Upgrade to Pro — share decks privately, control downloads, hide ads and more …

自由でセキュアな環境のつくりかた / Building free and secure clo...

Hokuto Hoshi
November 08, 2018

自由でセキュアな環境のつくりかた / Building free and secure cloud environment

Hokuto Hoshi

November 08, 2018
Tweet

More Decks by Hokuto Hoshi

Other Decks in Technology

Transcript

  1. ੕ ๺ే (΄͠ ΄͘ͱ) / @kani_b • ΫοΫύουגࣜձࣾ
 ΠϯϑϥετϥΫνϟʔ෦ ෦௕


    ݉ ίʔϙϨʔτΤϯδχΞϦϯά෦
 ݉ ؂ࠪҕһձ ؂ࠪิॿऀ • SRE, ηΩϡϦςΟΤϯδχΞ • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)
  2. ৽͍͠औΓ૊Έ • cookpadTV https://www.cookpad.tv/ • Cookpad DO! https://cookpad.do/ • OiCy

    https://oicy.cookpad.com/ • komerco https://komer.co/ • etc…
  3. ౰࣌ͷ૊৫ߏ଄ • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦) • Πϯϑϥͷ؅ཧ͸શͯΠϯϑϥ෦͕ߦ͏
 (=

    AWS ͷ؅ཧ͸શͯΠϯϑϥ෦) • AWS ʹؔ͢Δϊ΢ϋ΢͸શͯΠϯϑϥ෦ʹू໿ • ηΩϡϦςΟରࡦ΋΄΅Πϯϑϥ෦͕ओಋ ࣄۀ෦ Πϯϑϥ෦ ࣄۀ෦ ࣄۀ෦
  4. ݖݶ؅ཧ • ඞཁͳαʔϏεͷ Admin ݖݶΛ޿͘෇༩ • “ಛఆαʔϏεͷΈڐՄ͠ ͳ͍” ϙϦγʔ \

    7FSTJPO  4UBUFNFOU< \ &⒎FDU"MMPX  /PU"DUJPO< DMPVEUSBJM   DPOpH   EJSFDUDPOOFDU   SPVUF   SPVUFEPNBJOT   BXTQPSUBM.PEJGZ"DDPVOU  BXTQPSUBM.PEJGZ#JMMJOH  BXTQPSUBM.PEJGZ1BZNFOU.FUIPET  JBN$SFBUF6TFS  FD$SFBUF7QD >  3FTPVSDF  ^ > ^
  5. ϩάͷه࿥ • CloudTrail, VPC Flow Logs • AWS શମͷ API

    ϩά΍ VPC ͷ௨৴ϩάΛه࿥Ͱ͖Δ • ຊ൪ΞΧ΢ϯτͷ S3 όέοτʹอ࣋ • ϩάͷมߋ΍࡟আ͸Ͱ͖ͳ͘ͳΔ
  6. awslabs/aws-config-rules • ศརϨϙδτϦ • https://github.com/awslabs/aws-config-rules • Config Rules ʹ࢖͑Δ Lambda

    function ͕͍Ζ͍Ζ͋Δ • EBS ͸҉߸Խ͞Ε͍ͯΔ͔ʁ • IAM Ϣʔβͷ MFA ͸༗ޮԽʁ • etc…
  7. Amazon GuardDuty • CloudTrail ΍ VPC FlowLog Λ෼ੳͯ͠Ξϥʔτ • Ξϥʔτͷྫ

    • ීஈ࢖ΘΕͳ͍ IP ͔Βͷ API ίʔϧ • Πϯελϯεͷ௨৴ઌ͕͍ͭ΋ͱҧ͏ • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό
  8. ΫοΫύουͰͷ࢖͍ํ • Ξϥʔτ͸ GitHub -> PagerDuty ܦ༝Ͱൃใ͠
 ηΩϡϦςΟνʔϜ͕؂ࢹ • ௐࠪ෼ੳʹ

    CloudTrail ΍ Config Λ࢖͏ • ϩά͸ Graylog ʹ஝ੵ • ͪΐͬͱաහͳͷ͕࠷ۙͷ೰Έ
  9. ωοτϫʔΫߏ੒ • ౿Έ୆ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧ΢ϯτ) ͔Β
 VPC Peering

    ܦ༝Ͱ઀ଓͰ͖ΔΑ͏ʹ͢Δ • ౿Έ୆Λू໿ (TOTP ΍ FIDO U2F ʹ΋ରԠ͍ͯͯ͠ศར) • Name λάΛ࢖ͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ
  10. PR

  11. We’re Hiring!!! • Software Engineer (Security) • Software Engineer (Site

    Reliability) • ͦͷଞͷϙδγϣϯ΋͍Ζ͍Ζ͋Γ·͢ • https://cookpad.jobs/
  12. Q?