ECS on Fargate のセキュリティ対策は何をやるべき？開発者目線で考える/security-for-ecs-on-fargate-secjawsdays

以下のイベント「Security-JAWS DAYS」で発表した際の登壇資料です。
https://s-jaws.doorkeeper.jp/events/155024

Transcript

1. &$4
   PO
   'BSHBUF
   ͷηΩϡϦςΟରࡦ͸ԿΛ΍Δ べ ͖ʁ
   ։ൃऀ໨ઢ で ߟ͑Δ 
   ࠤ౻ஐथ $9ࣄۀຊ෦
   ΞʔΩςΫτνʔϜ
2. ࣗݾ঺հ  ࠤ౻ஐथ
   $9ࣄۀຊ෦
   ΞʔΩςΫτνʔϜ
   Ϛωʔδϟʔ
   +"846(
   $%,ࢧ෦
   ӡӦ
   झຯɿδϜɺಈըࢹௌʢ7$5ʣ
   ޷͖ͳ"84αʔϏεɿ-BNCEBɺ$%, !UNL !UPNPLJ
3. ΞδΣϯμ  w ཧ૝తͳঢ়ଶͱΑ͋͘Δ໰୊
   w ຊൃදͷର৅ͱࠓճͷ໨తΛ֬ೝ
   w ੹೚ڞ༗Ϟσϧʹ͍͓ͭͯ͞Β͍
   w ίϯςφηΩϡϦςΟपΓʹؔ͢ΔυΩϡϝϯτͷ֬ೝ
   w &$4
   PO
   'BSHBUF༻ʹϨΠϠʔΛ෼͚ରࡦΛ੔ཧ
4. ࣮͸  ҎԼͷ%FW%BZͰͷൃදͷଓฤͰ͢ɻ։ൃΛ΍ΔͳΒͪ͜Β΋ੋඇʂ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTJEFBMBOESFBMJUZXIFOJNQMFNFOUJOHDJDEGPSFDTPOGBSHBUFXJUIBXTDEL
5. ཧ૝తͳঢ়ଶͱݱ࣮ʹ͋Γ͕ͪͳ໰୊  ཧ૝తͳঢ়ଶɿνʔϜʹηΩϡϦςΟͷઐ໳Ո͕͓Γɺࢿۚ΋५୔ͰΤϯδχΞ΋ଟ਺
   ݱ࣮ʹ͋Γ͕ͪͳ໰୊ɿ
   w ίϯςφʹৄ͍͠ ηΩϡϦςΟͷઐ໳Ո͕͍ͳ͍ɺԼख͢Ε͹྆ํʜ
   w ࣗࣾ
   PS
   ͓٬༷ͷηΩϡϦςΟνΣοΫγʔτ͸͋Δ͕Ϋϥ΢υ΍ίϯςφʹద͍ͯ͠ͳ͍
   
   w "84
   4FDVSJUZ)VCʹΑΔݕ஌͚ͩͩͱ଍Γͳ͍ͷͰ͸ʁ
   w ۀքతʹ1$*
   %44΄Ͳͷݫ͍͠ج४Λຬͨ͢ඞཁ͸ͳ͍
   w ௐ΂Δͱ,VCFSOFUFTͷ࿩͸݁ߏग़ͯ͘Δ͚Ͳɺ&$4
   PO
   'BSHBUFͩͱԿΛ͢΂͖ʁ
6. ର৅ͱ໨ඪ  ຊൃදͷର৅ͱ͢Δํ
   w &$4
   PO
   'BSHBUFͷߏ੒Λݕ౼͍ͯ͠Δ࢖༻͍ͯ͠Δํ
   w ઌ΄Ͳͷϖʔδͷݱ࣮ʹ͋Γ͕ͪͳ໰୊ʹ౰͍ͨͬͯΔํ
   ൃදࢿྉΛݟͨޙͷ໨ඪ
   w ίϯςφηΩϡϦςΟʹؔͯ֬͠ೝ͢΂͖ࢿྉΛ஌Δ
   w ֤ྖҬ͝ͱʹͲͷΑ͏ͳڴҖରࡦ͕͋Δ͔ͱϢʔβଆͷ੹຿Λ஌Δ
   w શͯͷ߲໨΁ରࡦ͢ΔͷͰ͸ͳ͘ͲͷϦεΫΛରࡦ͢Δ͔ϦεΫΛड༰͢Δ͔ 1+ʹԠͯ͡બ୒ग़དྷΔΑ͏ʹͳΔ
7. ੹೚ڞ༗Ϟσϧͷ͓͞Β͍  "84ʹ͸ɺϢʔβଆͱ"84ଆͷηΩϡϦςΟ੹೚ʹؔ͢ΔϞσϧ͕ଘࡏ ʮ"84
   Ϋϥ΢υηΩϡϦςΟ
   ੹೚ڞ༗ϞσϧʯIUUQTBXTBNB[PODPNKQCMPHTBXTBVUIPSKCBSSQBHF
8. ੹೚ڞ༗Ϟσϧͷ͓͞Β͍  &$4
   PO
   &$ͱൺֱͨ͠৔߹ͷ&$4
   PO
   'BSHBUFͷ੹೚ڞ༗Ϟσϧ ʮ"NB[PO
   &MBTUJD
   $POUBJOFS
   4FSWJDFͷϕετϓϥΫςΟεΨΠυ
   
   ηΩϡϦςΟ੹೚ڞ༗Ϟσϧʯ 
 IUUQTEPDTBXTBNB[PODPNKB@KQ"NB[PO&$4MBUFTUCFTUQSBDUJDFTHVJEFTFDVSJUZTIBSFEIUNM
9. "84ͷ&$4ηΩϡϦςΟʹؔ͢ΔυΩϡϝϯτ  ʮ"NB[PO
   &$4ͷϕετϓϥΫςΟεΨΠυ
   
   ηΩϡϦςΟλεΫͱίϯςφͷηΩϡϦςΟʯ˞ ෼͔Γ΍͘͢ରࡦ͕ॻ͔Ε͍ͯΔ͕ 
 ݸਓతʹࢥͬͨ՝୊ɿ
   w ରࡦͷ෼ྨ͕ͳ͍ͷͰ࠷ॳͲͷྖҬͷ࿩͔ एׯ෼͔Γʹ͍͘ 
 Πϝʔδͦͷ΋ͷ ϨδετϦ λεΫ
   w ηΩϡϦςΟରࡦ࣮ࢪʹΑΔ෭࡞༻ʹ 
 ৮ΕΒΕ͍ͯͳ͍ͷͰίϯςφॳ৺ऀ͸ 
 ݫ͍͠ʁʢ3FBE0OMZ
   $POUBJOFSͳͲʣ
   w ৔ॴʹΑͬͯ&$4
   PO
   &$&$4
   PO
   'BSHBUFͷ࿩͕ࠞࡏ ˞
   IUUQTEPDTBXTBNB[PODPNKB@KQ"NB[PO&$4MBUFTUCFTUQSBDUJDFTHVJEFTFDVSJUZUBTLTDPOUBJOFSTIUNM
10. "84ͷ&$4ηΩϡϦςΟʹؔ͢ΔυΩϡϝϯτ  $POUBJOFS
    #VJME
    -FOT
    
    ެ։ 
 "84
    8FMM"SDIJUFDUFE
    'SBNFXPSLͷ؍఺ͰίϯςφΛѻ͏৔߹ͷߟྀ఺͕هࡌ
    IUUQTEPDTBXTBNB[PODPNKB@KQXFMMBSDIJUFDUFEMBUFTUDPOUBJOFS CVJMEMFOTDPOUBJOFSCVJMEMFOTIUNM ݪจ ཁ໿هࣄ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBXTXFMMBSDIJUFDUFE DPOUBJOFSMFOT
11. &$4
    PO
    'BSHBUFͰݕ౼͢ΔηΩϡϦςΟઃܭ  Ϣʔβ͕࢖༻͍ͯ͠ΔαʔϏεࢹ఺ͰίϯςφͰͷ ΞλοΫαʔϑΣΠεΛཧղͯ͠ݕ౼
    "84ͷ੹೚ڞ༗Ϟσϧͱಉ༷ʹɺϢʔβଆͱ"84 ଆͷ੹೚෦෼Λ෼͚ͯߟ͑΍͘͢͢ΔͨΊɺҎԼͭ ͷࢿྉΛݩʹӈهͷਤͰϨΠϠʔΛ෼཭
    ʮ/*45
    4QFDJBM
    1VCMJDBUJPO
     
 ΞϓϦέʔγϣϯίϯςφηΩϡϦςΟΨΠυʯ˞ 
 ʢҎ߱/*45
    41ͱهࡌʣ 
 ʮ&$4
    'BSHBUFʹ͓͚ΔڴҖͷϞσϦϯάʯ˞
    ҰൠతͳڴҖϞσϦϯά͸্هࢿྉͰ͞Ε͍ͯΔͷ ͰରࡦΛ੔ཧ͠ɺ1+಺ͰରԠՄೳͳ΋ͷΛ֬ೝ ˞
    IUUQTXXXJQBHPKQGJMFTQEG ˞
    IUUQTXXXTDTLKQTQTZTEJHCMPHDPOUBJOFS@TFDVSJUZFDT@GBSHBUFIUNM "84ͷ੹೚ྖҬ Ϣʔβͷ੹೚ྖҬ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO
12. &$4
    PO
    'BSHBUFͰݕ౼͢ΔηΩϡϦςΟઃܭ  ઌ΄ͲͷϨΠϠʔʹ"84ͷαʔϏε ΍ઃܭͳͲʹϚοϐϯάͯ͠ΈΔɻ
    ʢ"QQ෦෼͸&$ͳͲΛ࢖͏৔߹ͱ ಉ͡ରԠ͕ඞཁͳͨΊলུʣ
    ͦΕͧΕͷαʔϏεઃܭʹରͯ͠ ϢʔβଆͰऔΕΔରࡦΛߟ͑Δɻ &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
13. *".
    ෦෼  &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
14. *".
    ෦෼  /*45
    41
    ͔ΒҾ༻ 
 અʹ௚઀Ϋϥ΢υ޲͚ͷ߲͸ͳ͍ͨΊؔ࿈෦෼Λൈਮ
    w 
    ະঝೝίϯςφ
    w ʮ
    ૊৫͸ɺ։ൃɺςετɺຊ൪ɺ͓ΑͼͦͷଞͷγφϦΦʹରͯ͠ݸผͷ؀ڥΛߏங͠ɺͦΕ ͧΕͷ؀ڥͰɺίϯςφͷσϓϩΠ͓Αͼ؅ཧͱ͍ͬͨΞΫςΟϏςΟʹର͢Δ໾ׂϕʔεͷΞ Ϋηε੍ޚΛఏڙ͢ΔͨΊͷ۩ମతͳ੍ޚΛߦ͏͜ͱ͕๬·͍͠ɻʯ
    w ʮΞΫςΟϏςΟͷ໌֬ͳ؂ࠪূ੻Λఏڙ͢ΔͨΊʹɺ͢΂ͯͷίϯςφ࡞੒͸ɺݸʑͷϢʔ β
    *%ʹؔ࿈෇͚ͯϩάʹه࿥͢Δ͜ͱ͕๬·͍͠ɻʯ
15. *".
    ෦෼  
    ΁ͷରࡦɿΞΧ΢ϯτ෼཭ূ੻ݖݶ؅ཧ
    "84
    $MPVE5SBJM$PO fi HΛ༗ޮԽ͠؂ࠪূ੻Λ࢒͠ɺίϯςφΠϝʔδ࡞੒ऀΛ໌֬Խ
    ίϯςφ্Ͱ࠷খݖݶͷઃܭݪଇΛߟྀͯ͠ઃܭ
    w &$4
    5BTL
    &YFDVUJPO
    3PMF
    w &$4
    5BTLࣗମΛ࣮ߦ͢Δࡍ΍BXTMPHT
    ϩάυϥΠόʔΛར༻͢Δϩάͷه࿥ͳͲͰ 
 &$4ͷίϯςφΤʔδΣϯτ͕ར༻͢Δϩʔϧ
    w &$4
    5BTL
    3PMF
    w ίϯςφͷதͷΞϓϦ͕"84αʔϏε΁ͷΞΫηεʹ࢖༻͢Δϩʔϧ 
 &$4
    &YFDͷϩάه࿥Ͱ΋ར༻˞
    w $*$%Λ࣮ߦ͢Δج൫ʹ༩͑Δϩʔϧͷݖݶ΋࠷খݶΛҙࣝ ˞ʮ&$4
    &YFD
    ͷϩάه࿥͸λεΫϩʔϧͰߦΘΕΔͨΊ஫ҙ͠Α͏ʯ
    IUUQTEFWDMBTTNFUIPEKQBSUJDMFTFDTFYFDVTFUBTLSPMFGPSMPHHJOH
16. /FUXPSL
    ෦෼  &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
17. /FUXPSL
    ෦෼  /*45
    41
    ͔ΒҾ༻ 
 અʹ௚઀/FUXPSLͷઅ͸ͳ͍ͨΊؔ࿈෦෼Λൈਮ
    w 
    ίϯςφ͔Βͷແ੍ݶωοτϫʔΫΞΫηε
    w ʮ૊৫͸ɺίϯςφ͕ૹ৴͢Δ֎޲͚ͷωοτϫʔΫτϥϑΟοΫ
    FHSFTT
    OFUXPSL
    USB ff i D
    Λ੍ޚ͢Δ͜ͱ͕๬·͍͠ɻʯ
    w ʮΠϯό΢ϯυϙʔτͱϓϩηεϙʔτͷόΠϯσΟϯάͷ྆ํΛؚΉɺద੾ͳίϯςφωοτ ϫʔΩϯάαʔϑΣεͷࣗಈܾఆɻʯ
    w ʮ૊৫ͷωοτϫʔΫ಺ͷ༧ظ͠ͳ͍τϥϑΟοΫϑϩʔɺϙʔτεΩϟϯɺ·ͨ͸જࡏతʹة ݥͳѼઌ΁ͷΞ΢τό΢ϯυΞΫηεͳͲͷωοτϫʔΫͷҟৗͷݕ஌ɻʯ
18. /FUXPSL
    ෦෼  
    ΁ͷରԠɿ&$ͳͲͷΠϯϑϥߏஙͱಉ༷ͳ෦෼ͱίϯςφಛ༗ͷ෦෼Λೝࣝͯ͠ઃܭ
    ֤1+͝ͱͷηΩϡϦςΟཁ݅ʹԠͯ͡ҎԼΛ࣮ࢪ
    w "-#͔ΒίϯςφɺίϯςφؒͳͲ௨৴͸ηΩϡϦςΟάϧʔϓͰ੍ޚ
    w ίϯςφ͸جຊ1SJWBUF
    4VCOFU͔*TPMBUFE
    4VCOFUʹ഑ஔ͠&-#ܦ༝ͰΞΫηε
    w 71$֎ͷ"84αʔϏε΁ͷΦʔϓϯͳΞΫηεΛڐՄ͠ͳ͍৔߹͸71$
    &OEQPJOUΛ׆༻˞
    w (VBSE%VUZΛ࢖͍71$
    'MPX
    -PHT΍%/4ϩά౳ͷ৘ใ͔ΒͷڴҖݕ஌Λ༗ޮԽ
    w ηΩϡϦςΟج४͕ҟͳΔίϯςφ͸71$Λ෼཭
    w ௨৴࣌ৗ࣌҉߸Խ͕ඞཁͰ͋Ε͹ɺίϯςφؒ௨৴Λ҉߸Խ
    w ίϯςφ͔Β֎෦ͷજࡏతʹةݥͳѼઌ΁ͷΞ΢τό΢ϯυ௨৴Λݕ஌͍ͨ͠৔߹͸ 
 "RVB
    4FDVSJUZ΍4ZTEJH౳ͷηΩϡϦςΟ੡඼ͷ׆༻΋ݕ౼
    ˞ ίετ؍఺Ͱͷ71$
    &OEQPJOUͷར༻΋ཁݕ౼
    
19. /FUXPSL
    ෦෼  "84ͷηΩϡϦςΟؔ࿈αʔϏεͰઃఆมߋݕ஌Λ࣮ࢪ͠ϛεΛ๷ࢭ
    w "84
    4FDVSJUZ)VC
    w "84
    'PVOEBUJPOBM
    4FDVSJUZ
    #FTU
    1SBDUJDFT
    ίϯτϩʔϧ
    
    $*4
    "84
    'PVOEBUJPOT
    #FODINBSL
    ඪ४
    w <&$>
    71$
    ͷσϑΥϧτͷ4FDVSJUZ(SPVQͰ͸*OCPVOE0VUCPVOE
    5SB ffi DΛڐՄ͠ͳ͍ඞཁ͕͋Γ·͢ 
 ˠجຊσϑΥϧτͷ4FDVSJUZ(SPVQ͸࢖༻͠ͳ͍
    w <&$>
    4FDVSJUZ(SPVQ͸ڐՄ͞Εͨϙʔτʹରͯ͠ແ੍ݶͷண৴τϥϑΟοΫͷΈΛڐՄ͢Δඞཁ͕͋Γ·͢
    FUDʜ
    w "NB[PO
    (VBSE%VUZ
    w $MPVE5SBJMɺ71$
    'MPX
    -PHTɺ%/4ϩάͳͲ͔Β௨ৗͷϦΫΤετͱҟͳΔಈ͖Λ࡯஌ͯ͠௨஌
    ্هͷΠϕϯτΛ"NB[PO
    4/4ܦ༝Ͱ4MBDLʹ௨஌͠ৗʹؾ෇͘Α͏ʹઃఆ
20. 3FHJTUSZ
    ෦෼  &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
21. 3FHJTUSZ
    ෦෼  /*45
    41
    ͔ΒҾ༻
    
    ϨδετϦ΁ͷηΩϡΞͰͳ͍઀ଓ
    w ʮ૊৫͸ɺ҉߸Խ͞ΕͨνϟωϧͰͷΈϨδετϦʹ઀ଓ͢ΔΑ͏ɺ։ൃπʔϧɺΦʔέετϨʔ λɺ͓ΑͼίϯςφϥϯλΠϜΛઃఆ͢Δͷ͕๬·͍͠ɻʯ
    
    ෆे෼ͳೝূɾೝՄ੍ݶ
    w ʮϨδετϦ΁ͷॻ͖ࠐΈΞΫηε͸͢΂ͯೝূΛඞཁͱ͢Δͷ͕๬·͍͠ɻʯ
    ΁ͷରࡦɿ&$3΁ΞΫηεͰ͖ΔϢʔβͷݖݶΛ੍ݶ
    ɹ&$3΁ͷΞΫηε͸*".ʹΑΓ੍ޚ͞Ε͍ͯΔͷͰɺ*".ͷݖݶ੍ޚΛߟྀ
    w Ϣʔβ͕*".ϩʔϧͷݖݶͰΠϝʔδΛϓογϡ͢Δ৔߹ɺϓογϡઌϦϙδτϦΛ੍ݶ
    w $*$%؀ڥ͔Βϓογϡ͢Δ৔߹΋ɺϓογϡઌϦϙδτϦΛ੍ݶ
    ˞
    IUUQTEPDTBXTBNB[PODPNKB@KQ"NB[PO&$4MBUFTUCFTUQSBDUJDFTHVJEFTFDVSJUZUBTLTDPOUBJOFSTIUNM
22. 3FHJTUSZ
    ෦෼  /*45
    41
    ͔ΒҾ༻
    
    ϨδετϦ಺ͷݹ͍Πϝʔδ
    w ʮ΋͏࢖༻͢Δ͜ͱ͕ͳ͍ɺ੬ऑੑ͕͋ͬͯ҆શͰ͸ͳ͍Πϝʔδͷొ࿥Λ࡟আ͢Δ͜ͱʯ
    w ʮ࢖༻͢ΔΠϝʔδͷݸผͷόʔδϣϯΛಛఆ͢ΔΠϛϡʔλϒϧͳ໊લΛ࢖༻ͯ͠Πϝʔδʹ ΞΫηε͢Δ͜ͱ͕๬·͍͠ɻʯ
    "NB[PO
    &$4
    ͷϕετϓϥΫςΟεΨΠυ
    λεΫͱίϯςφͷηΩϡϦςΟ
    w "NB[PO
    &$3
    ͰλάͷΠϛϡʔλϏϦςΟΛ༗ޮԽ˞ 
 ߈ܸऀ͕ಉ͡λάͰΠϝʔδͷ৵֐͞ΕͨόʔδϣϯΛQVTI͢Δ͜ͱΛ๷͙ 
 ˞
    IUUQTEPDTBXTBNB[PODPNKB@KQ"NB[PO&$4MBUFTUCFTUQSBDUJDFTHVJEFTFDVSJUZUBTLTDPOUBJOFSTIUNM
23. 3FHJTUSZ
    ෦෼  
    ΁ͷରԠɿϨδετϦ಺ͷݹ͍Πϝʔδͷ࡟আ
    w "NB[PO
    &$3ͷϥΠϑαΠΫϧϙϦγʔΛ࢖༻͠ɺOੈ୅લͷΠϝʔδ͸࡟আͳͲͰରॲ
    w ݱঢ়Ͱ͸ʮ"NB[PO
    &$4ͷλεΫͰ࢖༻தͷΠϝʔδ͸อޢʯͳͲߴ౓ͳઃఆ͸Ͱ͖ͳ͍ 
 ࢖༻தΠϝʔδ͕ফ͑ΔͱλεΫ͕ىಈͰ͖ͳ͘ͳΔͷͰ஫ҙ ରॲͰ͖Δ044΋͋Δ˞
    ˞࢖༻தΠϝʔδ࡟আͷରࡦͱͯ͠࢖༻Ͱ͖Δ044
    IUUQTUFDICMPHLBZBDDPNFDSNPTT const repository = new ecr.Repository(this, `${id}-repository`, { repositoryName: `sample-repo`, imageScanOnPush: true, imageTagMutability: ecr.TagMutability.IMMUTABLE, }); repository.addLifecycleRule({ maxImageCount: 5 }); // 5ੈ୅อ࣋
24. 3FHJTUSZ
    ෦෼ɿΠϛϡʔλϒϧλάͰى͖Δ໰୊  
    ΁ͷରԠɿΠϛϡʔλϒϧͳλά໊ͷΈڐՄ
    Πϛϡʔλϒϧͳλά໊ͷΑ͋͘Δ෇͚ํ
    w Πϝʔδλάʹ(JU)VCͳͲͷίϛοτϋογϡΛ࢖༻͠ιʔεͱΠϝʔδΛ࿈ಈ
    w ηϚϯςΟοΫόʔδϣχϯάΛ࢖༻ 
 ֎෦഑෍ͷ৔߹͸ɺߋ৽Λ෼͔Γ΍͘͢͢ΔͨΊύοέʔδͷΑ͏ʹόʔδϣϯ൪߸Λ෇͚Δ 
 (JU)VCͷ3FMFBTF
    5BHΛ࢖ͬͯΔ৔߹ɺҰகͤ͞ΔͱτϨʔε͠΍͍͢
    $*$%ͷதͰίϛοτϋογϡͷλάΛ෇༩͢Δํ๏ͷྫ
    w "84
    $PEF#VJME
    ͷ৔߹ɿ$0%&#6*-%@3&40-7&%@4063$&@7&34*0/ఆ਺Λऔಘ
    w (JU)VC
    "DUJPOTͷ৔߹ɿHJUIVCTIBͰίϛοτϋογϡΛऔಘ 

25. *NBHF
    ෦෼  &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
26. *NBHF
    ෦෼  /*45
    41
    ͔ΒҾ༻
    
    Πϝʔδͷ੬ऑੑ
    w ʮैདྷͷ੬ऑੑ؅ཧπʔϧ͸ɺϗετͷ଱ٱੑ΍ΞϓϦͷߋ৽ϝΧχζϜ΍ස౓ʹ͍ͭͯଟ͘ͷԾఆΛ͍ͯ͠ Δ͕ɺͦΕΒ͸ίϯςφԽ͞ΕͨϞσϧͱ͸ࠜຊతʹͣΕ͍ͯΔɻ͜ΕΒͷπʔϧ͸ɺίϯςφ಺ͷ੬ऑੑΛ ݕ஌Ͱ͖ͳ͍͜ͱ͕ଟ͘ɺޡͬͨ҆৺ײΛ΋ͨΒ͢ɻʯ
    w ʮΠϝʔδͷϕʔεϨΠϠ͚ͩͰͳ͘ɺ૊৫͕࢖༻͍ͯ͠ΔΞϓϦέʔγϣϯϑϨʔϜϫʔΫ΍ΧελϜιϑτ ΢ΣΞͳͲɺΠϝʔδͷ͢΂ͯͷϨΠϠʹ͓͚Δ੬ऑੑͷՄࢹੑɻʯ
    w ʮ૊৫͸ϏϧυͱσϓϩΠͷϓϩηεͷ֤ஈ֊ʹ͓͍ͯʮ඼࣭ήʔτʯΛ࡞੒͠૊৫ͷ੬ऑੑϙϦγʔͱߏ੒ ϙϦγʔΛຬͨ͢ΠϝʔδͷΈ͕ਐߦΛڐՄ͞ΕΔ͜ͱΛ࣮֬ʹ͢Δ͜ͱ͕๬·͍͠ɻʯ
    
    ຒΊࠐ·ΕͨϚϧ΢ΣΞ
    w ʮຒΊࠐ·ΕͨϚϧ΢ΣΞ͕ͳ͍͔ɺ͢΂ͯͷΠϝʔδΛܧଓతʹϞχλϦϯά͢Δ͜ͱ͕๬·͍͠ɻʯ
27. *NBHF
    ෦෼ʢ*NBHF
    4DBOฤʣ  
    
    ΁ͷରԠɿ
    ΠϝʔδεΩϟϯʢ*OTQFDUPS
    7ͳͲʣΛ࢖༻͢Δ
    Πϝʔδ΍Πϯετʔϧͨ͠ύοέʔδͷ੬ऑੑ΁ରԠ͢ΔͨΊΠϝʔδεΩϟφΛ࢖༻
    *OTQFDUPS
    7
    ͱ͸ʢίϯςφؔ࿈෦෼ͷΈʣ
    w "NB[PO
    &$3ʹQVTI͞ΕͨίϯςφΠϝʔδΛࣗಈతʹεΩϟϯ
    w Πϝʔδιϑτ΢ΣΞύοέʔδΛݕग़͠੬ऑੑ͕ͳ͍͔֬ೝ
    w ੬ऑੑ%#ͷҰ෦ͱͯ͠4OZLͷ৘ใΛ࢖༻˞
    w "NB[PO
    &$3શମͰܧଓεΩϟϯΛઃఆ͢ΔͱҎԼͷλΠϛϯάͰεΩϟϯ˞
    w Πϝʔδϓογϡ࣌
    w "NB[PO
    *OTQFDUPS಺෦ͷ੬ऑੑ%#ߋ৽࣌ ˞
    IUUQTBXTBNB[PODPNKQBCPVUBXTXIBUTOFXBNB[POJOTQFDUPSDPOUJOVBMWVMOFSBCJMJUZNBOBHFNFOU ˞
    IUUQTEPDTBXTBNB[PODPNJOTQFDUPSMBUFTUVTFSFOBCMFEJTBCMFTDBOOJOHFDSIUNM "NB[PO
    *OTQFDUPS
28. *NBHF
    ෦෼ʢ*NBHF
    4DBOฤʣ  *OTQFDUPS
    7ͷεΩϟϯ݁Ռ͸ɺҎԼͷྲྀΕͰߋ৽࣌ʹࣗಈ௨஌Մೳ 
 &WFOU#SJEHF΁ͷ௨஌͸ৗʹྲྀΕ͍ͯΔͷͰɺ&WFOU#SJEHFˠ4/4ˠ$IBUCPUͷྲྀΕ͚ͩ࡞੒ // InspectorV2Findings via SecurityHub new cwe.Rule(this, 'InspectorV2ViaSecurityHub', { description: 'CloudWatch Event Rule to …’, enabled: true, eventPattern: { source: ['aws.securityhub'], detailType: ['Security Hub Findings - Imported'], detail: { findings: { ProductName: ['Inspector'], Severity: { Label: ['CRITICAL', ‘HIGH'], // είΞ7.0Ҏ্͸௨஌ }, }, }, }, targets: [new cwet.SnsTopic(secTopic)], }); "NB[PO
    *OTQFDUPS "NB[PO
    4/4 "84
    $IBUCPU "84
    
    4FDVSJUZ
    )VC "NB[PO
    &WFOU#SJEHF ੬ऑੑൃݟ Πϕϯτ௨஌ ϧʔϧ߹க ௨஌
29. *NBHF
    ෦෼  /*45
    41
    ͔ΒҾ༻
    
    ϥϯλΠϜιϑτ΢ΣΞ಺ͷ੬ऑੑ
    w ʮίϯςφϥϯλΠϜ͸ɺ੬ऑੑ͕஫ҙਂ͘ϞχλϦϯά͞Εɺ໰୊͕ݕ஌͞Εͨ৔߹ʹ͸ਝ଎ ʹमਖ਼͞Εͳ͚Ε͹ͳΒͳ͍ɻʯ
    w ʮπʔϧΛ࢖༻ͯ͠ɺσϓϩΠ͞ΕͨϥϯλΠϜͷڞ௨੬ऑੑࣝผࢠʢ$7&ʣͷ੬ऑੑΛ୳͠ɺ ϦεΫͷ͋ΔΠϯελϯεΛΞοϓάϨʔυ͠ɺΦʔέετϨʔλ͕ద੾ʹϝϯςφϯε͞Εͨ ϥϯλΠϜ΁ͷσϓϩΠͷΈΛڐՄ͢Δ͜ͱΛ࣮֬ͱ͢Δ͜ͱ͕๬·͍͠ɻʯ
    
30. *NBHF
    ෦෼ʢ*NBHF
    4DBO $*$%ʣ  ޙ൒΁ͷରԠɿ$*$%ʹΠϝʔδεΩϟϯΛ૊ΈࠐΈɺ$%ܦ༝ͰͷΈσϓϩΠ
    ։ൃݕূຊ൪؀ڥ͢΂ͯʹεΩϟϯΛઃఆ͠ɺ։ൃ؀ڥͰ੬ऑੑΛఠग़ޙʹ൓ө͠։ൃ؀ڥΛ඼࣭ ήʔτͱͯ͠࢖༻ɻ
    ৽نͰݕ஌͞Εͨ੬ऑੑ͸࣮૷࡞ۀʹ૊ΈࠐΈରॲ
    ։ൃऀʹ඼࣭ήʔτͷྲྀΕΛڧ੍తʹ४ڌͤ͞Δ৔߹͸ɺ$*$%ʹ5SJWZͳͲΛ૊ࠐΜͰΠϝʔδʹ 
 ੬ऑੑؚ͕·ΕΔ৔߹$*Λࣦഊͤ͞Δ "NB[PO
    &$3 ։ൃ؀ڥ "NB[PO
    &$3 ݕূ؀ڥ "NB[PO
    &$3 ຊ൪؀ڥ 3FQMJDBUJPO 1VTI "84
    $PEF#VJME Πϝʔδͷ੬ऑੑݕ஌ 03 BOE
    NPSF 03
31. *NBHF
    ෦෼  /*45
    41
    ͔ΒҾ༻
    
    Πϝʔδઃఆͷෆ۩߹
    w ʮ૊৫͸ɺηΩϡΞͳઃఆͷϕετϓϥΫςΟε΁ͷ४ڌΛݕূ͓Αͼ࣮ࢪ͢ΔͨΊͷπʔϧͱ ϓϩηεΛ࠾༻͢Δ͜ͱ͕๬·͍͠ɻྫ͑͹ɺΠϝʔδ͸ඇಛݖϢʔβͱ࣮ͯ͠ߦ͞ΕΔΑ͏ઃ ఆ͢Δ͜ͱ͕๬·͍͠ɻʯ
    
    ຒΊࠐ·Εͨฏจͷൿີ৘ใ
    w ʮൿີ৘ใ͸Πϝʔδͷ֎ʹอଘ͠ɺ࣮ߦ࣌ʹಈతʹఏڙ͞ΕΔͷ͕๬·͍͠ʯ
32. *NBHF
    ෦෼ʢ%PDLFS fi MFฤʣ  
    ΁ͷରԠɿ%PDLFS fi MFͷ੬ऑੑΛEPDLMF΍5SJWZͳͲͰνΣοΫ
    %PDLFS fi MFࣗମͷهड़಺༰͕ηΩϡΞʹͳ͍ͬͯΔ͔νΣοΫ https://aquasecurity.github.io/trivy/v0.29.2/docs/miscon fi guration/scanning/ https://github.com/goodwithtech/dockle
33. *NBHF
    ෦෼ʢ%PDLFS fi MFฤʣ  
    ΁ͷରԠɿػີ৘ใ͸4FDSFU.BOBHFS44.
    1BSBNFUFS4UPSFʹอଘ "NB[PO
    &$3 $PEF
    3FQP "84
    4FDSFUT
    .BOBHFS "84
    4ZTUFNT
    .BOBHFS Parameter Store "84
    "QQ$POGJH *NBHF ؀ڥݻ༗৘ใࢀর ೝূ৘ใࢀর ػೳࠩҟࢀর 1VTI
34. $POUBJOFS
    ෦෼  &$4
    'BSHBUF &$3 &$4
    4FSWJDF5BTL
    ͳͲ %PDLFSGJMF 71$
    ͳͲ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO "84
    *".
35. $POUBJOFS
    ෦෼  w ʮίϯςφ͸ɺϧʔτϑΝΠϧγεςϜΛಡΈऔ Γઐ༻ϞʔυͰ࣮ߦ͢Δ͜ͱ͕๬·͍͠ɻʯ
    w ʮҎԼͷΑ͏ͳΠϕϯτΛؚΉ࣮ߦ࣌ͷҟৗΛݕ ஌͠ɺ๷ࢭͰ͖Δ͜ͱ͕๬·͍͠ɻʯ
    w ແޮͳɺ·ͨ͸༧ظͤ͵ϓϩηεͷ࣮ߦ
    
    w ແޮͳɺ·ͨ༧ظͤ͵γεςϜίʔϧ
    w อޢ͞ΕͨઃఆϑΝΠϧͱόΠφϦͷมߋ
    
    w ༧ظͤ͵৔ॴ΍ϑΝΠϧλΠϓ΁ͷॻ͖ࠐΈ
    w ༧ظͤ͵ωοτϫʔΫϦεφʔͷ࡞੒
    w ༧ظͤ͵ωοτϫʔΫͷѼઌʹૹ৴͞Εͨτϥ ϑΟοΫ
    w Ϛϧ΢ΣΞͷอଘ·ͨ͸࣮ߦ /*45
    41
    ͔ΒҾ༻ʢؔ࿈෦෼ͱ൑அ߲ͨ͠ͷΈʣ
    
    ΞϓϦͷ੬ऑੑ
36. $POUBJOFS
    ෦෼  w ʮίϯςφ͸ɺϧʔτϑΝΠϧγεςϜΛಡΈऔ Γઐ༻ϞʔυͰ࣮ߦ͢Δ͜ͱ͕๬·͍͠ɻʯ
    w ʮҎԼͷΑ͏ͳΠϕϯτΛؚΉ࣮ߦ࣌ͷҟৗΛݕ ஌͠ɺ๷ࢭͰ͖Δ͜ͱ͕๬·͍͠ɻʯ
    w ແޮͳɺ·ͨ͸༧ظͤ͵ϓϩηεͷ࣮ߦ
    
    w ແޮͳɺ·ͨ༧ظͤ͵γεςϜίʔϧ
    w อޢ͞ΕͨઃఆϑΝΠϧͱόΠφϦͷมߋ
    
    w ༧ظͤ͵৔ॴ΍ϑΝΠϧλΠϓ΁ͷॻ͖ࠐΈ
    w ༧ظͤ͵ωοτϫʔΫϦεφʔͷ࡞੒ 
 ˠ
    'BSHBUFଆͰ؅ཧ˞
    w ༧ظͤ͵ωοτϫʔΫͷѼઌʹૹ৴͞Εͨτϥ ϑΟοΫ
    
 ˠ/FUXPSL෦෼ࢀর
    w Ϛϧ΢ΣΞͷอଘ·ͨ͸࣮ߦ /*45
    41
    ͔ΒҾ༻ʢؔ࿈෦෼ͱ൑அ߲ͨ͠ͷΈʣ
    
    ΞϓϦͷ੬ऑੑ ˞
    IUUQTBXTBNB[PODPNKQCMPHTOFXTVOEFSUIFIPPEGBSHBUFEBUBQMBOF
37. $POUBJOFS
    ෦෼ʢϑΝΠϧॻ͖ࠐΈʣ  "NB[PO
    &$4
    ͷϕετϓϥΫςΟεΨΠυ
    λεΫͱίϯςφͷηΩϡϦςΟ
    w ʮಡΈऔΓઐ༻ͷϧʔτϑΝΠϧγεςϜΛ࢖༻͢Δʯ
    w ίϯςφͷϧʔτϑΝΠϧγεςϜ΁ͷॻ͖ࠐΈΛېࢭ͠ҎԼΛ๷ࢭ
    w ߈ܸऀ͕ϑΝΠϧγεςϜ΁Ϛϧ΢ΣΞΛॻ͖ࠐΈɺѱҙͷ͋ΔϓϩηεΛ࣮ߦͯ͠σʔ λͷྲྀग़΍վ͟ΜͳͲΛ࣮ࢪ
    w "84
    4FDVSJUZ)VCͰະઃఆͷίϯςφΛݕ஌Մೳ
    w <&$4>
    
    &$4
    ίϯςφ͸ɺϧʔτϑΝΠϧγεςϜ΁ͷಡΈऔΓઐ༻ΞΫηεʹ੍ݶ͢Δ ඞཁ͕͋Γ·͢
    ˞ ˞
    IUUQTEPDTBXTBNB[PODPNKB@KQTFDVSJUZIVCMBUFTUVTFSHVJEFTFDVSJUZIVCTUBOEBSETGTCQDPOUSPMTIUNMGTCQFDT serviceTaskDefinition .addContainer(`${id}-ServiceTaskContainerDefinition`, { image, … readonlyRootFilesystem: true, // ಡΈऔΓઐ༻ })
38. $POUBJOFS
    ෦෼ʢϑΝΠϧॻ͖ࠐΈʣ  
    ΁ͷରԠɿϧʔτϑΝΠϧγεςϜΛಡΈऔΓઐ༻ʹมߋ
    ϧʔτϑΝΠϧγεςϜΛಡΈऔΓઐ༻ʹͨ͠৔߹ͷ஫ҙ఺
    w ਖ਼نͷ04΍ϓϩηεͷॻ͖ࠐΈ΋ېࢭ͞ΕΔͨΊɺ༗ޮԽ࣌ʹॻ͖ࠐΈΤϥʔʹͳΔةݥੑ
    w &$4
    &YFDͳͲͷπʔϧ΋௨ৗ͸࢖༻ෆՄ
    ஫ҙ఺ͷճආࡦ
    w Ұ෦ͷσΟϨΫτϦΛϚ΢ϯτͯ͠ݶఆతʹॻ͖ࠐΈڐՄྖҬΛ࡞ΓɺͲ͏ͯ͠΋ॻ͖ࠐΈ͕ 
 ඞཁͳػೳʹ͍ͭͯ͸Ϛ΢ϯτઌʹॻ͖ࠐΉ
    w &$4
    &YFDͷྫɿʮ6TJOH
    &$4
    &YFD
    XJUI
    SFBEPOMZ
    SPPU
    fi MF
    TZTUFN
    DPOUBJOFSTʯ˞
    w $POUBJOFS
    *OTJHIUTμογϡϘʔυΛλεΫϨϕϧͰ֬ೝ͠ɺ4UPSBHF8SJUF#ZUFTͰ 
 ॻ͖ࠐΈ͕ൃੜͯ͠ͳ͍͜ͱΛ֬ೝ͔ͯ͠ΒಡΈऔΓઐ༻ʹมߋ˞ ˞
    IUUQTUPSJTJPVTJOHFDTFYFDXJUISFBEPOMZSPPU fi MFTZTUFNFOBCMFEDPOUBJOFST ˞
    ৄ͍͠৘ใɿʲ4FDVSJUZ
    )VCम෮खॱʳ<&$4>
    &$4
    ίϯςφ͸ɺϧʔτϑΝΠϧγεςϜ΁ͷΞΫηεΛಡΈऔΓઐ༻ʹ੍ݶ͢Δඞཁ͕͋Γ·͢
39. $POUBJOFS
    ෦෼ʢϑΝΠϧॻ͖ࠐΈͷকདྷͷر๬ʣ  কདྷతʹ͸"NB[PO
    (VBSE%VUZͷ.BMXBSF
    1SPUFDUJPOʹ΋ظ଴ʂʂ 
 ʢݱࡏ͸"NB[PO
    &$4
    PO
    "84
    'BSHBUF͸αϙʔτ֎˞ʣ
    "NB[PO
    (VBSE%VUZ
    .BMXBSF
    1SPUFDUJPOͷػೳ
    ʮ৵֐͞ΕͨՄೳੑ͕͋Δ
    "NB[PO
    &$
    Πϯελϯε͓ΑͼίϯςφϫʔΫϩʔυʹΞλον 
 ɹ͞Εͨ
    &#4
    ϘϦϡʔϜ্ͷϚϧ΢ΣΞΛεΩϟϯͯ͠ݕग़ʯ
    কདྷతʹ͸ίϯςφΛ3FBE0OMZԽͯ͠ɺ࠷௿ݶϚ΢ϯτͨ͠Օॴ͚ͩεΩϟϯɻෆ৹ͳಈ࡞Λ 
 ݕ஌ͯ͠௨஌΍ରॲ͕Ͱ͖Δͱخ͍͠ "NB[PO
    (VBSE%VUZ ˞
    IUUQTEPDTBXTBNB[PODPNKB@KQHVBSEEVUZMBUFTUVHNBMXBSFQSPUFDUJPOIUNM
40. $POUBJOFS
    ෦෼  w ʮίϯςφ͸ɺϧʔτϑΝΠϧγεςϜΛಡΈऔ Γઐ༻ϞʔυͰ࣮ߦ͢Δ͜ͱ͕๬·͍͠ɻʯ
    w ʮҎԼͷΑ͏ͳΠϕϯτΛؚΉ࣮ߦ࣌ͷҟৗΛݕ ஌͠ɺ๷ࢭͰ͖Δ͜ͱ͕๬·͍͠ɻʯ
    w ແޮͳɺ·ͨ͸༧ظͤ͵ϓϩηεͷ࣮ߦ˞
    w ແޮͳɺ·ͨ༧ظͤ͵γεςϜίʔϧ
    w อޢ͞ΕͨઃఆϑΝΠϧͱόΠφϦͷมߋ
    
    w ༧ظͤ͵৔ॴ΍ϑΝΠϧλΠϓ΁ͷॻ͖ࠐΈ
    w ༧ظͤ͵ωοτϫʔΫϦεφʔͷ࡞੒ 
 ˠ
    'BSHBUFଆͰ؅ཧ
    w ༧ظͤ͵ωοτϫʔΫͷѼઌʹૹ৴͞Εͨτϥ ϑΟοΫ
    
 ˠ/FUXPSL෦෼ࢀর
    w Ϛϧ΢ΣΞͷอଘ·ͨ͸࣮ߦ /*45
    41
    ͔ΒҾ༻ʢؔ࿈෦෼ͱ൑அ߲ͨ͠ͷΈʣ
    
    ΞϓϦͷ੬ऑੑ ˞
    3FBE0OMZίϯςφͰ΋ϥΠϒϥϦͷ੬ऑੑʹΑͬͯ৵֐͞ΕΔྫ
    IUUQTXXXTDTLKQTQTZTEJHCMPHTZTEJH@TFDVSFSFBEPOMZIUNM
41. $POUBJOFS
    ෦෼ʢίϯςφϥϯλΠϜʣ  લड़·ͰͷηΩϡϦςΟઃఆΛߦͬͯ΋ɺҎԼͷΑ͏ͳঢ়گ͕ൃੜ͢ΔՄೳੑ͸͋Δ
    w ΞϓϦέʔγϣϯͷಠ࣮ࣗ૷෦෼ʹؚ·ΕΔ੬ऑੑΛѱ༻ͯ͠༧ظͤ͵ϓϩηεͷ࣮ߦ
    w θϩσΠ߈ܸͰϥΠϒϥϦͷະ஌ͷ੬ऑੑΛѱ༻͠ɺҙਤͤͣ֎෦΁ػີ৘ใΛૹ৴
    γεςϜن໛ʹΑͬͯ͸্ه΁ͷରࡦͷͨΊ
    ෆ৹ͳಈ࡞ͷݕ஌΍؂ࠪূ੻Λ࢒͢ඞཁ͕͋Δ৔߹΋
    'BMDPͳͲϥϯλΠϜʹ͓͚ΔಈతͳৼΔ෣͍Λݕ஌͢ΔπʔϧΛݕ౼͢Δ͔ఆظతͳίϯςφͷ 
 ఀࢭىಈɺ·ͨ͸঎༻੡඼ 4ZTEJH΍"RVB
    4FDVSJUZɺ1SJTNB
    $MPVEͳͲ ͷ࢖༻Λݕ౼ 
 ˠ࠷ۙঢ়گ͕গ͠มΘͬͨ
    ิ଍ɿ্هରࡦΛߨͯ͡΋ΞϓϦέʔγϣϯϨΠϠ಺Ͱ׬݁͢Δ߈ܸ͸ରࡦෆՄೳͳͷͰɺϖωτ ϨʔγϣϯςετͳͲ͸มΘΒͣʹඞཁ
42. $POUBJOFS
    ෦෼ʢίϯςφϥϯλΠϜʣ  'BMDPΛ࢖ͬͯΈͨྫᶃ 
 &$4Ͱ࢖͏৔߹ͷ໰୊఺͕هࡌ "84͕ఏڙ͢Δαϯϓϧ࣮૷ 
 ʢ೥݄ʹެ։ʣ IUUQTTQFBLFSEFDLDPNUPCBDIJ DPOUBJOFSTFDVSJUZXJUIPTTUPPMT TMJEF ʮOSSͰ࢝ΊΔίϯςφηΩϡϦςΟʯ 'BMDPΛ࢖ͬͯΈͨྫᶄ 
 ଎౓΍ϝϯςφϯε౳ͷ 
 ໰୊఺͕هࡌ IUUQTHJUIVCDPNBXTTBNQMFTBXT GBSHBUFGBMDPFYBNQMFT IUUQTQBQFSESPQCPYDPNEPD&$4 'BSHBUF$Z$"V#N0HF#*:RC ʮECS FargateͰ΋ແྉͰূ੻؅ཧ͍ͨ͠ʯ 'BSHBUF্ͰͷγεςϜίʔϧΛ؂ࢹํ๏ʹ͍ͭͯݴٴ࣮૷͍ͯ͠Δ৘ใ ΑΓલͷ࿩
43. $POUBJOFS
    ෦෼ʢίϯςφϥϯλΠϜʣ  "84
    'BSHBUF্ͷಉ͡&$4λεΫ಺ͷ͢΂ͯͷίϯςφͰϓϩηε*%
    1*%
    ໊લۭؒΛ 
 ڞ༗Ͱ͖ΔΑ͏ʹͳΓ·ͨ͠ʂʢ
    6QEBUF
    ࠓճͷػೳͰαΠυΧʔ͔ΒγεςϜίʔϧͷ؂ࢹ΍ϓϩηεͷ؂ࢹɺఀࢭɺ࠶ىಈ͕Ͱ͖ΔΑ͏ʹ ͳΓ·ͨ͠ʂࠓޙ"84͔ηΩϡϦςΟاۀ͔Βূ੻ͷऩू΍ҟৗݕग़ˠఀࢭͷػೳ͕ग़Δ͔΋ʁ https://aws.amazon.com/jp/blogs/containers/announcing- additional-linux-controls-for-amazon-ecs-tasks-on-aws-fargate/ https://dev.classmethod.jp/articles/ecs-on-fargate-support-shared-pid-namespace/
44. $POUBJOFS
    ෦෼ʢίϯςφϥϯλΠϜ4ZTEJHʣ  4ZTEJH
    4FDVSFͰγεςϜίʔϧΛར༻ͨ͠ίϯςφ্ͷڴҖݕ஌͕Մೳ
    Πϝʔδ಺ͷ੬ऑੑͱγεςϜίʔϧΛ෼ੳ͠ɺ࣮ࡍʹ࢖ΘΕ͍ͯΔػೳͷ੬ऑ͚ͩτϦΞʔδ΍ 
 ىಈ࣌ͷίϯςφΠϝʔδʹͳ͔࣮ͬͨߦՄೳϑΝΠϧͷ%-ɺߋ৽ɺมߋͳͲͷݕ஌͕Մೳ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTTZTEJHDPNQPOFOUFDTPOGBSHBUF
45. $POUBJOFS
    ෦෼ʢίϯςφϥϯλΠϜ4ZTEJHʣ  IUUQTEFWDMBTTNFUIPEKQBSUJDMFTTZTEJHDPNQPOFOUFDTPOGBSHBUF 4ZTEJH
    4FDVSFͰγεςϜίʔϧΛར༻ͨ͠ίϯςφ্ͷڴҖݕ஌͕Մೳ
    Πϝʔδ಺ͷ੬ऑੑͱγεςϜίʔϧΛ෼ੳ͠ɺ࣮ࡍʹ࢖ΘΕ͍ͯΔػೳͷ੬ऑ͚ͩτϦΞʔδ΍ 
 ىಈ࣌ͷίϯςφΠϝʔδʹͳ͔࣮ͬͨߦՄೳϑΝΠϧͷ%-ɺߋ৽ɺมߋͳͲͷݕ஌͕Մೳ
46. 4QFDJBM
    5IBOLT
    🎈  ຊࢿྉ͸ҎԼͷํʑʹϨϏϡʔ͍͖ͨͩ·ͨ͠🎉 
 w ͔ͨ͘ʹ͞Μʢ$MBTTNFUIPEʣ
    w ᐩ઒
    ݈ଠ࿠͞Μʢ$MBTTNFUIPEʣ 
 ͞Βʹ಺༰ྑ͘͢Δ͜ͱ͕ग़དྷ·ͨ͠ʂຊ౰ʹ͋Γ͕ͱ͏͍͟͝·͢
    🙏
47. ·ͱΊ  w ίϯςφηΩϡϦςΟͷݕ౼ʹඞཁͳࢿྉΛ঺հ
    w ࢿྉ͔Β&$4
    PO
    'BSHBUFͰߟྀ͢΂͖ϨΠ ϠʔͰ੔ཧ
    w ֤ϨΠϠʔͷதͰඞཁͳରࡦΛӈͷਤͰఏࣔ
    w Ϣʔβଆͷ੹೚ൣғΛ֬ೝ
    w ίϯςφϥϯλΠϜηΩϡϦςΟͷର৅ൣғʹ ͍ͭͯ֬ೝ
    w େ఍ͷରࡦ͸"84੡඼͚ͩͰ΋ҰԠ࣮ࢪՄೳ
    w ηΩϡϦςΟରࡦͷޮ཰Խ΍ίϯςφ಺ͷ؂ࠪূ ੻ಈతݕ஌͕ඞཁͰ͋Ε͹঎༻੡඼Λݕ౼ "84ͷ੹೚ྖҬ Ϣʔβͷ੹೚ྖҬ /FUXPSL *NBHF 3FHJTUSZ $POUBJOFS 0SDIFTUSBUPS )PTU
    04 $POUBJOFS
    3VOUJNF "QQMJDBUJPO
48. ෇࿥ɿ/*45
    41Ͱର৅֎ͱ߲ͨ͠໨ͷཧ༝  /*45
    41ͷষͰର৅֎ͱߟ߲͑ͨ໨Ϧετɻ֤ࣗͰ΋͝ݕ౼͍ͩ͘͞
    w 
    ৴པͰ͖ͳ͍Πϝʔδͷ࢖༻
    w ઌʹ৴པͰ͖ΔΠϝʔδΛอূ͢Δ૊৫࡞Γ͕ඞཁɻͳ͓Πϝʔδॺ໊ʹ&$4͸ະରԠ˞
    w 
    ΦʔέετϨʔλͷରࡦ
    w ΦʔέετϨʔλ͸"84ଆͷ؅ཧൣғͱ੔ཧ
    w 
    ηΩϡΞͰͳ͍ίϯςφϥϯλΠϜͷઃఆ
    w ΑΓຊ߲໨͸ಛݖϞʔυͷར༻ʹΑΔϗετ΁ͷΞΫηεͷݒ೦Ͱ͋Γɺ&$4
    PO
    'BSHBUFͰ͸ಛ ݖϞʔυ QSJWJMFHFE
    NPEF ʹͳΕͳ͍ͷͰ"84ଆͷ؅ཧൣғͱ੔ཧ˞
    w 
    ϗετ
    04
    ͷରࡦ
    w ϗετ04ଆͷઃఆ͸"84ଆͷ؅ཧൣғͱ੔ཧ ˞
    IUUQTBXTBNB[PODPNKQBCPVUBXTXIBUTOFXBXTDPOUBJOFSJNBHFTJHOJOH ˞
    QSJWJMFHFE
    NPEFͱSPPUݖݶͷҧ͍ͷղઆʮʲ4FDVSJUZ
    )VCम෮खॱʳ<&$4>
    &$4
    ίϯςφ͸ɺඇಛݖͱ࣮ͯ͠ߦ͢Δඞཁ͕͋Γ·͢ʯ
    ɹɹIUUQTEFWDMBTTNFUIPEKQBSUJDMFTTFDVSJUZIVCGTCQSFNFEJBUJPOFDT
49. ෇࿥ɿίϯςφϥϯλΠϜͱ͍͏໊લͷൣғ  ίϯςφϥϯλΠϜͱ͍͏ݴ༿͕සൟʹ࢖ΘΕΔ͕ɺ͍͔ͭ͘ύλʔϯ͕͋Γจ຺͔ΒͲΕͷ࿩Λ͠ ͍ͯΔͷ͔ਪଌ͕ඞཁ
    w ߴϨΠϠʔίϯςφϥϯλΠϜʢ'BSHBUFͳΒ$POUBJOFSE˞ ʣ
    w Ϣʔβ΍ଞͷϓϩάϥϜͷ໋ྩͰɺίϯςφ΍/8ͷ؅ཧΛ࣮ߦ˞
    w ௿ϨΠϠʔίϯςφϥϯλΠϜʢ'BSHBUFͳΒSVOD˞ ʣ
    w ίϯςφΛ࣮ߦ͢ΔϓϩηεΛɺϗετ͔Β෼཭࣮ͯ͠ߦ˞
    w ୯ʹίϯςφϥϯλΠϜͱݺΜͰ͍Δ࣌
    w ্هͷ௿ߴϨΠϠʔίϯςφϥϯλΠϜͷ͜ͱɻ΋͘͠͸ɺ௿ϨΠϠʔίϯςφϥϯλΠϜ ͕࡞ͬͨɺΞϓϦ͕ಈ͍͍ͯΔίϯςφͷϓϩηε ˞
    IUUQTBXTBNB[PODPNKQCMPHTOFXTVOEFSUIFIPPEGBSHBUFEBUBQMBOF ˞
    ӈهͷॻ੶Λࢀߟʹهࡌ
    ʮجૅ͔ΒֶͿίϯςφηΩϡϦςΟ
    %PDLFSΛ௨ͯ͠ཧղ͢Δίϯςφͷ߈ܸྫͱରࡦʯ
50. ෇࿥ɿίϯςφϥϯλΠϜͱ͍͏໊લͷൣғ  ίϯςφϥϯλΠϜ಺ͷϢʔβͷ੹೚ൣғʢ੺࿮෦෼ʣ ˞
    IUUQTBXTBNB[PODPNKQCMPHTOFXTVOEFSUIFIPPEGBSHBUFEBUBQMBOF ίϯςφϥϯλΠϜηΩϡϦςΟͱ͍ ͏৔߹͸ɺίϯςφͷϓϩηεΛର৅ ͱ͢Δ৔߹͕ଟ͍ʢݸਓͷײ૝ʣ
    &$4
    PO
    'BSHBUFͩͱ$POUBJOFSFE ͱSVOD͸ɺ"84ͷ؅ཧൣғͳͷͰ੺ ࿮෦෼ʹؔ࿈͢ΔՕॴͷΈߟྀ
51. ෇࿥ɿ$POUBJOFS
    ෦෼ʢকདྷͷر๬ʣ  'BSHBUFͷF#1' FYUFOEFE
    #FSLFMFZ
    1BDLFU
    'JMUFS ରԠʹظ଴ʂ
    ݱঢ়ϩʔυϚοϓ্ʹ 
 JTTVF͸্͕͍ͬͯΔ͕3FTFBSDIJOH
    ˠ
    ࠓ೥8F`SF
    8PSLJOH
    0O
    *Uʹͳͬͨʂ
    QUSBDFʹΑΔ଎౓௿Լͷ໰୊˞ͷӨڹΛड͚ͣʹ؂ࢹূ੻؅ཧ͕Ͱ͖Δ੡඼ͷબ୒ࢶ͕૿͑΍͘͢ ͳΔͷͰੋඇ
    👍Ͱ౤ථ ˞
    IUUQTXXXTDTLKQTQTZTEJHCMPHDPOUBJOFS@TFDVSJUZBXT@GBSHBUFQUSBDFME@QSFMPBEIUNM IUUQTHJUIVCDPNBXTDPOUBJOFSTSPBENBQJTTVFT