Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWS Service Namespace を流行らせたい/ AWS Service Namespace to become popular

AWS Service Namespace を流行らせたい/ AWS Service Namespace to become popular

325ce6fcd0a74ff78990b8632817da55?s=128

YukihiroChiba

January 28, 2022
Tweet

More Decks by YukihiroChiba

Other Decks in Technology

Transcript

  1. ʜʜྲྀߦΒ͍ͤͨɺ "844FSWJDF/BNFTQBDFΛɻ  ઍ༿޾޺ʢνόϢΩʣ

  2. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ࣦޮ ͠·ͨ͠

  3. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ࣦޮ ͠·ͨ͠

  4. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ɾ2021 APN AWS Top

    Engineer ࣦޮ ͠·ͨ͠
  5. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ɾ2021 APN AWS Top

    Engineer ɾ޷͖ͳAWSαʔϏεɿIAM
  6. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM

  7. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ

  8. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole

  9. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole ޷͖ͳAWS Service Namespaceɿtiros

  10. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole ޷͖ͳAWS Service Namespaceɿtiros φχίϨʁʁ

  11.  ޷͖ͳ AWS Service Namespace Λ ܾΊ·͠ΐ͏ ϝΠϯςʔϚ

  12. "HFOEB  1.AWSαʔϏε͋Δ͋Δ 2.AWS Service Namespace 1.ͱ͸ 2.ௐ΂ํ 3.ΫΠζ 1.ਖ਼Ҿ͖

    2.ٯҾ͖
  13.  AWS αʔϏε͋Δ͋Δ ݴ͍͍ͨ

  14.  "84αʔϏε͋Δ͋Δ ͦͷ1. ͦͷ2. ͦͷ3.

  15.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ͦͷ3.

  16.  ଟ͍ɻ ͳΜͰ΋223ݸ͋Δͱ͔…… ɹͳ͍ͱ͔…… ֮͑ΒΕͳ͍Α……

  17.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ͦͷ3.

  18.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ

    ͦͷ3.
  19.  ઀಄ࣙ"84͔"NB[PO͔໎͍͕ͪ Ұઆʹ͸ɻ ʮAWSʯ͕ͭ͘ͷ͸…… ɹɹଞͷAWSαʔϏεͱ૊Έ߹ΘͤΔલఏ ɹɹɹɹAWS LambdaɺAWS BackupɺAWS IAM... ʮAmazonʯ͕ͭ͘ͷ͸……

    ɹɹ୯ಠͰ࢖͑Δ΋ͷ Amazon EC2ɺAmazon Route53ɺAmazon S3…
  20.  ઀಄ࣙ"84͔"NB[PO͔໎͍͕ͪ ͪΐͬͱ೿ੜͯ͠ ਖ਼໊ࣜশ໎͍͕ͪ໰୊ •Amazon Elastic Compute Cloudʁ •Amazon EC2ʁ

    •Amazon Simple Storage Serviceʁ •Amazon S3ʁ ͳͲͳͲ…… ΋͔ͯ͠͠ʮAmazon Elastic Compute Cloud (EC2)ʯʁ
  21.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ

    ͦͷ3.
  22.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ

    ͦͷ3. ԿΛ΋ͬͯ”αʔϏε”͔೰Ή
  23.  ԿΛ΋ͬͯzαʔϏεz͔೰Ή Ϛωδϝϯτίϯιʔϧج४ʁ Ϋϥ΢υ੡඼Ұཡج४ʁ AWSυΩϡϝϯτج४ʁ

  24.  ԿΛ΋ͬͯzαʔϏεz͔೰Ή Ϛωίϯ ੡඼ϖʔδ υΩϡϝϯτ &-# ʮ&$ʯͷ Ұ෦ ͋Δ τοϓϖʔδ

    ʹ͋Δ 5SBOTJU(BUFXBZ ʮ71$ʯͷ Ұ෦ ͋Δ ʮ71$ʯʹ ͋Δ .BSLFUQMBDF αʔϏεը໘ ͕͋Δ ͳ͍ τοϓϖʔδ ʹ͋Δ ྫ͑͹……
  25.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ

    ͦͷ3. ԿΛ΋ͬͯ”αʔϏε”͔೰Ή ͏ʔΉ…… 🤔
  26.  ͦ͜Ͱ AWS Service Namespace Ͱ͢Α ೰ΊΔ͋ͳͨ΁

  27.  "844FSWJDF/BNFTQBDF͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾ ɾ

  28.  "844FSWJDF/BNFTQBDF͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾAWS ΋ Amazon ΋͔ͭͳ͍🤗 ɹɹେମུশΛ͓͚֮͑ͯ͹OK ɾ

  29.  "844FSWJDF/BNFTQBDF͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾAWS ΋ Amazon ΋͔ͭͳ͍🤗 ɹɹେମུশΛ͓͚֮͑ͯ͹OK ɾ਺͸AWSαʔϏεΑΓଟ͍🥺

    ɹɹ2022/1/27࣌఺Ͱ301ݸ͋Γ·͢
  30.  AWS Service Namespace ͱ͸Կ͔ ࠓ೔ͷຊ୊

  31.  "844FSWJDF/BNFTQBDFͱ͸ arn:aws:s3:::my_corporate_bucket arn:aws:iam::123456789012:user/Test • AWS ੡඼Λࣝผ͢ΔͨΊͷαʔϏε໊લۭؒ • ARN ʹొ৔͠·͢

  32.  "844FSWJDF/BNFTQBDFͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition

    • αʔϏεϓϨϑΟοΫεͱ΋
  33.  "844FSWJDF/BNFTQBDFͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition

    • αʔϏεϓϨϑΟοΫεͱ΋ ec2:CreateVpc s3:GetObject Actionͷྫɻ ɹରԠ͢ΔAPI͕ແ͘ݖݶ෇༩ͷͨΊʹͷΈ͋Δ΋ͷ΋
  34.  "844FSWJDF/BNFTQBDFͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition

    • αʔϏεϓϨϑΟοΫεͱ΋ ec2:CreateVpc s3:GetObject iam:AWSServiceName rds:DatabaseName Actionͷྫɻ ɹରԠ͢ΔAPI͕ແ͘ݖݶ෇༩ͷͨΊʹͷΈ͋Δ΋ͷ΋ Conditionͷྫɻ ɹάϩʔόϧ৚݅Ωʔʹରͯ͠ ɹ αʔϏεݻ༗ͷ৚݅Ωʔͱݺ͹ΕΔ
  35.  "844FSWJDF/BNFTQBDFͱ͸ • AWS CLI ͷίϚϯυ໊ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍ • ྫ֎΋͋Γ·͢ʢaws con fi

    gserviceͱ͔ʣ aws sts get-caller-identity aws ecr put-image
  36.  "844FSWJDF/BNFTQBDFͱ"84αʔϏε • 1ର1ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍ • ҰͭͷAWSαʔϏε͕ෳ਺ͷAWS Service NamespaceΛ࣋ͭ͜ͱ΋͋Δ • ҟͳΔAWSαʔϏε͕ಉ͡AWS

    Service Namespace Λ࣋ͭ͜ͱ΋͋Δ
  37.  Ͳ͏΍ͬͯ֬ೝ͢Ε͹Α͍͔ "844FSWJDF/BNFTQBDF

  38.  ίϚϯυΛୟ͜͏ i=`aws iam generate-service-last-accessed-details --arn arn:aws:iam::aws:policy/AdministratorAccess --output text` \

    && sleep 1 \ && aws iam get-service-last-accessed-details --job-id $i --max-items 1000 \ | jq -c '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace]' ࠓ೥ͷ AWS αʔϏε໊લۭؒɺࠓ೥ͷ͏ͪʹɻ 2021 https://dev.classmethod.jp/articles/aws-service- namespace-2021/ ҎԼʹࡌͬͯ·͢ɻ
  39.  ͳʹɺͦͷίϚϯυʜʜ AdministratorAccessΛΞΫηεΞυόΠβʔͰ ݟΔͷͱಉ͜͡ͱΛ AWS CLI Ͱ΍ͬͯ·͢ɻ ΞΫηεՄೳͳ ʮαʔϏεʯͱ ࠷ऴΞΫηε࣌ؒΛ

    දࣔ͢ΔΑ
  40.  ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ • αʔϏεೝূϦϑΝϨϯεΛΈΑ͏ • Service Authorization Reference ͳͷͰʮೝՄʯͱ༁ͯ͠΄͘͠΋ ͋Δͱ͔ͳ͍ͱ͔

    • αʔϏεϓϨϑΟοΫε͝ͱʹϖʔδ͕࡞ΒΕ͍ͯ·͢ ϙϦγʔઃܭ͢Δ࣌ʹ ֎ͤͳ͍Ͱ͢ΑͶ https://docs.aws.amazon.com/ja_jp/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
  41.  ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ • ʮAWS IAMͱ࿈ܞ͢ΔαʔϏεʯϖʔδ΋େࣄ • AWS IAM ͷυΩϡϝϯτͷҰ෦Ͱ͢ •

    ͜͜ͰͷʮαʔϏεʯ͸αʔϏεϓϨϑΟοΫε͕ج४Ͱ͢ ϒοΫϚʔΫͯ͠ͳ͍…ʁ ͳΜͰ……ʁ https://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html
  42.  IAM ͱ஥ྑ͘ͳΔͳΒ AWSαʔϏε͡Όͳ͘ AWS Service Namespace Λҙࣝ͠Α͏ "844FSWJDF/BNFTQBDF

  43.  AWS Service Namespace ΫΠζʂʂʂʂʂ νϟϨϯδ͠Α͏

  44.  ΍Δ͜ͱ • ਖ਼Ҿ͖ • AWSαʔϏε͔Β໊લۭؒΛߟ͑Δ • ٯҾ͖ • ໊લۭ͔ؒΒAWSαʔϏεΛߟ͑Δ

    ͜͜Ͱͷʮਖ਼Ҿ͖ʯͱ͔ʮٯҾ͖ʯ͸Θͨ͠ ͕উखʹͦ͏ݺΜͰΔ͚ͩͰ͢ɻ ΑͦͰݴ͏ͱ ஏΛ͔͖·͢Α
  45.  ਖ਼Ҿ͖ฤ "844FSWJDF/BNFTQBDFΫΠζ

  46.  ୈҰ໰ "NB[PO&$ ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace

  47.  ୈҰ໰ "NB[PO&$ FD ೉қ౓ɿ AWSαʔϏε AWS Service Namespace ؆୯Ͱ͢Ͷɻ

  48.  ୈೋ໰ "NB[PO4 ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace

  49.  ୈೋ໰ "NB[PO4 T ೉қ౓ɿ AWSαʔϏε AWS Service Namespace ๏ଇΘ͔͖ͬͯ·ͨ͠Ͷɻ

  50.  ୈࡾ໰ "NB[PO71$ ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace

  51.  ୈࡾ໰ "NB[PO71$ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace FD ʮvpcʯͰ͸͋Γ·ͤΜΑɻ

  52.  ໊લۭؒFDଟ͍Αʜʜ • Amazon EC2 actions • Amazon EBS actions

    • Amazon VPC actions • Amazon IPAM actions • AWS Transit Gateway actions • AWS PrivateLink actions • AWS Client VPN actions • AWS Site-to-Site VPN actions • AWS Outposts actions • AWS Wavelength actions • VM Import/Export actions • AWS Nitro Enclaves https://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query.html
  53.  ٯҾ͖ฤ "844FSWJDF/BNFTQBDFΫΠζ

  54.  ୈҰ໰ "NB[PO3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace SET Amazon

    RDS Ҏ֎ͰԿ͕͋ΔͰ͠ΐ͏ʁ ʁ
  55.  ୈҰ໰ "NB[PO3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace SET "NB[PO

    %PDVNFOU%# ͦ͏ͳΜͩ……ɻ
  56.  ୈೋ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace NFEJBJNQPSU ϝσΟΞܥͷαʔϏε͔ͳʁʁʁʁ ʁ

  57.  ୈೋ໰ "NB[PO3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace Amazon RDS

    Custom for Oracle ͷ ɹΠϯετʔϧϝσΟΞʹର͢ΔݖݶΛ෇༩͢ΔͨΊͷ໊લۭؒɻɻ NFEJBJNQPSU
  58.  ୈࡾ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace UJSPT ฉ͍ͨ͜ͱ΋ͳ͍Α…… ʁ

  59.  ୈࡾ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace UJSPT ਖ਼֬ʹݴ͑͹ Amazon

    VPC Reachability Analyzer ͕ ɹ΋ͬͱ΋ؔΘΓ͕ڧ͍ "NB[PO71$ ڧ͍ͯݴ͑͹
  60.  UJSPTJTԿ https://aws.amazon.com/jp/security/provable-security/ • ਪ࿦πʔϧʁ෼ੳج൫ʁΈ͍ͨͳ΋ͷ • Inspector ΍ΞΫηεΞφϥΠβʔͰ΋࢖༻͞ΕΔ • ઐ༻ͷAPIΛୟ͚ΔΘ͚Ͱͳ͘ڐՄΛ༩͑ΔͨΊʹඞཁ

    • ྫ͑͹ Inspector v2 ͷαʔϏεϦϯΫϩʔϧͷIAMϙϦγʔΛோΊͯΈΑ͏
  61.  ͋ͳͨ͸Կ໰ਖ਼ղͰ͖·͔ͨ͠ʁ "844FSWJDF/BNFTQBDFΫΠζ

  62.  ·ͱΊ Α͏΍͘ऴΘΓͰ͢

  63.  "844FSWJDF/BNFTQBDF͸͍͍ͧ IAMʹৄ͘͠ͳΔͳΒආ͚ͯ௨Εͳ͍ 300ݸҎ্΋όϦΤʔγϣϯ͕͋Δ ਪ͠Λݟ͚ͭͯ௥͍͔͚Α͏

  64.  ऴΘΓʹɿΘͨ͠ͷࣥ೦ΛோΊ͍ͯͩ͘͞ https://dev.classmethod.jp/articles/aws-services-with-aws-servicenamespaces/ ೥຤೥࢝ͷ࣌ؒΛ๋͛·ͨ͠