Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS WAFのログが3時間しか見れないのでなんとかしてみる
Search
Tmorinaga
February 14, 2017
Technology
3
4.3k
AWS WAFのログが3時間しか見れないのでなんとかしてみる
Ops JAWS #10
Tmorinaga
February 14, 2017
Tweet
Share
More Decks by Tmorinaga
See All by Tmorinaga
OpsJAWS#13 IAMベストプラクティス
tmorinaga
1
3.9k
Developers.IO 2017 E3
tmorinaga
0
1.3k
JAWS DAYS 2017 Security-JAWS発表資料
tmorinaga
2
4.8k
re:Growth 2016 in Tokyo
tmorinaga
0
2.2k
Developers.IO 2016 in Fukuoka
tmorinaga
1
860
【エンジニア編】AWS活用を考えているなら”必ず!"知っておくべきセキュリティの話
tmorinaga
1
4.4k
【ビジネス編】AWS活用を考えているなら”必ず!"知っておくべきセキュリティの話
tmorinaga
1
2.3k
OpsJAWS#4 CloudWatch Events Hands-on
tmorinaga
3
1.8k
Other Decks in Technology
See All in Technology
Modern Linux
oracle4engineer
PRO
0
160
共有と分離 - Compose Multiplatform "本番導入" の設計指針
error96num
2
1.2k
Apache Spark もくもく会
taka_aki
0
140
Snowflake Intelligence × Document AIで“使いにくいデータ”を“使えるデータ”に
kevinrobot34
1
120
Autonomous Database - Dedicated 技術詳細 / adb-d_technical_detail_jp
oracle4engineer
PRO
4
10k
「全員プロダクトマネージャー」を実現する、Cursorによる仕様検討の自動運転
applism118
22
12k
メルカリIBISの紹介
0gm
0
330
Webアプリケーションにオブザーバビリティを実装するRust入門ガイド
nwiizo
7
890
Android Audio: Beyond Winning On It
atsushieno
0
3.4k
Firestore → Spanner 移行 を成功させた段階的移行プロセス
athug
1
500
2つのフロントエンドと状態管理
mixi_engineers
PRO
3
160
Unlocking the Power of AI Agents with LINE Bot MCP Server
linedevth
0
120
Featured
See All Featured
Imperfection Machines: The Place of Print at Facebook
scottboms
268
13k
Designing Experiences People Love
moore
142
24k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
50k
Six Lessons from altMBA
skipperchong
28
4k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
How to Ace a Technical Interview
jacobian
279
23k
Producing Creativity
orderedlist
PRO
347
40k
Art, The Web, and Tiny UX
lynnandtonic
303
21k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
12
1.1k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
358
30k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
34
6k
We Have a Design System, Now What?
morganepeng
53
7.8k
Transcript
AWS WAFͷϩά͕ 3͔࣌ؒ͠ݟΕͳ͍ͷͰ ͳΜͱ͔ͯ͠ΈΔ Ϋϥεϝιουגࣜձࣾ ιϦϡʔγϣϯΞʔΩςΫτ Ӭେࢤ
ࣗݾհ
ɹɹɹɹɹɹӬ େࢤ(@morimoritaitai) AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ ✦ झຯ : ήʔϜ / ञ
/ Χϝϥ ✦ ڵຯ : Security / OpsࣗಈԽ ✦ ͖:Config/CloudTrail/IAM/PHD ✦ ৭ͷαʔϏε͕͖ͳϑϨϯζ ✦ AWSೝఆࢿ֨5ף
ձࣾհ
ϒϩάͷձࣾ
AWS WAFͬͯ·͔͢ʁ
AWS WAFͱ • CloudFrontͱALBʹࠐΊΔϚωʔδυWAF • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅ຬͨ ͤΔ • ͦΜͳʹෳࡶͳઃఆग़དྷͳ͍͚Ͳ؆қͳ
WAF͕΄͍͠ͳΒ͘͢͝ศར
AWS WAFศརͳΜͰ͕͢ɺ 1͍͚ͨͩͳ͍͜ͱ͕…
Πϕϯτϩά͕3͔࣌ؒ͠ ݟΕͳ͍
४ϦΞϧλΠϜͷ ΠϯγσϯτରԠͱߟ͑Ε ͔Βͳ͘ͳ͍
ͰͬͺΓΠϕϯτϩά ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠
ͳΜͱ͔ͯ͠ΈΔ
ߏΛߟ͑Δ • AWS WAFͷΠϕϯτCloudWatchͰݕ • CloudWatchͷΞϥʔτΛSNSͰൃใ • SNSͰLambdaΛൃՐ • Lambda͕AWS
WAFͷϩάΛऔಘ͠S3อଘ
ߏਤ ᶃ Πϕϯτൃੜ ᶄΞϥʔϜൃใ ᶅ SNS௨ ᶆ ϩάऔಘ ᶇ ϩάอ
WAF CloudWatch SNS Lambda S3
SNSτϐοΫ࡞
CloudWatchΞϥʔτ࡞ 1ͭͰϒϩοΫ͕͋Ε SNSͰ௨
ϩάอ༻S3όέοτ࡞
Lambda༻IAMϩʔϧ࡞ • AmazonS3FullAccess • AWSWAFReadOnlyAccess • AWSLambdaBasicExecutionRole
LambdaϑΝϯΫγϣϯ࡞ • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py
LambdaϑΝϯΫγϣϯ࡞ SNSΛΠϕϯτιʔεʹ
LambdaϑΝϯΫγϣϯ࡞ ڥมͰS3όέοτ໊ࢦఆ ࡞ͨ͠IAM RoleΛࢦఆ
ࢼ͢ Α͋͘ΔSQLΠϯδΣΫγϣϯྫ
ࢼ͢ ϒϩοΫ͞Εͨ
5ޙ
ࢼ͢ S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ
ҙ • AWS WAFଆͷ༷ͰPOSTͷதݟΕͳ͍ • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ • Sample Requests100͔݅͠औΕͳ͍ͷͰɺ Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ
࠷ޙʹ • ͍ͭެࣜରԠ͓͔ͯ͘͠͠ͳ͍ͷͰυΩυ Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠ • POSTͷதΛه͍ͨ͠…ʂ • ϓϧϦΫ͍ͩ͘͞ • https://github.com/Tmorinaga/aws-waf-
logger/blob/master/aws-waf-logger.py
JAWS DAYS2017ʹొஃ͠·͢ • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ͘ޠΓ·͢ • ଞʹSec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯΓ·͢
None