$30 off During Our Annual Pro Sale. View Details »

IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた

 IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた

IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた話です。遊ぶな。

YukihiroChiba

April 27, 2021
Tweet

More Decks by YukihiroChiba

Other Decks in Technology

Transcript

  1. *".ϩʔϧΛ
    ݸ࡞ͬͯ༡ΜͰ͍ͨΒ
    "84ར༻අ͕υϧΛ௒͍͑ͯͨ

    ઍ༿޾޺ʢνόϢΩʣ

    View Slide

  2. ࠓ೔࣋ͪؼ͍͖͍ͬͯͨͩͨ͜ͱ
    ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
    ʮAWS Config ͷϕετϓϥΫςΟεʯ
    ʁʁʁʁʁ

    View Slide

  3. ࣗݾ঺հ
    ɾ2020೥1݄Ϋϥεϝιου ೖࣾ
    ɾITΤϯδχΞྺ7೥ऑɺ
    ɹɹ͏ͪAWSྺ6೥ऑ
    ɾAWSԿ΋Θ͔ΒΜɻɻ😇
    ɾ࠲ӈͷ໏ɿ
    ɹʮIAM ϩʔϧ͸͓໘ͷΑ͏ͳ΋ͷʯ

    View Slide

  4. ಥવͰ͕͢
    ͜Μͳ͜ͱɺΑ͋͘Γ·ͤΜ͔ʁʁ

    View Slide

  5. ͋Γ;Εͨ೔ৗͷ෩ܠ

    View Slide

  6. ͋Γ;Εͨ೔ৗͷ෩ܠ
    ʮ͋ʔ……ʯ

    View Slide

  7. ͋Γ;Εͨ೔ৗͷ෩ܠ
    ʮIAMϩʔϧ
    ɹ1000ݸ
    ɹɹ࡞Γ͍ͨͳ……ʯ
    ʮ͋ʔ……ʯ

    View Slide

  8. ͋ʔʜʜ
    *".ϩʔϧ
    ɹݸ
    ࡞Γ͍ͨͳᴸᴸᴸ

    View Slide

  9. ͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ
    ʮͲ͏ͤ IAM ͬͯ
    ɹɹແྉͩ͠ͳʯ
    Θͨ͠

    View Slide

  10. ͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ
    ʮͲ͏ͤ IAM ͬͯ
    ɹɹແྉͩ͠ͳʯ
    ˛Կ͔͕ߦΘΕ͍ͯΔ༷ࢠ
    Կ͔Λ͢ΔΘͨ͠

    View Slide

  11. શ༰͸ͪ͜ΒΛͲ͏ͧ
    Զୡ͸͍ͭ·Ͱ΋ཱͪਚ͘͠
    ݟͭΊ͍ͯͨᴸᴸᴸ
    ਺ଟͷ*".ϩʔϧ͕ҠΖ͏Α͏
    ʹ࿈࠯͍ͯ͘͠ɺͦͷ͞·Λɻ

    View Slide

  12. :PV`WF(PU"/PUJpDBUJPO
    ✉ 💨💨💨

    View Slide

  13. :PV`WF(PU"/PUJpDBUJPO

    View Slide

  14. :PV`WF(PU"/PUJpDBUJPO
    65.3υϧ

    View Slide

  15. :PV`WF(PU"/PUJpDBUJPO
    65.3υϧ
    👁👁
    👄
    ͕ܲ౾మ๒ΛᷰΒͬͨΑ͏ͳإΛ͢ΔΘͨ͠

    View Slide

  16. γϯΩϯάλΠϜ
    ʮߟ͑Ζᴸᴸߟ͑ΔΜͩᴸᴸᴸʜʜʯ

    View Slide

  17. ʁʁ
    ʁʁ
    ݪҼ͸$POpHͰͨ͠
    👁 👁
    ʮ*".ϩʔϧΛݸ࡞ͬͨΒ
    ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ
    ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ
    ʁʁʁʁ
    ʁʁʁ
    ʁʁʁʁ

    View Slide

  18. ݪҼ͸$POpHͰͨ͠
    👁 👁
    ʮ*".ϩʔϧΛݸ࡞ͬͨΒ
    ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ
    ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ

    View Slide

  19. $POpH
    $POpH
    <ίϯϑΟά>

    View Slide

  20. "84$POpHͱ͸
    l"84$POpH͸ɺ"84ϦιʔεͷઃఆΛධՁɺ؂ࠪɺ৹ࠪͰ͖ΔαʔϏεͰ͢ɻ
    $POpHͰ͸ɺ"84Ϧιʔεͷઃఆ͕ܧଓతʹϞχλϦϯά͓Αͼه࿥͞Εɺ
    ๬·ΕΔઃఆʹର͢Δه࿥͞ΕͨઃఆͷධՁΛࣗಈతʹ࣮ߦͰ͖·͢ɻz
    https://
    aws.amazon.com/jp/
    config/
    https://www.slideshare.net/
    AmazonWebServicesJapan/
    20190618-aws-black-belt-
    online-seminar-aws-config

    View Slide

  21. 5SBJMͱ$POpHͷҧ͍
    A͞Μ
    B͞Μ
    ΠϯελϯεA
    Πϯελϯε
    ৽ن࡞੒
    Πϯελϯε
    λΠϓมߋ


    m5.xlarge
    m5.large

    View Slide

  22. 5SBJMͱ$POpHͷҧ͍
    A͞Μ
    B͞Μ
    ΠϯελϯεA
    Πϯελϯε
    ৽ن࡞੒
    Πϯελϯε
    λΠϓมߋ


    m5.xlarge
    m5.large
    Cloud Trail AWS Config

    View Slide

  23. ͦΕΛ౿·͑ͯ
    Կ͕ى͍ͬͯͨ͜ͷ͔

    View Slide

  24. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͪΐ
    ΍ͬͯΈ͔ͬʂ

    View Slide

  25. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϩʔϧΛ
    ͨ͘͞Μ
    ࡞Δͧʂ

    View Slide

  26. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϙϦγʔΛ
    ͦΕͧΕ
    ͚ͭΔͧʂ

    View Slide

  27. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͨΜ
    ࡟আ͢Δͧʂ

    View Slide

  28. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϩʔϧΛ
    ͨ͘͞Μ
    ࡞Δͧʂ

    View Slide

  29. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϙϦγʔΛ
    ͦΕͧΕ
    ͚ͭΔͧʂ

    View Slide

  30. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͨΜ
    ࡟আ͢Δͧʂ

    View Slide

  31. શ෦ه࿥ͯ͠·ͨ͠Α
    ώΟ
    શ෦ه࿥
    ͯ͠·ͨ͠Α
    ౦ژͷ
    Config
    ʁʁʁ

    View Slide

  32. ࢲ΋શ෦ه࿥ͯ͠·ͨ͠Α
    ώΟ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ࢲ΋
    શ෦ه࿥
    ͯ͠·ͨ͠Α

    View Slide

  33. ح۰ͩͳɺԶ΋ه࿥ͯͨ͠Α
    ώΟ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ϜϯόΠͷ
    Config
    ʁʁʁ

    View Slide

  34. ʮʮʮ͓͍͓͍ɺԶͨͪΛ๨ΕΔͳΑʜʁʯʯʯ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ϜϯόΠͷ
    Config
    ʁʁʁ
    ֤Ϧʔδϣϯͷ
    Configͨͪ
    ʁʁʁ
    ώϡο
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ͓͍͓͍ɺ
    ԶͨͪΛ
    ๨ΕΔͳΑʜʁ
    ͓͍͓͍ɺ
    ԶͨͪΛ
    ๨ΕΔͳΑʜʁ

    View Slide

  35. ֤Ϧʔδϣϯʢݸʣͷ$POpH
    ౦ژͷ
    Config
    όʔδχΞͷ
    Config
    ϜϯόΠͷ
    Config
    ֤Ϧʔδϣϯͷ
    Configͨͪ
    ͋Γ͕ͱ͏
    ͍͟͝·͢

    View Slide

  36. νϦ΋ੵ΋Ε͹υϧ௒͑Δ
    46υϧ
    5υϧ
    2021೥3݄શମ
    2021೥4݄த०
    ʮ͓΅Ζ͛ͳ͕Β
    ු͔ΜͰ͖ͨΜͰ͢ɻʯ

    View Slide

  37. $POpHͷྉۚ
    ɾه࿥͞Εͨઃఆ߲໨͝ͱʹ0.003USD
    ɾ1000ΠϕϯτͰ3USD
    ɾIAM ͸άϩʔόϧϦιʔεͳͷͰ
    ɹશϦʔδϣϯͷ Config ͕ه࿥
    ͋Γ͕ͱ͏
    ͍͟͝·͢

    View Slide

  38. $POpH͚ͩ͡Όͳ͍
    େྔͷAPIίʔϧ
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    ֤Ϧʔδϣϯͷ
    Trail
    ֤Ϧʔδϣϯͷ
    GuardDuty

    View Slide

  39. 5SBJMͱ(VBSE%VUZͷྉۚ
    ௥Ճͷίϐʔ
    ഑৴͞Εͨ ؅ཧΠϕϯτ͋ͨΓ64%
    6υϧ
    Trail
    9υϧ
    GuardDuty
    ສΠϕϯτ͋ͨΓ64% ສΠϕϯτ͋ͨΓ64%

    View Slide

  40. ͘͠͡Βͳ͍ͨΊʹ
    Ͳ͏͢Ε͹ආ͚ΒΕͨͷ͔

    View Slide

  41. ̏ͭ͋Γ·͢
    • ɹ
    • ɹ
    • ɹ

    View Slide

  42. ̏ͭ͋Γ·͢
    • IAMϩʔϧͰ༡͹ͳ͍
    • ɹ
    • ɹ

    View Slide

  43. ̏ͭ͋Γ·͢
    • IAMϩʔϧͰ༡͹ͳ͍
    • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ
    • ɹ

    View Slide

  44. ྫ͑͹
    • ੥ٻΞϥʔτ
    • AWS Budgets
    • ࡞ΓࠐΈʹΑΔఆظऔಘ
    https://dev.classmethod.jp/articles/
    aws-budgets-alert-by-aws-chatbot/
    https://dev.classmethod.jp/articles/
    notify-slack-aws-billing/

    View Slide

  45. ࢲ΋΍ͬͯ·͢
    ͸͍ʜʜ

    View Slide

  46. ̏ͭ໨
    • IAMϩʔϧͰ༡͹ͳ͍
    • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ
    • ConfigͷϕετϓϥΫςΟεʹ
    ͷͬͱΔ

    View Slide

  47. $POpHͷϕετϓϥΫςΟε
    https://
    aws.amazon.com/jp/
    blogs/news/aws-
    config-best-practices/
    Config ϕετϓϥΫςΟε ϒϩά | ݕࡧ
    20ݸͷϓϥΫςΟε

    View Slide

  48. $POpHͷϕετϓϥΫςΟεʢൈਮʣ
    1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Config Λ༗ޮʹ͢Δ
    2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ
    3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ
    ͳ S3 όέοτΛ࢖༻͢Δ
    5. ……

    View Slide

  49. ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    ౦ژͷ
    Config
    ֤Ϧʔδϣϯͷ Configͨͪ
    ࢲ͚͕ͩ
    ه࿥͠·͢
    ……
    ͸͍ʜʜ

    View Slide


  50. ҰํͰ

    View Slide

  51. $POpHͷϕετϓϥΫςΟεʢൈਮʣ
    1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Config Λ༗ޮʹ͢Δ
    2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ
    3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ
    ͳ S3 όέοτΛ࢖༻͢Δ
    5. …… ͷͬͱΔͷ͕
    ϚετͰ͸ͳ͍

    View Slide

  52. $POpHͷه࿥ର৅ͷબ୒
    https://docs.aws.amazon.com/ja_jp/
    config/latest/developerguide/resource-
    config-reference.html
    ݸऑͷ
    ϦιʔελΠϓͷத͔Β
    ඞཁ෼ͷΈΛબ୒

    View Slide

  53. ຊ౰ʹه࿥͕ඞཁʁίετΛҙࣝ͠Α͏
    ྫʣAutoScaling ؔ࿈Ϧιʔε͕͢΂ͯه࿥ର৅ͱͳΔͨΊɺ
    සൟʹஔ͖׵͕͑ߦΘΕΔ৔߹ɺ
    ίετ͕ਹΉ͜ͱ΋ɻ
    Auto scaling
    Instance
    Elastic network
    interface
    Volume
    Security group
    શ෦ه࿥ʹ࢒͢ඞཁ
    ͋Δ͔ͳʁ

    View Slide

  54. ৽نରԠϦιʔε΋ه࿥ͯ͘͠ΕΔͷ͸خ͍͚͠ΕͲ
    2021/2/26
    •Configͷه࿥ର৅͕૿͑ͨ
    •ʮ͢΂ͯΛه࿥ʯͷ৔߹ɺ৽نͷର৅΋ࣗ
    ಈతʹه࿥։࢝
    •͜Ε·Ͱൃੜ͍ͯ͠ͳ͔ͬͨίετ͕ٸʹ
    ૿͑ͨɺͱ͍͏͜ͱ΋ى͜Γ͏Δ

    View Slide

  55. ه࿥͢Δ͜ͱΛݪଇͱͭͭ͠ίετ΋ҙࣝ
    • ه࿥Λ࢒͢ͷ͸େࣄ
    • ίετݟ߹͍Ͱऔࣺબ୒Λ
    Config Trail GuardDuty
    Ϧιʔεͷ
    ઃఆ಺༰Λ
    ه࿥͠·͢
    ΠϕϯτΛ
    ه࿥͠·͢
    ෆ৹ͳ
    ΞΫςΟϏςΟΛ
    ݕ஌͠·͢

    View Slide


  56. ·ͱΊ

    View Slide

  57. ࣋ͪؼ͍ͬͯͩ͘͞
    ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
    ʮAWS Config ͷϕετϓϥΫςΟεʯ

    View Slide

  58. ࣋ͪؼ͍ͬͯͩ͘͞
    ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
    ʮAWS Config ͷϕετϓϥΫςΟεʯ
    ʮIAMϩʔϧͰ༡ΜͰ͸͍͚ͳ͍ʯ

    View Slide