Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS IAM の知っておくべき話と知らなくてもいい話 DevIO2023/ AWS IAM ...
Search
YukihiroChiba
July 27, 2023
0
3.1k
AWS IAM の知っておくべき話と知らなくてもいい話 DevIO2023/ AWS IAM DevIO 2023
YukihiroChiba
July 27, 2023
Tweet
Share
More Decks by YukihiroChiba
See All by YukihiroChiba
わたしの業務の中に住み着いたCacoo/Cacoo has taken up residence in my work routine
yukihirochiba
0
700
Amazon VPCでの IPv6利用に向けた はじめの一歩/first-step-towards-using-ipv6-in-amazon-vpc
yukihirochiba
0
16
AWS IAM の結果整合性を避けるためセッションポリシーを用いてポリシーの動作確認を行う、を解説する
yukihirochiba
0
670
SSMエージェントはIAMロールの夢を見るか/ Do SSM Agents Dream Of IAM Roles?
yukihirochiba
0
2.1k
デジタルアイデンティティWGミニウェビナー第4回「IaaSとアイデンティティ」/ jnsa-iaas-identity
yukihirochiba
0
630
学習エンジンがうなりを上げているチームの作り方 / How to build a team with a learning engine humming along
yukihirochiba
0
3.8k
Amazon Route 53 Application Recovery Controller zonal shift 試してみた
yukihirochiba
0
1.6k
re:Growth 2022 Amazon Verified Permissions/妄想を膨らませる_チバユキ
yukihirochiba
0
5k
どこで動いてるの?AWS IAM のコントロールプレーンとデータプレーンに思いを馳せる/iam-background
yukihirochiba
0
4.6k
Featured
See All Featured
GraphQLの誤解/rethinking-graphql
sonatard
65
9.7k
Pencils Down: Stop Designing & Start Developing
hursman
118
11k
Six Lessons from altMBA
skipperchong
26
3.3k
A designer walks into a library…
pauljervisheath
201
24k
For a Future-Friendly Web
brad_frost
173
9.3k
A better future with KSS
kneath
235
17k
Practical Orchestrator
shlominoach
185
10k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
42
2k
Designing with Data
zakiwarfel
98
5k
The Language of Interfaces
destraynor
153
23k
10 Git Anti Patterns You Should be Aware of
lemiorhan
653
58k
Fireside Chat
paigeccino
31
2.9k
Transcript
"84*".ͷ͓͖ͬͯ͘ͱ Βͳ͍͍ͯ͘ "84ࣄۀຊ෦νόϢΩ
ࣗݾհ ઍ༿ (νόϢΩ) •2020ೖࣾ •͖ͳAWSαʔϏεɿIAM •͖ͳΞΫγϣϯɿsts:AssumeRole IUUQTEFWDMBTTNFUIPEKQBVUIPSDIJCBZVLJIJSP
ࠓͷҙؾࠐΈ w ͜ͷ࣌ؒʮνϣʔΫτʔΫʯͰ͢ w Θ͕ͨ͠ҰํతʹΔͷͰͳ͘ɺͥͻํͰΓऔΓ͠·͠ΐ͏ w །Ұͷਖ਼ղ͕͋ΔͷͰ͋Γ·ͤΜ w ʮΈΜͳͲ͏ͯ͠ΔΜͩΖ͏ʯΛڞ༗ͨ͠Γ
w ʮͲ͏͢Δͷ͕ΑΓྑ͍ͩΖ͏ʯΛҰॹʹߟ͑ͨΓ͠·͠ΐ͏
ࠓͷ͓ଋ w Έͳ͞Μʹݺͼ͔͚͍ͨ͜ͱ͕͋Δ߹ɺεϥ Πυͷӈ্ʹ͜Μͳͷ͕ग़͖ͯ·͢ ํλΠϜ w ڍखɺεέονϒοΫͷॻ͖ࠐΈɺϚΠΫͰͷ ൃݴͳͲɺํͰΓऔΓ͍ͨ͠ͷͰ͝ڠྗ ͓ئ͍͠·͢
ͬͦͬͯ͘͞ΈΑ͏ ํλΠϜ Έͳ͞Μͷ*".ϨϕϧΛڭ͍͑ͯͩ͘͞ɻ *".Λ৮ͬͨ͜ͱ͕ͳ͍ *".ϢʔβʔɺάϧʔϓɺϩʔϧɺϙϦγʔΛ͍ͬͯΔ *".ϦιʔεΛઃܭ͋Δ͍ߏஙͨ͜͠ͱ͕͋Δ
4$1͘͠1FSNJTTJPOTCPVOEBSZΛͬͨ͜ͱ͕͋Δ ηογϣϯϙϦγʔΛͬͨ͜ͱ͕͋Δ εέονϒοΫʹࣈΛॻ͍͍ͯͩ͘͞
͞ΒʹͬͯΈΑ͏ ํλΠϜ ྡͷ੮ͷਓͱ؆୯ͳࣗݾհͱ ʮࠓԿΛֶͼ͍͔ͨʯΛ͠·͠ΐ͏ ʢͻͱΓͣͭʣ
ࠓͷςʔϚ
ࠓͷςʔϚ *".ઃܭͷʢߏɺݖݶͷ࣋ͨͤํʣ *".ϕετϓϥΫςΟεͷ ධՁཧͷ σʔλϓϨʔϯͱίϯτϩʔϧϓϨʔϯͷ
ࠓͷςʔϚ *".ઃܭͷʢߏɺݖݶͷ࣋ͨͤํʣ *".ϕετϓϥΫςΟεͷ ධՁཧͷ σʔλϓϨʔϯͱίϯτϩʔϧϓϨʔϯͷ
্͔Βॱʹʮ͓͖ͬͯ͘ʯ͕ߴ͍ Լ͔Βॱʹʮ͠ΌΓ͍ͨʯ͕ߴ͍ ͓͖ͬͯ͘ ͠ΌΓ͍ͨ
ࠓͷςʔϚ *".ઃܭͷʢߏɺݖݶͷ࣋ͨͤํʣ *".ϕετϓϥΫςΟεͷ ධՁཧͷ σʔλϓϨʔϯͱίϯτϩʔϧϓϨʔϯͷ
ํλΠϜ Έͳ͞Μ͕ڵຯ͋ΔͷΛ ڍखͰڭ͍͑ͯͩ͘͞ Γ͍ͨ༰ΛεέονϒοΫʹ ॻ͍͍ͯͩ͘͞
*".ઃܭͷ ʢߏɺݖݶͷ࣋ͨͤํʣ
ߏͱݖݶͷ࣋ͨͤํ ✦ ʮߏʯͷྫ w *".ϢʔβʔͷΈʁεΠονϩʔϧʁ w *".ϩʔϧΛ͍ͬͯΔ߹ɺϢʔβʔͱʁ w "84*".*EFOUJUZ$FOUFSʁ*".4".-ϑΣσϨʔγϣϯʁ
w ϚϧνΞΧϯτʁͦͷ߹Ͳͷ͘Β͍ͷنʁ ✦ ʮݖݶͷ࣋ͨͤํʯͷྫ w Ͳͷ͘Βׂ͍Λ͚ͯΔʁ w ࠷খݖݶΛͲͷ͘Β͍ٻͯ͠Δʁ w Ͳͷ͘Β͍ϙϦγʔΧελϚΠζͯ͠Δʁ w ΨʔυϨʔϧ༻ͯ͠Δʁ
*".ઃܭʹؔͯ͠σΟεΧογϣϯλΠϜ ํλΠϜ *".ઃܭʢߏɾݖݶͷ࣋ͨͤํʣʹؔͯ͠ ࠔΓ͝ͱɺฉ͍ͯΈ͍ͨ͜ͱ͕ ͋Εͥͻޱ಄Ͱ͓ئ͍͠·͢
ࢀߟʹͳΔࢥ ✦ຊ൪ɺεςʔδϯάɺ։ൃͰ"84 ΞΧϯτΛ͚Δ ✦ҎԼͷׂͰ͚Δ wཧऀ wΞϓϦνʔϜ wΠϯϑϥνʔϜ wӡ༻νʔϜ ✦ͳΔ͘ਓ͕৮Βͳ্ͨ͘͠Ͱ
ΊʹݖݶΛ༩͑Δ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTJBNSPMFCBTFQFSNJTTJPO
*".ϕετϓϥΫςΟεͷ
*".ʹϕετϓϥΫςΟε͕͋Γ·͢ IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFCFTUQSBDUJDFTIUNM
ཁ͢Δͱ͜Μͳײ͡ ਓʹ*%ϑΣσϨʔγϣϯͬͯͶ ϫʔΫϩʔυʹ*".ϩʔϧͬͯͶ .'"༗ޮԽͯ͠Ͷ ΞΫηεΩʔϩʔςͯ͠Ͷ
ϧʔτϢʔβʔΘͳ͍ͰͶ ࠷খݖݶΛࢦͯ͠Ͷ ఆظతʹ*".Ϧιʔε୨Էͯ͠͠Ͷ *".ϙϦγʔͰ݅ΩʔͬͯͶ *"."DDFTT"OBMZ[FSͬͯͶ 0SHBOJ[BUJPOT4$1ͬͯͶ 1FSNJTTJPOTCPVOEBSZͬͯͶ
ಠஅͱภݟʹΑΔϥϕϧ͚ͮ ਓʹ*%ϑΣσϨʔγϣϯͬͯͶ ϫʔΫϩʔυʹ*".ϩʔϧͬͯͶ .'"༗ޮԽͯ͠Ͷ ΞΫηεΩʔϩʔςͯ͠Ͷ
ϧʔτϢʔβʔΘͳ͍ͰͶ ࠷খݖݶΛࢦͯ͠Ͷ ఆظతʹ*".Ϧιʔε୨Էͯ͠͠Ͷ *".ϙϦγʔͰ݅ΩʔͬͯͶ *"."DDFTT"OBMZ[FSͬͯͶ 0SHBOJ[BUJPOT4$1ͬͯͶ 1FSNJTTJPOTCPVOEBSZͬͯͶ ݫक Ͱ͖ΔݶΓ ༨༟͕͋Ε ༨༟͕͋Ε ༨༟͕͋Ε ༨༟͕͋Ε Ͱ͖ΔݶΓ ༨༟͕͋Ε Ͱ͖ΔݶΓ ༨༟͕͋Ε Ͱ͖ΔݶΓ
ϕετϓϥΫςΟεʹؔ͢Δ͋Ε͜Εɹɹ ਓʹ*%ϑΣσϨʔγϣϯͬͯͶ ϫʔΫϩʔυʹ*".ϩʔϧͬͯͶ .'"༗ޮԽͯ͠Ͷ ΞΫηεΩʔϩʔςͯ͠Ͷ
ϧʔτϢʔβʔΘͳ͍ͰͶ ࠷খݖݶΛࢦͯ͠Ͷ ఆظతʹ*".Ϧιʔε୨Էͯ͠͠Ͷ *".ϙϦγʔͰ݅ΩʔͬͯͶ *"."DDFTT"OBMZ[FSͬͯͶ 0SHBOJ[BUJPOT4$1ͬͯͶ 1FSNJTTJPOTCPVOEBSZͬͯͶ ݫक Ͱ͖ΔݶΓ ༨༟͕͋Ε ༨༟͕͋Ε ༨༟͕͋Ε ༨༟͕͋Ε Ͱ͖ΔݶΓ ༨༟͕͋Ε Ͱ͖ΔݶΓ ༨༟͕͋Ε Ͱ͖ΔݶΓ ํλΠϜ ͍Ζ͍Ζ ฉ͔͍ͤͯͩ͘͞
ධՁཧͷ
ධՁཧͱ "84SF*OWFOU)BSOFTTQPXFSPG*".QPMJDJFT SFJOJOQFSNJTTJPOTX"DDFTT"OBMZ[FS 4&$ ΑΓ ✦ "84*".ҎԼΛಥ͖߹Θͤͯ ධՁ͢Δ w
ϦΫΤετͷίϯςΩετ w ධՁରͷϙϦγʔ ✦ ධՁͷ݁ՌҎԼͷ͍ͣΕ͔ w ڐՄ w ڋ൱
ධՁཧϑϩʔνϟʔτઈରΈΑ͏ ˞୯ҰΞΧϯτʹ͓͚ΔϑϩʔνϟʔτͰ͋Δ͜ͱʹҙ IUUQTEPDTBXTBNB[PODPNKB@KQ*".MBUFTU6TFS(VJEFSFGFSFODF@QPMJDJFT@FWBMVBUJPOMPHJDIUNMQPMJDZFWBMEFOZBMMPX
͜Ε͚͓֮ͩ͑ͯ͜͏ ✦ σϑΥϧτͰڋ൱ʢ҉తͳڋ൱ʣ ✦ ໌ࣔతͳڋ൱͕Ͳ͔͜ʹ͋Ε݁Ռڋ൱ ✦ ʮ໌ࣔతͳڐՄʯΛ༩͑ΒΕΔͷҎԼͷΈ w ΞΠσϯςΟςΟϕʔεϙϦγʔ
w ϦιʔεϕʔεϙϦγʔ ✦ ҎԼΨʔυϨʔϧͱͯ͠ػೳ w 0SHBOJ[BUJPOT4$1 w 1FSNJTTJPOTCPVOEBSZ w ηογϣϯϙϦγʔʢείʔϓμϯϙϦγʔʣ w ʢ71$ΤϯυϙΠϯτϙϦγʔʣ
͜Ε͚͓֮ͩ͑ͯ͜͏ ✦ ୯ҰΞΧϯτͷ߹ɺҎԼͷ͍ͣΕ͔ͷΞΫηεڐՄͷ ༩ͷΈͰ݁Ռ͕ڐՄʹͳΔ߹͕͋Δ w ΞΠσϯςΟςΟϕʔεϙϦγʔ w ϦιʔεϕʔεϙϦγʔ ✦
ϦιʔεϕʔεϙϦγʔͰڐՄ͢ΔϓϦϯγύϧʹΑͬͯ ධՁཧ͕มΘΔ߹͕͋Δ ✦ ΫϩεΞΧϯτͷ߹ɺํͰڐՄ͕ඞཁ
ϑϦʔͷ࣭λΠϜ ํλΠϜ ͜͜ͷ෦͕ฉ͖͍ͨΜ͕ͩʁΛ ืू͍ͯ͠·͢
ʹཱͪͦ͏ͳϦϯΫू IUUQTEFWDMBTTNFUIPEKQBSUJDMFTOFXQPMJDZFWBMVBUJPOMPHJD fl PXDIBSU IUUQTEFWDMBTTNFUIPEKQBSUJDMFTEFWJPJBNFWBMVBUJPOMPHJD IUUQTEFWDMBTTNFUIPEKQBSUJDMFTQSJODJQBMFMFNFOUJBNSPMFPSSPMFTFTTJPO
σʔλϓϨʔϯͱ ίϯτϩʔϧϓϨʔϯͷ
*".ʹσʔλϓϨʔϯͱίϯτϩʔϧϓϨʔϯ͕͋Δ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBXTJBNDPOUSPMQMBOFEBUBQMBOF
ϑϦʔͷ࣭λΠϜ ํλΠϜ ฉ͖͍ͨ͜ͱʜʜ͋Γ·͢ʁ
ʹཱͪͦ͏ͳϦϯΫू IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBXTGBVMUJTPMBUJPOCPVOEBSJFT IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBXTJBNFWFOUVBMDPOTJTUFODZTFTTJPOQPMJDZ IUUQTEFWDMBTTNFUIPEKQBSUJDMFTBXTJBNCBDLHSPVOEEFWJP
͓͠·͍
ηογϣϯΞϯέʔτ%": ຬ্ҐͷηογϣϯΛޙϒϩάͰެ։༧ఆʂ ճͷ͝ڠྗΛΑΖ͓͘͠ئ͍͠·͢ɻ ෳճՄɺ લճͷ༰Ҿ͖ܧ͗·͢ ऴྃ͠·ͨ͠
None