Upgrade to Pro — share decks privately, control downloads, hide ads and more …

サーバーレスなマルチテナントSaaSの権限管理 / Serverless Multitenant SaaS Auth Management

C04919d0b55a6a78a68b8ae72658bfbc?s=47 ykarakita
August 31, 2018

サーバーレスなマルチテナントSaaSの権限管理 / Serverless Multitenant SaaS Auth Management

2018/08/31 Serverless Meetup Tokyo #10

C04919d0b55a6a78a68b8ae72658bfbc?s=128

ykarakita

August 31, 2018
Tweet

More Decks by ykarakita

Other Decks in Technology

Transcript

  1. αʔόʔϨεͳ ϚϧνςφϯτSaaSͷݖݶ؅ཧ Serverless Meetup Tokyo #10 2018/08/31 @ykarakita

  2. Profile ඦ໦ా ༤྄ʢYusuke Karakitaʣ ϋϯζϥϘגࣜձࣾʗαʔϏε։ൃνʔϜ ୲౰ɿΠϯϑϥઃܭɺAPIόοΫΤϯυ։ൃ @ykarakita

  3. ը૾Ͱ΋ͬͱɺച৔ͱͭͳ͕Δ ίϛϡχέʔγϣϯαʔϏε

  4. ϚϧνςφϯτΞϓϦέʔγϣϯ

  5. ϚϧνςφϯτΞϓϦέʔγϣϯ • ҰͭͷΞϓϦέʔγϣϯϓϥοτϑΥʔϜΛ ෳ਺ͷ૊৫Ͱڞ༗ γεςϜ ∟૊৫A ∟ϢʔβʔA ∟ϢʔβʔB ∟૊৫B ∟ϢʔβʔC

    ∟ϢʔβʔD
  6. ϚϧνςφϯτΞϓϦέʔγϣϯ Ͱߟྀ͕ඞཁͳ͜ͱ

  7. Ϛϧνςφϯτͷߟྀ఺ • ݖݶ؅ཧ • ςφϯτ؅ཧʢϓϥϯͷมߋͳͲʣ • σʔλྖҬʢσʔλ෼཭ʣ • Ϧιʔε؅ཧʢϝϞϦɺσΟεΫɺCPUͳͲʣ •

    ͳͲ
  8. ࠓ೔ͷ಺༰ αʔόʔϨεͰϚϧνςφϯτ ΞϓϦΛߏங͢Δ্Ͱͷ ݖݶ؅ཧͷϊ΢ϋ΢

  9. ϚϧνςφϯτΞϓϦͷ ݖݶ؅ཧͬͯͲΜͳײ͡ʁ

  10. Ϛϧνςφϯτͷݖݶ؅ཧ • Ϣʔβʔͷෳ਺ͷଐੑ͔ΒΞΫηεՄೳͳϦ ιʔε͕ܾఆ͢Δ ɾςφϯτ →tenant-Aɺtenant-B… ɾςφϯτͷར༻ϓϥϯ →freeɺstandardɺpremium… ɾϢʔβʔ →User-AɺUser-B…

    ɾϢʔβʔͷϩʔϧ →AdminɺUser… ɾϢʔβʔͷͦͷଞͷଐੑʢॴଐΤϦΞͳͲʣ →Area-AɺArea-B…
  11. ϚϧνςφϯτΞϓϦͷ ηΩϡϦςΟཁ݅ • ex1) σʔλ΁ͷΞΫηεͷೝՄ • tenant-Aʹଐ͢ΔϢʔβʔ͸tenant-Aͷσʔ λͷΈΞΫηε͕ڐՄ͞ΕΔ • ex2)

    API ͷೝՄ • AdminϩʔϧͷϢʔβʔ͸͢΂ͯͷAPIϦΫ Τετ͕ڐՄ͞ΕΔ͕UserϩʔϧͷϢʔβʔ ͸GETϝιουͷΈΞΫηε͕ڐՄ͞ΕΔ
  12. ͭ·ΓϚϧνςφϯτΞϓϦ͸ ɾڞ௨ͷγεςϜͷதͰ ɾϢʔβʔͷଐੑ͝ͱʹ ɾΞΫηε੍ޚ͕ඞཁ

  13. Ұൠతʹ͸ɾɾ • WebϑϨʔϜϫʔΫ΍ϛυϧ΢ΣΞϨϕϧͰ੍ޚ

  14. αʔόʔϨεͰϚϧνςφϯτɾɾ ɾɾશવࣄྫͳ͍ʘ(^o^)ʗ

  15. AWSωΠςΟϒͳΞϓϦͳΒ Cognito + IAM Ͱ࣮ݱͰ͖Δ

  16. Ϣʔβʔ΁ͷݖݶ෇༩ ϢʔβʔʹΑͬͯΞΫηεՄೳͳϦιʔε͕ҟͳΔͨΊɺ LambdaϑΝϯΫγϣϯ΁ݖݶΛ෇༩͢ΔͷͰ͸ͳ͘ɺ Ϣʔβʔࣗ਎ʹݖݶΛ෇͚Δ ݖݶ෇༩

  17. Cognito User Pool άϧʔϓͷઃఆ Cognito Tenant-A User Group Admin Group

    Billing Group tenant_a_user_role tenant_a_billing_role tenant_a_admin_role Cognito Tenant-B Cognito Tenant-C • ςφϯτ͝ͱʹUser PoolΛ࡞੒͠ɺͦͷதʹΞϓϦͰͷϩʔϧ͝ͱʹCognitoά ϧʔϓΛ࡞੒͢Δɻάϧʔϓʹ͸IAMϩʔϧΛΞλονɻ
  18. άϧʔϓͷIAMϩʔϧ tenant_a_admin_role ɹɹɹɹɹɹɹɹộ { "Action": [ "s3:GetObject" "s3:PutObject" ], "Resource":

    “arn:aws:s3:::myapp/tenant_a/*”, "Effect": "Allow" }, ɹɹɹɹɹɹɹɹộ tenant_a_user_role ɹɹɹɹɹɹɹɹộ { "Action": [ "s3:GetObject" ], "Resource": “arn:aws:s3:::myapp/tenant_a/*”, "Effect": "Allow" }, ɹɹɹɹɹɹɹɹộ ΞΫηεՄೳͳϦιʔεΛ੍ݶ ΞϓϦ಺Ͱͷϩʔϧผʹ࣮ߦՄೳͳૢ࡞Λ੍ݶ
  19. API GatewayͷೝՄ ᶃLogin with username & password ᶄReturn Token(JWT) ᶅAPI

    Request with ID Token(JWT) ᶆJWTͷ༗ޮੑΛ֬ೝʢॺ໊νΣοΫɾ༗ޮظݶνΣοΫʣ ᶇJWT͔ΒϢʔβʔͷଐੑΛऔಘ ᶈೝՄ͢ΔAPIΛܾఆ CognitoʹΧελϜଐੑͱͯ͠tierͳͲΛઃఆ͓ͯ͘͜͠ͱͰɺ ϓϥϯͳͲʹΑΔݖݶܾఆϩδοΫΛ૊ΈࠐΉ͜ͱ΋Մೳ Custom Authorizer ᶉೝՄ͞Εͨૢ࡞ͳΒ ϦΫΤετଓߦ
  20. Ϧιʔε΁ͷΞΫηε JWT Token JWT Token JWT Token Token͔ΒҰ࣌ೝূ৘ใΛੜ੒ Ұ࣌ೝূ৘ใΛ࢖ͬͯΞΫηε ίϯϐϡʔτࣗ਎ͷϩʔϧʹ͸S3΁ͷΞΫηεݖݶΛ෇༩͍ͯ͠ͳ͍

    ͢΂ͯͷϦιʔεΞΫηεΛϢʔβʔʹ෇༩͞ΕͨϩʔϧΛ࢖ͬ ࣮ͯߦ͢Δ͜ͱͰΠϯϑϥϨϕϧͰͷΞΫηε੍ޚ͕Մೳʹ
  21. "1*(BUFXBZ 4FSWJDF" 4FSWJDF# 4FSWJDF$ ϚΠΫϩαʔϏεͰಈ͍ͯ·͢ • Shared API Gateway •

    API GatewayͱΧελϜΦʔιϥΠβʔΛαʔ Ϗεڞ௨Ͱ࢖༻
  22. ϚΠΫϩαʔϏεؒͷ΍ΓͱΓ͸Πϕϯτ υϦϒϯ • αʔόʔϨεͷϙςϯγϟϧΛ࠷େݶʹҾ͖ग़͢ ͨΊʹ͸ΠϕϯτυϦϒϯͳΞʔΩςΫνϟ͕࠷ ద 4FSWJDF" Pub Sub SNS

    Topic 4FSWJDF# Pub SNS Topic ඇಉظͰૄ݁߹ͳΞʔΩςΫνϟ✨✨ඒ͍͠ɾɾ
  23. 4FSWJDF" ΠϕϯτυϦϒϯ • αʔϏεؒͰ࿈ܞ͕ඞཁͳ৔߹͸ඇಉظతʹॲཧ͢Δ • ଞͷαʔϏεͷσʔλ͕ඞཁ৔߹͸ɺऔಘଆ͕੹೚Λ࣋ͬͯ Sub͢Δ • Πϕϯτσʔλͷઃܭ͸ࣄલʹ͔ͬ͠Γ΍Βͳ͍ͱޙʑେม 4FSWJDF#

    4FSWJDF$ Pub Pub Pub Sub Sub SNS Topic
  24. 4FSWJDF" ͔͠͠ɺ 4FSWJDF# 4FSWJDF$ Pub Pub Pub Sub Sub SNS

    Topic ͲͷLambdaϑΝϯΫγϣϯ΋ϦιʔεΞΫηεݖݶΛ࣋ͨͳ͍
  25. IDτʔΫϯΛҾ͖ͣΓճ͢ 4FSWJDF" 4FSWJDF# Pub Pub Sub JWT Token • Πϕϯτσʔλʹ͸ඞͣIDτʔΫϯΛؚΊΔ

    • Ͳ͜·Ͱ΋Ҿ͖ͣΓճ͢ • τʔΫϯͷ༗ޮظݶʹ஫ҙ͢Δʢ̍࣌ؒʣ JWT Token