Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
自由でセキュアな環境のつくりかた / Building free and secure clo...
Search
Hokuto Hoshi
November 08, 2018
Technology
1
4.8k
自由でセキュアな環境のつくりかた / Building free and secure cloud environment
Hokuto Hoshi
November 08, 2018
Tweet
Share
More Decks by Hokuto Hoshi
See All by Hokuto Hoshi
Connecting organisation with Technology
kanny
0
170
Why Slack - 5 years of Cookpad with Slack
kanny
0
62
Security by builders - セキュリティ監視をクラウドで「つくる」 / Security by builders
kanny
7
2.6k
セキュリティ担当者から見た re:Invent と AWS Security Hub / Impression of re:Invent and AWS Security Hub
kanny
2
4.2k
事例でわかる、AWS 運用を支える サポート活用方法と エンタープライズサポートという選択 / AWS Enterprise Support and Cookpad
kanny
2
2.4k
AWS で加速する機械学習 / Accelerate Machine Learning with AWS
kanny
1
990
クックパッドのログをいい感じにしているアーキテクチャ / Logging architecture at Cookpad
kanny
23
15k
クックパッドの機械学習を支える基盤のつくりかた / Machine Learning ops at Cookpad
kanny
4
8.7k
cookpad.com 全 HTTPS 化の軌跡
kanny
30
22k
Other Decks in Technology
See All in Technology
ISUCONに強くなるかもしれない日々の過ごしかた/Findy ISUCON 2024-11-14
fujiwara3
8
870
Engineer Career Talk
lycorp_recruit_jp
0
190
B2B SaaSから見た最近のC#/.NETの進化
sansantech
PRO
0
890
New Relicを活用したSREの最初のステップ / NRUG OKINAWA VOL.3
isaoshimizu
3
630
インフラとバックエンドとフロントエンドをくまなく調べて遅いアプリを早くした件
tubone24
1
430
Incident Response Practices: Waroom's Features and Future Challenges
rrreeeyyy
0
160
Lambda10周年!Lambdaは何をもたらしたか
smt7174
2
110
生成AIが変えるデータ分析の全体像
ishikawa_satoru
0
170
Oracle Cloud Infrastructureデータベース・クラウド:各バージョンのサポート期間
oracle4engineer
PRO
28
13k
Lambdaと地方とコミュニティ
miu_crescent
2
370
VideoMamba: State Space Model for Efficient Video Understanding
chou500
0
190
[CV勉強会@関東 ECCV2024 読み会] オンラインマッピング x トラッキング MapTracker: Tracking with Strided Memory Fusion for Consistent Vector HD Mapping (Chen+, ECCV24)
abemii
0
230
Featured
See All Featured
Unsuck your backbone
ammeep
668
57k
GraphQLとの向き合い方2022年版
quramy
43
13k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
28
2k
A Tale of Four Properties
chriscoyier
156
23k
Scaling GitHub
holman
458
140k
Code Review Best Practice
trishagee
64
17k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
506
140k
Documentation Writing (for coders)
carmenintech
65
4.4k
Docker and Python
trallard
40
3.1k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
93
16k
A better future with KSS
kneath
238
17k
Writing Fast Ruby
sferik
627
61k
Transcript
ࣗ༝ͰηΩϡΞͳڥͷ ͭ͘Γ͔ͨ Hokuto Hoshi Head of Infrastructure, Cookpad Inc.
[email protected]
ే (΄͠ ΄͘ͱ) / @kani_b • ΫοΫύουגࣜձࣾ ΠϯϑϥετϥΫνϟʔ෦ ෦
݉ ίʔϙϨʔτΤϯδχΞϦϯά෦ ݉ ࠪҕһձ ࠪิॿऀ • SRE, ηΩϡϦςΟΤϯδχΞ • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)
https://speakerdeck.com/kanny
None
Ϩγϐ ສ ࠃͷ݄ؒར༻ऀ ສਓ
ରԠݴޠ ݴޠΧࠃ ւ֎ͷ݄ؒར༻ऀ ສਓ
৽͍͠औΓΈ • cookpadTV https://www.cookpad.tv/ • Cookpad DO! https://cookpad.do/ • OiCy
https://oicy.cookpad.com/ • komerco https://komer.co/ • etc…
ΫοΫύουͱΫϥυ • 2011ʹ DC ͔ΒશҠߦ͠ϑϧΫϥυԽ • ଟ͘ͷαʔϏε͕ AWS ͰՔಇ •
Ұ෦ͷαʔϏε Google Firebase ্ͰՔಇ
എܠ • ػೳɺࣄۀͳͲ৽͍͠औΓΈΛՃ͍ͨ͠
࣌ͷ৫ߏ • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦) • ΠϯϑϥͷཧશͯΠϯϑϥ෦͕ߦ͏ (=
AWS ͷཧશͯΠϯϑϥ෦) • AWS ʹؔ͢ΔϊϋશͯΠϯϑϥ෦ʹू • ηΩϡϦςΟରࡦ΄΅Πϯϑϥ෦͕ओಋ ࣄۀ෦ Πϯϑϥ෦ ࣄۀ෦ ࣄۀ෦
தԝཧͷݶք • ςετ༻ΠϯελϯεϦιʔεΛ࡞Δͷʹ Πϯϑϥ෦Ͱ࡞ۀΛߦ͏ඞཁ͕͋ͬͨ • ηΩϡϦςΟͷϨϏϡʔ • ʮͦͦ AWS ͷྑ͞Λࡴͯ͠ΔͷͰʁʁʁʁʁʁʯ
• αʔϏεͷ҆ఆੑηΩϡϦςΟΛଛͳΘͣʹ࣮ݱ͍ͨ͠
ཧํͷస • ݖݶͱΛ֤։ൃऀʹҠৡ͢Δํʹγϑτ • ཧ͖͢෦Λ͓͑ͯ͞Ҡৡ͍ͯ͘͠
։ൃऀ༻ΞΧϯτ • ։ൃऀͰ͋Ε୭Ͱࣗ༝ʹར༻Ͱ͖Δ AWS ΞΧϯτ • ຊ൪ͷ AWS ΞΧϯτͱ͞Ε͍ͯΔ •
AWS IAM ͷۭؒΛׂ͢Δ͜ͱ͕Ͱ͖Δ • ϩάΠϯ SAML ܦ༝
ݖݶཧ • ඞཁͳαʔϏεͷ Admin ݖݶΛ͘༩ • “ಛఆαʔϏεͷΈڐՄ͠ ͳ͍” ϙϦγʔ \
7FSTJPO 4UBUFNFOU< \ &⒎FDU"MMPX /PU"DUJPO< DMPVEUSBJM DPOpH EJSFDUDPOOFDU SPVUF SPVUFEPNBJOT BXTQPSUBM.PEJGZ"DDPVOU BXTQPSUBM.PEJGZ#JMMJOH BXTQPSUBM.PEJGZ1BZNFOU.FUIPET JBN$SFBUF6TFS FD$SFBUF7QD > 3FTPVSDF ^ > ^
ϩάͷه • CloudTrail, VPC Flow Logs • AWS શମͷ API
ϩά VPC ͷ௨৴ϩάΛهͰ͖Δ • ຊ൪ΞΧϯτͷ S3 όέοτʹอ࣋ • ϩάͷมߋআͰ͖ͳ͘ͳΔ
ϩάͷੳ • Graylog ʹऔΓࠐΈੳͰ͖ΔΑ͏ʹ https://speakerdeck.com/mizutani/ohuisuawshuan-jing-wosekiyuritei-jian-shi-surutamefalserokushou-ji
AWS Config • EC2 ֤छϦιʔεͷมߋཤྺΛهͰ͖Δ
͍ํ • Output ઌΛຊ൪ΞΧϯτ (CloudTrail ͱಉ͡) ʹηοτͯ͠༗ޮԽ • “͜Εมߋͨ͠ͷ୭ͩΖ͏ʁ” Λ୳͢ࡍʹར༻
• ಛఆͷΠϯελϯεηΩϡϦςΟάϧʔϓͳͲʹඥ͚ͮͯ୳ͤΔ ͷͰศར
AWS Config Rules • ઃఆมߋΛτϦΨͱͯ͠ lambda function ͰઃఆΛνΣοΫͰ͖Δ • ηΩϡϦςΟάϧʔϓͷΠϯλʔωοτղ์ͳͲΛνΣοΫ
• Fail ͨ͠߹ Slack ͳͲʹ௨ͤ͞Δ • શαʔϏεରԠͯ͠΄͍͠…
None
awslabs/aws-config-rules • ศརϨϙδτϦ • https://github.com/awslabs/aws-config-rules • Config Rules ʹ͑Δ Lambda
function ͕͍Ζ͍Ζ͋Δ • EBS ҉߸Խ͞Ε͍ͯΔ͔ʁ • IAM Ϣʔβͷ MFA ༗ޮԽʁ • etc…
Amazon GuardDuty • CloudTrail VPC FlowLog Λੳͯ͠Ξϥʔτ • Ξϥʔτͷྫ
• ීஈΘΕͳ͍ IP ͔Βͷ API ίʔϧ • Πϯελϯεͷ௨৴ઌ͕͍ͭͱҧ͏ • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό
ΫοΫύουͰͷ͍ํ • Ξϥʔτ GitHub -> PagerDuty ܦ༝Ͱൃใ͠ ηΩϡϦςΟνʔϜ͕ࢹ • ௐࠪੳʹ
CloudTrail Config Λ͏ • ϩά Graylog ʹੵ • ͪΐͬͱաහͳͷ͕࠷ۙͷΈ
ωοτϫʔΫߏ • ౿Έ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧϯτ) ͔Β VPC Peering
ܦ༝ͰଓͰ͖ΔΑ͏ʹ͢Δ • ౿ΈΛू (TOTP FIDO U2F ʹରԠ͍ͯͯ͠ศར) • Name λάΛͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ
https://speakerdeck.com/kanny/machine-learning-ops-at-cookpad
։ൃऀΞΧϯτͷಛ • “Λະવʹ͙” ͜ͱΑΓ “Λ͋ͱ͔ΒͰ͍͍ͷͰݕग़ Ͱ͖Δ” ରࡦʹϑΥʔΧε • ΞΧϯτʹٻΊΒΕΔॊೈੑͳͲ͔Βߟ͑ͨ݁Ռ •
AWS αʔϏεΛׂͱૉʹͬͨߏ • ͜͏͍͏ͱ͜Ζ·ͰͰ͖ΔΑ͏ʹͳͬͨɺͱ͍͑Δ
࣮ࡍͷӡ༻ • ։ൃऀΞΧϯτ͔ΒͷΞϥʔτଟ͘ͳ͍ঢ়گ • ར༻ͷ૯ྔଟ͍ • EC2 ΠϯελϯεΛىಈͯ͠ͷ࣮ݧ • AWS
৽αʔϏεͳͲͷݕূ
·ͱΊ • ηΩϡϦςΟͱࣗ༝͞Λཱ྆ͤͨ͞։ൃڥΛͭ͘Δ • ͍ΘΏΔ “ηΩϡϦςΟଆ” ͕Ͳ͏ߟ͑ΒΕΔ͔ʹΑͬͯ ࣮ݱͰ͖Δࣗ༝͕มΘͬͯ͘Δ • AWS
αʔϏεΛϑϧʹͬͯΈΔ͚ͩͰׂͱ৭ʑͰ͖Δ • ʮ͏ͪͰ͜͏͍͏ײ͡ʯͳͲ͕͋Εڭ͑ͯ΄͍͠Ͱ͢
PR
We’re Hiring!!! • Software Engineer (Security) • Software Engineer (Site
Reliability) • ͦͷଞͷϙδγϣϯ͍Ζ͍Ζ͋Γ·͢ • https://cookpad.jobs/
Q?