Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ここが好きだよAWS管理ポリシー_devio2022/i_am_iam_lover

 ここが好きだよAWS管理ポリシー_devio2022/i_am_iam_lover

YukihiroChiba

August 01, 2022
Tweet

More Decks by YukihiroChiba

Other Decks in Technology

Transcript


  1. "84ࣄۀຊ෦ίϯαϧςΟϯά෦ઍ༿޾޺ʢνόϢΩʣ
    ࢲͷ"84ѪΛฉ͚ʂ
    ͕͜͜޷͖ͩΑ
    "84*".ͷ"84؅ཧϙϦγʔ

    View full-size slide

  2. ࣗݾ঺հ
    ઍ༿޾޺
    νόϢΩ

    w"84ྺɿ೥ڧ
    w޷͖ͳ"84αʔϏεɿ"84*".
    w޷͖ͳ͓໘ͷछྨɿఱۡͷ͓໘
    ࠓճͷεϥΠυ͸ຕ͋Γ·͢

    View full-size slide


  3. ͳΜͷ਺ࣈ͔Θ͔ΔͰ͠ΐ͏͔ʁ

    View full-size slide


  4. ͳΜͷ਺ࣈ͔Θ͔ΔͰ͠ΐ͏͔ʁ

    Կ͔Λ߹ܭͨ͠਺Ͱ͢

    View full-size slide


  5. ݴ͑Δ͔ͳʁ

    ϙ˓Ϟϯͷछྨ
    ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
    IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ

    View full-size slide


  6. ϙ˓ϞϯΑΓଟ͍"84؅ཧϙϦγʔ

    "84؅ཧ
    ϙϦγʔͷ਺
    ˞ +5$
    ࣌఺
    ͰΞΫςΟϒͳ΋ͷ
    ϙ˓Ϟϯͷछྨ
    ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
    IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ

    View full-size slide

  7. ͕͜͜޷͖ͩΑ"84؅ཧϙϦγʔ
    wࣗಈͰ࡞੒ɾߋ৽͞ΕΔ
    wͨ͘͞Μ͋Δ͠ɺͨ·ʹ͍ͳ͘ͳΔ
    w໊শ΍આ໌ʹϑϦʔμϜ͞Λײ͡Δ
    ޷͖ͩͳ͊

    View full-size slide


  8. "84؅ཧϙϦγʔͱ͸

    View full-size slide

  9. "84؅ཧϙϦγʔͱ͸
    "84͕؅ཧ͢ΔϙϦγʔ
    ͷ͜ͱͰ͢

    View full-size slide

  10. "84؅ཧϙϦγʔͱ͸
    "84͕؅ཧ͢ΔϙϦγʔ
    ͷ͜ͱͰ͢
    ΠϯϥΠϯͰͳ͍
    ΧελϚʔ؅ཧͰͳ͍

    View full-size slide

  11. ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    ೥݄ʹొ৔

    View full-size slide


  12. ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    "84
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    "84ʹΑΓ؅ཧ͞ΕΔ
    ΧελϚʔ͕؅ཧ
    ࠓճऔΓ্͛Δͷ͸͜Ε
    ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘

    View full-size slide


  13. ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    όʔδϣϯ؅ཧɺελϯυΞϩϯɺ
    ෳ਺Ϧιʔε΁ͷΞλον͕Մೳ
    *".Ϧιʔε΁ͷຒΊࠐΈ
    "84ʹΑΓ؅ཧ͞ΕΔ
    ৬຿ػೳ༻
    αʔϏε
    ϩʔϧ༻
    αʔϏεϦϯΫ
    ϩʔϧ 4-3

    ্هҎ֎
    ΧελϚʔ͕؅ཧ
    ϙϦγʔͷύε͔Β൑ผ
    ϙϦγʔΛΠϯϥΠϯ͔؅ཧ͔ͷ੾ΓޱͰݟ͍ͯ͘
    "84
    ؅ཧϙϦγʔ

    View full-size slide

  14. ͨͷ͍͠ʂ
    ϙϦγʔ ΠϯϥΠϯϙϦγʔ
    ؅ཧϙϦγʔ
    ΧελϚʔ
    ؅ཧϙϦγʔ
    ৬຿ػೳ༻
    αʔϏε
    ϩʔϧ༻
    αʔϏεϦϯΫ
    ϩʔϧ 4-3

    ্هҎ֎
    ͨͷ͍͠ʂ
    "84
    ؅ཧϙϦγʔ
    ৽αʔϏεɺ৽ػೳͷൃදʹઌߦͯ͠
    ࡞੒ɾߋ৽͞Ε͍ͯΔ͜ͱ͕ଟ͍

    View full-size slide


  15. ਺ࣈͰݟΔ
    "84؅ཧϙϦγʔ

    View full-size slide


  16. ࠶ܝ

    "84؅ཧ
    ϙϦγʔͷ਺
    ϙ˓Ϟϯͷछྨ
    ˞8JLJQFEJBΑΓɻୈੈ୅͸আ͘ɻ
    IUUQTKBXJLJQFEJBPSHXJLJશࠃϙέϞϯਤؑॱͷϙέϞϯҰཡ
    ˞ +5$
    ࣌఺
    ͰΞΫςΟϒͳ΋ͷ

    View full-size slide


  17. Ͳͷ͘Β͍ͷϖʔεͰ
    ૿͍͑ͯΔͷ͔ʁ

    View full-size slide

  18. ೥͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ΄΅ຖ೥௒
    ૿͑ͯΔ

    View full-size slide


  19. Ͳͷ݄͕͍ͪ͹Μ
    ૿͍͑ͯΔͷ͔ʁ

    View full-size slide

  20. ݄͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ݄΋ଟ͍ͷʁ

    View full-size slide

  21. ೥ͱ݄͝ͱʹݟΔ"84؅ཧϙϦγʔͷ૿Ճ
    ೥݄
    ͕ଟ͍͚ͩͩͬͨ

    View full-size slide


  22. ͜Ε·Ͱͷ૿Ճ܏޲Λ
    ݄͝ͱʹݟΔ

    View full-size slide

  23. ΍ͬͺΓ݄ͱ݄͕ͭΑ͍

    View full-size slide

  24. ΍ͬͺΓ݄ͱ݄͕ͭΑ͍
    ೥຤͸
    "84؅ཧϙϦγʔͷ०

    View full-size slide


  25. ݮΔ͜ͱ΋͋ΔΑɺ
    "84؅ཧϙϦγʔ

    View full-size slide

  26. ඇਪ঑ͷ"84؅ཧϙϦγʔ
    wඇਪ঑ʢഇࢭɾ%FQSFDBUFEʣʹͳΔͱʜʜ
    wΞλονࡁΈͷ৔߹
    wΞλον͸ܧଓ͞ΕΔ
    wϙϦγʔͷޮྗ΋ܧଓ͞ΕΔ
    wΞλον͞Εͯͳ͍৔߹
    w৽نͷΞλον͕Ͱ͖ͳ͍ʢ*T"UUBDIBCMFGBMTFʣ
    wදࣔ͞Εͳ͘ͳΔ

    View full-size slide

  27. ΋͍ͬͨͳͯ͘ϦϦʔεͰ͖ͳ͍
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU@'VMM"DDFTT
    %FQSFDBUFEʢഇࢭࡁΈʣ
    ৽͍͠ϙϦγʔ

    View full-size slide

  28. কདྷతʹඇਪ঑ʹͳΓͦ͏ͳϙϦγʔ
    w"NB[PO%ZOBNP%#'VMM"DDFTTXJUI%BUB1JQFMJOF
    w"NB[PO&$3PMFGPS44.
    w"NB[PO&MBTUJD.BQ3FEVDF'VMM"DDFTT
    w"NB[PO&MBTUJD.BQ3FEVDF3PMF
    w"84%BUB1JQFMJOF3PMF
    ʮઆ໌ʯʹEFQSFDBUJPO
    ΋͘͠͸EFQSFDBUFEΛ
    ؚΉ΋ͷΛ୳͠·ͨ͠

    View full-size slide


  29. "84؅ཧϙϦγʔ
    ͷѪͰํ

    View full-size slide


  30. "84$-*ͱKRͰ$47ग़ྗͯ͠
    εϓϨουγʔτͰѪͰ·͠ΐ͏

    View full-size slide

  31. BXTJBNMJTUQPMJDJFT
    aws iam list-policies\


    --scope AWS\


    --max-items 1000\


    | jq -r '


    ["ϙϦγʔ໊","ύε","σϑΥϧτόʔδϣϯ","࡞੒೔࣌","ߋ৽೔࣌","ΞλονՄ൱"],


    (.Policies[] | [.PolicyName,.Path,.DefaultVersionId,.CreateDate,.UpdateDate,.IsAttachable]) | @csv' | pbcopy
    είʔϓͱͯ͠ʮ"84ʯΛࢦఆ͠ɺ
    KRͰඞཁͳՕॴͷΈϑΟϧλϦϯά$47Խ͠ɺ
    ΫϦοϓϘʔυʹίϐʔʢ.BDͷ৔߹ʣ
    Ұ౓ͷ࣮ߦͰશྔΛ
    औಘͰ͖ͳ͘ͳΔ೔΋ۙͦ͏

    View full-size slide

  32. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ

    View full-size slide

  33. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ

    View full-size slide

  34. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏

    View full-size slide

  35. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ

    View full-size slide

  36. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ

    View full-size slide

  37. ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏ͯ͠ɺ͜͏

    View full-size slide

  38. ৚݅ͰϑΟϧλ
    ;ˠ"Ͱฒ΂
    $06/5*'4

    ͋ͱ͸͍͔Α͏ʹ΋ʂ
    -&/

    View full-size slide

  39. ʮઆ໌ʯ΋ཉ͚͠Ε͹BXTJBNHFUQPMJDZ
    aws iam list-policies --max-items 1000 --scope AWS | jq -r '.Policies[].Arn' \


    | while read policy; do


    aws iam get-policy --policy-arn $policy \


    | jq -r '.Policy | [.PolicyName,.Description] | @csv' >> policies.csv


    done
    MJTUQPMJDJFTͷ݁ՌΛͻͱͭͣͭ৯Θͤͯ
    HFUQPMJDZͰϙϦγʔ໊ɺઆ໌Λग़ྗ
    ͋ͱ͸7-00,61ؔ਺ͰؤுΔ
    ෼͘Β͍͔͔ͬͨ
    ؾ͕͠·͢

    View full-size slide


  40. "84؅ཧϙϦγʔ
    ͳΜͰ΋ϥϯΩϯά
    ˞ +5$
    ࣌఺

    View full-size slide


  41. ϙϦγʔ໊ͷ௕͞

    View full-size slide

  42. ϙϦγʔ໊ͷ௕͞ͷ্ݶ͸
    ͍ͪ͹Μ௕͍ จࣈ

    "NB[PO4BHF.BLFS4FSWJDF$BUBMPH1SPEVDUT$MPVEGPSNBUJPO4FSWJDF3PMF1PMJDZ
    ͍ͪ͹Μ୹͍ จࣈ

    #JMMJOH
    ௕͍Αʂ
    ୹͍Αʂ
    ฏۉ஋ɿจࣈ
    தԝ஋ɿจࣈ

    View full-size slide


  43. આ໌ͷ௕͞

    View full-size slide

  44. આ໌ͷ௕͞ͷ্ݶ͸
    ͍ͪ͹Μ௕͍ จࣈ

    5IJTQPMJDZJTBUUBDIFEUPUIF&MBTUJD%JTBTUFS3FDPWFSZ3FQMJDBUJPOTFSWFSTJOTUBODFSPMF5IJTQPMJDZBMMPXTUIF&MBTUJD%JTBTUFS3FDPWFSZ %34

    3FQMJDBUJPO4FSWFST XIJDIBSF&$JOTUBODFTMBVODIFECZ&MBTUJD%JTBTUFS3FDPWFSZUPDPNNVOJDBUFXJUIUIF%34TFSWJDF BOEUPDSFBUF
    TOBQTIPUTJOZPVS"84BDDPVOU"O*".SPMFXJUIUIJTQPMJDZJTBUUBDIFE BTBO&$*OTUBODF1SP
    fi
    MF
    CZ&MBTUJD%JTBTUFS3FDPWFSZUPUIF%34
    3FQMJDBUJPO4FSWFSTXIJDIBSFBVUPNBUJDBMMZMBVODIFEBOEUFSNJOBUFECZ%34 BTOFFEFE%343FQMJDBUJPO4FSWFSTBSFVTFEUPGBDJMJUBUFEBUB
    SFQMJDBUJPOGSPNZPVSFYUFSOBMTFSWFSTUP"84 BTQBSUPGUIFSFDPWFSZQSPDFTTNBOBHFECZ%348FEPOPUSFDPNNFOEUIBUZPVBUUBDIUIJT
    QPMJDZUPZPVS*".VTFSTPSSPMFT
    ͍ͪ͹Μ୹͍ จࣈ

    %FOZBMMBDDFTT
    ௕͍Αʂ
    ඒ͢͠͞Βײ͡Δ
    ฏۉ஋ɿจࣈ
    தԝ஋ɿจࣈ
    "84&MBTUJD%JTBTUFS3FDPWFSZ3FQMJDBUJPO4FSWFS1PMJDZ
    "84%FOZ"MM

    View full-size slide


  45. όʔδϣϯ਺

    View full-size slide

  46. ͪͳΈʹ7JFX0OMZ"DDFTT͸όʔδϣϯ਺ͰҐ
    3FBE0OMZ"DDFTT
    "84$PO
    fi
    H3PMF
    4FDVSJUZ"VEJU
    "84$PO
    fi
    H4FSWJDF3PMF1PMJDZ
    '.44FSWJDF3PMF1PMJDZ
    "844VQQPSU4FSWJDF3PMF1PMJDZ
    "NB[PO4BHF.BLFS'VMM"DDFTT
    $MPVEXBUDI"QQMJDBUJPO*OTJHIUT4FSWJDF-JOLFE3PMF1PMJDZ
    "NB[PO&$4@'VMM"DDFTT
    "844FSWJDF3PMF'PS*NBHF#VJMEFS
    όʔδϣϯ਺501
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ
    ɹ

    ͓ੈ࿩ʹͳͬͯ·͢

    View full-size slide


  47. ͕͜͜޷͖ͩΑ
    "84؅ཧϙϦγʔ

    View full-size slide


  48. ϙϦγʔ໊ͱ͔આ໌ʹ
    ͳΜ͔͜͏ʜʜ
    ϑϦʔμϜ͞Λײ͡Δ

    View full-size slide

  49. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    wʙ3FBE0OMZ"DDFTTͩͬͨΓʙ3FBE0OMZͩͬͨΓ
    w3FBE0OMZ͡Όͳͯ͘3FBEPOMZ΋͋Δ
    wʮ"84ʯ΍ʮ"NB[POʯͷ઀಄͍ࣙͭͨΓ͔ͭͳ͔ͬͨΓ͢Δ
    wʙ'VMM"DDFTT ʙ3FBE0OMZ"DDFTTͷલʹΞϯμʔείΞ͋ͬͨΓͳ͔ͬͨΓ
    wʙ4FSWJDF3PMFͩͬͨΓʙ4FSWJDF3PMF1PMJDZͩͬͨΓ
    wαʔϏε໊ུ͕শͩͬͨΓϑϧ໊শͩͬͨΓ
    wΞϯμʔείΞͦ͜ʹڬΉΜͩʜʜͱͳͬͨΓ
    "NB[PO$POOFDU'VMM"DDFTT
    "NB[PO$POOFDU@'VMM"DDFTT "84$PO
    fi
    H3PMF
    "84@$PO
    fi
    H3PMF
    "84$MPVE5SBJM3FBE0OMZ"DDFTT
    "84$MPVE5SBJM@3FBE0OMZ"DDFTT
    ϙϦγʔͷ໋໊نଇ·ΘΓ

    View full-size slide

  50. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    w"NB[PO$IJNF4%,
    w"84&MBTUJD#FBOTUBML&OIBODFE)FBMUI
    w"NB[PO'SFF350405"6QEBUF
    w"MFYB'PS#VTJOFTT%FWJDF4FUVQ
    w"84$MPVE'SPOU-PHHFS
    w"84*P53VMF"DUJPOT
    ͪΐͬͱݟͩͱϙϦγʔ໊ͱΘ͔Βͳ͍ݸੑతͳ໊લͨͪ
    w"84-BNCEB*OWPDBUJPO%ZOBNP%#
    w*".6TFS44),FZT
    w"NB[PO44.1BUDI"TTPDJBUJPO
    w"840QT8PSLT3FHJTUFS$-*@&$
    w*743FDPSE5P4
    w&$*OTUBODF$POOFDU

    View full-size slide

  51. ͔ͦ͜͜͠ʹજΉѪ͠͞ϙΠϯτ
    w຤ඌͷʮʯ͕͍ͭͨΓ͔ͭͳ͔ͬͨΓ
    wͪͳΈʹʮʯ͕෇͘ͷ͸ݸதݸ
    w5IJTQPMJDZ͔Β࢝·ͬͨΓ5IJT*".QPMJDZ͔Β࢝·ͬͨΓ
    w͍͖ͳΓಈࢺ͔Β࢝·Δύλʔϯ΋ଟ͍
    wSFBEPOMZͩͬͨΓSFBEPOMZͩͬͨΓ
    w%0/0564&ͬͯॻ͍ͯ͋ͬͨΓ
    wจࣈॻ͍ͯ͋ͬͨΓจࣈͰऴΘͬͨΓ
    ϙϦγʔͷઆ໌ͷதʹ΋

    View full-size slide


  52. ͢΂͕ͯѪ͓͍͠ͳʜʜ

    View full-size slide


  53. ͩͬͯͦ͜ʹ͸
    ྺ࢙
    νʔϜͷଟ͞
    ײ͡ΒΕΔ͔Β
    ͱ
    Λ

    View full-size slide

  54. "84ͱ͍͏αʔϏεͷཪʹ͍Δ਺ଟͷਓʑʜʜ

    View full-size slide

  55. ͕͜͜޷͖ͩΑ"84؅ཧϙϦγʔ
    wͦ͜ʹ͸ະདྷɺͦͯ͠ྺ࢙ɺͭ·Γ"84ͷ͢΂͕ͯ
    ͋Δ
    wόϦΤʔγϣϯ๛͔ɺͦΕͰ͍ͯফ͑Δ͔΋͠Εͳ͍
    ၪ͞
    wਪ͠ϙϦγʔΛݟ͚ͭΑ͏ʂ

    View full-size slide

  56. Ͳ͕ͬͪઌʹ ʹ౸ୡ͢Δ͔ͳʁ

    View full-size slide