やんわり押さえよう IAM の評価論理 / 2021 DevIo Decade IAM Evaluation Logic

"84ࣄۀຊ෦ίϯαϧςΟϯά෦ઍ༿޾޺
΍ΜΘΓԡ͑͞Α͏*".ͷධՁ࿦ཧ

View Slide

։ນҰ൪
ಥવͰ͕͢໰୊Ͱ͢

View Slide

࣍ͷ͏ͪ

ʮIAM ʹ͓͚ΔϙϦγʔʯ͸

ͲΕͰ͠ΐ͏ʁ

ʢෳ਺ճ౴Մʣ

View Slide

ݸҎ্ͷਖ਼ղͷબ୒ࢶ͕͋Γ·͢
ΠϯϥΠϯϙϦγʔ
AdministratorAccess
ReadOnlyAccess
ηογϣϯϙϦγʔ
ΞΠσϯςΟςΟϕʔεϙϦγʔ
S3όέοτϙϦγʔ
KMSΩʔϙϦγʔ
S3ΞΫηείϯτϩʔϧϦετ
ΞΫηεڐՄͷڥք
Organizations SCP
ΧελϚʔ؅ཧϙϦγʔ EC2FullAccess
ϦιʔεϕʔεϙϦγʔ
VPCΤϯυϙΠϯτϙϦγʔ
LambdaΞΫηεϙϦγʔ
৬຿ػೳͷAWS؅ཧϙϦγʔ
SNSτϐοΫϙϦγʔ
৴པϙϦγʔ

View Slide

ਖ਼ղ͸……

View Slide

શ෦Ͱ͢ʂʂʂ

View Slide

ΈΜͳ޿͍ҙຯͰͷʮ*".ͷϙϦγʔʯ
ΠϯϥΠϯϙϦγʔ
AdministratorAccess
ReadOnlyAccess
ηογϣϯϙϦγʔ
S3όέοτϙϦγʔ
KMSΩʔϙϦγʔ
S3ΞΫηείϯτϩʔϧϦετ
ΞΫηεڐՄͷڥք
Organizations SCP
ΧελϚʔ؅ཧϙϦγʔ EC2FullAccess
VPCΤϯυϙΠϯτϙϦγʔ
LambdaΞΫηεϙϦγʔ
৬຿ػೳͷAWS؅ཧϙϦγʔ
SNSτϐοΫϙϦγʔ
৴པϙϦγʔ

View Slide

*".ͷϙϦγʔͷ૊Έ߹Θͤ
ը૾͸͢΂ͯAWSυΩϡϝϯτΑΓ

View Slide

*".ϜζΧγΠ
🤔
🤔
🤔
എܠը૾͸͢΂ͯAWSυΩϡϝϯτΑΓ

View Slide

શ෦Λཧղ͢Δͷ͸೉͍͠ͷͰ
΍ΜΘΓԡ͑͞·͠ΐ͏

View Slide

࠷ऴతʹ͜Μͳײ͡Ͱԡ͑͞·͢

View Slide

ΞδΣϯμ
1.IAM JSON ϙϦγʔ

2.ಉҰΞΧ΢ϯτͰͷධՁ࿦ཧ

3.ΫϩεΞΧ΢ϯτͰͷධՁ࿦ཧ

4.ΨʔυϨʔϧ

5.ҟ୺ʂVPCΤϯυϙΠϯτϙϦγʔ

View Slide

ࣗݾ঺հ
ઍ༿ ޾޺
ɾAWS ࣄۀຊ෦

ɹίϯαϧςΟϯά෦

ɹϚωʔδϟʔ
ɾ2020೥1݄JOIN
ɾ2021 APN AWS Top Engineer
ɾ޷͖ͳΞΫγϣϯ: sts:AssumeRole

View Slide

*".+40/ϙϦγʔ

View Slide

*".ʹ͓͚ΔϙϦγʔλΠϓ

View Slide

ϙϦγʔλΠϓ͝ͱͷॏཁ౓ʢࢲݟʣ

View Slide

ϙϦγʔλΠϓ͸΄ͱΜͲ+40/
JSON
JSON
JSON
JSON
JSON
JSONͰͳ͍

View Slide

ݟ͍ͯ͜͏
IAM JSON ϙϦγʔͷߏ੒ཁૉ

View Slide

*".+40/ϙϦγʔߏ੒ཁૉ
ͰͷΈࢦఆՄ
⭐…ࢦఆඞਢͷ߲໨

View Slide

Θ͔Γ΍͍͢Πϝʔδ
ʮAWSʹ͓͚ΔABACͷخ͠͞ɺਏ͞ΛޠΓ·ͨ͠ #AKIBAAWSʯΑΓ

ɹhttps://dev.classmethod.jp/articles/akibaaws-06-iam-abac/

View Slide

1SJODJQBMཁૉɿʮ୭͕ʯΛఆٛ
*".άϧʔϓ͸
ࢦఆͰ͖ͳ͍
ͰͷΈࢦఆ

View Slide

"DUJPOཁૉɿʮԿΛʯΛఆٛ
ec2 : StartInstances
s3 : PutObject
kms : Decrypt
ΞΫγϣϯϓϨϑΟοΫε͸
αʔϏε໊લۭؒ
ϚωδϝϯτίϯιʔϧɺAWS CLIɺAWS SDKͳͲͷ

ΦϖϨʔγϣϯͷछผʹґΒͣධՁ͞ΕΔɻ
ΞΫγϣϯʹΑΓ

ରԠ͢ΔϦιʔελΠϓ͕ҟͳΔɻ

View Slide

3FTPVDFཁૉɿʮԿʹʯΛఆٛ
• arn:aws:s3:::όέοτ໊
• arn:aws:s3:::όέοτ໊/ΦϒδΣΫτ໊
• arn:aws:ec2:${Region}:${Account}:instance/ΠϯελϯεID
• arn:aws:ec2:${Region}:${Account}:volume/ϘϦϡʔϜID
ARN Λࢦఆ͢ΔɻΞΫγϣϯʹΑΓରԠ͢ΔϦιʔελΠϓ͸ҟͳΔɻ
ҟͳΔϦιʔελΠϓ

View Slide

• arn:aws:s3:::όέοτ໊/*
ϫΠϧυΧʔυͷ࢖༻Մ
• arn:aws:ec2:${Region}:${Account}:instance/*

View Slide

• arn:aws:s3:::όέοτ໊/*
• *
ϫΠϧυΧʔυͷ࢖༻Մ
• arn:aws:ec2:${Region}:${Account}:instance/*
ΞΫγϣϯʹΑͬͯ͸͢΂ͯ(*)ͷࢦఆ͕ඞਢ
ʢϦετܥͷΞΫγϣϯʹଟ͍ʣ

View Slide

۩ମྫɿ"84؅ཧϙϦγʔʮ"ENJOJTUSBUPS"DDFTTʯ
{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "*",

"Resource": "*"

}

]

}
͢΂ͯͷϦιʔε΁ͷ

͢΂ͯͷΞΫγϣϯʹ

ʢ৚݅ͳ͠Ͱʣ

AllowΛ༩͑Δ

View Slide

۩ମྫɿΧελϚʔ؅ཧϙϦγʔ
{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Deny",

"Action": "*",

"NotResource": “arn:aws:ec2:ap-northeast-1:

012345678910:instance/i-xxxxx”

}

]

}
ಛఆͷϦιʔεҎ֎΁ͷ

͢΂ͯͷΞΫγϣϯΛ

Deny͢Δ
ର৅͕͜ͷΠϯελϯεͰ͋ͬͯ΋ɺ
EFTDSJCFܥͳͲɺϦιʔελΠϓJOTUBODFʹ
ରԠ͍ͯ͠ͳ͍ΞΫγϣϯ͸ڋ൱͞ΕΔ

View Slide

"MMPX΋͘͠͸%FOZ
εςʔτϝϯτ͝ͱʹ Allow ΋͘͠͸ Deny ͕ఆٛ͞ΕΔɻ

ϦΫΤετͷ಺༰ʹ͍ͭͯҎԼͷ͍ͣΕ͔ͷঢ়ଶͱͳΔɻ

ঢ়ଶ ֓ཁ
҉໧తͳڋ൱
%FOZ΋"MMPX΋༩͑ΒΕ͍ͯͳ͍ɻ
σϑΥϧτɻ
໌ࣔతͳڋ൱
%FOZ͕༩͑ΒΕ͍ͯΔঢ়ଶɻ
໌ࣔతͳڐՄΑΓ༏ઌ͞ΕΔɻ
໌ࣔతͳڐՄ
"MMPX͕༩͑ΒΕ͍ͯΔঢ়ଶɻ
%FOZͱॏෳ͢Δ৔߹ɺଧͪফ͞ΕΔɻ
୭͕Կʹରͯ͠ʢͲΜͳ৚݅ͰʣԿΛ͢Δ͔

View Slide

ಉҰΞΧ΢ϯτͰͷධՁ࿦ཧ

View Slide

*".ʹ͓͚ΔϙϦγʔλΠϓʢ࠶ܝʣ

View Slide

ࠓճͷൃදͰ͸ׂѪ͠·͢
ࠓճͷର৅֎

View Slide

ຊষ͸͜ͷ̎ͭΛऔΓ্͛·͢
ຊষͷର৅

View Slide

*".Ϣʔβʔ
*".άϧʔϓ
*".ϩʔϧ
Ξλον
͍ΘΏΔʮIAMϙϦγʔʯɻΞΠσϯςΟςΟʹΞλονɻ

View Slide

ҰͭͷIAM ΤϯςΟςΟʹ௚઀ຒΊ͜Έɻ

ಠཱͨ͠ϦιʔεͰ͸ͳ͍ɻ
ग़དྷ߹͍ͷϙϦγʔɻ

ʮ৬຿ػೳͷAWS؅ཧϙϦγʔʯͱ͍͏ࡉ෼Խ΋Մೳɻ

AdministratorAccessɺReadOnly AccessͳͲɻ
ΧελϚʔ͕ಠࣗʹ࡞੒͢ΔϙϦγʔɻ

όʔδϣϯ؅ཧɺෳ਺ΤϯςΟςΟ΁ͷΞλον͕Մೳɻ
*".Ϣʔβʔ
*".άϧʔϓ
*".ϩʔϧ
Ξλον
͍ΘΏΔʮIAMϙϦγʔʯɻΞΠσϯςΟςΟʹΞλονɻ

View Slide

…
• ϦιʔεଆʹΞλον͢ΔϙϦγʔ

• S3όέοτ

• KMSΩʔ

• Lambdaؔ਺

• SNSτϐοΫ …ଞଟ਺

• ͢΂ͯͷϦιʔε͕ରԠ͍ͯ͠ΔΘ͚Ͱ͸ͳ͍

• Principalཁૉͷఆ͕ٛՄೳ

• ΠϯϥΠϯϙϦγʔʢϦιʔεʹ௚઀ຒΊ͜Έʣ

View Slide

ΞΠσϯςΟςΟϕʔεͱϦιʔεϕʔε
IAMϢʔβʔ
ΞΠσϯςΟςΟϕʔεϙϦγʔ ϦιʔεϕʔεϙϦγʔ
S3όέοτ
EC2Πϯελϯε
IAMϢʔβʔ
Ϧιʔεϕʔε
ϙϦγʔඇରԠ
s3:PutObject
ec2:StartInstances

View Slide

͍Β͢ͱͰߟ͑Α͏
IAMϢʔβʔ AWSϦιʔε

View Slide

σϑΥϧτͰ͜Ε
1.҉໧తͳڋ൱

View Slide

྆ऀͷϙϦγʔͷΠϝʔδ
Θͨ͠͸͜ͷϦΫΤετΛ
࣮ߦͰ͖Δ
͜ͷਓ͔ΒͷϦΫΤετ͸
ڐՄͯ͋͛͠Δ

View Slide

σϑΥϧτͰ͸ͲͪΒͷఆٛ΋ͳ͍
ʜʜ ʜʜ

View Slide

ͲͪΒͰ΋ڐՄ͕ͳ͍ͷͰ݁Ռతʹڋ൱
͓ؼΓ͍ͩ͘͞˝
εΠʔ

View Slide

୯ͳΔʮڐՄʯͱ΋
2.໌ࣔతͳڐՄ

View Slide

ͲͪΒ͔ͰڐՄ͕༩͑ΒΕ͍ͯΔ
Θͨ͠͸
͜Ε͕Ͱ͖Δ
͜ͷਓʹ͸
͜ΕΛڐ͢
खͿΒ

View Slide

ڐՄ͞ΕΔ
εΠʔ ͋ͳͨ͸௨͍͍ͬͯͱ
ݴΘΕ͍ͯ·͢
͋ͳͨ͸௨ΔݖརΛ
͍࣋ͬͯΔΑ͏Ͱ͢Ͷ
εΠʔ
ϦιʔεϕʔεϙϦγʔΛ
ΞλονͰ͖ͳ͍Ϧιʔεͷ৔߹ɺ
ΞΠσϯςΟςΟଆͰݖݶͷ֬อ͕ඞཁ

View Slide

ͪΐͬͱิ଍
ΞΧ΢ϯτ୯ҐͷڐՄͱ

ΤϯςΟςΟ୯ҐͷڐՄ

View Slide

ΞΧ΢ϯτΛ֗ͱͯ͠ߟ͑ͯΈΔ
֗ʢΞΧ΢ϯτʣA ֗B
֗C
rootϢʔβʔ
IAMϢʔβʔ

1,2,3
AWSϦιʔε

View Slide

ϦιʔεϕʔεϙϦγʔͰͷڐՄͷ࢓ํ
֗ʢΞΧ΢ϯτʣA ֗B
֗C
IAMϢʔβʔ

View Slide

खͿΒͰ௨ΕΔͷ͸ΤϯςΟςΟ୯ҐͰڐՄ͞Εͨ΋ͷ
֗"ͷ*".Ϣʔβʔ͔ΒͷΞΫηεΛڐՄ
खͿΒ
खͿΒ
IAMϢʔβʔ1
IAMϢʔβʔ2
IAMϢʔβʔ3

View Slide

Ұ൪ڧ͍
3.໌ࣔతͳڋ൱

View Slide

Ͳ͔͜Ͱ%FOZ͕༩͑ΒΕ͍ͯΕ͹ڋ൱

View Slide

໌ࣔతͳڋ൱͸ԿΑΓ΋ڧ͍
εΠʔ ௨͍͍ͯ͠ͱ
ݴΘΕ͍͚ͯͨͲ
ڋ൱͞Ε͍ͯΔΑ͏Ͱ͢Ͷ
௨ͯ͠͸͍͚ͳ͍ͱ
ݴΘΕ͍ͯ·͢
εΠʔ

View Slide

ΫϩεΞΧ΢ϯτͰͷධՁ࿦ཧ

View Slide

ΞΧ΢ϯτΛލ͍ͩΞΫηε
֗ʢΞΧ΢ϯτʣA ֗ʢΞΧ΢ϯτʣB

View Slide

جຊతͳߟ͑ํ͸มΘΒͳ͍
• ҉໧తͳڋ൱ɺ໌ࣔతͳڐՄɺ໌ࣔతͳڋ൱ͷߟ͑ํ͸มΘΒͳ͍

• ΞΠσϯςΟςΟͱϦιʔεͷ྆ํͰAllow͕༩͑ΒΕ͍ͯͳ͍ͱ
҉໧తͳڋ൱ͱͳΔ

• ϦιʔεଆͰͷڐՄ͸ɺΞΧ΢ϯτ୯ҐɾΤϯςΟςΟ୯ҐͷͲͪ
ΒͰ΋ྑ͍

View Slide

྆ํͰͷڐՄ͕ඞཁ

View Slide

ϦιʔεଆͰͷڐՄ
֗"ͷ*".Ϣʔβʔ͔ΒͷΞΫηεΛڐՄ
֗"͔ΒͷΞΫηεΛڐՄ
ͲͪΒͰ΋OK

View Slide

ยํ͚ͩͷڐՄͩͱ҉໧తͳڋ൱
͋ͳͨ͸ট଴٬Ϧετʹ
ࡌ͍ͬͯΔ͚Ͳ
ڐՄূΛ࣋ͬͯͳ͍Ͱ͢Ͷ

View Slide

Α͘࢖͏ྫ
ΫϩεΞΧ΢ϯτͰͷεΠονϩʔϧ

View Slide

ผΞΧ΢ϯτͷૢ࡞ʹεΠονϩʔϧΛ࢖͏͜ͱ͕ଟ͍
IAMϢʔβʔ
IAMϩʔϧ

View Slide

*".ϩʔϧΛҾ͖ड͚Δͱ͸
IAMϢʔβʔ IAMϩʔϧ
IAMϩʔϧΛ

Ҿ͖ड͚ͨηογϣϯ

ʢ੍࣌ؒݶ͋Γʣ
IAMϩʔϧͱ

ಉ౳ͷݖݶ
IAMϙϦγʔ
sts:AssumeRole

View Slide

*".ϩʔϧΛҾ͖ड͚Δʹ͸ڐՄ͕ඞཁ
ΞΠσϯςΟςΟ
ϕʔεϙϦγʔ
ΞΠσϯςΟςΟ
ϕʔεϙϦγʔ

ʢ৴པϙϦγʔʣ
ΫϩεΞΧ΢ϯτ

ΞΫηε
ಉ͡ΞΧ΢ϯτͰͷ
ΞΫηε

View Slide

ΨʔυϨʔϧ

View Slide

ຊষͷର৅
ຊষͷର৅

View Slide

ΨʔυϨʔϧʁ
• ΍͍͍ͬͯ͜ͱͷ্ݶΛઃ͚ΔΑ͏ʹػೳ͢Δ΋ͷ

• ΞΠσϯςΟςΟϕʔεϙϦγʔͱϦιʔεϕʔεϙϦγʔͷ֎ଆ
Ͱఆٛ͢Δ

• ͏͔ͬΓ޿͍ڐՄΛ༩͑ͯ͠·ͬͯ΋ΨʔυϨʔϧʹΑΓ๷͙

• ΨʔυϨʔϧࣗମͰԿ͔ΛڐՄͰ͖Δ΋ͷͰ͸ͳ͍

• ࠓճऔΓ্͛Δͷ͸ҎԼ

• Organizations SCPʢΞΧ΢ϯτશମʹద༻ʣ

• Permissions boundaryʢݸผͷΤϯςΟςΟʹద༻ʣ

• ΨʔυϨʔϧͰAllow͕༩͑ΒΕ͍ͯͳ͍΋ͷ͸҉໧తͳڋ൱ʹ
ͳΔ

View Slide

0SHBOJ[BUJPOTͱ͸
ϚωδϝϯτΞΧ΢ϯτ
ΞΧ΢ϯτA ΞΧ΢ϯτB ΞΧ΢ϯτC
SCP
ෳ਺ͷAWSΞΧ΢ϯτΛ

֊૚Խͯ͠؅ཧͰ͖Δػೳɻ

ݸʑͷAWSΞΧ΢ϯτʹ

SCPΛׂΓ౰ͯΒΕΔɻ

View Slide

0SHBOJ[BUJPOT4$1͕ద༻͞ΕΔͱ
IAMϢʔβʔ
AWSϦιʔε
rootϢʔβʔ
Organizations SCP
ΞΧ΢ϯτ಺ͷrootϢʔβʔΛؚΉશͯͷΤϯςΟςΟͷΞΫγϣϯ͸SCPʹΑΔධՁΛड͚Δɻ
ϩʔϧΛҾ͖ड͚ͨ

ηογϣϯ

View Slide

0SHBOJ[BUJPOT4$1͕ద༻͞ΕΔͱ
SCPͰڐՄ͕༩͑ΒΕ͍ͯͳ͍ϦΫΤετ͸ଞͷύʔϛογϣϯʹؔ܎ͳ͘҉໧తͳڋ൱ͱͳΔ
Organizations SCP
͜͜ͰڐՄ͞Ε͍ͯΔ
͜ͱ͕͢΂ͯ
΋ͪΖΜ%FOZ͕͋Ε͹
໌ࣔతͳڋ൱

View Slide

1FSNJTTJPOTCPVOEBSZͱ͸
ʮΞΫηεڐՄͷڥքʯͱ΋ɻ

ͱηοτͰߟ͑Δɻ

IAMϢʔβʔ΋͘͠͸IAMϩʔϧ
ʹׂΓ౰ͯՄೳͰɺIAMάϧʔϓ
ʹ͸ׂΓ౰ͯෆՄɻ

View Slide

1FSNJTTJPOTCPVOEBSZͷΠϝʔδ
Permissions boundary ΞΠσϯςΟςΟ

ϕʔεϙϦγʔ ϦιʔεϕʔεϙϦγʔ
ηοτͰ࢖༻͢Δ ΞΠσϯςΟςΟϕʔεϙϦγʔͷ
ධՁͷλΠϛϯάͰΨʔυϨʔϧͱͯ͠ػೳ

View Slide

ϦιʔεϕʔεϙϦγʔͰͷ"MMPX͕ͳ͍৔߹

ϕʔεϙϦγʔ
ʮ͜ͷϢʔβʔ͕
΍͍͍ͬͯͷ͸͜͜·Ͱʯ
Permissions boundaryͰAllow͕ͳ͍৔߹ɺ҉໧తͳڋ൱ͱͳΔ
1FSNJTTJPOTCPVOEBSZͰ
ڐՄ͞Ε͍ͯͳ͍Α͏Ͱ͢ɻ
໌ࣔతͳڋ൱
Ͱ͸ڐՄ͕͋ΔΑ͏Ͱ͕͢ɺ

View Slide

ϦιʔεϕʔεϙϦγʔͰ"MMPX͕͋Δ৔߹

͋ͳͨ͸ট଴͞Ε͍ͯΔͷͰ
ڐՄূ͸ݟͤͯ΋ΒΘͳͯ͘΋
େৎ෉Ͱ͢ɻ
ϦιʔεϕʔεϙϦγʔͰͷධՁ͕ઌʹߦΘΕΔͨΊͦ͜ͰAllow͕͋Ε͹ڐՄ͞ΕΔ
ʮ͜ͷϢʔβʔ͕
໌ࣔతͳڋ൱

View Slide

ΫϩεΞΧ΢ϯτͷ৔߹

ΫϩεΞΧ΢ϯτͷ৔߹ɺΞΠσϯςΟςΟϕʔεϙϦγʔ΋ධՁ͞ΕΔͨΊΨʔυϨʔϧ͕ൃಈ
ʮ͜ͷϢʔβʔ͕
1FSNJTTJPOTCPVOEBSZͰ
ڐՄ͞Ε͍ͯͳ͍Α͏Ͱ͢ɻ
ଞͷϙϦγʔͰ͸
ڐՄ͕͋ΔΑ͏Ͱ͕͢ɺ

View Slide

͜͜·Ͱݟ͖ͯͨ಺༰ͷ੔ཧ
https://www.slideshare.net/AmazonWebServicesJapan/20190129-aws-black-belt-online-seminar-aws-identity-and-
access-management-iam-part1
20190129 AWS Black Belt Online Seminar AWS Identity and Access Management (AWS IAM) Part1
ʮ͜ͷϢʔβʔ͕
ΞΧ΢ϯτΛލ͍ͩ৔߹ͷҧ͍

View Slide

ҟ୺ʂ
71$ΤϯυϙΠϯτϙϦγʔ

View Slide

෼ྨ্͸ϦιʔεϕʔεϙϦγʔ͕ͩಛघ

View Slide

71$ΤϯυϙΠϯτϙϦγʔ
VPC
EC2ͳͲ
VPCΤϯυϙΠϯτ
VPC಺ͷϦιʔε͕αʔϏεΤϯυϙΠϯτʹ௨৴Λߦ͏ͨΊʹ࢖༻Ͱ͖ΔVPCΤϯυϙΠϯτɻ

αʔϏεͷछผʹΑͬͯ͸ΤϯυϙΠϯτʹϙϦγʔΛઃఆͰ͖Δɻ

View Slide

ΨʔυϨʔϧͱͯ͠ػೳ
VPCΤϯυϙΠϯτ
͜͜Λܦ༝ͨ͠௨৴Ͱ
ڐՄ͢Δͷ͸͜Ε͚ͩ
ڐՄ͕ͳ͍΋ͷ͸
҉໧తͳڋ൱

View Slide

71$ΤϯυϙΠϯτϙϦγʔͷ࢖༻ྫ
VPC
VPCΤϯυϙΠϯτ
VPC಺෦ͷϦιʔε͔Β֎෦ͷS3όέοτ΁ͷΞΫηε͕ෆՄͱͳΔΑ͏

VPCΤϯυϙΠϯτϙϦγʔΛ࢖༻͢Δɻ

View Slide

·ͱΊ

View Slide

঺հͨ͠΋ͷͷશ෦੝Γ

VPCΤϯυϙΠϯτ
VPC
ΫϩεΞΧ΢ϯτΞΫηε

View Slide

঺հͨ͠΋ͷͷશ෦੝Γ

VPCΤϯυϙΠϯτ
VPC
ΫϩεΞΧ΢ϯτΞΫηε
1FSNJTTJPOT
CPVOEBSZ
ΞΠσϯςΟςΟ
ϕʔεϙϦγʔ
0SHBOJ[BUJPOT
4$1
71$ΤϯυϙΠϯτ
ϙϦγʔ

View Slide

·ͱΊ
• IAMͷධՁ࿦ཧͷ݁Ռ͸ҎԼͷ͍ͣΕ͔ͱͳΔ

• ҉໧తͳڋ൱ʢσϑΥϧτʣ

• ໌ࣔతͳڐՄʢΨʔυϨʔϧͰ͸༩͑ΒΕͳ͍ʣ

• ໌ࣔతͳڋ൱ʢͲ͔͜ͰDeny͕͋Ε͹ඞͣ͜ΕʹͳΔʣ

• ҉໧తͳڋ൱ͱͳΔྫ͸ҎԼ

• ΞΠσϯςΟςΟͰ΋ϦιʔεͰ΋Allow͕༩͑ΒΕ͍ͯͳ͍

• ΨʔυϨʔϧͰAllow͕༩͑ΒΕ͍ͯͳ͍

• ΫϩεΞΧ΢ϯτͷ৔߹ʹ૒ํͰڐՄ͞Ε͍ͯͳ͍

View Slide

View Slide

やんわり押さえよう IAM の評価論理 / 2021 DevIo Decade IAM Evaluation Logic

やんわり押さえよう IAM の評価論理 / 2021 DevIo Decade IAM Evaluation Logic

YukihiroChiba

More Decks by YukihiroChiba

Other Decks in Technology

Featured

Transcript