ʜʜྲྀߦΒ͍ͤͨɺ"844FSWJDF/BNFTQBDFΛɻઍ༿ʢνόϢΩʣ
View Slide
ࣗݾհ ઍ༿ (νόϢΩ)ࣦޮ͠·ͨ͠
ࣗݾհ ઍ༿ (νόϢΩ)ɾ20201݄ΫϥεϝιουJOINɹɹɹɹࣦޮ͠·ͨ͠
ࣗݾհ ઍ༿ (νόϢΩ)ɾ20201݄ΫϥεϝιουJOINɹɹɹɹɾ2021 APN AWS Top Engineerࣦޮ͠·ͨ͠
ࣗݾհ ઍ༿ (νόϢΩ)ɾ20201݄ΫϥεϝιουJOINɹɹɹɹɾ2021 APN AWS Top Engineerɾ͖ͳAWSαʔϏεɿIAM
͖ͳʜʜ ͖ͳAWSαʔϏεɿIAM
͖ͳʜʜ ͖ͳAWSαʔϏεɿIAM͖ͳAWSϦιʔεɿIAMϩʔϧ
͖ͳʜʜ ͖ͳAWSαʔϏεɿIAM͖ͳAWSϦιʔεɿIAMϩʔϧ͖ͳΞΫγϣϯɿsts:AssumeRole
͖ͳʜʜ ͖ͳAWSαʔϏεɿIAM͖ͳAWSϦιʔεɿIAMϩʔϧ͖ͳΞΫγϣϯɿsts:AssumeRole͖ͳAWS Service Namespaceɿtiros
͖ͳʜʜ ͖ͳAWSαʔϏεɿIAM͖ͳAWSϦιʔεɿIAMϩʔϧ͖ͳΞΫγϣϯɿsts:AssumeRole͖ͳAWS Service NamespaceɿtirosφχίϨʁʁ
͖ͳ AWS Service Namespace ΛܾΊ·͠ΐ͏ϝΠϯςʔϚ
"HFOEB 1.AWSαʔϏε͋Δ͋Δ2.AWS Service Namespace1.ͱ2.ௐํ3.ΫΠζ1.ਖ਼Ҿ͖2.ٯҾ͖
AWS αʔϏε͋Δ͋Δݴ͍͍ͨ
"84αʔϏε͋Δ͋Δͦͷ1.ͦͷ2.ͦͷ3.
"84αʔϏε͋Δ͋Δͦͷ1. ଟ͍ɻͦͷ2.ͦͷ3.
ଟ͍ɻͳΜͰ223ݸ͋Δͱ͔……ɹͳ͍ͱ͔……֮͑ΒΕͳ͍Α……
"84αʔϏε͋Δ͋Δͦͷ1. ଟ͍ɻͦͷ2. ಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪͦͷ3.
಄ࣙ"84͔"NB[PO͔໎͍͕ͪҰઆʹɻʮAWSʯ͕ͭ͘ͷ……ɹɹଞͷAWSαʔϏεͱΈ߹ΘͤΔલఏɹɹɹɹAWS LambdaɺAWS BackupɺAWS IAM...ʮAmazonʯ͕ͭ͘ͷ……ɹɹ୯ಠͰ͑ΔͷAmazon EC2ɺAmazon Route53ɺAmazon S3…
಄ࣙ"84͔"NB[PO͔໎͍͕ͪͪΐͬͱੜͯ͠ਖ਼໊ࣜশ໎͍͕ͪ•Amazon Elastic Compute Cloudʁ•Amazon EC2ʁ•Amazon Simple Storage Serviceʁ•Amazon S3ʁͳͲͳͲ……͔ͯ͠͠ʮAmazon Elastic Compute Cloud (EC2)ʯʁ
"84αʔϏε͋Δ͋Δͦͷ1. ଟ͍ɻͦͷ2. ಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪͦͷ3. ԿΛͬͯ”αʔϏε”͔Ή
ԿΛͬͯzαʔϏεz͔ΉϚωδϝϯτίϯιʔϧج४ʁΫϥυҰཡج४ʁAWSυΩϡϝϯτج४ʁ
ԿΛͬͯzαʔϏεz͔ΉϚωίϯ ϖʔδ υΩϡϝϯτ&-#ʮ&$ʯͷҰ෦͋Δτοϓϖʔδʹ͋Δ5SBOTJU(BUFXBZʮ71$ʯͷҰ෦͋Δʮ71$ʯʹ͋Δ.BSLFUQMBDFαʔϏεը໘͕͋Δͳ͍τοϓϖʔδʹ͋Δྫ͑……
"84αʔϏε͋Δ͋Δͦͷ1. ଟ͍ɻͦͷ2. ಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪͦͷ3. ԿΛͬͯ”αʔϏε”͔Ή͏ʔΉ……🤔
ͦ͜Ͱ AWS Service Namespace Ͱ͢ΑΊΔ͋ͳͨ
"844FSWJDF/BNFTQBDFɾج४͕໌֬🤗ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔɾɾ
"844FSWJDF/BNFTQBDFɾج४͕໌֬🤗ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔɾAWS Amazon ͔ͭͳ͍🤗ɹɹେମུশΛ͓͚֮͑ͯOKɾ
"844FSWJDF/BNFTQBDFɾج४͕໌֬🤗ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔɾAWS Amazon ͔ͭͳ͍🤗ɹɹେମུশΛ͓͚֮͑ͯOKɾAWSαʔϏεΑΓଟ͍🥺ɹɹ2022/1/27࣌Ͱ301ݸ͋Γ·͢
AWS Service Namespace ͱԿ͔ࠓͷຊ
"844FSWJDF/BNFTQBDFͱarn:aws:s3:::my_corporate_bucketarn:aws:iam::123456789012:user/Test• AWS Λࣝผ͢ΔͨΊͷαʔϏε໊લۭؒ• ARN ʹొ͠·͢
"844FSWJDF/BNFTQBDFͱ• IAM JSON ϙϦγʔʹొ͠·͢• Action• Condition• αʔϏεϓϨϑΟοΫεͱ
"844FSWJDF/BNFTQBDFͱ• IAM JSON ϙϦγʔʹొ͠·͢• Action• Condition• αʔϏεϓϨϑΟοΫεͱec2:CreateVpcs3:GetObjectActionͷྫɻɹରԠ͢ΔAPI͕ແ͘ݖݶ༩ͷͨΊʹͷΈ͋Δͷ
"844FSWJDF/BNFTQBDFͱ• IAM JSON ϙϦγʔʹొ͠·͢• Action• Condition• αʔϏεϓϨϑΟοΫεͱec2:CreateVpcs3:GetObjectiam:AWSServiceNamerds:DatabaseNameActionͷྫɻɹରԠ͢ΔAPI͕ແ͘ݖݶ༩ͷͨΊʹͷΈ͋ΔͷConditionͷྫɻɹάϩʔόϧ݅Ωʔʹରͯ͠ɹ αʔϏεݻ༗ͷ݅ΩʔͱݺΕΔ
"844FSWJDF/BNFTQBDFͱ• AWS CLI ͷίϚϯυ໊ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍• ྫ֎͋Γ·͢ʢaws configserviceͱ͔ʣaws sts get-caller-identityaws ecr put-image
"844FSWJDF/BNFTQBDFͱ"84αʔϏε• 1ର1ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍• ҰͭͷAWSαʔϏε͕ෳͷAWS ServiceNamespaceΛ࣋ͭ͜ͱ͋Δ• ҟͳΔAWSαʔϏε͕ಉ͡AWS Service NamespaceΛ࣋ͭ͜ͱ͋Δ
Ͳ͏ͬͯ֬ೝ͢ΕΑ͍͔"844FSWJDF/BNFTQBDF
ίϚϯυΛୟ͜͏i=`aws iam generate-service-last-accessed-details --arnarn:aws:iam::aws:policy/AdministratorAccess --output text`\&& sleep 1\&& aws iam get-service-last-accessed-details --job-id $i --max-items 1000\| jq -c '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace]'ࠓͷ AWS αʔϏε໊લۭؒɺࠓͷ͏ͪʹɻ 2021https://dev.classmethod.jp/articles/aws-service-namespace-2021/ҎԼʹࡌͬͯ·͢ɻ
ͳʹɺͦͷίϚϯυʜʜAdministratorAccessΛΞΫηεΞυόΠβʔͰݟΔͷͱಉ͜͡ͱΛ AWS CLI Ͱͬͯ·͢ɻΞΫηεՄೳͳʮαʔϏεʯͱ࠷ऴΞΫηε࣌ؒΛදࣔ͢ΔΑ
ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ• αʔϏεೝূϦϑΝϨϯεΛΈΑ͏• Service Authorization Reference ͳͷͰʮೝՄʯͱ༁ͯ͠΄͋͘͠Δͱ͔ͳ͍ͱ͔• αʔϏεϓϨϑΟοΫε͝ͱʹϖʔδ͕࡞ΒΕ͍ͯ·͢ϙϦγʔઃܭ͢Δ࣌ʹ֎ͤͳ͍Ͱ͢ΑͶhttps://docs.aws.amazon.com/ja_jp/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ• ʮAWS IAMͱ࿈ܞ͢ΔαʔϏεʯϖʔδେࣄ• AWS IAM ͷυΩϡϝϯτͷҰ෦Ͱ͢• ͜͜ͰͷʮαʔϏεʯαʔϏεϓϨϑΟοΫε͕ج४Ͱ͢ϒοΫϚʔΫͯ͠ͳ͍…ʁͳΜͰ……ʁhttps://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html
IAM ͱྑ͘ͳΔͳΒAWSαʔϏε͡Όͳ͘AWS Service Namespace Λҙࣝ͠Α͏"844FSWJDF/BNFTQBDF
AWS Service NamespaceΫΠζʂʂʂʂʂνϟϨϯδ͠Α͏
Δ͜ͱ• ਖ਼Ҿ͖• AWSαʔϏε͔Β໊લۭؒΛߟ͑Δ• ٯҾ͖• ໊લۭ͔ؒΒAWSαʔϏεΛߟ͑Δ͜͜Ͱͷʮਖ਼Ҿ͖ʯͱ͔ʮٯҾ͖ʯΘ͕ͨ͠উखʹͦ͏ݺΜͰΔ͚ͩͰ͢ɻΑͦͰݴ͏ͱஏΛ͔͖·͢Α
ਖ਼Ҿ͖ฤ"844FSWJDF/BNFTQBDFΫΠζ
ୈҰ"NB[PO&$қɿʁAWSαʔϏε AWS Service Namespace
ୈҰ"NB[PO&$ FDқɿAWSαʔϏε AWS Service Namespace؆୯Ͱ͢Ͷɻ
ୈೋ"NB[PO4қɿʁAWSαʔϏε AWS Service Namespace
ୈೋ"NB[PO4 TқɿAWSαʔϏε AWS Service Namespace๏ଇΘ͔͖ͬͯ·ͨ͠Ͷɻ
ୈࡾ"NB[PO71$қɿʁAWSαʔϏε AWS Service Namespace
ୈࡾ"NB[PO71$қɿAWSαʔϏε AWS Service NamespaceFDʮvpcʯͰ͋Γ·ͤΜΑɻ
໊લۭؒFDଟ͍Αʜʜ• Amazon EC2 actions• Amazon EBS actions• Amazon VPC actions• Amazon IPAM actions• AWS Transit Gateway actions• AWS PrivateLink actions• AWS Client VPN actions• AWS Site-to-Site VPN actions• AWS Outposts actions• AWS Wavelength actions• VM Import/Export actions• AWS Nitro Enclaveshttps://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query.html
ٯҾ͖ฤ"844FSWJDF/BNFTQBDFΫΠζ
ୈҰ"NB[PO3%4қɿAWSαʔϏε AWS Service NamespaceSETAmazon RDS Ҏ֎ͰԿ͕͋ΔͰ͠ΐ͏ʁʁ
ୈҰ"NB[PO3%4қɿAWSαʔϏε AWS Service NamespaceSET"NB[PO%PDVNFOU%#ͦ͏ͳΜͩ……ɻ
ୈೋқɿAWSαʔϏε AWS Service NamespaceNFEJBJNQPSUϝσΟΞܥͷαʔϏε͔ͳʁʁʁʁʁ
ୈೋ"NB[PO3%4қɿAWSαʔϏε AWS Service NamespaceAmazon RDS Custom for Oracle ͷɹΠϯετʔϧϝσΟΞʹର͢ΔݖݶΛ༩͢ΔͨΊͷ໊લۭؒɻɻNFEJBJNQPSU
ୈࡾқɿAWSαʔϏε AWS Service NamespaceUJSPTฉ͍ͨ͜ͱͳ͍Α……ʁ
ୈࡾқɿAWSαʔϏε AWS Service NamespaceUJSPTਖ਼֬ʹݴ͑ Amazon VPC Reachability Analyzer ͕ɹͬͱؔΘΓ͕ڧ͍"NB[PO71$ڧ͍ͯݴ͑
UJSPTJTԿhttps://aws.amazon.com/jp/security/provable-security/• ਪπʔϧʁੳج൫ʁΈ͍ͨͳͷ• Inspector ΞΫηεΞφϥΠβʔͰ༻͞ΕΔ• ઐ༻ͷAPIΛୟ͚ΔΘ͚Ͱͳ͘ڐՄΛ༩͑ΔͨΊʹඞཁ• ྫ͑ Inspector v2 ͷαʔϏεϦϯΫϩʔϧͷIAMϙϦγʔΛோΊͯΈΑ͏
͋ͳͨԿਖ਼ղͰ͖·͔ͨ͠ʁ"844FSWJDF/BNFTQBDFΫΠζ
·ͱΊΑ͏͘ऴΘΓͰ͢
"844FSWJDF/BNFTQBDF͍͍ͧIAMʹৄ͘͠ͳΔͳΒආ͚ͯ௨Εͳ͍300ݸҎ্όϦΤʔγϣϯ͕͋Δਪ͠Λݟ͚͍͔͚ͭͯΑ͏
ऴΘΓʹɿΘͨ͠ͷࣥ೦ΛோΊ͍ͯͩ͘͞https://dev.classmethod.jp/articles/aws-services-with-aws-servicenamespaces/࢝ͷ࣌ؒΛ๋͛·ͨ͠
yukihirochiba
otanet
tacck
andpad
poteboy
oracle4engineer
kgsi
tomoaki25
yamamuteki
murachiakira
rynsuke
hakubishin3
philhawksworth
yeseniaperezcruz
jlugia
lynnandtonic
smashingmag
marktimemedia
zenorocha
pauljervisheath
eileencodes
phodgson
deanohume
danielanewman