AWS WAFのログが3時間しか見れないのでなんとかしてみる

Transcript

1. AWS WAFͷϩά͕ 3͔࣌ؒ͠ݟΕͳ͍ͷͰ ͳΜͱ͔ͯ͠ΈΔ Ϋϥεϝιουגࣜձࣾ ιϦϡʔγϣϯΞʔΩςΫτ ৿Ӭେࢤ

2. ࣗݾ঺հ

3. ɹɹɹɹɹɹ৿Ӭ େࢤ(@morimoritaitai) AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ ✦ झຯ : ήʔϜ / ञ

   / Χϝϥ ✦ ڵຯ : Security / OpsࣗಈԽ ✦ ޷͖:Config/CloudTrail/IAM/PHD ✦ ྘৭ͷαʔϏε͕޷͖ͳϑϨϯζ ✦ AWSೝఆࢿ֨5ף

4. ձࣾ঺հ

5. ϒϩάͷձࣾ

6. AWS WAF࢖ͬͯ·͔͢ʁ

7. AWS WAFͱ͸ • CloudFrontͱALBʹ࢓ࠐΊΔϚωʔδυWAF • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅͸ຬͨ ͤΔ • ͦΜͳʹෳࡶͳઃఆ͸ग़དྷͳ͍͚Ͳ؆қͳ

   WAF͕΄͍͠ͳΒ͘͢͝ศར

8. AWS WAFศརͳΜͰ͕͢ɺ 1఺͍͚ͨͩͳ͍͜ͱ͕…

9. Πϕϯτϩά͕3͔࣌ؒ͠ ݟΕͳ͍໰୊

10. ४ϦΞϧλΠϜͷ ΠϯγσϯτରԠͱߟ͑Ε͹ ෼͔Βͳ͘͸ͳ͍

11. Ͱ΋΍ͬͺΓΠϕϯτϩά͸ ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠

12. ͳΜͱ͔ͯ͠ΈΔ

13. ߏ੒Λߟ͑Δ • AWS WAFͷΠϕϯτ͸CloudWatchͰݕ஌ • CloudWatchͷΞϥʔτΛSNSͰൃใ • SNSͰLambdaΛൃՐ • Lambda͕AWS

    WAFͷϩάΛऔಘ͠S3΁อଘ

14. ߏ੒ਤ ᶃ Πϕϯτൃੜ ᶄΞϥʔϜൃใ ᶅ SNS௨஌ ᶆ ϩάऔಘ ᶇ ϩάอ؅

    WAF CloudWatch SNS Lambda S3

15. SNSτϐοΫ࡞੒

16. CloudWatchΞϥʔτ࡞੒ 1ͭͰ΋ϒϩοΫ͕͋Ε͹ SNSͰ௨஌

17. ϩάอ؅༻S3όέοτ࡞੒

18. Lambda༻IAMϩʔϧ࡞੒ • AmazonS3FullAccess • AWSWAFReadOnlyAccess • AWSLambdaBasicExecutionRole

19. LambdaϑΝϯΫγϣϯ࡞੒ • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py

20. LambdaϑΝϯΫγϣϯ࡞੒ SNSΛΠϕϯτιʔεʹ

21. LambdaϑΝϯΫγϣϯ࡞੒ ؀ڥม਺ͰS3όέοτ໊ࢦఆ ࡞੒ͨ͠IAM RoleΛࢦఆ

22. ࢼ͢ Α͋͘ΔSQLΠϯδΣΫγϣϯྫ

23. ࢼ͢ ϒϩοΫ͞Εͨ

24. 5෼ޙ

25. ࢼ͢ S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ

26. ஫ҙ఺ • AWS WAFଆͷ࢓༷ͰPOSTͷத਎͸ݟΕͳ͍ • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ • Sample Requests͸100͔݅͠औΕͳ͍ͷͰɺ Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ

27. ࠷ޙʹ • ͍ͭެࣜରԠͯ͠΋͓͔͘͠ͳ͍ͷͰυΩυ Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠ • POSTͷத਎Λه࿥͍ͨ͠…ʂ • ϓϧϦΫ͍ͩ͘͞ • https://github.com/Tmorinaga/aws-waf-

    logger/blob/master/aws-waf-logger.py

28. JAWS DAYS2017ʹొஃ͠·͢ • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ೤͘ޠΓ·͢ • ଞʹ΋Sec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯ΋஻Γ·͢

29. None