Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
サーバーレスなマルチテナントSaaSの権限管理 / Serverless Multitenan...
Search
ykarakita
August 31, 2018
Technology
3
1.9k
サーバーレスなマルチテナントSaaSの権限管理 / Serverless Multitenant SaaS Auth Management
2018/08/31 Serverless Meetup Tokyo #10
ykarakita
August 31, 2018
Tweet
Share
More Decks by ykarakita
See All by ykarakita
ユーザー企業における サーバーレスな Web APIバックエンド開発 / Developping serverless Web API Backend
ykarakita
2
2.5k
Fitbit APIのススメ / Effective usage of fitbit API
ykarakita
0
710
Fitbit ✕ Music 〜Fitbit APIで最高のトレーニングを〜 / Great Training with Fitbit API
ykarakita
5
910
Other Decks in Technology
See All in Technology
事例で学ぶ!B2B SaaSにおけるSREの実践例/SRE for B2B SaaS: A Real-World Case Study
bitkey
1
160
IPA&AWSダブル全冠が明かす、人生を変えた勉強法のすべて
iwamot
PRO
2
190
Lufthansa ®️ USA Contact Numbers: Complete 2025 Support Guide
lufthanahelpsupport
0
220
2025-07-06 QGIS初級ハンズオン「はじめてのQGIS」
kou_kita
0
180
SREの次のキャリアの道しるべ 〜SREがマネジメントレイヤーに挑戦して、 気づいたこととTips〜
coconala_engineer
1
150
QuickSight SPICE の効果的な運用戦略~S3 + Athena 構成での実践ノウハウ~/quicksight-spice-s3-athena-best-practices
emiki
0
120
shake-upを科学する
rsakata
7
790
タイミーのデータモデリング事例と今後のチャレンジ
ttccddtoki
6
2.5k
「クラウドコスト絶対削減」を支える技術—FinOpsを超えた徹底的なクラウドコスト削減の実践論
delta_tech
4
180
インフラ寄りSREの生存戦略
sansantech
PRO
7
2.6k
CDK Toolkit Libraryにおけるテストの考え方
smt7174
0
120
AI エージェントと考え直すデータ基盤
na0
17
5.5k
Featured
See All Featured
How to Ace a Technical Interview
jacobian
278
23k
Statistics for Hackers
jakevdp
799
220k
Gamification - CAS2011
davidbonilla
81
5.4k
It's Worth the Effort
3n
185
28k
Navigating Team Friction
lara
187
15k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
161
15k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
29
9.6k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
281
13k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.4k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
50k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.7k
Transcript
αʔόʔϨεͳ ϚϧνςφϯτSaaSͷݖݶཧ Serverless Meetup Tokyo #10 2018/08/31 @ykarakita
Profile ඦా ༤྄ʢYusuke Karakitaʣ ϋϯζϥϘגࣜձࣾʗαʔϏε։ൃνʔϜ ୲ɿΠϯϑϥઃܭɺAPIόοΫΤϯυ։ൃ @ykarakita
ը૾Ͱͬͱɺചͱͭͳ͕Δ ίϛϡχέʔγϣϯαʔϏε
ϚϧνςφϯτΞϓϦέʔγϣϯ
ϚϧνςφϯτΞϓϦέʔγϣϯ • ҰͭͷΞϓϦέʔγϣϯϓϥοτϑΥʔϜΛ ෳͷ৫Ͱڞ༗ γεςϜ ∟৫A ∟ϢʔβʔA ∟ϢʔβʔB ∟৫B ∟ϢʔβʔC
∟ϢʔβʔD
ϚϧνςφϯτΞϓϦέʔγϣϯ Ͱߟྀ͕ඞཁͳ͜ͱ
Ϛϧνςφϯτͷߟྀ • ݖݶཧ • ςφϯτཧʢϓϥϯͷมߋͳͲʣ • σʔλྖҬʢσʔλʣ • ϦιʔεཧʢϝϞϦɺσΟεΫɺCPUͳͲʣ •
ͳͲ
ࠓͷ༰ αʔόʔϨεͰϚϧνςφϯτ ΞϓϦΛߏங͢Δ্Ͱͷ ݖݶཧͷϊϋ
ϚϧνςφϯτΞϓϦͷ ݖݶཧͬͯͲΜͳײ͡ʁ
Ϛϧνςφϯτͷݖݶཧ • Ϣʔβʔͷෳͷଐੑ͔ΒΞΫηεՄೳͳϦ ιʔε͕ܾఆ͢Δ ɾςφϯτ →tenant-Aɺtenant-B… ɾςφϯτͷར༻ϓϥϯ →freeɺstandardɺpremium… ɾϢʔβʔ →User-AɺUser-B…
ɾϢʔβʔͷϩʔϧ →AdminɺUser… ɾϢʔβʔͷͦͷଞͷଐੑʢॴଐΤϦΞͳͲʣ →Area-AɺArea-B…
ϚϧνςφϯτΞϓϦͷ ηΩϡϦςΟཁ݅ • ex1) σʔλͷΞΫηεͷೝՄ • tenant-Aʹଐ͢ΔϢʔβʔtenant-Aͷσʔ λͷΈΞΫηε͕ڐՄ͞ΕΔ • ex2)
API ͷೝՄ • AdminϩʔϧͷϢʔβʔͯ͢ͷAPIϦΫ Τετ͕ڐՄ͞ΕΔ͕UserϩʔϧͷϢʔβʔ GETϝιουͷΈΞΫηε͕ڐՄ͞ΕΔ
ͭ·ΓϚϧνςφϯτΞϓϦ ɾڞ௨ͷγεςϜͷதͰ ɾϢʔβʔͷଐੑ͝ͱʹ ɾΞΫηε੍ޚ͕ඞཁ
Ұൠతʹɾɾ • WebϑϨʔϜϫʔΫϛυϧΣΞϨϕϧͰ੍ޚ
αʔόʔϨεͰϚϧνςφϯτɾɾ ɾɾશવࣄྫͳ͍ʘ(^o^)ʗ
AWSωΠςΟϒͳΞϓϦͳΒ Cognito + IAM Ͱ࣮ݱͰ͖Δ
Ϣʔβʔͷݖݶ༩ ϢʔβʔʹΑͬͯΞΫηεՄೳͳϦιʔε͕ҟͳΔͨΊɺ LambdaϑΝϯΫγϣϯݖݶΛ༩͢ΔͷͰͳ͘ɺ ϢʔβʔࣗʹݖݶΛ͚Δ ݖݶ༩
Cognito User Pool άϧʔϓͷઃఆ Cognito Tenant-A User Group Admin Group
Billing Group tenant_a_user_role tenant_a_billing_role tenant_a_admin_role Cognito Tenant-B Cognito Tenant-C • ςφϯτ͝ͱʹUser PoolΛ࡞͠ɺͦͷதʹΞϓϦͰͷϩʔϧ͝ͱʹCognitoά ϧʔϓΛ࡞͢ΔɻάϧʔϓʹIAMϩʔϧΛΞλονɻ
άϧʔϓͷIAMϩʔϧ tenant_a_admin_role ɹɹɹɹɹɹɹɹộ { "Action": [ "s3:GetObject" "s3:PutObject" ], "Resource":
“arn:aws:s3:::myapp/tenant_a/*”, "Effect": "Allow" }, ɹɹɹɹɹɹɹɹộ tenant_a_user_role ɹɹɹɹɹɹɹɹộ { "Action": [ "s3:GetObject" ], "Resource": “arn:aws:s3:::myapp/tenant_a/*”, "Effect": "Allow" }, ɹɹɹɹɹɹɹɹộ ΞΫηεՄೳͳϦιʔεΛ੍ݶ ΞϓϦͰͷϩʔϧผʹ࣮ߦՄೳͳૢ࡞Λ੍ݶ
API GatewayͷೝՄ ᶃLogin with username & password ᶄReturn Token(JWT) ᶅAPI
Request with ID Token(JWT) ᶆJWTͷ༗ޮੑΛ֬ೝʢॺ໊νΣοΫɾ༗ޮظݶνΣοΫʣ ᶇJWT͔ΒϢʔβʔͷଐੑΛऔಘ ᶈೝՄ͢ΔAPIΛܾఆ CognitoʹΧελϜଐੑͱͯ͠tierͳͲΛઃఆ͓ͯ͘͜͠ͱͰɺ ϓϥϯͳͲʹΑΔݖݶܾఆϩδοΫΛΈࠐΉ͜ͱՄೳ Custom Authorizer ᶉೝՄ͞Εͨૢ࡞ͳΒ ϦΫΤετଓߦ
ϦιʔεͷΞΫηε JWT Token JWT Token JWT Token Token͔ΒҰ࣌ೝূใΛੜ Ұ࣌ೝূใΛͬͯΞΫηε ίϯϐϡʔτࣗͷϩʔϧʹS3ͷΞΫηεݖݶΛ༩͍ͯ͠ͳ͍
ͯ͢ͷϦιʔεΞΫηεΛϢʔβʔʹ༩͞ΕͨϩʔϧΛͬ ࣮ͯߦ͢Δ͜ͱͰΠϯϑϥϨϕϧͰͷΞΫηε੍ޚ͕Մೳʹ
"1*(BUFXBZ 4FSWJDF" 4FSWJDF# 4FSWJDF$ ϚΠΫϩαʔϏεͰಈ͍ͯ·͢ • Shared API Gateway •
API GatewayͱΧελϜΦʔιϥΠβʔΛαʔ Ϗεڞ௨Ͱ༻
ϚΠΫϩαʔϏεؒͷΓͱΓΠϕϯτ υϦϒϯ • αʔόʔϨεͷϙςϯγϟϧΛ࠷େݶʹҾ͖ग़͢ ͨΊʹΠϕϯτυϦϒϯͳΞʔΩςΫνϟ͕࠷ ద 4FSWJDF" Pub Sub SNS
Topic 4FSWJDF# Pub SNS Topic ඇಉظͰૄ݁߹ͳΞʔΩςΫνϟ✨✨ඒ͍͠ɾɾ
4FSWJDF" ΠϕϯτυϦϒϯ • αʔϏεؒͰ࿈ܞ͕ඞཁͳ߹ඇಉظతʹॲཧ͢Δ • ଞͷαʔϏεͷσʔλ͕ඞཁ߹ɺऔಘଆ͕Λ࣋ͬͯ Sub͢Δ • Πϕϯτσʔλͷઃܭࣄલʹ͔ͬ͠ΓΒͳ͍ͱޙʑେม 4FSWJDF#
4FSWJDF$ Pub Pub Pub Sub Sub SNS Topic
4FSWJDF" ͔͠͠ɺ 4FSWJDF# 4FSWJDF$ Pub Pub Pub Sub Sub SNS
Topic ͲͷLambdaϑΝϯΫγϣϯϦιʔεΞΫηεݖݶΛ࣋ͨͳ͍
IDτʔΫϯΛҾ͖ͣΓճ͢ 4FSWJDF" 4FSWJDF# Pub Pub Sub JWT Token • ΠϕϯτσʔλʹඞͣIDτʔΫϯΛؚΊΔ
• Ͳ͜·ͰҾ͖ͣΓճ͢ • τʔΫϯͷ༗ޮظݶʹҙ͢Δʢ̍࣌ؒʣ JWT Token