AWS Network Firewall Proxyを触ってみた

JAWS-UG 栃木 オフライン # 6 -1周年感謝祭-

Transcript

1. +"846(
   ಢ໦
   ΦϑϥΠϯ
   
   प೥ײँࡇ
   
   "84
   /FUXPSL
   'JSFXBMM
   1SPYZ
   Λ৮ͬͯΈͨ ޒຯͳ͗͞ʢ9ɿ!OBHJTB@ʣɹ
2. ࣗݾ঺հ w ໊લɿޒຯ
   ͳ͗͞ w ࢓ࣄɿ4*FSΠϯϑϥ෦໳Ϋϥ΢υؔ࿈άϧʔϓϚωʔδϟʔ w झຯɿΩοΫϘΫγϯά ɺεΩϡʔόμΠϏϯά w ޷͖ͳ"84αʔϏεɿ/8ܥαʔϏεશൠ "84
   $PNNVOJUZ
   #VJMEFST
   ʢ/FUXPSLJOH
   BOE
   $POUFOU
   %FMJWFSZʣ
   "84
   "NCBTTBEPSTʢʣ
   "84
   +BQBO
   5PQ
   &OHJOFFSTʢʣ
   +BQBO
   "MM
   "84
   $FSUJGJDBUJPOT
   &OHJOFFSTʢʣ
   +"846(
   Ϋϥ΢υঁࢠձ࠼ͷࠃ࡛ۄࢧ෦ӡӦ
   +"84
   %":4
   
   ࣮ߦҕһʢӶҙ४උதʂʣ
3. "84
   /FUXPSL
   'JSFXBMM
   1SPYZ 1SFWJFX w "84Ϛωʔδυͳ'PSXBSE
   1SPYZ
   w ʹ1SFWJFX൛ͱͯ͠ొ৔
   w ͜Ε·Ͱ͸Ϛωʔδυͳ'PSXBSE
   1SPYZ͕ͳ͘ɺ
   '2%/Ͱͷ੍ޚΛݫີʹߦ͍͍ͨ৔߹ɺ
   4RVJE౳ͷQSPYZαʔόΛϢʔβʔଆͰཱͯΔඞཁ͕͋ͬͨɻ
   ˠɹ͍ͭʹ"84ϚωʔδυͰར༻Ͱ͖Δ1SPYZ͕ʂ
4. ैདྷͷ"/'ʹ͓͚ΔѼઌ੍ޚͷ՝୊ ANF ಁաతɻ HTTPS௨৴ͷ৔߹ɺ ʢTLS InterceptionΛར༻͍ͯ͠ͳ͍ݶΓʣ ௨৴ͷத਎͸ݟΕͳ͍ͨΊ SSL/TLSϋϯυγΣΠΫͷClient Helloʹؚ·ΕΔ SNIͷ஋Λݩʹ੍ޚɻ ※HTTPͷ৔߹͸Host Headerͷ஋ SNIͷ஋͸࣮ࡍͷѼઌFQDNͱҟͳΔ஋ʹِ૷Մೳ ڐՄ͍ͯ͠Δϗετ໊ΛSNIʹೖΕͯ͠·͑͹௨৴Ͱ͖ͯ͠·͏ ΫϥΠΞϯτͱͯ͠͸ Ѽઌʹͦͷ··઀ଓ Ѽઌɿ https://example.com
5. ैདྷͷ"/'ʹ͓͚ΔѼઌ੍ޚͷ՝୊ Proxy Ѽઌ΁ͷ௨৴ΛProxyαʔό͕தܧ͢ΔܗʹͳΔɻ HTTPS௨৴ͷத਎͸ݟΕͳ͍͕ɺΫϥΠΞϯτ͸ HTTP CONNECTϝιουͰProxyαʔόʹ઀ଓͨ͠ͷͪ ʹProxyαʔόʹͯѼઌͷ໊લղܾΛߦ͏ͨΊɺ ࣮ࡍͷѼઌͱͳΔFQDNΛݩʹ੍ͨ͠ޚ͕Մೳ ProxyΛ໌ࣔతʹࢦఆ Ѽઌɿ https://example.com
6. /FUXPSL
   'JSFXBMM
   1SPYZͷߏ੒ Ҿ༻ݩɿhttps://aws.amazon.com/jp/blogs/networking-and-content-delivery/securing-egress-architectures-with-network-firewall-proxy/ NAT GatewayͱηοτͰར༻ Proxy Endpoint͕࡞ΒΕɺ ΫϥΠΞϯτଆ͸Proxy EndpointΛ ϓϩΩγαʔόͱͯ͠ࢦఆ ैདྷͷNetwork Firewallͷ Endpoint͸ෆཁ
7. ࣮ࡍʹ΍ͬͯΈͨ w ҎԼͭΛॱʹઃఆ
   w ϓϩΩγάϧʔϓ
   w ϓϩΩγઃఆ
   w ϓϩΩγʢຊମʣ
8. ϓϩΩγάϧʔϓ w ϧʔϧͷϑΣʔζͱ৚݅ɺΞΫγϣϯʢڐՄڋ൱ʣΛઃఆ w ϑΣʔζ
   w QSF%/4
   w υϝΠϯ໊ղܾલʹධՁ͞ΕΔ
   w 1SF3FRVFTU
   w %/4ղܾޙɺ)551TϦΫΤετΛૹ৴͢ΔલʹධՁ͞ΕΔ
   w 1PTU3FTQPOTF
   w )551TϨεϙϯεΛड৴ͨ͠ޙʹධՁ͞ΕΔ ˞1SF
   3FRVFTUͱ1PTU3FTQPOTF͸ཁ5-4
   *OUFSDFQUJPO
9. ิ଍ 5-4
   *OUFSDFQUJPO ΫϥΠΞϯτͱProxyؒͰTLS SessionΛཱ֬͠ɺҰ౓Proxy্Ͱ҉߸ԽΛղ͍ͯ த਎Λ֬ೝͷ্ɺProxyͱຊདྷͷѼઌؒͰTLS SessionΛཱ֬͢Δɻ ͜ͷ৔߹ɺΫϥΠΞϯτͱͷTLS Sessionͷཱ֬ͷͨΊʹඞཁͳূ໌ॻͷProxy ΁ͷηοτ΍ɺΫϥΠΞϯτଆʹ֘౰ͷূ໌ॻͷϧʔτূ໌ॻΛImport͢Δ ͳͲͷରԠ͕ඞཁɻ Ҿ༻ݩɿhttps://aws.amazon.com/jp/blogs/networking-and-content-delivery/securing-egress-architectures-with-network-firewall-proxy/
10. ϓϩΩγάϧʔϓ w ৚݅ ϑΣʔζʹΑͬͯ ࢖͑Δ৚݅͸ҟͳΔ
11. ϓϩΩγάϧʔϓ ࠓճ͸QSF%/4ϑΣʔζͰಛఆ'2%/ΛڐՄ͢ΔϓϩΩγάϧʔϓΛ࡞੒
12. ϓϩΩγઃఆ w σϑΥϧτͷΞΫγϣϯͱඥ෇͚Δϧʔϧάϧʔϓͷઃఆ PreRequest/PostResponseͷσϑΥϧτΞΫγϣϯΛʮڋ൱ʯʹ͍ͯ͠ΔͱHTTPϦΫΤετ/Ϩεϙϯεͷத ਎ΛݟΑ͏ͱ͢Δಈ࡞ʹͳΔͷ͔ɺʮTLS interceptionʯΛར༻͠ͳ͍ঢ়ଶͰ͸ɺ͜ͷޙߦͬͨಈ࡞֬ೝͷ ࡍʹTLS Connection Error͕ൃੜͨ͠ͷͰཁ஫ҙɻ PreDNSͷϧʔϧ͔͠࢖Θͳ͍৔߹͸ɺPreDNSͷΈʮڋ൱ʯͱ͍ͯ͠Ε͹ظ଴͢Δ੍ޚ͕Մೳɻ ࠓճ͸ϓϩΩγάϧʔϓ ͰڐՄͨ͠FQDNҎ֎͸ڋ ൱͍ͨ͠ͷͰɺσϑΥϧ τΛʮڋ൱ʯͰઃఆɻ ͕ɺҎԼ՝୊ɻ
13. ϓϩΩγʢຊମʣ w ඥ෇͚Δ/"5
    (BUFXBZ΍5-4
    JOUFSDFQUJPOɺ
    ϙʔτ൪߸ͳͲͷઃఆΛߦ͏ ݱ࣌఺Ͱ Resional NAT Gateway͸ ࢦఆෆՄ
14. ૄ௨֬ೝ w ڐՄͨ͠'2%/
    ˠ
    ૄ௨0, w ૄ௨0,ڐՄ͍ͯ͠ͳ͍Ѽઌ΁1SPYZܦ༝Ͱ$VSM
    ˠ
    $0//&$5ʹର͠1SPYZ͔Β͕ฦ͓ͬͯΓૄ௨/(
15. ऴΘΓʹ w ࣮ࡍʹ࢖ͬͯΈ͕ͨҰൠతͳ1SPYZ༻్ͱͯ͠ඞཁͳػೳΛඋ͍͑ͯͦ͏
    w ৄ͘͠͸ҎԼΛݟ͍ͯͩ͘͞
    "84ͷ&HSFTT௨৴पΓͷΞοϓσʔτʹ৮ΕͯΈͨ
    
    3FHJPOBM
    /"5
    (BUFXBZ
    /FUXPSL
    'JSFXBMM
    1SPYZ
    
    w Ұൠఏڙ։࢝ͨ͠ޙͷ͓஋ஈ͸ؾʹͳΔͱ͜Ζɻɻɻ
    ˠ
    ैདྷͷ/FUXPSL
    'JSFXBMMͷ&OEQPJOUΛར༻͢ΔܗͰ͸ͳ͍ͷͰ
    ผྉۚମܥʹͳΔͷͰ͸ͱظ଴ ૣ͘དྷͯ΄͍͠