AWS CDKで コンテナイメージスキャンを行う 〜ECRとその他の方法〜 / cdk-container-image-scan

2023/10/16開催 JAWS-UG コンテナ支部 × JAWS-UG 千葉支部 #1 〜今知りたいコンテナセキュリティ〜 での登壇資料です。

Transcript

1. 
   LHPUP าͷςοΫ "84
   $%,Ͱ
   ίϯςφΠϝʔδεΩϟϯΛߦ͏
   ʙ&$3ͱͦͷଞͷํ๏ʙ +"846(
   ίϯςφࢧ෦
   º
   +"846(
   ઍ༿ࢧ෦
   
   ࠓ஌Γ͍ͨίϯςφηΩϡϦςΟ
2. ࣗݾ঺հ LHPUP w ςοΫϦʔυɾϥʔϝϯ޷͖
   w "84
   $PNNVOJUZ
   #VJMEFS %FW5PPMT
   w าͷςοΫ ٕज़ϒϩά
   w ࣗ࡞"84πʔϧͷ044։ൃ
   w "84
   $%,ίϯτϦϏϡʔλʔ
   w 9 5XJUUFS 
   !@TUFQ@UFDI
   ‣ LHPUP าͷςοΫ
3. ͜ͷ೥ͷొஃৼΓฦΓ ˙
   "84
   %FW
   %BZ
   
   +BQBO
   ‣ αʔόʔϨεͳϝʔϧૹ৴γεςϜΛ"84
   $%,Ͱߏங͠਺ઍਓن໛ͷ؀ڥͰӡ༻ͨ͠࿩
   ˙
   +"846(
   $%,ࢧ෦
   ‣ $%,Ͱ7BMJEBUJPO͢Δຊ౰ͷํ๏
   ˙
   "QQ
   3VOOFS
   /JHIU
    "84
   4UBSUVQ
   .FFUVQ
   ‣ "QQ
   3VOOFSͰ
   "QQͰͳ͍΋ͷΛ3VO͢Δ
   ˙
   "84
   $%,
   $POGFSFODF
   +BQBO
   
   ‣ "84
   $%,ͱ;PEΛ׆༻ͨ͠όϦσʔγϣϯύλʔϯू
   ˙
   +"846(
   43&ࢧ෦
   ‣ $MPVE8BUDIෳ߹ΞϥʔϜͰ&-#ͷ99Λ͍͍ײ͡ʹݕ஌͠Α͏ͱͨ͠Β͏·͍͔͘ͳ͔ͬͨ࿩
   ˙
   "84
   %FW
   %BZ
   
   5PLZP
   ‣ "84
   $%,ͰֶͿ(P'σβΠϯύλʔϯ
   ʙ*B$ʹ΋ίʔυઃܭʙ
   ˙
   +"846(
   $%,ࢧ෦
   ‣ "84
   $%,Ͱ࢖͏(P'σβΠϯύλʔϯ
   ʙ࣮ࡍͲ͏ͳͷʁʙ
   ˙
   4UBSUVQ
   %BZ
   
   ‣ ελʔτΞοϓͰͦ͜$%,͕׆͖ͨʙੜ࢈ੑΛ޲্Ͱ͖ͨͭͷཧ༝ʙ
   ˙
   +"846(
   $%,ࢧ෦
   ‣ $MPVE'PSNBUJPOϢʔβʔ͕$%,ʹೖ໳ͯ͠Έͯࢥͬͨ͜ͱ ύωϧσΟεΧογϣϯ
   ˙
   +"846(
   ίϯςφࢧ෦
   º
   +"846(
   ઍ༿ࢧ෦
   ‣ "84
   $%,ͰίϯςφΠϝʔδεΩϟϯΛߦ͏ʙ&$3ͱͦͷଞͷํ๏ʙ $%,ωλ શొஃ
   
   
   ɿຊ
   $%,ωλɿຊ $%,ͷେϑΝϯͰ͢ʂʂʂ
   $%,ͷܒ໤׆ಈத
4. ίϯςφηΩϡϦςΟ
5. AWS CDKͰίϯςφΠϝʔδεΩϟϯΛߦ͏
6. "84
   $%,Ͱίϯςφʁ
7. "84
   $%,
   º
   ίϯςφΠϝʔδϏϧυ
8. "84
   $%,ºίϯςφΠϝʔδϏϧυ w "84
   $%,Ͱ͸؆୯ʹίϯςφΠϝʔδͷϏϧυ͕Ͱ͖Δ
   ‣ *B$ϨΠϠʔ *B$ίʔυ಺ ͰͷΠϝʔδϏϧυɾΠϝʔδϓογϡ͕Մೳ
    $%,Ҏ֎ͷ*B$πʔϧͰ͸*B$ͷ؅ཧ֎Ͱ΍Δ͜ͱ͕ଟ͍ ϦϙδτϦ࡞੒ ΠϝʔδϏϧυ Πϝʔδϓογϡ
9. "84
   $%,ºίϯςφΠϝʔδεΩϟϯʁ w "84
   $%,͚ͩͰΠϝʔδͷϏϧυ͔Βϓογϡ·Ͱग़དྷͯศརʂ
   w Ͱ΋ɺ"84
   $%,಺ͰϏϧυͨ͠ΠϝʔδͷεΩϟϯ͸Ͳ͏΍ͬͯʁ
   ‣ ࣮͸ɾɾɾ
10. "84
    $%,ºίϯςφΠϝʔδεΩϟϯʁ w "84
    $%,͚ͩͰΠϝʔδͷϏϧυ͔Βϓογϡ·Ͱग़དྷͯศརʂ
    w Ͱ΋ɺ"84
    $%,಺ͰϏϧυͨ͠ΠϝʔδͷεΩϟϯ͸Ͳ͏΍ͬͯʁ
    ‣ ࣮͸ɾɾɾ ཱ֬͞Ε͍ͯͳ͍
11. "84
    $%,ºίϯςφΠϝʔδεΩϟϯʁ w "84
    $%,͚ͩͰΠϝʔδͷϏϧυ͔Βϓογϡ·Ͱग़དྷͯศརʂ
    w Ͱ΋ɺ"84
    $%,಺ͰϏϧυͨ͠ΠϝʔδͷεΩϟϯ͸Ͳ͏΍ͬͯʁ
    ‣ ࣮͸ɾɾɾ ཱ֬͞Ε͍ͯͳ͍ ͱ͍͏͔ ͋·Γฉ͔ͳ͍ Ͱ͢ΑͶʁ
12. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w Ұൠతʹ͸Ͳ͏΍ͬͯΠϝʔδεΩϟϯ͢Δͷʁ πʔϧ
    ‣ &$3
     ϕʔγοΫεΩϟϯ
     ֦ுεΩϟϯ XJUI
    "NB[PO
    *OTQFDUPS
    ‣ αʔυύʔςΟπʔϧ
     5SJWZ
     %PDLMF
     FUDʜ
13. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w Ұൠతʹ͸Ͳ͏΍ͬͯΠϝʔδεΩϟϯ͢Δͷʁ ϑϩʔ
    ‣ Ұఆִؒ ఆظ ࣮ߦ
     ೔ʹճ
    ‣ ඇಉظ Πϕϯτ ࣮ߦ
     ΠϝʔδͷϓογϡΛτϦΨʔ
    ‣ ಉظ࣮ߦ
     $*$%ύΠϓϥΠϯͷεςοϓ
14. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w ಉظ࣮ߦ $*$%ύΠϓϥΠϯͷεςοϓ ͷྫ ΠϝʔδεΩϟϯ ΠϝʔδϏϧυ Πϝʔδϓογϡ
15. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w ಉظ࣮ߦ $*$%ύΠϓϥΠϯͷεςοϓ ͷྫ ΠϝʔδεΩϟϯ ΠϝʔδϏϧυ Πϝʔδϓογϡ ੬ऑੑݕग़
16. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w ಉظ࣮ߦ $*$%ύΠϓϥΠϯͷεςοϓ ͷྫ ΠϝʔδεΩϟϯ ΠϝʔδϏϧυ Πϝʔδϓογϡ ͤ͞ͳ͍ ੬ऑੑݕग़
17. ҰൠతͳίϯςφΠϝʔδͷεΩϟϯํ๏ w ಉظ࣮ߦ $*$%ύΠϓϥΠϯͷεςοϓ ͷྫ ΠϝʔδεΩϟϯ ΠϝʔδϏϧυ Πϝʔδϓογϡ ͤ͞ͳ͍ ੬ऑੑݕग़ ϓογϡΛτϦΨʔʹ
    σϓϩΠ͢Δέʔε΋҆৺ σϓϩΠલʹऴྃ
18. ͋ΒͨΊͯ
19. "84
    $%,Ͱ
    ίϯςφΠϝʔδεΩϟϯͬͯ
    Ͳ͏΍Δͷʁ
20. ͱΓ͋͑ͣ
21. &$3Ͱ
    ΍ͬͯΈ·͢
22. "84
    $%,º&$3Πϝʔδ ϓογϡ εΩϟϯ w 3FQPTJUPSZ
    JNBHF4DBO0O1VTI
23. "84
    $%,º&$3Πϝʔδ ϓογϡ εΩϟϯ w ੬ऑੑݕग़࣌ͷಉظతରԠʹ͸࢖͑ͳ͍ ϓογϡ͕τϦΨʔ ੬ऑੑ͕͋ͬͯ΋
    ϓογϡ͸ࢭΊΒΕͳ͍ʂ ࣮ߦ͸ඇಉظ σϓϩΠ΋ࢭ·Βͳ͍ʂ Ϗϧυ ϓογϡ
24. ͡Ό͋ͦͷଞͷํ๏͸ʁ
25. "84
    $%,ºͦͷଞͷΠϝʔδεΩϟϯ w αʔυύʔςΟπʔϧʁ
    ‣ 5SJWZ
    ‣ %PDLMF
    ‣ FUDʜ
    w ͔͠͠ʜ
    ‣ $%,͸"84༻πʔϧͳͷͰ"84Ϧιʔεͷ΋ͷ͔͠ແ͍ جຊతʹ͸ ྫ֎͋Γ
26. ͦͷଞͷํ๏͸
27. ແ͍
28. ͡Ό͋
29. Ͳ͏͢Δʁ
30. ࡞Ε͹͍͍͡ΌΜ
31. $POTUSVDU
    )VC w $%,ίϯετϥΫτϥΠϒϥϦू
    IUUQTDPOTUSVDUTEFW
    ‣  
    Ҏ্ͷΦʔϓϯιʔεͷ$%,ίϯετϥΫτ͕ެ։
    ‣ ݸਓͰ࡞ͬͨࣗ࡞ίϯετϥΫτͷެ։΋Մೳ 044ͱͯ͠
     (JU)VCʹύϒϦοΫϦϙδτϦΛ࡞੒
     $%,ίϯετϥΫτΛ࣮૷
     OQNʹύϒϦογϡ $%,༻λά෇͚Λͯ͠
     ਺෼ʙ਺े෼ܦͭͱ$POTUSVDU
    )VCʹࣗಈͰొ࿥͞ΕΔ ίϯετϥΫτ $POTUSVDU
    $%,ಛ༗ͷࣗ༝ͳཻ౓ͷϦιʔεू߹ ίϯϙʔωϯτ ɻ
    "84ఏڙͷ΋ͷ͚ͩͰͳ͘Ϣʔβ΋ࣗ༝ʹ૊ΊΔɻ
32. ࡞ͬͯΈ·ͨ͠
33. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ˞
    IUUQTDPOTUSVDUTEFWQBDLBHFTJNBHFTDBOOFSXJUIUSJWZ ˞
    IUUQTDPOTUSVDUTEFWQBDLBHFTJNBHFTDBOOFSXJUIEPDLMF ᶃ JNBHFTDBOOFSXJUIUSJWZ
    ˞
    ᶄ JNBHFTDBOOFSXJUIEPDLMF
    ˞ ˞ͱΓ͋͑ͣ5ZQF4DSJQUݶఆͰ࢖༻Մೳ ࠓޙ޿͛ͯ΋͍͍͔ͳͱ ˞ ˞
34. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ w ಛ௃
    ᶃ $%,ϨΠϠʔ $%,ίʔυ ಺ͰɺίϯςφΠϝʔδεΩϟϯΛߦ͏
     
    ʮ5SJWZʯɾʮ%PDLMFʯΛ$%,Ͱ࢖͑ΔΑ͏ʹͳͬͨʂ
     $%,͚ͩͰϏϧυɾϓογϡʹՃ͑ͯεΩϟϯ·Ͱߦ͑ΔΑ͏ʹͳͬͨʂ
    ᶄ σϓϩΠաఔͰϏϧυͨ͠ΠϝʔδΛ࢖͍ճͨ͢ΊɺແବͳϏϧυ͕ൃੜ͠ͳ͍
     ʮεΩϟϯͷͨΊʹϏϧυ͠ɺσϓϩΠͷͨΊʹ΋ϏϧυʯͳͲΛ͠ͳ͍
    ᶅ ੬ऑੑݕ஌ͷࡍɺ&$3΁ͷΠϝʔδͷϓογϡ΍$%,σϓϩΠΛࢭΊΒΕΔ
35. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ w ࢓૊Έ
    ‣ $%, $MPVE'PSNBUJPO ʹ͸ʮΧελϜϦιʔεʯͱ͍͏ಛघͳϦιʔε͕͋Δ
     $%,͕ରԠ͍ͯ͠ͳ͍ॲཧΛ-BNCEBͰࣗલͰ࣮૷Ͱ͖Δػೳ 4/4Ͱ΋Մ
    ‣ ͜ͷΧελϜϦιʔε-BNCEBͰʮ5SJWZʯʮ%PDLMFʯΛୟ࣮͘૷Λ͢Δ
    ‣ ͜ΕΛ$POTUSVDUԽ͠ɺ$%,ίʔυͰσϓϩΠϑϩʔʹ૊ΈࠐΊΔΑ͏ʹ
36. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶃJNBHFTDBOOFSXJUIUSJWZ
37. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶃJNBHFTDBOOFSXJUIUSJWZ Ϗϧυ εΩϟϯ ϓογϡ
38. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶃJNBHFTDBOOFSXJUIUSJWZ ੬ऑੑݕग़࣌͸Τϥʔʹͯ͠ ϓογϡͤ͞ͳ͍ʂ
    σϓϩΠ΋Τϥʔऴྃ Ϗϧυ εΩϟϯ ϓογϡ
39. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶃJNBHFTDBOOFSXJUIUSJWZ Φϓγϣϯ΋৭ʑ͋Γʂ
    ࢦఆͳ͠Ͱ΋͍͍ײ͡ʹಈ͖·͢ʂ
40. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶃJNBHFTDBOOFSXJUIUSJWZ ΤσΟλ্Ͱͷೖྗ஋બ୒ɾೖྗิ׬ɾEPDग़ྗ ͳͲʹΑΓੜͷπʔϧΑΓศར͔΋ʂʁ
41. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶄJNBHFTDBOOFSXJUIEPDLMF
42. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶄJNBHFTDBOOFSXJUIEPDLMF *HOPSFϧʔϧ͕ࢦఆՄೳʂ Ϗϧυ εΩϟϯ ϓογϡ
43. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ᶄJNBHFTDBOOFSXJUIEPDLMF *HOPSFϧʔϧ͕ࢦఆՄೳʂ Ϗϧυ εΩϟϯ ϓογϡ ੬ऑੑݕग़࣌͸Τϥʔʹͯ͠ ϓογϡͤ͞ͳ͍ʂ
    σϓϩΠ΋Τϥʔऴྃ
44. ࣗ࡞ίϯετϥΫτ "84
    $%,༻ w 5SJWZͷެࣜυΩϡϝϯτͷΤίγεςϜϖʔδʹࡌͤͯ΋Β͍·ͨ͠ʂ
45. ࠶ܝ ࣗ࡞ίϯετϥΫτ "84
    $%,༻ ˞
    IUUQTDPOTUSVDUTEFWQBDLBHFTJNBHFTDBOOFSXJUIUSJWZ ˞
    IUUQTDPOTUSVDUTEFWQBDLBHFTJNBHFTDBOOFSXJUIEPDLMF ᶃ JNBHFTDBOOFSXJUIUSJWZ
    ˞
    ᶄ JNBHFTDBOOFSXJUIEPDLMF
    ˞ ˞ͱΓ͋͑ͣ5ZQF4DSJQUݶఆͰ࢖༻Մೳ ࠓޙ޿͛ͯ΋͍͍͔ͳͱ ˞ ˞
46. $%,ͰͷΠϝʔδεΩϟϯํ๏͸
    ཱ֬͞Ε͍ͯͳ͍ʁ
47. ཱ֬͞Ε·ͨ͠ʂ
48. ·ͱΊ w "84
    $%,Ͱ ಉظతͳ ίϯςφΠϝʔδεΩϟϯͷํ๏͸ཱ֬͞Ε͍ͯͳ͍
    ‣ Ϗϧυɾϓογϡࣗମ͸؆୯
    ‣ &$3ͰͷඇಉظͳϓογϡεΩϟϯ͸͋Δ
    w "84
    $%,༻ͷࣗ࡞ίϯετϥΫτΛ࡞ͬͨ 5SJWZ൛ɾ%PDLMF൛
    ‣ 044ͱͯ͠$POTUSVDU
    )VCʹެ։ͨ͠
    w $%,ͰͷίϯςφΠϝʔδεΩϟϯํ๏ཱ͕֬͞Εͨʂ ʁ
    ‣ Α͔ͬͨΒ࢖ͬͯΈ͍ͯͩ͘͞
49. ࢀߟɿαϯϓϧίʔυ (JU)VC w "84
    $%,Ͱ
    ‣ JNBHFTDBOOFSXJUIUSJWZ
    ‣ JNBHFTDBOOFSXJUIEPDLMF
    w Λ࢖ͬͨαϯϓϧίʔυΛ(JU)VCʹࡌ͍ͤͯΔͷͰΑ͔ͬͨΒͥͻ IUUQTHJUIVCDPNHPUPLDELJNBHFTDBOUFTU
50. એ఻ɿࣗ࡞"84πʔϧ044 ʲEFMTUBDLʳ"84
    $MPVE'PSNBUJPOελοΫڧ੍࡟আπʔϧ
    ‣ IUUQTHPUPLIBUFOBCMPHDPNFOUSZEFMTUBDL
    ʲDMTʳ4όέοτߴ଎࡟আɾۭʹ͢Δπʔϧ όʔδϣχϯάରԠ
    ‣ IUUQTHPUPLIBUFOBCMPHDPNFOUSZDMT
    ʲMBNWFSʳ-BNCEBϥϯλΠϜόʔδϣϯݕࡧπʔϧ Ϧʔδϣϯԣஅ
    ‣ IUUQTHPUPLIBUFOBCMPHDPNFOUSZMBNWFS
51. એ఻ɿDMTεϖΠϯޠهࣄ "84
    &TQBÑPM w "84
    &TQBÑPMͷํ͕ʮDMT 4࡟আπʔϧ ʯͷεϖΠϯޠهࣄΛॻ͍ͯ͘Ε ·ͨ͠ʂ
    ‣ ͜ΕͰ೔ຊޠɾӳޠɾεϖΠϯޠͷ͔ࠃޠͷهࣄ͕ग़དྷ·ͨ͠ʂ IUUQTEFWUPBXTFTQBOPMDMTCVTRVFEBZFMJNJOBDJPONBTJWBEFCVDLFUTTHC
52. એ఻ɿDMTͷొஃ͠·͢ʂ w 4UPSBHF+"84ͷه೦͢΂͖ୈճʹ͓ݺͼ௖͖ɺDMTͷηογϣϯΛͤ͞ ͯ௖͘͜ͱʹͳΓ·ͨ͠ʂ
    ‣  ਫ
    4UPSBHF+"84
    
53. 5IBOL
    :PV LHPUP าͷςοΫ