Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
自由でセキュアな環境のつくりかた / Building free and secure clo...
Search
Hokuto Hoshi
November 08, 2018
Technology
1
5k
自由でセキュアな環境のつくりかた / Building free and secure cloud environment
Hokuto Hoshi
November 08, 2018
Tweet
Share
More Decks by Hokuto Hoshi
See All by Hokuto Hoshi
開発も運用もビジネス部門も! クラウドで実現する「つらくない」統制とセキュリティ / Effortless Governance and Security Enabled by the Cloud
kanny
4
3.9k
転生CISOサバイバル・ガイド / CISO Career Transition Survival Guide
kanny
4
2.2k
Connecting organisation with Technology
kanny
0
300
Why Slack - 5 years of Cookpad with Slack
kanny
0
130
Security by builders - セキュリティ監視をクラウドで「つくる」 / Security by builders
kanny
7
2.7k
セキュリティ担当者から見た re:Invent と AWS Security Hub / Impression of re:Invent and AWS Security Hub
kanny
2
4.3k
事例でわかる、AWS 運用を支える サポート活用方法と エンタープライズサポートという選択 / AWS Enterprise Support and Cookpad
kanny
2
2.5k
AWS で加速する機械学習 / Accelerate Machine Learning with AWS
kanny
1
1k
クックパッドのログをいい感じにしているアーキテクチャ / Logging architecture at Cookpad
kanny
23
15k
Other Decks in Technology
See All in Technology
Gaze-LLE: Gaze Target Estimation via Large-Scale Learned Encoders
kzykmyzw
0
310
浸透しなさいRFC 5322&7208
hinono
0
120
AIとTDDによるNext.js「隙間ツール」開発の実践
makotot
5
660
あとはAIに任せて人間は自由に生きる
kentaro
3
1.1k
RAID6 を楔形文字で組んで現代人を怖がらせましょう(実装編)
mimifuwa
0
300
MySQL HeatWave:サービス概要のご紹介
oracle4engineer
PRO
4
1.7k
サービスロボット最前線:ugoが挑むPhysical AI活用
kmatsuiugo
0
190
Webアクセシビリティ入門
recruitengineers
PRO
1
220
Browser
recruitengineers
PRO
3
260
JavaScript 研修
recruitengineers
PRO
2
130
Oracle Base Database Service:サービス概要のご紹介
oracle4engineer
PRO
2
20k
Yahoo!ニュースにおけるソフトウェア開発
lycorptech_jp
PRO
0
330
Featured
See All Featured
Code Review Best Practice
trishagee
70
19k
The Art of Programming - Codeland 2020
erikaheidi
55
13k
How STYLIGHT went responsive
nonsquared
100
5.7k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
53
2.9k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
30
9.6k
BBQ
matthewcrist
89
9.8k
Bash Introduction
62gerente
614
210k
The World Runs on Bad Software
bkeepers
PRO
70
11k
jQuery: Nuts, Bolts and Bling
dougneiner
64
7.9k
Rebuilding a faster, lazier Slack
samanthasiow
83
9.1k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
1.1k
Transcript
ࣗ༝ͰηΩϡΞͳڥͷ ͭ͘Γ͔ͨ Hokuto Hoshi Head of Infrastructure, Cookpad Inc.
[email protected]
ే (΄͠ ΄͘ͱ) / @kani_b • ΫοΫύουגࣜձࣾ ΠϯϑϥετϥΫνϟʔ෦ ෦
݉ ίʔϙϨʔτΤϯδχΞϦϯά෦ ݉ ࠪҕһձ ࠪิॿऀ • SRE, ηΩϡϦςΟΤϯδχΞ • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)
https://speakerdeck.com/kanny
None
Ϩγϐ ສ ࠃͷ݄ؒར༻ऀ ສਓ
ରԠݴޠ ݴޠΧࠃ ւ֎ͷ݄ؒར༻ऀ ສਓ
৽͍͠औΓΈ • cookpadTV https://www.cookpad.tv/ • Cookpad DO! https://cookpad.do/ • OiCy
https://oicy.cookpad.com/ • komerco https://komer.co/ • etc…
ΫοΫύουͱΫϥυ • 2011ʹ DC ͔ΒશҠߦ͠ϑϧΫϥυԽ • ଟ͘ͷαʔϏε͕ AWS ͰՔಇ •
Ұ෦ͷαʔϏε Google Firebase ্ͰՔಇ
എܠ • ػೳɺࣄۀͳͲ৽͍͠औΓΈΛՃ͍ͨ͠
࣌ͷ৫ߏ • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦) • ΠϯϑϥͷཧશͯΠϯϑϥ෦͕ߦ͏ (=
AWS ͷཧશͯΠϯϑϥ෦) • AWS ʹؔ͢ΔϊϋશͯΠϯϑϥ෦ʹू • ηΩϡϦςΟରࡦ΄΅Πϯϑϥ෦͕ओಋ ࣄۀ෦ Πϯϑϥ෦ ࣄۀ෦ ࣄۀ෦
தԝཧͷݶք • ςετ༻ΠϯελϯεϦιʔεΛ࡞Δͷʹ Πϯϑϥ෦Ͱ࡞ۀΛߦ͏ඞཁ͕͋ͬͨ • ηΩϡϦςΟͷϨϏϡʔ • ʮͦͦ AWS ͷྑ͞Λࡴͯ͠ΔͷͰʁʁʁʁʁʁʯ
• αʔϏεͷ҆ఆੑηΩϡϦςΟΛଛͳΘͣʹ࣮ݱ͍ͨ͠
ཧํͷస • ݖݶͱΛ֤։ൃऀʹҠৡ͢Δํʹγϑτ • ཧ͖͢෦Λ͓͑ͯ͞Ҡৡ͍ͯ͘͠
։ൃऀ༻ΞΧϯτ • ։ൃऀͰ͋Ε୭Ͱࣗ༝ʹར༻Ͱ͖Δ AWS ΞΧϯτ • ຊ൪ͷ AWS ΞΧϯτͱ͞Ε͍ͯΔ •
AWS IAM ͷۭؒΛׂ͢Δ͜ͱ͕Ͱ͖Δ • ϩάΠϯ SAML ܦ༝
ݖݶཧ • ඞཁͳαʔϏεͷ Admin ݖݶΛ͘༩ • “ಛఆαʔϏεͷΈڐՄ͠ ͳ͍” ϙϦγʔ \
7FSTJPO 4UBUFNFOU< \ &⒎FDU"MMPX /PU"DUJPO< DMPVEUSBJM DPOpH EJSFDUDPOOFDU SPVUF SPVUFEPNBJOT BXTQPSUBM.PEJGZ"DDPVOU BXTQPSUBM.PEJGZ#JMMJOH BXTQPSUBM.PEJGZ1BZNFOU.FUIPET JBN$SFBUF6TFS FD$SFBUF7QD > 3FTPVSDF ^ > ^
ϩάͷه • CloudTrail, VPC Flow Logs • AWS શମͷ API
ϩά VPC ͷ௨৴ϩάΛهͰ͖Δ • ຊ൪ΞΧϯτͷ S3 όέοτʹอ࣋ • ϩάͷมߋআͰ͖ͳ͘ͳΔ
ϩάͷੳ • Graylog ʹऔΓࠐΈੳͰ͖ΔΑ͏ʹ https://speakerdeck.com/mizutani/ohuisuawshuan-jing-wosekiyuritei-jian-shi-surutamefalserokushou-ji
AWS Config • EC2 ֤छϦιʔεͷมߋཤྺΛهͰ͖Δ
͍ํ • Output ઌΛຊ൪ΞΧϯτ (CloudTrail ͱಉ͡) ʹηοτͯ͠༗ޮԽ • “͜Εมߋͨ͠ͷ୭ͩΖ͏ʁ” Λ୳͢ࡍʹར༻
• ಛఆͷΠϯελϯεηΩϡϦςΟάϧʔϓͳͲʹඥ͚ͮͯ୳ͤΔ ͷͰศར
AWS Config Rules • ઃఆมߋΛτϦΨͱͯ͠ lambda function ͰઃఆΛνΣοΫͰ͖Δ • ηΩϡϦςΟάϧʔϓͷΠϯλʔωοτղ์ͳͲΛνΣοΫ
• Fail ͨ͠߹ Slack ͳͲʹ௨ͤ͞Δ • શαʔϏεରԠͯ͠΄͍͠…
None
awslabs/aws-config-rules • ศརϨϙδτϦ • https://github.com/awslabs/aws-config-rules • Config Rules ʹ͑Δ Lambda
function ͕͍Ζ͍Ζ͋Δ • EBS ҉߸Խ͞Ε͍ͯΔ͔ʁ • IAM Ϣʔβͷ MFA ༗ޮԽʁ • etc…
Amazon GuardDuty • CloudTrail VPC FlowLog Λੳͯ͠Ξϥʔτ • Ξϥʔτͷྫ
• ීஈΘΕͳ͍ IP ͔Βͷ API ίʔϧ • Πϯελϯεͷ௨৴ઌ͕͍ͭͱҧ͏ • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό
ΫοΫύουͰͷ͍ํ • Ξϥʔτ GitHub -> PagerDuty ܦ༝Ͱൃใ͠ ηΩϡϦςΟνʔϜ͕ࢹ • ௐࠪੳʹ
CloudTrail Config Λ͏ • ϩά Graylog ʹੵ • ͪΐͬͱաහͳͷ͕࠷ۙͷΈ
ωοτϫʔΫߏ • ౿Έ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧϯτ) ͔Β VPC Peering
ܦ༝ͰଓͰ͖ΔΑ͏ʹ͢Δ • ౿ΈΛू (TOTP FIDO U2F ʹରԠ͍ͯͯ͠ศར) • Name λάΛͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ
https://speakerdeck.com/kanny/machine-learning-ops-at-cookpad
։ൃऀΞΧϯτͷಛ • “Λະવʹ͙” ͜ͱΑΓ “Λ͋ͱ͔ΒͰ͍͍ͷͰݕग़ Ͱ͖Δ” ରࡦʹϑΥʔΧε • ΞΧϯτʹٻΊΒΕΔॊೈੑͳͲ͔Βߟ͑ͨ݁Ռ •
AWS αʔϏεΛׂͱૉʹͬͨߏ • ͜͏͍͏ͱ͜Ζ·ͰͰ͖ΔΑ͏ʹͳͬͨɺͱ͍͑Δ
࣮ࡍͷӡ༻ • ։ൃऀΞΧϯτ͔ΒͷΞϥʔτଟ͘ͳ͍ঢ়گ • ར༻ͷ૯ྔଟ͍ • EC2 ΠϯελϯεΛىಈͯ͠ͷ࣮ݧ • AWS
৽αʔϏεͳͲͷݕূ
·ͱΊ • ηΩϡϦςΟͱࣗ༝͞Λཱ྆ͤͨ͞։ൃڥΛͭ͘Δ • ͍ΘΏΔ “ηΩϡϦςΟଆ” ͕Ͳ͏ߟ͑ΒΕΔ͔ʹΑͬͯ ࣮ݱͰ͖Δࣗ༝͕มΘͬͯ͘Δ • AWS
αʔϏεΛϑϧʹͬͯΈΔ͚ͩͰׂͱ৭ʑͰ͖Δ • ʮ͏ͪͰ͜͏͍͏ײ͡ʯͳͲ͕͋Εڭ͑ͯ΄͍͠Ͱ͢
PR
We’re Hiring!!! • Software Engineer (Security) • Software Engineer (Site
Reliability) • ͦͷଞͷϙδγϣϯ͍Ζ͍Ζ͋Γ·͢ • https://cookpad.jobs/
Q?