Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-le...

Avatar for opelab opelab
July 22, 2024

AWSで”最小権限の原則”を実現するための考え方 /20240722-ssmjp-aws-least-privilege

ssmonline #43 での発表資料です。

(運用設計ラボ合同会社 波田野裕一)

Avatar for opelab

opelab

July 22, 2024
Tweet

More Decks by opelab

Other Decks in Technology

Transcript

  1. Operation Lab ӡ༻ઃܭϥϘ 8IPBN* 3 +"846($-*ઐ໳ࢧ෦ࢧ෦௕ +"846(ΞʔΩςΫνϟઐ໳ࢧ෦ӡӦ +"846(ேձӡӦ ೾ా໺༟Ұ "84$PNNVOJUZ)FSP

    ʙ "844BNVSBJ ݸਓ "844BNVSBJ $-*ઐ໳ࢧ෦ ೔ຊ.41ڠձಛผձһ ʙ ࠓ೥લ൒ʹશ෦ࣦޮ༧ఆͰ͕ͨ͠ɺແࣄߋ৽͠·ͨ͠ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ ʙ
  2. Operation Lab ӡ༻ઃܭϥϘ *".ʹΑΔ"84"1*ͷΞΫηε੍ޚ 8 *".͕"84"1*΁ͷΞΫηε੍ޚΛ୲͏ *". "84 Ϧιʔε ར༻ऀ

    ֎෦ Ϧιʔε "84 "1* ೝূ "VUIFOUJDBUJPO ೝՄ "VUIPSJ[BUJPO ΄΅શͯͷ"84"1*ϦΫϦετ͸ *".Λհ࣮ͯ͠ߦ͞ΕΔ "1*ΞΫγϣϯ୯ҐͰ͖Ίࡉ੍͔͘ޚՄೳ 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε ϧʔτΞΧ΢ϯτͷϦΫΤετ͸*".Λܦ༝͠ͳ͍ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
  3. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ͷجຊߏ଄ 9 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε

    ϓϦϯγύϧ *".ΤϯςΟςΟ ਎ݩ؅ཧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ *".ϩʔϧ *".Ϣʔβʔ "84 "1* ݺͼग़͞ΕΔଆ ೝՄ ΞΫηε؅ཧ "VUIPSJ[BUJPO ೝՄ͞ΕͨϦΫΤετ ͚͕࣮ͩߦ͞ΕΔ *".ϙϦγʔ ΠϯϥΠϯ ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ ڥք *".ΞΠσϯςΟςΟ *".ϩʔϧ *".Ϣʔβʔ *".άϧʔϓ *".ϙϦγʔͷ ׂΓ౰ͯઌ ຊਓ ࣮ମ ࣝผࢠ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
  4. Operation Lab ӡ༻ઃܭϥϘ *".͸ʮ࠷খݖݶͷݪଇʯΛ࣮ݱ͢Δ࣮૷Λఏڙ͍ͯ͠Δ 10 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε

    ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ { "Sid": "AllowCreateNetworkInterfaceWithCloudShellTag", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "ManagedByCloudShell" } } }, FD"1*ͷΞΫγϣϯͷ͏ͪ ͚ͭͩΛࢦఆ͍ͯ͠Δɻ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
  5. Operation Lab ӡ༻ઃܭϥϘ "84͸ʮ࠷খݖݶͷݪଇʯͷ࣮ફΛར༻ऀʹҕͶ͍ͯΔ 11 383 APIs 15319 Actions ग़య"84$-*ެࣜϦϑΝϨϯε

    ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ͔Ͳ͏͔͸ɺ ར༻ऀͷϦεΫ൑அʹҕͶΒΕ͍ͯΔɻ "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷
  6. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͠ͳ͍ϦεΫ 12 "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ηΩϡϦςΟΠϯγσϯτͷӨڹ͕க໋తʹͳΔ ΦϖϨʔγϣϯϛε͕ࣄނʹ௚݁͢Δ • ݖݶΛୣΘΕͨ৔߹ʹɺ෯޿͍ݖݶΛѱ༻͞Εͯ͠·͏ɻ

    • ݖݶΛୣΘΕͨ࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ • ؒҧͬͨૢ࡞ɺ૝ఆ֎ͷૢ࡞Ͱ΋ɺݖݶ͕͋ΔͨΊʹͦͷ··࣮ߦ͞Εͯ͠·͏ɻ • ΦϖϛεΛͨ͠࡞ۀऀɺ্࢘ɺͦͷ૊৫ͷϏδωε΍৴༻ʹେ͖ͳμϝʔδΛ༩͑Δ
  7. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊͷલఏ 14 "84ʹ͓͚Δʮ࠷খݖݶͷݪଇʯ࣮ݱͷͨΊͷ࣮૷ ར༻ऀͷʮ஌ࣝ໘ʯͰͷલఏ ར༻ऀͷʮ࣮૷໘ʯͰͷલఏ • "84"1*ͷ஌ࣝ

    • ૢ࡞ର৅Ϧιʔεͷಛఆ • "84ͷ֤छϙϦγʔͷ஌ࣝ • ʮ6/*9ͷߟ͑ํʯͷ࣮ફ • ඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭ • ೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭
  8. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏʮ6/*9ͷߟ͑ํʯʹجͮ͘ઃܭ େલఏ 16 ઃܭ໘Ͱͷલఏ ࠷΋6/*9తͳߟ͑ํ͸ ʮҰͭ ͚ͩ

    ͷ͜ͱΛ͏·͘΍ΒͤΔʯ ͜ͱ ఆཧ ͭͷʮ*".Ϣʔβʔʯ΍ʮ*".ϩʔϧʯʹ ͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭ *".ϩʔϧ *".Ϣʔβʔ ͭͷ*".Ϣʔβʔʹ ৭ʑͳ͜ͱΛͤ͞ͳ͍ ͭͷ*".ϩʔϧʹ ৭ʑͳ͜ͱΛͤ͞ͳ͍
  9. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͱΠϯλϥΫςΟϒར༻ͷ෼཭ 17 ઃܭ໘Ͱͷલఏ ΠϯλϥΫςΟϒར༻ ඇΠϯλϥΫςΟϒར༻ • ਓ͕ࢼߦࡨޡ͠ͳ͕Βૢ࡞͢ΔͨΊʹ࢖͏ɻ

    • ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠ʹ͍͘ɻ • εΫϦϓτ΍-BNCEBؔ਺ͷ࣮ߦͳͲʹ࢖͏ • ڐՄ͢ΔΞΫγϣϯ΍ϦιʔεΛݶఆ͠΍͍͢ɻ ඇΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧͱ ΠϯλϥΫςΟϒར༻ͷ*".Ϣʔβʔ΍*".ϩʔϧΛ෼͚Δɻ ࠷খݖݶͷݪଇʹ४ڌՄೳ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇΠϯλϥΫςΟϒ༻ *".ϩʔϧ ඇΠϯλϥΫςΟϒ༻ *".Ϣʔβʔ ΠϯλϥΫςΟϒ༻ *".ϩʔϧ ΠϯλϥΫςΟϒ༻ *".Ϣʔβʔ ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ
  10. Operation Lab ӡ༻ઃܭϥϘ "84 "84 ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷ֦େ ྫ 18 ઃܭ໘Ͱͷલఏ ॲཧ಺༰ΛΫϥΠΞϯτଆͰ੍ޚ

    ΠϯλϥΫςΟϒʹ͍ۙ ॲཧ಺༰Λ-BNCEBؔ਺Խ੍ͯ͠ޚ ඇΠϯλϥΫςΟϒԽ ॲཧΛ"84αʔϏεʹҠస͢Δ͜ͱͰ "84֎෦ͰඞཁͱͳΔݖݶΛ཈੍͢Δ͜ͱ͕Ͱ͖Δ ख࡞ۀ΍ ෳࡶͳεΫϦϓτ "84 "1* ଟ༷ͳΞΫγϣϯʹର͢Δݖݶ͕ඞཁ ΩοΫεΫϦϓτ "84 "1* -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ -BNCEB ؔ਺ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ
  11. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷྫ 19 ઃܭ໘Ͱͷલఏ "84 ΩοΫεΫϦϓτ -BNCEB ؔ਺

    ར༻ऀ ηΩϡϦςΟ άϧʔϓ &$ Πϯελϯε 44) ΞΫηεݩ*1ΞυϨεΛ ఻͑ͯJOWPLF͢Δ͚ͩ ΞΫηεݩ*1ΞυϨε͔Βͷ ΞΫηεڐՄϧʔϧΛ௥Ճ ಉ࣌ʹطଘͷڐՄΛશ࡟আ ॾൠͷࣄ৘ͰηογϣϯϚωʔδϟʔ ࢖͍ͬͯ·ͤΜ -BNCEBؔ਺ͷJOWPLFݖݶͷΈඞཁ ؔ਺͕ݺͼग़͢ΞΫγϣϯʹඞཁͳݖݶͷΈඞཁ
  12. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏඇΠϯλϥΫςΟϒར༻ͷϙϦγʔྫ 20 ઃܭ໘Ͱͷલఏ { "Version": "2012-10-17", "Statement":

    [ { "Sid": "Invoke", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:ap-northeast-1:XXXXXXXXXXXX:function:update-port-ssh" } ] } "84 ΩοΫεΫϦϓτ -BNCEB ؔ਺
  13. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏೝূ໨తͱೝՄ໨తʹΑΔϩʔϧͷ෼཭ 21 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε

    ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ "84 "1* ݺͼग़͞ΕΔଆ ೝՄ "VUIPSJ[BUJPO *".ϙϦγʔ ΠϯϥΠϯ ϙϦγʔ ؅ཧϙϦγʔ ΞΫηεڐՄ ڥք ࡞ۀ$༻ *".ϩʔϧ ࡞ۀ"༻ *".ϩʔϧ ઃܭ໘Ͱͷલఏ ࡞ۀ#༻ *".ϩʔϧ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯ༻ *".Ϣʔβʔ "84ΞΧ΢ϯτ௚઀ ඇਪ঑
  14. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏೝূ໨తͷϩʔϧ 22 "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε

    ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ αΠϯΠϯ༻ *".Ϣʔβʔ ઃܭ໘Ͱͷલఏ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ "84ΞΧ΢ϯτ௚઀ ඇਪ঑ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ  ύεϫʔυมߋ .'"ઃఆ Ҏ֎͸ڐՄ͠ͳ͍ ࡞ۀ༻ϩʔϧͷҾड͚ εΠονϩʔϧ  Ҏ֎͸ڐՄ͠ͳ͍ ೝূ໨త ΋͠*".ϢʔβʔΛ࢖͏ͳΒ͹
  15. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘ͰͷલఏೝՄ໨తͷϩʔϧ 23 ೝՄ "VUIPSJ[BUJPO ࡞ۀ$༻ *".ϩʔϧ ࡞ۀ"༻

    *".ϩʔϧ ઃܭ໘Ͱͷલఏ ࡞ۀ#༻ *".ϩʔϧ ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝՄ໨త ͦΕͧΕͷ࡞ۀʹඞཁͳ • ࠷খݶͷαʔϏεͷ • ࠷খݶͷΞΫγϣϯΛ • ࠷খݶͷϦιʔεʹରͯ͠ • ݶఆ͞Εͨ৚݅ԼͰ ڐՄ͢Δɻ "84 Ϧιʔε ར༻ऀ ֎෦ Ϧιʔε ϓϦϯγύϧ ೝূ "VUIFOUJDBUJPO ݺͼग़͢ଆ αΠϯΠϯ༻ *".ϩʔϧ αΠϯΠϯ༻ *".Ϣʔβʔ "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ *".*EFOUJUZ$FOUFS ܦ༝ "84ΞΧ΢ϯτ௚઀ ඇਪ঑ ೝূ໨త ࡞ۀ಺༰ʹԠͯ͡ඃΔ๧ࢠ ϩʔϧ Λ ม͑ΔΠϝʔδ ࣄނ๷ࢭɾ࡞ۀऀอޢ ؍఺ͷઃܭ͔Β͸͡ΊΔ
  16. Operation Lab ӡ༻ઃܭϥϘ ઃܭ໘Ͱͷલఏ ·ͱΊ 24 ઃܭ໘Ͱͷલఏ ͭͷ*".ΤϯςΟςΟ *".Ϣʔβʔ΍*".ϩʔϧ ʹ

    ͍ΖΜͳ͜ͱΛ΍Βͤͳ͍ઃܭΛ͢Δ ೝূ "VUIFOUJDBUJPO "84ΞΧ΢ϯτʹ ೖΔͨΊ͚ͩʹ࢖͏ ೝՄ "VUIPSJ[BUJPO ࡞ۀʹඞཁͳݖݶʹΑͬͯ Ҿ͖ड͚ΔϩʔϧΛ੾Γସ͑Δ ೝূ໨త ೝՄ໨త αΠϯΠϯͱ ϩʔϧҾड͚͚ͩͷ *".ϩʔϧ ඇΠϯλϥΫςΟϒ໨తͷ *".ϩʔϧ ϙϦγʔ ΠϯλϥΫςΟϒ໨తͷ *".ϩʔϧ ϙϦγʔ ࠷খݖݶͷݪଇʹ४ڌՄೳ ࠷খݖݶͷݪଇ ʹ४ڌ ৗʹཁٻ͕มԽ͢ΔͨΊ௥੻͕ඞཁ ඇਪ঑͕ͩ*".Ϣʔβʔ΋ ೥ࠒ͔Βݸਓతʹ ͜ͷΑ͏ͳઃܭΛ͍ͯ͠·͢ɻ *".*EFOUJUZ$FOUFSҠߦத ຊ൪؀ڥͰ͸࢖༻ېࢭ ݕূ΍։ൃͰͷΈ࢖༻͢Δ ࣄނ๷ࢭɾ࡞ۀऀอޢ ؍఺ͷઃܭ͔Β͸͡ΊΔ
  17. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ$36%ͱϦεΫϨϕϧ 25 ઃܭ໘Ͱͷલఏ ࡞ۀͷओ໨త͕$36%ͷ͍ͣΕͳͷ͔ʹΑͬͯϦεΫΛධՁ͢Δ ӡ༻ࣗಈԽର৅ͷબఆʹ͓͍ͯ΋༗ޮͳධՁج४ ϦεΫϨϕϧ ϦεΫϨϕϧ

    ϦεΫϨϕϧ 3FBE $SFBUF 6QEBUF %FMFUF جຊతʹ͸௿ϦεΫ ηΩϡϦςΟ؍఺Ͱ͸৘ใ࿙ӮϦεΫΛՃຯ͢Δඞཁ͕͋Δ தϦεΫ ޡ࡞੒ʹରͯ͠͸ɺ࡟আ͢Ε͹Өڹ͠ͳ͍৔߹΋ଟ͍ɻ ߴϦεΫ ޡ࡟আʹରͯ͠͸ɺ࠶࡞੒͢Ε͹Өڹ͕ݶఆతͳ৔߹΋͋Δ͕ɺ ޡߋ৽ʹ͍ͭͯ͸ɺ༰қʹ෮چͰ͖ͳ͍৔߹΋͋ΔͨΊɺ ߋ৽ͱ࡟আͷͲͪΒ͕ϦεΫߴ͍͔Ұ֓ʹ͸ݴ͑ͳ͍ɻ ϩʔϧͷݖݶʹ͍ͭͯ΋ɺҟͳΔϦεΫϨϕϧͷ΋ͷΛࠞͥͳ͍
  18. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ͷݖݶΛ҆қʹ෇༩͠ͳ͍ 26 ઃܭ໘Ͱͷલఏ ࣗ෼ࣗ਎ͷೝূ৘ใΛૢ࡞͢ΔΞΫγϣϯ *".αʔϏεͷDSFBUFVQEBUFEFMFUFܥ"1*ΞΫγϣϯ͸ ݪଇͱͯ͠*".؅ཧऀҎ֎ʹ͸ڐՄ͠ͳ͍ɻ ϧʔτϢʔβʔʹ͔͠Ͱ͖ͳ͍͜ͱҎ֎ͷ

    શͯͷݖݶͷ෇༩΍ണୣΛͰ͖Δɻ ࣗ෼ࣗ਎ͷݖݶΛࣗࡏʹมߋͰ͖Δɻ *".'VMM"DDFTT *".؅ཧऀ༻ϙϦγʔ க໋తɾഁյతͳૢ࡞͕؆୯ʹ࣮ࢪͰ͖ͯ͠·͏ɻ ྫ֎ αΠϯΠϯ༻ *".Ϣʔβʔ ύεϫʔυมߋ .'"ઃఆ ॳظύεϫʔυͷڧ੍มߋ΍.'"ڧ੍Λ͢Δ্ͰඞཁͱͳΔɻ
  19. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84"1*ͷ஌ࣝ 28 ஌ࣝ໘Ͱͷલఏ 383 APIs 15319 Actions

    ग़య"84$-*ެࣜϦϑΝϨϯε ͋ΔΞΫγϣϯ͔Β޷͖ʹબ୒ͯ͠ڐՄڋ൱Ͱ͖Δ "84Λ"1*αʔϏεͱͯ͠ཧղ͢Δ͜ͱ͕ෆՄܽ ͭ·Γ
  20. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘ͰͷલఏϚωδϝϯτίϯιʔϧͷཪଆ 29 ஌ࣝ໘Ͱͷલఏ (6* "84 "1* ΦϖϨʔλʔ

    Ϛωδϝϯτίϯιʔϧ 383 APIs 15319 Actions Ϛωδϝϯτίϯιʔϧͷૢ࡞ͷཪଆͰ͸"1*͕ݺͼग़͞Ε͍ͯΔ Ϛωδϝϯτίϯιʔϧ͔Β "1*ݺͼग़͠಺༰͸ݟ͑ͳ͍ ݱঢ় Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸ ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍
  21. Operation Lab ӡ༻ઃܭϥϘ (6* $-* ϓϩάϥϜίʔυ Ϛωδϝϯτίϯιʔϧ ஌ࣝ໘Ͱͷલఏ"84"1*ͷ௚઀తͳར༻ɾཧղ 30 ஌ࣝ໘Ͱͷલఏ

    "84 "1* ΦϖϨʔλʔ 383 APIs 15319 Actions "84$-*4%,͸"84"1*Λ௚઀తʹૢ࡞͢Δɻ ʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢ΔͨΊʹ͸ "84$-*4%,Ͱ௚઀తʹ"84"1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ͲͷΑ͏ͳͱ͖ʹ ͲΜͳ"1*ΞΫγϣϯΛߦ͏͔ཧղ͍ͯ͠Δ ίϯϐϡʔςΟϯά Ϧιʔε "84$-* "844%,
  22. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏૢ࡞ର৅Ϧιʔεͷಛఆ 31 ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ

    "84$-*Ͱͷૢ࡞खॱͳͲʹΑΓɺඞཁͳΞΫγϣϯΛಛఆ͢Δɻ ΞΫγϣϯͷૢ࡞ର৅ͱͳΔϦιʔεΛಛఆ͢Δɻ ໋໊نଇͷ੔උͳͲʹΑΓɺݫີʹಛఆͰ͖ΔΑ͏ʹ޻෉͢Δɻ ઀಄ࣙ΍઀ඌࣙɺλάͳͲ ૢ࡞ର৅Ϧιʔεʹ͍ͭͯɺͲͷཻ౓ͰΞΫηε੍ޚͰ͖Δͷ͔Λ֬ೝ͢Δɻ ૢ࡞ର৅ϦιʔεͷϥΠϑαΠΫϧΛ೺Ѳ͠ɺӬଓతͳϦιʔεͷഁյతͳૢ࡞͸ڐՄ͠ͳ͍ͳͲͷݕ౼Λߦ͏ɻ
  23. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏૢ࡞ର৅Ϧιʔεͷྫ $MPVE'SPOU 32 ஌ࣝ໘Ͱͷલఏ "1*ΞΫγϣϯͷૢ࡞ର৅ϦιʔεΛಛఆ͠ɺͦͷಛੑΛ೺Ѳ͢Δ { "Version":

    "2012-10-17", "Statement": [ { "Sid": "", "Action": [ "cloudfront:CreateInvalidation", "cloudfront:GetInvalidation", "cloudfront:ListDistributions", "cloudfront:ListInvalidations", "cloudfront:ListTagsForResource" ], "Effect": "Allow", "Resource": "*" } ] } ੲ͸ɺσΟετϦϏϡʔγϣϯ୯ҐͰ ੍ޚͰ͖ͳ͔ͬͨɻ ଞͷσΟετϦϏϡʔγϣϯͷΩϟογϡແޮԽ͕Մೳ $%/ͷΩϟογϡແޮԽΛߦ͏ͨΊͷΞΫγϣϯͷڐՄ ݱࡏ͸ arn:${Partition}:cloudfront::${Account}:distribution/${DistributionId} Ͱର৅ϦιʔεΛࢦఆͰ͖Δɻ $%/ͷΩϟογϡແޮԽͷૢ࡞ର৅Ϧιʔε͸ $MPVE'SPOUσΟετϦϏϡʔγϣϯ $MPVE'SPOUσΟετϦϏϡʔγϣϯͷಛੑ
  24. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84ͷ֤छϙϦγʔͷ஌ࣝ 33 ஌ࣝ໘Ͱͷલఏ "84ͷೝՄͰ࢖ΘΕΔϙϦγʔ͸*".͚ͩ͡Όͳ͍ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ *". ϦιʔεϕʔεͷϙϦγʔ

    0SHBOJ[BUJPOT ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ 4$1 44244/4ͳͲ ΞΫηείϯτϩʔϧϦετ "$- 4&$ͳͲ &$ 71$ΤϯυϙΠϯτϙϦγʔ 454 ηογϣϯϙϦγʔ
  25. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ"84ͷ֤छϙϦγʔͷ஌ࣝ 34 ஌ࣝ໘Ͱͷલఏ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ ΞΫηείϯτϩʔϧϦετ "$- 71$ΤϯυϙΠϯτϙϦγʔ

    ҉໧తͳڋ൱ σϑΥϧτ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ໌ࣔతͳڐՄ ϦιʔεϕʔεͷϙϦγʔ ΞΫηεڐՄͷڥք αʔϏείϯτϩʔϧϙϦγʔ 4$1 ηογϣϯϙϦγʔ ΞΠσϯςΟςΟϕʔεͷϙϦγʔ ϦιʔεϕʔεධՁ 424ΩϡʔϙϦγʔ 4/4τϐοΫϙϦγʔ 4όέοτϙϦγʔ "84ͷϙϦγʔධՁ࿦ཧ ໌ࣔతͳڋ൱͸࠷༏ઌͰద༻͞ΕΔ
  26. Operation Lab ӡ༻ઃܭϥϘ ஌ࣝ໘Ͱͷલఏ·ͱΊ 35 ஌ࣝ໘Ͱͷલఏ $-* ϓϩάϥϜίʔυ "84$-* "844%,

    "84 "1* ΦϖϨʔλʔ 383 APIs 15319 Actions ίϯϐϡʔςΟϯά Ϧιʔε "84$-*4%,Ͱ௚઀తʹ "84"1*ʹ਌͠ΜͰ͍Δ͜ͱ͕ෆՄܽ ࡞ۀʹඞཁͳΞΫγϣϯͷಛఆ ΞΫγϣϯͷૢ࡞ର৅Ϧιʔεͷಛఆ ૢ࡞ର৅Ϧιʔεͷಛੑͷ೺Ѳ ෳ਺ͷϙϦγʔΛ૊Έ߹Θͤͯʮ࠷খݖݶͷݪଇʯΛ࣮ફ͢Δ Ϛωδϝϯτίϯιʔϧ͔Βͷૢ࡞͔͠஌Βͳ͍ਓ͸ ʮ࠷খݖݶͷݪଇʯΛ࣮ફͰ͖ͳ͍ "84ϓϩϑΣογϣφϧͷᅂΈͱͯ͠ͷʮ࠷খݖݶͷݪଇʯΛ਎ʹ෇͚Α͏
  27. Operation Lab ӡ༻ઃܭϥϘ ࢀߟ*".ϙϦγʔͷ࢖͍෼͚ 37 *".ͷछྨͷϙϦγʔΛ࢖͍෼͚Δ ஌ࣝ໘Ͱͷલఏ ؅ཧϙϦγʔ ΠϯϥΠϯϙϦγʔ ෳ਺ͷ*".ΞΠσϯςΟςΟͰڞ༗Ͱ͖ΔϙϦγʔ

    ୯ಠͷ*".ΞΠσϯςΟςΟ಺෦Ͱอ༗͢ΔϙϦγʔ "84؅ཧϙϦγʔ ΧελϚʔ؅ཧϙϦγʔ "84͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͕؅ཧ͢ΔϙϦγʔ ར༻ऀ͸มߋͰ͖ͳ͍ɻ Ϧιʔε͕ ͳͷͰϦεΫߴ͍ɻ ຊ൪Ͱͷར༻ඇਪ঑ɻओʹݕূ༻ɻ ར༻ऀ͕มߋͰ͖Δɻ ڞ༗ར༻ͨ͠৔߹ɺӨڹൣғ͕େ͖͘ɺ ݖݶͷංେԽʹΑΓ࠷খݖݶͷݪଇʹ൓͢Δ͜ͱ΋͋Δɻ ར༻ऀ͕มߋͰ͖Δɻ ڞ༗Ͱ͖ͳ͍ͨΊɺ࠷খݖݶͷݪଇΛ९क͠΍͍͢ɻ هड़Ͱ͖Δจࣈ਺ʹ੍ݶ͕͋Δɻ
  28. Operation Lab ӡ༻ઃܭϥϘ ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ ྫ 39 ʮ࠷খݖݶͷݪଇʯ࣮ફ΁ͷϩʔυϚοϓ ೝূ໨తͷϩʔϧͱೝՄ໨తͷϩʔϧΛ෼͚Δ ೝՄ໨తͷϩʔϧͷݖݶΛɺ࡞ۀऀอޢɾࣄނ๷ࢭͷ؍఺Ͱ෼཭͍ͯ͘͠ɻ "84$-*Λ௨ͯ͡"84"1*ΞΫγϣϯʹ׳Ε਌͠ΜͰ͍͘ɻ

    εςοϓ εςοϓ εςοϓ ඇΠϯλϥΫςΟϒૢ࡞ͱΠϯλϥΫςΟϒૢ࡞ͷϩʔϧ෼཭ *".ݖݶͷ෇༩Λݫີʹ͢Δ *".؅ཧऀҎ֎ʹ͸ݪଇ෇༩͠ͳ͍  ओͳ࡞ۀ໨త $36% ʹΑΓϩʔϧΛ੾Γସ͑Δɻ