IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた

IAMロールを1000個作って遊んでいたらAWS利用費が50ドルを超えていた話です。遊ぶな。

Transcript

1. *".ϩʔϧΛ
   ݸ࡞ͬͯ༡ΜͰ͍ͨΒ
   "84ར༻අ͕υϧΛ௒͍͑ͯͨ
   
   ઍ༿޾޺ʢνόϢΩʣ
   

   View Slide

2. ࠓ೔࣋ͪؼ͍͖͍ͬͯͨͩͨ͜ͱ
   ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
   ʮAWS Config ͷϕετϓϥΫςΟεʯ
   ʁʁʁʁʁ
   

   View Slide

3. ࣗݾ঺հ
   ɾ2020೥1݄Ϋϥεϝιου ೖࣾ
   ɾITΤϯδχΞྺ7೥ऑɺ
   ɹɹ͏ͪAWSྺ6೥ऑ
   ɾAWSԿ΋Θ͔ΒΜɻɻ😇
   ɾ࠲ӈͷ໏ɿ
   ɹʮIAM ϩʔϧ͸͓໘ͷΑ͏ͳ΋ͷʯ
   

   View Slide

4. ಥવͰ͕͢
   ͜Μͳ͜ͱɺΑ͋͘Γ·ͤΜ͔ʁʁ
   

   View Slide

5. ͋Γ;Εͨ೔ৗͷ෩ܠ
   

   View Slide

6. ͋Γ;Εͨ೔ৗͷ෩ܠ
   ʮ͋ʔ……ʯ
   

   View Slide

7. ͋Γ;Εͨ೔ৗͷ෩ܠ
   ʮIAMϩʔϧ
   ɹ1000ݸ
   ɹɹ࡞Γ͍ͨͳ……ʯ
   ʮ͋ʔ……ʯ
   

   View Slide

8. ͋ʔʜʜ
   *".ϩʔϧ
   ɹݸ
   ࡞Γ͍ͨͳᴸᴸᴸ
   

   View Slide

9. ͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ
   ʮͲ͏ͤ IAM ͬͯ
   ɹɹແྉͩ͠ͳʯ
   Θͨ͠
   

   View Slide

10. ͍ͱ΋ͨ΍͘͢ߦΘΕΔߟྀͷ଍Γͳ͍ߦҝ
    ʮͲ͏ͤ IAM ͬͯ
    ɹɹແྉͩ͠ͳʯ
    ˛Կ͔͕ߦΘΕ͍ͯΔ༷ࢠ
    Կ͔Λ͢ΔΘͨ͠
    

    View Slide

11. શ༰͸ͪ͜ΒΛͲ͏ͧ
    Զୡ͸͍ͭ·Ͱ΋ཱͪਚ͘͠
    ݟͭΊ͍ͯͨᴸᴸᴸ
    ਺ଟͷ*".ϩʔϧ͕ҠΖ͏Α͏
    ʹ࿈࠯͍ͯ͘͠ɺͦͷ͞·Λɻ
    

    View Slide

12. :PV`WF(PU"/PUJpDBUJPO
    ✉ 💨💨💨
    

    View Slide

13. :PV`WF(PU"/PUJpDBUJPO
    

    View Slide

14. :PV`WF(PU"/PUJpDBUJPO
    65.3υϧ
    

    View Slide

15. :PV`WF(PU"/PUJpDBUJPO
    65.3υϧ
    👁👁
    👄
    ͕ܲ౾మ๒ΛᷰΒͬͨΑ͏ͳإΛ͢ΔΘͨ͠
    

    View Slide

16. γϯΩϯάλΠϜ
    ʮߟ͑Ζᴸᴸߟ͑ΔΜͩᴸᴸᴸʜʜʯ
    

    View Slide

17. ʁʁ
    ʁʁ
    ݪҼ͸$POpHͰͨ͠
    👁 👁
    ʮ*".ϩʔϧΛݸ࡞ͬͨΒ
    ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ
    ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ
    ʁʁʁʁ
    ʁʁʁ
    ʁʁʁʁ
    

    View Slide

18. ݪҼ͸$POpHͰͨ͠
    👁 👁
    ʮ*".ϩʔϧΛݸ࡞ͬͨΒ
    ɹ֤Ϧʔδϣϯͷ$POpHʹิ଍͞Ε·ͨ͠ʯ
    ʮෆཁͳه࿥ΛࢭΊ·ͨ͠ʯ
    

    View Slide

19. $POpH
    $POpH
    <ίϯϑΟά>
    

    View Slide

20. "84$POpHͱ͸
    l"84$POpH͸ɺ"84ϦιʔεͷઃఆΛධՁɺ؂ࠪɺ৹ࠪͰ͖ΔαʔϏεͰ͢ɻ
    $POpHͰ͸ɺ"84Ϧιʔεͷઃఆ͕ܧଓతʹϞχλϦϯά͓Αͼه࿥͞Εɺ
    ๬·ΕΔઃఆʹର͢Δه࿥͞ΕͨઃఆͷධՁΛࣗಈతʹ࣮ߦͰ͖·͢ɻz
    https://
    aws.amazon.com/jp/
    config/
    https://www.slideshare.net/
    AmazonWebServicesJapan/
    20190618-aws-black-belt-
    online-seminar-aws-config
    

    View Slide

21. 5SBJMͱ$POpHͷҧ͍
    A͞Μ
    B͞Μ
    ΠϯελϯεA
    Πϯελϯε
    ৽ن࡞੒
    Πϯελϯε
    λΠϓมߋ
    
    
    m5.xlarge
    m5.large
    

    View Slide

22. 5SBJMͱ$POpHͷҧ͍
    A͞Μ
    B͞Μ
    ΠϯελϯεA
    Πϯελϯε
    ৽ن࡞੒
    Πϯελϯε
    λΠϓมߋ
    
    
    m5.xlarge
    m5.large
    Cloud Trail AWS Config
    

    View Slide

23. ͦΕΛ౿·͑ͯ
    Կ͕ى͍ͬͯͨ͜ͷ͔
    

    View Slide

24. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͪΐ
    ΍ͬͯΈ͔ͬʂ
    

    View Slide

25. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϩʔϧΛ
    ͨ͘͞Μ
    ࡞Δͧʂ
    

    View Slide

26. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϙϦγʔΛ
    ͦΕͧΕ
    ͚ͭΔͧʂ
    

    View Slide

27. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͨΜ
    ࡟আ͢Δͧʂ
    

    View Slide

28. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϩʔϧΛ
    ͨ͘͞Μ
    ࡞Δͧʂ
    

    View Slide

29. Կ͕ى͍ͬͯͨ͜ͷ͔
    ϙϦγʔΛ
    ͦΕͧΕ
    ͚ͭΔͧʂ
    

    View Slide

30. Կ͕ى͍ͬͯͨ͜ͷ͔
    ͍ͬͨΜ
    ࡟আ͢Δͧʂ
    

    View Slide

31. શ෦ه࿥ͯ͠·ͨ͠Α
    ώΟ
    શ෦ه࿥
    ͯ͠·ͨ͠Α
    ౦ژͷ
    Config
    ʁʁʁ
    

    View Slide

32. ࢲ΋શ෦ه࿥ͯ͠·ͨ͠Α
    ώΟ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ࢲ΋
    શ෦ه࿥
    ͯ͠·ͨ͠Α
    

    View Slide

33. ح۰ͩͳɺԶ΋ه࿥ͯͨ͠Α
    ώΟ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ϜϯόΠͷ
    Config
    ʁʁʁ
    

    View Slide

34. ʮʮʮ͓͍͓͍ɺԶͨͪΛ๨ΕΔͳΑʜʁʯʯʯ
    ౦ژͷ
    Config
    ʁʁʁ όʔδχΞͷ
    Config
    ʁʁʁ
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ϜϯόΠͷ
    Config
    ʁʁʁ
    ֤Ϧʔδϣϯͷ
    Configͨͪ
    ʁʁʁ
    ώϡο
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ح۰ͩͳɺ
    Զ΋ه࿥ͯͨ͠Α
    ͓͍͓͍ɺ
    ԶͨͪΛ
    ๨ΕΔͳΑʜʁ
    ͓͍͓͍ɺ
    ԶͨͪΛ
    ๨ΕΔͳΑʜʁ
    

    View Slide

35. ֤Ϧʔδϣϯʢݸʣͷ$POpH
    ౦ژͷ
    Config
    όʔδχΞͷ
    Config
    ϜϯόΠͷ
    Config
    ֤Ϧʔδϣϯͷ
    Configͨͪ
    ͋Γ͕ͱ͏
    ͍͟͝·͢
    

    View Slide

36. νϦ΋ੵ΋Ε͹υϧ௒͑Δ
    46υϧ
    5υϧ
    2021೥3݄શମ
    2021೥4݄த०
    ʮ͓΅Ζ͛ͳ͕Β
    ු͔ΜͰ͖ͨΜͰ͢ɻʯ
    

    View Slide

37. $POpHͷྉۚ
    ɾه࿥͞Εͨઃఆ߲໨͝ͱʹ0.003USD
    ɾ1000ΠϕϯτͰ3USD
    ɾIAM ͸άϩʔόϧϦιʔεͳͷͰ
    ɹશϦʔδϣϯͷ Config ͕ه࿥
    ͋Γ͕ͱ͏
    ͍͟͝·͢
    

    View Slide

38. $POpH͚ͩ͡Όͳ͍
    େྔͷAPIίʔϧ
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    Ͳ͏ͨ͠
    ֤Ϧʔδϣϯͷ
    Trail
    ֤Ϧʔδϣϯͷ
    GuardDuty
    

    View Slide

39. 5SBJMͱ(VBSE%VUZͷྉۚ
    ௥Ճͷίϐʔ
    ഑৴͞Εͨ ؅ཧΠϕϯτ͋ͨΓ64%
    6υϧ
    Trail
    9υϧ
    GuardDuty
    ສΠϕϯτ͋ͨΓ64% ສΠϕϯτ͋ͨΓ64%
    

    View Slide

40. ͘͠͡Βͳ͍ͨΊʹ
    Ͳ͏͢Ε͹ආ͚ΒΕͨͷ͔
    

    View Slide

41. ̏ͭ͋Γ·͢
    • ɹ
    • ɹ
    • ɹ
    

    View Slide

42. ̏ͭ͋Γ·͢
    • IAMϩʔϧͰ༡͹ͳ͍
    • ɹ
    • ɹ
    

    View Slide

43. ̏ͭ͋Γ·͢
    • IAMϩʔϧͰ༡͹ͳ͍
    • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ
    • ɹ
    

    View Slide

44. ྫ͑͹
    • ੥ٻΞϥʔτ
    • AWS Budgets
    • ࡞ΓࠐΈʹΑΔఆظऔಘ
    https://dev.classmethod.jp/articles/
    aws-budgets-alert-by-aws-chatbot/
    https://dev.classmethod.jp/articles/
    notify-slack-aws-billing/
    

    View Slide

45. ࢲ΋΍ͬͯ·͢
    ͸͍ʜʜ
    

    View Slide

46. ̏ͭ໨
    • IAMϩʔϧͰ༡͹ͳ͍
    • ྉۚʹ͍ͭͯͷ௨஌Λ༗ޮԽ͢Δ
    • ConfigͷϕετϓϥΫςΟεʹ
    ͷͬͱΔ
    

    View Slide

47. $POpHͷϕετϓϥΫςΟε
    https://
    aws.amazon.com/jp/
    blogs/news/aws-
    config-best-practices/
    Config ϕετϓϥΫςΟε ϒϩά | ݕࡧ
    20ݸͷϓϥΫςΟε
    

    View Slide

48. $POpHͷϕετϓϥΫςΟεʢൈਮʣ
    1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Config Λ༗ޮʹ͢Δ
    2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ
    3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ
    ͳ S3 όέοτΛ࢖༻͢Δ
    5. ……
    

    View Slide

49. ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    ౦ژͷ
    Config
    ֤Ϧʔδϣϯͷ Configͨͪ
    ࢲ͚͕ͩ
    ه࿥͠·͢
    ……
    ͸͍ʜʜ
    

    View Slide

50. 
    ҰํͰ
    

    View Slide

51. $POpHͷϕετϓϥΫςΟεʢൈਮʣ
    1. ͢΂ͯͷΞΧ΢ϯτͱϦʔδϣϯͰ AWS Config Λ༗ޮʹ͢Δ
    2. ͢΂ͯͷϦιʔελΠϓͷઃఆมߋΛه࿥͢Δ
    3. 1ͭͷϦʔδϣϯͰͷΈάϩʔόϧϦιʔεΛه࿥͢Δ
    4. ઃఆཤྺͱεφοϓγϣοτϑΝΠϧΛऩू͢ΔϓϥΠϕʔτ
    ͳ S3 όέοτΛ࢖༻͢Δ
    5. …… ͷͬͱΔͷ͕
    ϚετͰ͸ͳ͍
    

    View Slide

52. $POpHͷه࿥ର৅ͷબ୒
    https://docs.aws.amazon.com/ja_jp/
    config/latest/developerguide/resource-
    config-reference.html
    ݸऑͷ
    ϦιʔελΠϓͷத͔Β
    ඞཁ෼ͷΈΛબ୒
    

    View Slide

53. ຊ౰ʹه࿥͕ඞཁʁίετΛҙࣝ͠Α͏
    ྫʣAutoScaling ؔ࿈Ϧιʔε͕͢΂ͯه࿥ର৅ͱͳΔͨΊɺ
    සൟʹஔ͖׵͕͑ߦΘΕΔ৔߹ɺ
    ίετ͕ਹΉ͜ͱ΋ɻ
    Auto scaling
    Instance
    Elastic network
    interface
    Volume
    Security group
    શ෦ه࿥ʹ࢒͢ඞཁ
    ͋Δ͔ͳʁ
    

    View Slide

54. ৽نରԠϦιʔε΋ه࿥ͯ͘͠ΕΔͷ͸خ͍͚͠ΕͲ
    2021/2/26
    •Configͷه࿥ର৅͕૿͑ͨ
    •ʮ͢΂ͯΛه࿥ʯͷ৔߹ɺ৽نͷର৅΋ࣗ
    ಈతʹه࿥։࢝
    •͜Ε·Ͱൃੜ͍ͯ͠ͳ͔ͬͨίετ͕ٸʹ
    ૿͑ͨɺͱ͍͏͜ͱ΋ى͜Γ͏Δ
    

    View Slide

55. ه࿥͢Δ͜ͱΛݪଇͱͭͭ͠ίετ΋ҙࣝ
    • ه࿥Λ࢒͢ͷ͸େࣄ
    • ίετݟ߹͍Ͱऔࣺબ୒Λ
    Config Trail GuardDuty
    Ϧιʔεͷ
    ઃఆ಺༰Λ
    ه࿥͠·͢
    ΠϕϯτΛ
    ه࿥͠·͢
    ෆ৹ͳ
    ΞΫςΟϏςΟΛ
    ݕ஌͠·͢
    

    View Slide

56. 
    ·ͱΊ
    

    View Slide

57. ࣋ͪؼ͍ͬͯͩ͘͞
    ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
    ʮAWS Config ͷϕετϓϥΫςΟεʯ
    

    View Slide

58. ࣋ͪؼ͍ͬͯͩ͘͞
    ʮ͋ɺ͜͜ʹར༻අ͔͔ΔΜͩͳʯ
    ʮAWS Config ͷϕετϓϥΫςΟεʯ
    ʮIAMϩʔϧͰ༡ΜͰ͸͍͚ͳ͍ʯ
    

    View Slide