AWS WAFの初心者向け最初の一歩

"848"'ͷॳ৺ऀ޲͚࠷ॳͷҰา 4FDVSJUZ+"84ӓాɹՂ༞

AWSɺϞόΠϧɺϏοά σʔλɺIoTͳͲ࠷৽ٕज़৘ ใ΍ΠϕϯτϨϙʔτΛܝ ࡌ͢ΔϒϩάϝσΟΞͰ͢ɻ

AWS׆༻ͷ͋ΒΏΔχʔζ ʹԠ͑Δ૯߹ࢧԉαʔϏε ʮΫϥεϝιουϝϯόʔ ζʯɻৄ͘͠͸ͪ͜Βͷ΢Σ ϒαΠτΛޚཡ͍ͩ͘͞ɻ

ࣗݾ঺հ ӓాɹՂ༞ ɾΫϥεϝιουגࣜձࣾ ɾ"84ࣄۀຊ෦ ɹιϦϡʔγϣϯΞʔΩςΫτ ɹɹηΩϡϦςΟνʔϜ ɾ4FDVSJUZ+"84ӡӦ ɾ޷͖ͳαʔϏε
ɹ"848"'Ϛωʔδυϧʔϧ New

໨࣍ w 8"'ͱ͸ w "848"'ͷಛ௃ w ָʹӡ༻ͯ͠ΈΔ ࠓճ͸"848"'ͷॳ৺ऀͷΦϖϨʔγϣϯدΓ
ͷਓ޲͚ʹ࡞͍ͬͯ·͢

WAFͱ͸

8"'ͱ͸ 8FC"QQMJDBUJPO'JSFXBMMʢུশ8"'ɺϫϑʣͱ͸ɺ΢Σ ϒΞϓϦέʔγϣϯͷ੬ऑੑΛѱ༻ͨ͠߈ܸ͔Β΢ΣϒΞϓ ϦέʔγϣϯΛอޢ͢ΔηΩϡϦςΟରࡦͷҰͭ ηΩϡϦςΟରࡦͱͯ͠͸ɺ΢ΣϒΞϓϦέʔγϣϯͷ࣮૷ ໘ͰͷࠜຊతͳରࡦͰ͸ͳ͘ɺ͋͘·Ͱ΋߈ܸʹΑΔӨڹΛ ௿ݮ͢Δӡ༻໘ͰͷରࡦͱͳΔ XJLJQFEJBҾ༻IUUQTKBXJLJQFEJBPSHXJLJ8FC@"QQMJDBUJPO@'JSFXBMM

ྨࣅػೳͱͷҧ͍ 8"'ͱྨࣅ͢Δػೳͱͯ͠ϑΝΠΞ΢Υʔϧ '8 ΍ɺ৵ೖ๷ࢭγεςϜ *14 ɺ৵ ೖݕ஌γεςϜ *%4
͕͋Δ͕ɺ๷ޚՄೳͳ߈ܸʹҧ͍͕͋Δɻ w '8Ͱ๷ޚՄೳͳ߈ܸͷྫ w ϙʔτεΩϟϯ w *14*%4Ͱ๷ޚՄೳͳ߈ܸͷྫ w %P4߈ܸ w 4:/qPPE߈ܸ w 8"'Ͱ๷ޚՄೳͳ߈ܸͷྫ w 42-ΠϯδΣΫγϣϯ w ΫϩεαΠτεΫϦϓςΟϯά 944 w ΠϯδΣΫγϣϯ߈ܸ w ύϥϝʔλվ᜵ XJLJQFEJBҾ༻IUUQTKBXJLJQFEJBPSHXJLJ8FC@"QQMJDBUJPO@'JSFXBMM '8 -- *14*%4 5$1)551 8"' ΞϓϦέʔγϣϯ 42-KBWBTDSJQU1)1౳

8"'ʹ͍ͭͯͷࢀߟࢿྉ w 8FC"QQMJDBUJPO'JSFXBMMಡຊ w IUUQTXXXJQBHPKQTFDVSJUZWVMOXBGIUNM w ೥ͷࢿྉͳͷͰݹ͍಺༰΋͋Δ͕ɺ8"'ͷੑ࣭Λཧղ ͢Δ෼ʹ͸ඇৗʹ͍͍
w 1$*%44 w IUUQTKBQDJTFDVSJUZTUBOEBSETPSHNJOJTJUFFOW w 8"'ͷඞཁੑʹ͍ͭͯॻ͔Ε͍ͯΔ w ʮ8FCϕʔεͷ߈ܸΛݕ஌͓Αͼճආ͢ΔͨΊʹɺҰൠެ։ ͞Ε͍ͯΔ8FCΞϓϦέʔγϣϯͷखલʹɺ8FCϕʔεͷ ߈ܸΛࣗಈతʹݕग़ɾ๷ࢭ͢Δٕज़తͳղܾࡦʢ8FCΞϓϦ έʔγϣϯϑΝΠΞ΢ΥʔϧͳͲʣΛΠϯετʔϧ͢Δɻʯ

8"'ͷ෼ྨ "84ͰαʔϏεΛಈ͔͢৔߹ͷࢹ఺͔Βݟͨར༻ܗଶʹΑΔ෼ྨ ෼ྨಛ௃ ֓ཁ ػೳੑ ॊೈੑ ؆қੑ ਌࿨ੑ
Ձ֨ Ծ૝ΞϓϥΠΞϯε ΦϯϓϨ࣌୅͔Β͋Δ੡ ඼܈Ͱߴػೳ ߴ ௿ ௿ ௿ ߴ Ϋϥ΢υܕ8"' 8"'ΛαʔϏεͱͯ͠ར ༻Ͱ͖ͯϝϯςφϯεָ͕ த ௿ த த த "848"' "84ͷαʔϏεͱͯ͠਌ ࿨ੑ͕ߴ͍ த ߴ த ߴ ௿ "848"' Ϛωʔδυϧʔϧ ηΩϡϦςΟϕϯμʔͷఏ ڙͨ͠ϧʔϧΛར༻Մೳ த௿ ߴ ߴ ߴ த

8"'ͷ෼ྨิ଍ w Ծ૝ΞϓϥΠΞϯε͸ߴػೳ͕ͩ"84ͱͷ਌࿨ੑ͸ߴ͘ͳ͍ w ߴ͍ίϯϓϥΠΞϯε͕ٻΊΒΕΔ৔߹౳ʹར༻ w ୯ҰͰ͸ར༻ͤͣ"848"'ͱซ༻͢Δ w
Ϋϥ΢υܕ8"'͸ϝϯςφϯεϑϦʔͰར༻͠΍͍͕͢εέʔ ϧͮ͠Β͍΋ͷ΋ w "848"'͸εέʔϧ͢Δ͕୯ମͷӡ༻͸ਏ͍ w "848"'Ϛωʔδυϧʔϧ͸࢖͍΍͍͢ w ࠐΈೖͬͨ͜ͱΛ͢ΔͳΒଞιϦϡʔγϣϯͱซ༻͕޷·͍͠

"848"'ͷཱͪҐஔ AWS WAF͸؆қతͳαʔϏεͰ ໾ཱͭϢʔεέʔε͸গͳ͍ʁ

"848"'ͷཱͪҐஔ AWS WAF͸؆қతͳαʔϏε͕ͩ ໾ཱͭϢʔεέʔε͸ଟ͍

๻ͷݸਓతͳײ֮Ͱ͕͢ "848"'͸͜Ε·Ͱ8"'Λར༻Ͱ͖ͳ͔ͬͨن໛ͷ αʔϏεʹ͸ಛʹࢗ͞Γ·͢ ෼ྨ େن໛αΠτ ͔ͬ͠Γରࡦ͞Ε͍ͯΔ தن໛αΠτ ΅ͪ΅ͪରࡦ͞Ε͍ͯΔ
খن໛αΠτ ͋Μ·Γରࡦ͞Ε͍ͯͳ͍ ࣮ࡍͷׂ߹͸ େن໛αΠτ ͔ͬ͠Γରࡦ͞Ε͍ͯΔ தن໛αΠτ ΅ͪ΅ͪରࡦ͞Ε͍ͯΔ খن໛αΠτ ͋Μ·Γରࡦ͞Ε͍ͯͳ͍ ͜ͷ͘Β͍͔͠ ༗ޮ͡Όͳ͍ͱ ࢥͬͨΒ ͜ͷ͘Β͍ ༗ޮͩͬͨ

ηΩϡϦςΟରࡦͷߟ͑ํ w ηΩϡϦςΟରࡦʹऴΘΓ ׬ᘳ ͸ͳ͍ w େମ͸අ༻ͱͷτϨʔυΦϑʹͳΔ w
कΔ΋ͷ͕େ͖͚Ε͹ద੾ʹ౤ࢿ͢Δ w খ͚͞Ε͹ඞཁ࠷௿ݶ͚ͩͰ΋ྑ͠ͱ͍͍ͯ͠ w "848"'͸ΤϯτϦʔϨϕϧͷηΩϡϦςΟରࡦ ͱͯ͠ߟ͍͑ͯ͘ͱ͍͍͔΋

AWS WAFͷಛ௃

"848"'ͷߏ੒ཁૉ w ݸผͷݕ஌ϧʔϧ͸ $POEJUJPO w 3VMFʹෳ਺$POEJUJPOΛ ొ࿥ w
8FC"$-ʹෳ਺3VMFΛ ొ࿥ w $MPVE'SPOUͱ"-#ʹ 8FC"$-Λద༻ AWS Black Belt Online Seminar 2017 AWS WAF https://www.slideshare.net/AmazonWebServicesJapan/20171122-aws-blackbeltawswafowasptop10/23

"848"'ಛ௃ w ඞཁͳ৚݅Λ૊Έ߹Θͤͯॊೈʹߏ੒Ͱ͖Δ w 42-J 944౳ͷࡉ͔͍ਖ਼نදݱΛॻ͘ඞཁ͕ͳ͍ w (FP*1Ͱ஍Ҭ੍ݶ͕Մೳ
w 3BUF#BTFEͰա৒ͳϦΫΤετΛࢭΊΒΕΔ w $MPVE'SPOU"-#ʹΠϯςάϨʔτͯࣗ͠ಈͰε έʔϧ͢Δ w ͍҆ "$-݄ 3VMF݄ τϥϑΟοΫສ

"848"'ͷͭΒ͍ॴ w ϧʔϧ ٴͼίϯσΟγϣϯɾϑΟϧλʔ Λࣗ෼Ͱ࡞੒͠ͳ͚ Ε͹ͳΒͳ͍ w ৽͍͠੬ऑੑʹରͯࣗ͠෼ͰϧʔϧΛ௥Ճ͠ͳ͚Ε͹ͳΒͳ͍
w ߟྀࣄ߲ w Ҿֻ͚͍ͬͨਖ਼نදݱ w ର৅ͷཁૉ ϔομɺ2VFSZ4USJOHɺ#PEZ౳ w Τϯίʔυ 63-ɺ)5.-౳

"848"'ͷͭΒ͍ॴ

"848"'ͷͭΒ͍ॴ w ͱʹ͔͘ઃఆ͕ͭΒ͍ w ৽͍͠੬ऑੑʹରԠ͢Δϧʔϧͷਖ਼͍͠࡞Γํ͕Θ͔ Βͳ͍ w ͦ΋ͦ΋Ұൠਓ͕΍Δ͜ͱͰ͸ͳ͍
w ηΩϡϦςΟͷઐ໳Ո͕࡞ͬͯ͘ΕͨΒ࿩͸ผ

ͦ͜Ͱొ৔͢Δͷ͕ AWS WAFϚωʔδυϧʔϧ

"848"'Ϛωʔδυϧʔϧ ηΩϡϦςΟϕϯμʔ͕ఏڙ͢Δ8"'ͷϧʔϧ ैྔ՝ۚͰ࣌ؒ୯ҐͰར༻Ͱ͖Δ ࠷݄҆ʙߴΊͰ΋ ৗʹ࠷৽ͷϧʔϧʹϝϯςφϯεͯ͘͠ΕΔ

͋ΘͤͯಡΈ͍ͨ ʲ৽ػೳʳ"848"'ϚωʔδυϧʔϧΛ࢖ͬͯ 8PSE1SFTTʹର͢Δ߈ܸΛ๷͍ͰΈͨSFJOWFOU IUUQTEFWDMBTTNFUIPEKQDMPVEBXTBXTSFJOWFOUXBGNBOBHFESVMFUSZ Ϛωʔδυϧʔϧͷྑ͞ʹ͍ͭͯৄ͘͠ղઆ͠ɺ߹Θ࣮ͤͯಈ࡞ͷݕূ Λߦͳ͍ͬͯ·͢

ϚωʔδυϧʔϧΛ෼ྨͯ͠ΈΔ w ط஌ͷ੬ऑੑରࡦ w $.4΍"QBDIF౳ͷ੬ऑੑରࡦ w 5SFOE.JDSP.BOBHFE3VMFTGPS"848"'$POUFOU.BOBHFNFOU 4ZTUFN
$.4 ౳ w 08"415PQରࡦ w 944 42-J౳ͷରࡦ w '3VMFTGPS"848"'8FCFYQMPJUT08"413VMFT౳ w #PUରࡦ w ੬ऑੑεΩϟφɺ8FCεΫϨΠύʔ౳ରࡦ w '3VMFTGPS"848"'#PU1SPUFDUJPO3VMFT ஫ҙࣄ߲ͲΕ͔Ұ͔ͭ͠8FC"$-ʹద༻͢Δ͜ͱ͕ग़དྷͳ͍

"848"'ͱͷ෇͖߹͍ํ w ·ͣอޢର৅γεςϜʹ߹͏ϚωʔδυϧʔϧΛબఆ w ϚωʔδυϧʔϧͰิ͑ͳ͍෦෼΋ඞཁͳΒݸผʹϧʔ ϧΛઃఆ͢Δ ׳Ε͖ͯͨΒ
w ྫ͑͹8PSEQSFTTαΠτͳΒ$.4༻ͷϚωʔδ υϧʔϧΛద༻͢Δ w 8FCϑΥʔϜ͕͋ΔͳΒɺͦͷϖʔδ͸42-Jର ࡦΑ͏ϧʔϧΛॻ͍ͯ͋ͯΔɺͱ͔ ͜Ε͚ͩͰ͍ͩͿ΍ΒΕʹ͘͘ͳΔ

ָʹӡ༻ͯ͠ΈΔ

8"'ͷӡ༻ͱ͸ ޡݕ஌ͱͷઓ͍

Ͱ΋େৎ෉ w "848"'͕ϋϚΔϢʔεέʔεͰ͋Δখن໛αΠτ͸ ͦ͜·ͰෳࡶͰͳ͍ͨΊޡݕ஌͸ൃੜͮ͠Β͍ࣄ͕ଟ͍ w ࠷ॳʹޡݕ஌͕ൃੜ͠ͳ͍͔֬ೝͨ͠Β͋ͱ͸ϧʔϧͷ Ξοϓσʔτ͸ηΩϡϦςΟϕϯμʔ͕΍ͬͯ͘ΕΔͷͰ ؂ࢹ͢Δ͘Β͍Ͱ͍͍
w ෳࡶͳαΠτͳΒগ͠ؤுͬͨ΄͏͕͍͍ w ૝ఆ͞ΕΔϦΫΤετͷύϥϝʔλͰݕ஌͞Εͳ͍͔ νΣοΫ͢Δ౳

"848"'Ͱඞཁͳӡ༻ w ϩάΛऔΔ w ݕ஌ྔΛ؂ࢹ͢Δ w ϩάΛղੳ͢Δ

"848"'ͷϩάऔಘ w ݱঢ়"848"'͸׬શͳϩάऔಘ͸Ͱ͖ͳ͍ w ݕ஌ޙ࣌ؒͷΈอ࣋͞ΕΔαϯϓϧϩάΛར༻͢Δ w ϩάऔಘ͸Լهͷ࢓૊ΈΛࢀর IUUQTEFWDMBTTNFUIPEKQDMPVEBXTEFQMPZHFUBXTXBGTBNQMFMPHMBNCEBGSPNDGOW

ݕ஌ྔΛ؂ࢹ͢Δ w ҟৗΛݕ஌ͨ͠Β$MPVE8BUDIϝτϦΫεͰΧ΢ϯ τ͞ΕΔ w ͠͹Β͘ࢼݧӡ༻ͯ͠ఆৗతʹग़ͯ͘Δݕ஌ྔΛ֬ೝ ͢Δ w
ద౰ͳ਺Λ௒͑ͨΒ4/4౳Ͱ௨஌͢Δ$MPVE8BUDI ΞϥʔϜΛઃఆ͢Δ ৗʹίϯιʔϧ΍4*&.ʹுΓ෇͘ඞཁ͸ͳ͍

ϩάΛղੳ͢Δ w 4ʹஷΊͨϩάΛ"UIFOBͰղੳ͢Δ w ओʹݕ஌ͨ͠ϧʔϧΛ֬ೝͨ͠Γૹ৴ݩ*1ࠃΛ֬ೝ w ৄࡉ͸Լهϒϩάࢀর IUUQTEFWDMBTTNFUIPEKQDMPVEBXTXBGRVFSZQBUUFSOJOBUIFOB

ղੳ࣌ͷΫΤϦྫ w $06/5΋͘͠͸#-0$,͔ͭ೔ຊ͔Βͷϩά w 4&-&$5 '30.XBqPHT8)&3&BDUJPO"--08"/%SFRVFTUDPVOUSZb+1 w ೔ຊ͔ΒͷϦΫΤετͰݕ஌͍ͯͨ͠Βޡݕ஌Ͱ͸ͳ͍͔63*΍ϔομɺૹ৴ݩ*1ͳͲ͔Β൑அ͢Δ
w ࠃຖͷϩά਺ͷूܭ w 4&-&$5SFRVFTUDPVOUSZ $06/5 SFRVFTUDPVOUSZ "4DPVOU'30.XBqPHT(3061#:SFRVFTUDPVOUSZ w ࠃίʔυ͕֬ೝͰ͖Δɻ໌Β͔ʹඞཁͳ͍ࠃ͔ΒͷΞΫηε͕ଟ͚Ε͹ɺ(FP*1ϧʔϧͰ#-0$,Λ௥Ճͯ͠΋͍͍ w ΫϥΠΞϯτ*1ຖͷϩά਺ͷूܭ w 4&-&$5SFRVFTUDMJFOUJQ $06/5 SFRVFTUDMJFOUJQ "4DPVOU'30.XBqPHT(3061#:SFRVFTUDMJFOUJQ w #-0$,͕ଟ͍*1͸ෆ৹ͳͷͰݸผʹ*1ͷ#-0$,΋ݕ౼

ԼهϑϩʔޙϦϦʔε͢Δ w ϚωʔδυϧʔϧΛ$06/5Ͱઃఆ͢Δ w લड़ͷϒϩάʹ͋ΔΫΤϦఔ౓Λ͔͚ͯϧʔϧΛ௥Ճ w ޡݕ஌ͱࢥΘΕΔ௨৴͕ͳ͘ͳͬͨΒ#-0$,ʹ͢Δ w
ΞϥʔτͷͨΊͷ͖͍͠஋ΛܾΊΔ

ޡݕ஌͕ଟ͍৔߹ ଟ෼AWS WAF͡Όͳ͍ WAFͷ΄͏͕͍͍Ͱ͢

·ͱΊ w ͜Ε·Ͱ8"'ಋೖ͕ࢹ໺֎ͩͬͨ؀ڥͰ͸"84 8"'ͷಋೖΛݕ౼ͯ͠Έ·͠ΐ͏ w "848"'͸ϚωʔδυϧʔϧΛओ࣠ʹͯ͠ɺνϡʔ χϯά౳Ͱগ͠ϧʔϧΛ௥Ճ͢Δ w
ϩάΛऔಘͯ͠"UIFOBͰղੳ͢Δͱ͍͍ײ͡ w ϚωʔδυϧʔϧͳΒӡ༻͸ָ͘͢͝

AWS WAFの初心者向け最初の一歩

AWS WAFの初心者向け最初の一歩

More Decks by cm-usuda-keisuke

Other Decks in Technology

Featured

Transcript