

    View full-size slide

  5. AWS WAFͱ͸
    • CloudFrontͱALBʹ࢓ࠐΊΔϚωʔδυWAF
    • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ
    γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅͸ຬͨ
    ͤΔ
    • ͦΜͳʹෳࡶͳઃఆ͸ग़དྷͳ͍͚Ͳ؆қͳ
    WAF͕΄͍͠ͳΒ͘͢͝ศར

    View full-size slide

  6. AWS WAFศརͳΜͰ͕͢ɺ
    1఺͍͚ͨͩͳ͍͜ͱ͕…

    View full-size slide

  7. Πϕϯτϩά͕3͔࣌ؒ͠
    ݟΕͳ͍໰୊

    View full-size slide

  8. ४ϦΞϧλΠϜͷ
    ΠϯγσϯτରԠͱߟ͑Ε͹
    ෼͔Βͳ͘͸ͳ͍

    View full-size slide

  9. Ͱ΋΍ͬͺΓΠϕϯτϩά͸
    ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠

    View full-size slide

  10. ͳΜͱ͔ͯ͠ΈΔ

    View full-size slide

  11. ߏ੒Λߟ͑Δ
    • AWS WAFͷΠϕϯτ͸CloudWatchͰݕ஌
    • CloudWatchͷΞϥʔτΛSNSͰൃใ
    • SNSͰLambdaΛൃՐ
    • Lambda͕AWS WAFͷϩάΛऔಘ͠S3΁อଘ

    View full-size slide

  12. ߏ੒ਤ
    ᶃ Πϕϯτൃੜ
    ᶄΞϥʔϜൃใ
    ᶅ SNS௨஌
    ᶆ ϩάऔಘ
    ᶇ ϩάอ؅
    WAF CloudWatch SNS
    Lambda
    S3

    View full-size slide

  13. SNSτϐοΫ࡞੒

    View full-size slide

  14. CloudWatchΞϥʔτ࡞੒
    1ͭͰ΋ϒϩοΫ͕͋Ε͹
    SNSͰ௨஌

    View full-size slide

  15. ϩάอ؅༻S3όέοτ࡞੒

    View full-size slide

  16. Lambda༻IAMϩʔϧ࡞੒
    • AmazonS3FullAccess
    • AWSWAFReadOnlyAccess
    • AWSLambdaBasicExecutionRole

    View full-size slide

  17. LambdaϑΝϯΫγϣϯ࡞੒
    • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py

    View full-size slide

  18. LambdaϑΝϯΫγϣϯ࡞੒
    SNSΛΠϕϯτιʔεʹ

    View full-size slide

  19. LambdaϑΝϯΫγϣϯ࡞੒
    ؀ڥม਺ͰS3όέοτ໊ࢦఆ
    ࡞੒ͨ͠IAM RoleΛࢦఆ

    View full-size slide

  20. ࢼ͢
    Α͋͘ΔSQLΠϯδΣΫγϣϯྫ

    View full-size slide

  21. ࢼ͢
    ϒϩοΫ͞Εͨ

    View full-size slide

  22. ࢼ͢
    S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ

    View full-size slide

  23. ஫ҙ఺
    • AWS WAFଆͷ࢓༷ͰPOSTͷத਎͸ݟΕͳ͍
    • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ
    • Sample Requests͸100͔݅͠औΕͳ͍ͷͰɺ
    Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ

    View full-size slide

  24. ࠷ޙʹ
    • ͍ͭެࣜରԠͯ͠΋͓͔͘͠ͳ͍ͷͰυΩυ
    Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠
    • POSTͷத਎Λه࿥͍ͨ͠…ʂ
    • ϓϧϦΫ͍ͩ͘͞
    • https://github.com/Tmorinaga/aws-waf-
    logger/blob/master/aws-waf-logger.py

    View full-size slide

  25. JAWS DAYS2017ʹొஃ͠·͢
    • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ೤͘ޠΓ·͢
    • ଞʹ΋Sec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯ΋஻Γ·͢

    View full-size slide