ここが好きだよAWS管理ポリシー_devio2022/i_am_iam_lover

Transcript

1. 
   "84ࣄۀຊ෦ίϯαϧςΟϯά෦ઍ༿޾޺ʢνόϢΩʣ
   ࢲͷ"84ѪΛฉ͚ʂ
   ͕͜͜޷͖ͩΑ
   "84*".ͷ"84؅ཧϙϦγʔ
   

   View Slide

2. ࣗݾ঺հ
   ઍ༿޾޺
   νόϢΩ
   
   w"84ྺɿ೥ڧ
   w޷͖ͳ"84αʔϏεɿ"84*".
   w޷͖ͳ͓໘ͷछྨɿఱۡͷ͓໘
   ࠓճͷεϥΠυ͸ຕ͋Γ·͢
   

   View Slide

3. 
   ɻ
   

   View Slide

4. 
   ͳΜͷ਺ࣈ͔Θ͔ΔͰ͠ΐ͏͔ʁ
   
   

   View Slide

5. 
   ͳΜͷ਺ࣈ͔Θ͔ΔͰ͠ΐ͏͔ʁ
   
   Կ͔Λ߹ܭͨ͠਺Ͱ͢
   

   View Slide

6. 
   ݴ͑Δ͔ͳʁ
   
   ϙ˓Ϟϯͷछྨ
   ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
   IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ
   

   View Slide

7. 
   ϙ˓ϞϯΑΓଟ͍"84؅ཧϙϦγʔ
   
   "84؅ཧ
   ϙϦγʔͷ਺
   ˞ +5$
   ࣌఺
   ͰΞΫςΟϒͳ΋ͷ
   ϙ˓Ϟϯͷछྨ
   ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
   IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ
   

   View Slide

8. ͕͜͜޷͖ͩΑ"84؅ཧϙϦγʔ
   wࣗಈͰ࡞੒ɾߋ৽͞ΕΔ
   wͨ͘͞Μ͋Δ͠ɺͨ·ʹ͍ͳ͘ͳΔ
   w໊শ΍આ໌ʹϑϦʔμϜ͞Λײ͡Δ
   ޷͖ͩͳ͊
   

   View Slide

9. 
   "84؅ཧϙϦγʔͱ͸
   

   View Slide

10. "84؅ཧϙϦγʔͱ͸
    "84͕؅ཧ͢ΔϙϦγʔ
    ͷ͜ͱͰ͢
    

    View Slide

11. "84؅ཧϙϦγʔͱ͸
    "84͕؅ཧ͢ΔϙϦγʔ
    ͷ͜ͱͰ͢
    ΠϯϥΠϯͰͳ͍
    ΧελϚʔ؅ཧͰͳ͍
    

    View Slide

12. ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    ೥݄ʹొ৔
    

    View Slide

13. 
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    "84
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    "84ʹΑΓ؅ཧ͞ΕΔ
    ΧελϚʔ͕؅ཧ
    ࠓճऔΓ্͛Δͷ͸͜Ε
    ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘
    

    View Slide

14. 
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    "84ʹΑΓ؅ཧ͞ΕΔ
    ৬຿ػೳ༻
    αʔϏε
    ϩʔϧ༻
    αʔϏεϦϯΫ
    ϩʔϧ 4-3
    ༻
    ্هҎ֎
    ΧελϚʔ͕؅ཧ
    ϙϦγʔͷύε͔Β൑ผ
    ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘
    "84
    ؅ཧϙϦγʔ
    

    View Slide

15. ͨͷ͍͠ʂ
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    ৬຿ػೳ༻
    αʔϏε
    ϩʔϧ༻
    αʔϏεϦϯΫ
    ϩʔϧ 4-3
    ༻
    ্هҎ֎
    ͨͷ͍͠ʂ
    "84
    ؅ཧϙϦγʔ
    ৽αʔϏεɺ৽ػೳͷൃදʹઌߦͯ͠
    ࡞੒ɾߋ৽͞Ε͍ͯΔ͜ͱ͕ଟ͍
    

    View Slide

16. 
    ਺ࣈͰݟΔ
    "84؅ཧϙϦγʔ
    

    View Slide

17. 
    ࠶ܝ
    
    "84؅ཧ
    ϙϦγʔͷ਺
    ϙ˓Ϟϯͷछྨ
    ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
    IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ
    ˞ +5$
    ࣌఺
    ͰΞΫςΟϒͳ΋ͷ
    

    View Slide

18. 
    Ͳͷ͘Β͍ͷϖʔεͰ
    ૿͍͑ͯΔͷ͔ʁ
    

    View Slide

19. ೥͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ΄΅ຖ೥௒
    ૿͑ͯΔ
    

    View Slide

20. 
    Ͳͷ݄͕͍ͪ͹Μ
    ૿͍͑ͯΔͷ͔ʁ
    

    View Slide

21. ݄͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ݄΋ଟ͍ͷʁ
    

    View Slide

22. ೥ͱ݄͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ೥݄
    ͕ଟ͍͚ͩͩͬͨ
    

    View Slide

23. 
    ͜Ε·Ͱͷ૿Ճ܏޲Λ
    ݄͝ͱʹݟΔ
    

    View Slide

24. ΍ͬͺΓ݄ͱ݄͕ͭΑ͍
    

    View Slide

25. ΍ͬͺΓ݄ͱ݄͕ͭΑ͍
    ೥຤͸
    "84؅ཧϙϦγʔͷ०
    

    View Slide

26. 
    ݮΔ͜ͱ΋͋ΔΑɺ
    "84؅ཧϙϦγʔ
    

    View Slide

27. ඇਪ঑ͷ"84؅ཧϙϦγʔ
    wඇਪ঑ʢഇࢭɾ%FQSFDBUFEʣʹͳΔͱʜʜ
    wΞλονࡁΈͷ৔߹
    wΞλον͸ܧଓ͞ΕΔ
    wϙϦγʔͷޮྗ΋ܧଓ͞ΕΔ
    wΞλον͞Εͯͳ͍৔߹
    w৽نͷΞλον͕Ͱ͖ͳ͍ʢ*T"UUBDIBCMFGBMTFʣ
    wදࣔ͞Εͳ͘ͳΔ
    

    View Slide

28. ΋͍ͬͨͳͯ͘ϦϦʔεͰ͖ͳ͍
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU@'VMM"DDFTT
    %FQSFDBUFEʢഇࢭࡁΈʣ
    ৽͍͠ϙϦγʔ
    

    View Slide

29. কདྷతʹඇਪ঑ʹͳΓͦ͏ͳϙϦγʔ
    w"NB[PO%ZOBNP%#'VMM"DDFTTXJUI%BUB1JQFMJOF
    w"NB[PO&$3PMFGPS44.
    w"NB[PO&MBTUJD.BQ3FEVDF'VMM"DDFTT
    w"NB[PO&MBTUJD.BQ3FEVDF3PMF
    w"84%BUB1JQFMJOF3PMF
    ʮઆ໌ʯʹEFQSFDBUJPO
    ΋͘͠͸EFQSFDBUFEΛ
    ؚΉ΋ͷΛ୳͠·ͨ͠
    

    View Slide

30. 
    "84؅ཧϙϦγʔ
    ͷѪͰํ
    

    View Slide

31. 
    "84$-*ͱKRͰ$47ग़ྗͯ͠
    εϓϨουγʔτͰѪͰ·͠ΐ͏
    

    View Slide

32. BXTJBNMJTUQPMJDJFT
    aws iam list-policies\
    
    
    --scope AWS\
    
    
    --max-items 1000\
    
    
    | jq -r '
    
    
    ["ϙϦγʔ໊","ύε","σϑΥϧτόʔδϣϯ","࡞੒೔࣌","ߋ৽೔࣌","ΞλονՄ൱"],
    
    
    (.Policies[] | [.PolicyName,.Path,.DefaultVersionId,.CreateDate,.UpdateDate,.IsAttachable]) | @csv' | pbcopy
    είʔϓͱͯ͠ʮ"84ʯΛࢦఆ͠ɺ
    KRͰඞཁͳՕॴͷΈϑΟϧλϦϯά$47Խ͠ɺ
    ΫϦοϓϘʔυʹίϐʔʢ.BDͷ৔߹ʣ
    Ұ౓ͷ࣮ߦͰશྔΛ
    औಘͰ͖ͳ͘ͳΔ೔΋ۙͦ͏
    

    View Slide

33. ͜͏ͯ͠ɺ
    

    View Slide

34. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ
    

    View Slide

35. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ
    

    View Slide

36. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏
    

    View Slide

37. ͜͏ͯ͠ɺ
    

    View Slide

38. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ
    

    View Slide

39. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ
    

    View Slide

40. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏
    

    View Slide

41. ৚݅ͰϑΟϧλ
    ;ˠ"Ͱฒ΂
    $06/5*'4
    
    ͋ͱ͸͍͔Α͏ʹ΋ʂ
    -&/
    
    

    View Slide

42. ʮઆ໌ʯ΋ཉ͚͠Ε͹BXTJBNHFUQPMJDZ
    aws iam list-policies --max-items 1000 --scope AWS | jq -r '.Policies[].Arn' \
    
    
    | while read policy; do
    
    
    aws iam get-policy --policy-arn $policy \
    
    
    | jq -r '.Policy | [.PolicyName,.Description] | @csv' >> policies.csv
    
    
    done
    MJTUQPMJDJFTͷ݁ՌΛͻͱͭͣͭ৯Θͤͯ
    HFUQPMJDZͰϙϦγʔ໊ɺઆ໌Λग़ྗ
    ͋ͱ͸7-00,61ؔ਺ͰؤுΔ
    ෼͘Β͍͔͔ͬͨ
    ؾ͕͠·͢
    

    View Slide

43. 
    "84؅ཧϙϦγʔ
    ͳΜͰ΋ϥϯΩϯά
    ˞ +5$
    ࣌఺
    

    View Slide

44. 
    ϙϦγʔ໊ͷ௕͞
    

    View Slide

45. ϙϦγʔ໊ͷ௕͞ͷ্ݶ͸
    ͍ͪ͹Μ௕͍ จࣈ
    
    "NB[PO4BHF.BLFS4FSWJDF$BUBMPH1SPEVDUT$MPVEGPSNBUJPO4FSWJDF3PMF1PMJDZ
    ͍ͪ͹Μ୹͍ จࣈ
    
    #JMMJOH
    ௕͍Αʂ
    ୹͍Αʂ
    ฏۉ஋ɿจࣈ
    தԝ஋ɿจࣈ
    

    View Slide

46. 
    આ໌ͷ௕͞
    

    View Slide

47. આ໌ͷ௕͞ͷ্ݶ͸
    ͍ͪ͹Μ௕͍ จࣈ
    
    5IJTQPMJDZJTBUUBDIFEUPUIF&MBTUJD%JTBTUFS3FDPWFSZ3FQMJDBUJPOTFSWFSTJOTUBODFSPMF5IJTQPMJDZBMMPXTUIF&MBTUJD%JTBTUFS3FDPWFSZ %34
    
    3FQMJDBUJPO4FSWFST XIJDIBSF&$JOTUBODFTMBVODIFECZ&MBTUJD%JTBTUFS3FDPWFSZUPDPNNVOJDBUFXJUIUIF%34TFSWJDF BOEUPDSFBUF
    TOBQTIPUTJOZPVS"84BDDPVOU"O*".SPMFXJUIUIJTQPMJDZJTBUUBDIFE BTBO&$*OTUBODF1SP
    fi
    MF
    CZ&MBTUJD%JTBTUFS3FDPWFSZUPUIF%34
    3FQMJDBUJPO4FSWFSTXIJDIBSFBVUPNBUJDBMMZMBVODIFEBOEUFSNJOBUFECZ%34 BTOFFEFE%343FQMJDBUJPO4FSWFSTBSFVTFEUPGBDJMJUBUFEBUB
    SFQMJDBUJPOGSPNZPVSFYUFSOBMTFSWFSTUP"84 BTQBSUPGUIFSFDPWFSZQSPDFTTNBOBHFECZ%348FEPOPUSFDPNNFOEUIBUZPVBUUBDIUIJT
    QPMJDZUPZPVS*".VTFSTPSSPMFT
    ͍ͪ͹Μ୹͍ จࣈ
    
    %FOZBMMBDDFTT
    ௕͍Αʂ
    ඒ͢͠͞Βײ͡Δ
    ฏۉ஋ɿจࣈ
    தԝ஋ɿจࣈ
    "84&MBTUJD%JTBTUFS3FDPWFSZ3FQMJDBUJPO4FSWFS1PMJDZ
    "84%FOZ"MM
    

    View Slide

48. 
    όʔδϣϯ਺
    

    View Slide

49. ͪͳΈʹ7JFX0OMZ"DDFTT͸όʔδϣϯ਺ͰҐ
    3FBE0OMZ"DDFTT
    "84$PO
    fi
    H3PMF
    4FDVSJUZ"VEJU
    "84$PO
    fi
    H4FSWJDF3PMF1PMJDZ
    '.44FSWJDF3PMF1PMJDZ
    "844VQQPSU4FSWJDF3PMF1PMJDZ
    "NB[PO4BHF.BLFS'VMM"DDFTT
    $MPVEXBUDI"QQMJDBUJPO*OTJHIUT4FSWJDF-JOLFE3PMF1PMJDZ
    "NB[PO&$4@'VMM"DDFTT
    "844FSWJDF3PMF'PS*NBHF#VJMEFS
    όʔδϣϯ਺501
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    
    ͓ੈ࿩ʹͳͬͯ·͢
    

    View Slide

50. 
    ͕͜͜޷͖ͩΑ
    "84؅ཧϙϦγʔ
    

    View Slide

51. 
    ϙϦγʔ໊ͱ͔આ໌ʹ
    ͳΜ͔͜͏ʜʜ
    ϑϦʔμϜ͞Λײ͡Δ
    

    View Slide

52. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    wʙ3FBE0OMZ"DDFTTͩͬͨΓʙ3FBE0OMZͩͬͨΓ
    w3FBE0OMZ͡Όͳͯ͘3FBEPOMZ΋͋Δ
    wʮ"84ʯ΍ʮ"NB[POʯͷ઀಄͍ࣙͭͨΓ͔ͭͳ͔ͬͨΓ͢Δ
    wʙ'VMM"DDFTT ʙ3FBE0OMZ"DDFTTͷલʹΞϯμʔείΞ͋ͬͨΓͳ͔ͬͨΓ
    wʙ4FSWJDF3PMFͩͬͨΓʙ4FSWJDF3PMF1PMJDZͩͬͨΓ
    wαʔϏε໊ུ͕শͩͬͨΓϑϧ໊শͩͬͨΓ
    wΞϯμʔείΞͦ͜ʹڬΉΜͩʜʜͱͳͬͨΓ
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU@'VMM"DDFTT "84$PO
    fi
    H3PMF
    "84@$PO
    fi
    H3PMF
    "84$MPVE5SBJM3FBE0OMZ"DDFTT
    "84$MPVE5SBJM@3FBE0OMZ"DDFTT
    ϙϦγʔͷ໋໊نଇ·ΘΓ
    

    View Slide

53. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    w"NB[PO$IJNF4%,
    w"84&MBTUJD#FBOTUBML&OIBODFE)FBMUI
    w"NB[PO'SFF350405"6QEBUF
    w"MFYB'PS#VTJOFTT%FWJDF4FUVQ
    w"84$MPVE'SPOU-PHHFS
    w"84*P53VMF"DUJPOT
    ͪΐͬͱݟͩͱϙϦγʔ໊ͱΘ͔Βͳ͍ݸੑతͳ໊લͨͪ
    w"84-BNCEB*OWPDBUJPO%ZOBNP%#
    w*".6TFS44),FZT
    w"NB[PO44.1BUDI"TTPDJBUJPO
    w"840QT8PSLT3FHJTUFS$-*@&$
    w*743FDPSE5P4
    w&$*OTUBODF$POOFDU
    

    View Slide

54. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    w຤ඌͷʮʯ͕͍ͭͨΓ͔ͭͳ͔ͬͨΓ
    wͪͳΈʹʮʯ͕෇͘ͷ͸ݸதݸ
    w5IJTQPMJDZ͔Β࢝·ͬͨΓ5IJT*".QPMJDZ͔Β࢝·ͬͨΓ
    w͍͖ͳΓಈࢺ͔Β࢝·Δύλʔϯ΋ଟ͍
    wSFBEPOMZͩͬͨΓSFBEPOMZͩͬͨΓ
    w%0/0564&ͬͯॻ͍ͯ͋ͬͨΓ
    wจࣈॻ͍ͯ͋ͬͨΓจࣈͰऴΘͬͨΓ
    ϙϦγʔͷઆ໌ͷதʹ΋
    

    View Slide

55. 
    ͢΂͕ͯѪ͓͍͠ͳʜʜ
    

    View Slide

56. 
    ͩͬͯͦ͜ʹ͸
    ྺ࢙
    νʔϜͷଟ͞
    ײ͡ΒΕΔ͔Β
    ͱ
    Λ
    

    View Slide

57. "84ͱ͍͏αʔϏεͷཪʹ͍Δ਺ଟͷਓʑʜʜ
    

    View Slide

58. 
    ·ͱΊ
    

    View Slide

59. ͕͜͜޷͖ͩΑ"84؅ཧϙϦγʔ
    wͦ͜ʹ͸ະདྷɺͦͯ͠ྺ࢙ɺͭ·Γ"84ͷ͢΂͕ͯ
    ͋Δ
    wόϦΤʔγϣϯ๛͔ɺͦΕͰ͍ͯফ͑Δ͔΋͠Εͳ͍
    ၪ͞
    wਪ͠ϙϦγʔΛݟ͚ͭΑ͏ʂ
    

    View Slide

60. Ͳ͕ͬͪઌʹ ʹ౸ୡ͢Δ͔ͳʁ
    

    View Slide

61. View Slide