Upgrade to Pro — share decks privately, control downloads, hide ads and more …

RDSのパスワードローテーションについて考えてみた話

 RDSのパスワードローテーションについて考えてみた話

Avatar for hoshino tsuyoshi

hoshino tsuyoshi

April 04, 2024
Tweet

More Decks by hoshino tsuyoshi

Other Decks in Technology

Transcript

  1. ࠓճྫͱͯ͠ߟ͑Δ3BJMTΞϓϦपลͷߏ੒ w 'BSHBUF্Ͱ&$4λεΫ ͕ಈ͘ w QVNB XFC  w TJEFLJR

    XPSLFS  w όονॲཧ ύεϫʔυ͸3BJMTͷ$SFEFOUJBMػೳɺ"844FDSFU.BOBHFSɺ"8444.ύϥϝʔλ ετΞ౳Λ࢖͏͜ͱ͕ଟ͍ͱࢥ͍·͢ ϢʔβʔɾύεϫʔυͰೝূ ϢʔβʔɾύεϫʔυͰೝূ
  2. ΋͠ɺ͍·%#αʔόʔͷύεϫʔυΛม͑ͨ͘ͳͬͨΒʁ ʢΈͳ͞Μ΋ߟ͑ͯΈ͍ͯͩ͘͞ʣ w ͍͖ͳΓม͑ΒΕΔ͔ʁ w όονॲཧతͳ΋ͷͷ৔߹ w Ͱ͖ͦ͏ w ࠓ·͞ʹಈ͍͍ͯΔXFCαʔόʔ

    QVNB ΍XPSLFSαʔόʔ TJEFLJR  w %#αʔόʔଆͰมߋͨ͠ॠؒʹΤϥʔଟൃͦ͠͏ w Τϥʔͳ͘ߦ͏ͷ͸೉ͦ͠͏ʁ🤔Ͳ͏͢Ε͹Α͍͔
  3. "844FDSFUT.BOBHFSઃఆΠϝʔδ w ˠը໘ΛਐΊ͍ͯ͘ͱɺ-BNCEBؔ਺΍$MPVE'PSNBUJPOͷઃఆ͕࢝·Δ Β͍͠  w ެࣜࢀߟIUUQTEPDTBXTBNB[PODPNKB@KQTFDSFUTNBOBHFSMBUFTU VTFSHVJEFUVUPSJBMT@SPUBUJPOBMUFSOBUJOHIUNMUVUPSJBMT@SPUBUJPO BMUFSOBUJOH@TUFQSPUBUF w

    ࠓճ͸͜ͷը໘͸࢖ΘͣʹUFSSBGSPNͷBXT@DMPVEGSPNBUJPO@TUBDLΛ࢖͍·ͨ͠ w ҎԼͷϖʔδ΋େ͍ʹࢀߟʹ͠·ͨ͠ w <"844FDSFUT.BOBHFSͰ3%4ͷύεϫʔυϩʔςʔγϣϯͯ͠ΈΔJO @%FWFMPQFST*0> IUUQTEFWDMBTTNFUIPEKQBSUJDMFTTFDSFUTNBOBHFS QBTTXPSESPUBUJPO
  4. ͲΜͳ-BNCEBؔ਺͔ʁ w MBNCEB@IBOEMFSͱ͍͏ϝΠϯؔ਺͔ΒҎԼͷؔ਺ΛݺͿ lambda_handlerؔ਺͸AWS Secrets Manager͔ΒͷϩʔςʔγϣϯΠϕϯτΛॲཧ͢ΔͨΊͷΤϯτϦ ϙΠϯτͱͳΓ·͢ɻ ͜ͷؔ਺͸࣍ͷ4ͭͷεςοϓΛ࣮ߦ͠·͢: •createSecret: ৽͍͠γʔΫϨοτΛ࡞੒͠·͢ɻ

    •setSecret: ৽͍͠γʔΫϨοτΛσʔλϕʔεʹద༻͠·͢ɻ •testSecret: ৽͍͠γʔΫϨοτ͕σʔλϕʔεʹਖ਼͘͠ద༻͞Εͨ͜ͱΛςετ͠·͢ɻ • fi nishSecret: ৽͍͠γʔΫϨοτΛAWSCURRENTͱͯ͠ϚʔΫ͠ɺݹ͍γʔΫϨοτΛ AWSPREVIOUSͱͯ͠ϚʔΫ͠·͢ɻ
  5. ͦͷଞඞཁͳઃఆFUD w -BNCEBؔ਺͕࣮ࡍʹ3%4ʹΞΫηε͢ΔͨΊͷ४උ w ωοτϫʔΫपΓ w 71$΍ηΩϡϦςΟάϧʔϓͷઃఆ͕ඞཁ w 3%4ࣗମ w

    ͜ͷ-BNCEBؔ਺༻ͷ%#Ϣʔβʔ ٴͼύεϫʔυ ΋ࣄલʹඞཁ w ͦͷೝূ৘ใ΋ผ్4FDSFUT.BOBHFSʹೖΕ͓ͯ͘ඞཁ͋Γ w 1PTUHSFTͷ৔߹͸$3&"5&30-&ݖݶ͕ඞཁ
  6. ͜͜·ͰͰ৮Εͳ͔ͬͨ࿩ w 3BJMTͷDPO fi HDSFEFOUJBMTZNMFOD 3"*-4@."45&3@,&: w 💭࢖͏ʹ͸͏·͘؂ࠪϩάऔΓ͍ͨ w 3%4ͷ*".ೝূ

    w 💭͜Ε͸΋͔ͨ͠͠Β΂ΜΓͦ͏ɾ3BJMTͰ͏·͘࢖͑ͨΒڭ͑ͯ΄ ͍͠ɾύϑΥʔϚϯε͸ͪΐͬͱؾ͕͔Γ