AWSにおけるクラウドネイティブでセキュアな証券システムの運用 / aws-summit-tokyo-2019-l2-03-finatext

[AWS Summit Tokyo 2019][L2-03] AWSにおけるクラウドネイティブで セキュアな証券システムの運用の登壇資料です。

Transcript

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWSʹ͓͚ΔΫϥ΢υωΠςΟϒͰ ηΩϡΞͳূ݊γεςϜͷӡ༻ Satoshi Tajima Twitter: @s_tajima Lead Developer Finatext Holdings Ltd. L 2 - 0 3 Atsushi Ishibashi Twitter: @bashi0501 Lead Developer Finatext Holdings Ltd.
5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T 1. STREAMͷγεςϜ 2. Ϋϥ΢υωΠςΟϒͱθϩτϥετͷ࣮ફ • Opsαʔό • ೝূ • ঝೝ • ηΩϡϦςΟϞχλϦϯά 3. ࠓޙͷల๬ Agenda
6. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. STREAMͷγεςϜ
7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͢΂ͯͷγεςϜ͕ ΞϚκϯ ΢Σϒ αʔϏε(AWS) ্ͰՔಇ • ढ़හੑͷ͋ΔαʔόϦιʔεௐୡ͕Մೳ • ਺ΫϦοΫ or ਺ίϚϯυͰ৽͍͠αʔόϦιʔε͕ར༻Մೳʹ • ࣄۀͷঢ়گ͕೔ʑେ͖͘มԽ͢Δϕϯνϟʔاۀʹͱͬͯ͜ͷढ़හੑ͸ෆՄܽ • αʔόϦιʔεͷಈతͳ૿ݮ͕Մೳ • ূ݊γεςϜ͸βϥ৔தͱβϥ৔֎ͰγεςϜͷෛՙ͕େ͖͘มಈ͢Δ • βϥ৔֎Ͱ͸ෆཁͳαʔόϦιʔεΛఀࢭ͢Δ͜ͱͰίετ࡟ݮ͕Մೳ • ӡ༻ෛ୲ܰݮͱੜ࢈ੑͷ޲্͕Մೳ • ੹೚ڞ༗Ϟσϧ΍ɺଟ͘ͷϚωʔδυαʔϏεʹΑΓɺγεςϜͷӡ༻ෛՙ͕ܰݮ • ϏδωεͷίΞͳ෦෼ͷ։ൃʹ஫ྗͰ͖Δ STREAMͷγεςϜ
8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • FISCʹΑΔʮ҆શରࡦج४ɾղઆॻʯʹैͬͨγεςϜ • ਖ਼ࣜʹ͸ʮۚ༥ػؔ౳ίϯϐϡʔλγεςϜͷ҆શରࡦج४ɾղઆॻʯ • ۚ༥ػؔ౳ͷ৘ใγεςϜͷ҆શରࡦʹؔ͢ΔσϑΝΫτελϯμʔυ • ࠷৽ͷୈ9൛ʹ͓͍ͯ͸ɺϦεΫϕʔεΞϓϩʔνΛऔΓೖΕΔ͜ͱΛਪ঑͍ͯ͠Δ • શͯͷϦεΫΛθϩʹ͢Δͷ͸ඞͣ͠΋߹ཧతͰ͸ͳ͘ɺ
 ঢ়گʹ߹Θͤͯద੾ͳରԠΛߟ͑·͠ΐ͏ͱ͍͏΋ͷ • ͋Β͔͡ΊఆΊΒΕͨըҰతͳ΍Γํʹै͍ͬͯΔ͚ͩͰ͍͍Θ͚Ͱ͸ͳ͘ɺ
 ࣗΒͷ؀ڥʹͱͬͯద੾ͳITΨόφϯεΛݕ౼͢Δඞཁ͕͋Δ STREAMͷγεςϜ
9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • AWS্Ͱͷద੾ͳITΨόφϯε • AWS FinTech ϦϑΝϨϯεɾΞʔΩςΫνϟʔ 
 (https://aws.amazon.com/jp/blogs/news/aws-fintech-architecture-jp/) Λࢀߟʹ • Ϋϥ΢υωΠςΟϒ΍θϩτϥετͷߟ͑ํΛऔΓೖΕΔ͜ͱͰ
 ࣗΒͷ؀ڥʹͱͬͯద੾ Ͱ ϦεΫϕʔεΞϓϩʔν ͳγεςϜΛߏங STREAMͷγεςϜ
10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒ • ΦϯϓϨϛε؀ڥΛલఏͱͨ͠ैདྷͷγεςϜߏஙͷํ๏࿦ʹറΒΕͣɺΫϥ΢υͷಛੑΛे ෼ʹ׆͔ͨ͠γεςϜΛߏங͢Δ͜ͱ • ୯ʹΫϥ΢υΛ࢖͍ͬͯΔ͚ͩͷঢ়گΛࢦ͢Θ͚Ͱ͸ͳ͍
 • θϩτϥετ • ڴҖ͸͍͔ͳΔ৔ॴʹ΋ଘࡏ͠ɺ͢΂ͯͷ؀ڥ͸߈ܸɾ৵֐͞Ε͏Δͱ͍͏લఏʹཱͭ • ରࡦʹ࢖͑ΔϦιʔε͸༗ݶͰ͋Δ͜ͱΛೝΊɺ͋ΒΏΔڴҖʹ׬શͳରࡦΛߦ͏ͷͰ͸ͳ ͘ɺඅ༻ରޮՌΛҙࣝͨ͠ࢪࡦΛ࣮ࢪ͢΂͖ STREAMͷγεςϜ
11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒ × θϩτϥετ • ʮϦιʔεΛ࢖͍ࣺͯʹͯ͠ఆظతʹ࠶ߏங͠ɺ؀ڥΛΫϦʔϯʹอͭʯ • ʮݖݶΛಈతʹ෇༩͠ɺΫϨσϯγϟϧ͸୹ظؒͰࣦޮͤ͞Δʯ • ʮϚωʔδυαʔϏεΛੵۃతʹ࢖͍ɺඅ༻ରޮՌͷߴ͍ηΩϡϦςΟࢪࡦΛ࣮ࢪ͢Δʯ STREAMͷγεςϜ
12. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Ϋϥ΢υωΠςΟϒͱ θϩτϥετͷ࣮ફ
13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Opsαʔό
14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Opsαʔό (Operationsαʔό) ͱ͸ • ຊ൪؀ڥʹର͢ΔΦϖϨʔγϣϯΛ͢ΔͨΊͷαʔό • Ұൠతʹ͸ɺ౿Έ୆αʔόɾήʔτ΢ΣΠαʔό౳ͱݺ͹ΕΔ͜ͱ͕ଟ͍ • ͳͥඞཁ͔ • ϓϥΠϕʔτͳωοτϫʔΫ಺ͷϦιʔε΁ͷΞΫηεͷதܧ • ෺ཧతͳฆࣦ΍౪೉ͷϦεΫͷߴ͍୺຤ʹॏཁͳσʔλΛ࢒͞ͳ͍ͨΊ • ॏཁͳσʔλͷऔΓѻ͍Λޮ཰తʹ؂ࠪ͢ΔͨΊ • ୭Ͱ΋؆୯ʹར༻Ͱ͖ΔωοτϫʔΫճઢ͔ΒॏཁͳσʔλʹΞΫηεͤ͞ͳ͍ͨΊ • ෳ਺ͷ࡞ۀऀͷ؀ڥΛ౷Ұ͢ΔͨΊ Opsαʔό
15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • ʮৗઃʯͰʮڞ༗ʯͷOpsαʔό Opsαʔό
16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ʮৗઃʯ • ຊ൪؀ڥ΁ͷܦ࿏͕ৗʹ͍͍͋ͯΔঢ়ଶ • Ұ౓Ϛϧ΢ΣΞʹײછͯ͠͠·͏ͱɺ௕ظؒͦͷ··ʹͳͬͯ͠·͏ • Ϛγϯ্ʹॏཁͳσʔλ͕஝ੵͯ͠͠·͏ • ʮڞ༗ʯ • ΞΫηεͰ͖ΔϦιʔεΛ࡞ۀऀຖʹ੍ݶ͢Δͷ͕೉͍͠ • ଞͷ࡞ۀऀͷσʔλʹΞΫηεͰ͖ͯ͠·͏/͞Εͯ͠·͏ (ݖݶઃఆͷෆඋ/ݖݶঢ֨) Opsαʔό
17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ʮ࢖͍ࣺͯʯͰʮઐ༻ʯͷOpsαʔό Opsαʔό
18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMʹ͓͚Δӡ༻ • Opsαʔόઐ༻ͷAWSΞΧ΢ϯτΛ༻ҙ • ຊ൪؀ڥͷVPCͱVPC PeeringͰ࿈ܞ • ࡞ۀऀݸਓຖʹ1୆ͷEC2ΠϯελϯεΛOpsαʔόͱׂͯ͠Γ౰ͯ • Opsαʔό͸ඞཁͳͱ͖ʹࣗ෼ࣗ਎Ͱىಈ͢Δ • Security GroupͱIAMͷInstance Profile΋ɺ࡞ۀऀຖʹݸผʹ࡞੒ • ىಈ࣌ͷΠϯελϯεઃఆ͸ Launch Template ʹΑ੍ͬͯݶ (ଞਓ༻ͷઃఆͰͷىಈΛ๷͙) • ࢖༻ޙʹ͸ຖճλʔϛωʔτ͞ΕΔ Opsαʔό
19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Launch Templateͱ͸ • EC2ΠϯελϯεΛىಈ͢ΔͨΊͷઃఆ৘ใͷςϯϓϨʔτ • AMI ID, ΠϯελϯελΠϓ, ωοτϫʔΫઃఆ౳Λࢦఆ͢Δ͜ͱ͕Ͱ͖Δ • IAMͷConditionΛࢦఆ͢Δ͜ͱͰɺ
 ʮࢦఆͷLaunch TemplateΛ࢖ͬͨ৔߹ͷΈΠϯελϯεͷىಈΛڐՄʯ
 ͱ੍͍ͬͨݶ͕Ͱ͖Δ Opsαʔό
20. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • ಛఆͷLaunch Templateࢦఆ࣌ͷΈRunInstanceͰ͖ΔIAM Policy { "Effect": "Allow", "Action": [ "ec2:RunInstances" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:LaunchTemplate": “<Launch TemplateͷARN>" }, "Bool": { "ec2:IsLaunchTemplateResource": "true"} } } Opsαʔό
21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ʮ࢖͍ࣺͯʯ • ຊ൪؀ڥ΁ͷܦ࿏͕ඞཁͳͱ͖Ҏ֎͸ด͍ͯ͡Δঢ়ଶ • Ϛϧ΢ΣΞʹײછͯ͠͠·ͬͯ΋͙͢ʹࣺͯΒΕΔͷͰӨڹ͕খ͍͞ • ॏཁͳσʔλ͕Ϛγϯ্ʹ஝ੵͯ͠͠·͏͜ͱΛ๷͙ • ʮઐ༻ʯ • ΞΫηεͰ͖ΔϦιʔεΛ࡞ۀऀຖʹ੍ݶ͢Δ͜ͱ͕Ͱ͖Δ • ଞͷ࡞ۀऀͷσʔλʹΞΫηεͰ͖Δ/͞Εͯ͠·͏ϦεΫ͕ͳ͍ Opsαʔό
22. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ೝূ
23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ೝূͱ͸ • γεςϜͷར༻ऀ͕ɺҙਤͨ͠௨Γͷຊਓͩͱ͔֬ΊΔ͜ͱ • ࠓճ͸ओʹOpsαʔό΁ͷSSHΞΫηε࣌ͷೝূʹ͍ͭͯ ೝূ
24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇθϩτϥετͳख๏ͷྫ • ެ։伴ೝূ • ΫϥΠΞϯτ͕ੜ੒ͨ͠ΩʔϖΞͷ͏ͪɺެ։伴Λαʔόʹొ࿥͓ͯ͘͠ • ΫϥΠΞϯτ͸ൿີ伴Λ࢖ͬͯαʔόʹ઀ଓ͢Δ ೝূ
25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ΫϥΠΞϯτ͕อ࣋͢Δൿີ伴ͷ؅ཧ͕೉͍͠ • αʔό͕૿͑Δͱൿີ伴΋૿͑Δ • ిࢠతͳ౪೉ (·ͨɺ౪·Εͯ΋ؾ෇͖ʹ͍͘) • ҙਤ͠ͳ͍ڞ༗΍࢖͍ճ͠ • ୀ৬ऀʹΑΔ࣋ͪग़͠ • αʔόʹઃఆ͢Δެ։伴 (authorized_keys) ͷ؅ཧ͕໘౗ • ΫϥΠΞϯτ͕૿͑Δͱެ։伴΋૿͑Δ • ϝϯόʔୀ৬࣌ʹେྔͷαʔόͷઃఆΛߋ৽͢Δඞཁ ೝূ
26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • θϩτϥετͳख๏ • SSHΫϥΠΞϯτূ໌ॻೝূ • X.509ͷPKIʹΑΔূ໌ॻΛSSHͷೝূʹར༻͢Δ (RFC6187) • ূ໌ॻൃߦ༻ͷCA(ೝূہ)Λ༻ҙ͢Δ (Ұൠతʹ͸ϓϥΠϕʔτͳCAΛ༻ҙ͢Δ) • αʔόʹ͸CAͷূ໌ॻ(ެ։伴) Λొ࿥͓ͯ͘͠ • CA͔ΒΫϥΠΞϯτূ໌ॻΛൃߦ͢Δ (ͦͷࡍʹద੾ͳೝূΛڬΉ) • ΫϥΠΞϯτূ໌ॻʹ͸ɺ༗ޮظݶΛࢦఆ͢Δ͜ͱ͕Ͱ͖Δ • ΫϥΠΞϯτ͸ɺΫϥΠΞϯτূ໌ॻΛར༻ͯ͠αʔόʹ઀ଓ͢Δ ೝূ
27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • θϩτϥετͳख๏ͷߏ੒ਤ ೝূ
28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • Pritunl Zero (https://zero.pritunl.com/) Λ࢖͏ • Pritunl Zero͕ɺCAͱΫϥΠΞϯτূ໌ॻൃߦ࣌ͷೝূͱϢʔβ؅ཧΛ୲͏ • ΫϥΠΞϯτূ໌ॻͷൃߦ͸ɺύεϫʔυ + U2F ʹΑͬͯೝূ • U2F༻ͷσόΠε͸YubiKeyΛ࢖༻ • ΫϥΠΞϯτূ໌ॻ͸ɺ1࣌ؒͰࣦޮ͢Δઃఆ ೝূ
29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Pritunl Zeroͱ͸ • θϩτϥετͳγεςϜΛߏங͢ΔͨΊͷOSS • ओʹҎԼͷ2ͭͷػೳ͕ར༻Ͱ͖Δ • WebαʔϏε༻ͷProxy • SSH ূ໌ॻ༻ͷCA (ࠓճ͸ͪ͜ΒͷػೳΛར༻) • Proxy΁ͷΞΫηε΍ূ໌ॻͷൃߦʹɺೝূΛڬΉ͜ͱ͕Ͱ͖Δ • ೝূ༻ͷΞΧ΢ϯτ͸ɺϩʔΧϧϢʔβ΋͘͠͸֤छΫϥ΢υαʔϏεͷSSO͕ར༻Մೳ • U2F΍Smart CardʹΑΔ2ཁૉೝূʹ΋ରԠ ೝূ
30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • U2F (Universal 2nd Factor) ͱ͸ • 2ཁૉೝূΛڧݻʹ͠ɺ͔ͭ؆୯ʹ͢ΔͨΊͷඪ४࢓༷ • 2ཁૉ໨ͷೝূʹɺUSBσόΠε΍NFCσόΠεͱ͍ͬͨ෺ཧσόΠεΛ༻͍Δ͜ͱ͕Ͱ͖Δ • U2FͷUSBσόΠεͱͯ͠͸YubiKey͕༗໊ • YubiKeyͷ৔߹͸ɺೝূ࣌ʹσόΠεΛ෺ཧతʹλον͢Δ͜ͱͰೝূ͕ߦ͑Δ • ࠓͩͱޙܧͷ FIDO 2.0 ͱ͍͏࢓༷΋ग़͖͍ͯͯΔ ೝূ
31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ͷߏ੒ਤ ೝূ
32. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. σϞಈը (ެ։ͷͨΊʹը૾ʹࠩ͠ସ͑)
41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ΫϥΠΞϯτূ໌ॻ͸ɺిࢠతʹ౪೉͞Εͯ΋ɺҙਤ͠ͳ͍ڞ༗΍࢖͍ճ͠Λ͞Εͯ΋ɺ
 ୀ৬ऀʹ࣋ͪग़͞Εͯ΋ɺҰఆظؒͰࣦޮ͢ΔͷͰӨڹ͕গͳ͍ • αʔόʹ͸ɺCAͷެ։伴Λ഑ஔ͢Δ͚ͩͰΑ͍ • ύεϫʔυ͸ɺύεϫʔυϚωʔδϟΛ࢖͏͜ͱͰൿີ伴ΑΓ΋؅ཧָ͕ʹͳΔ • U2FʹΑͬͯɺೝূΛ௨ͨ͢Ίʹ͸෺ཧσόΠε(ͭ·ΓYubiKey)͕ඞཁͰ͋ΓɺΦϯϥΠϯͷ ߈ܸ͚ͩ͸ෆਖ਼ΞΫηε͢Δ͜ͱ͕Ͱ͖ͳ͍ • ΋͠΋෺ཧσόΠε͕෺ཧతʹ౪·Εͨ৔߹͸ɺൺֱత͙͢ʹؾͮ͘͜ͱ͕Ͱ͖Δ ೝূ
42. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ঝೝ
43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ঝೝͱ͸ • ઃఆมߋ࡞ۀͷ಺༰͕ਖ਼౰Ͱ͋Δ͜ͱΛ͔֬Ίͯɺ࣮ࢪΛೝΊͯڐՄ͢Δ͜ͱ • ͳͥඞཁ͔ • ͋Δ࡞ۀʹରͯ͠ผͷਓ͕ϨϏϡʔΛ͢Δ͜ͱͰෆద੾ͳมߋ͕ߦΘͳ͍Α͏ʹ͢ΔͨΊ • Ұਓͷ࡞ۀऀ͕ѱҙΛ࣋ͬͨ৔߹ʹɺ୯ಠͰຊ൪؀ڥ΁ͷӨڹΛ༩͑ΒΕͳ͍Α͏ʹ͢ΔͨΊ • Ծʹ୭͔Ұਓͷ࡞ۀऀͷೝূ৘ใ͕౪·Εͨ৔߹ʹɺຊ൪؀ڥ΁ͷӨڹΛ๷͙ͨΊ ঝೝ
44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • ࡞ۀऀ͕ɺࣄલʹ࡞ۀͷ಺༰ΛจষͰهड़͠ɺਃ੥Λߦ͏ • ঝೝऀ͕ɺਃ੥͞Εͨ࡞ۀ಺༰ʹج͖ͮɺ࡞ۀ༻ͷ؀ڥ४උ(ΞΧ΢ϯτͷൃߦ౳)ΛखಈͰߦ ͏ • ͜ͷख๏ͷ໰୊఺ • ঝೝऀ͕ɺखಈͰ࡞ۀ༻ͷ؀ڥΛ༻ҙ͍ͯ͠ΔͨΊɺঝೝ·Ͱʹ༨ܭͳ͕͔͔࣌ؒΔ • ਃ੥͞Εͨ࡞ۀҎ֎ͷૢ࡞͕ߦΘΕͳ͍͜ͱΛอূ͢Δͷ͕೉͍͠ • ਃ੥௨Γͷ࡞ۀ͕ͳ͞Εͨ͜ͱΛอূ͢Δ͜ͱ͕೉͍͠ • ۓٸ࣌ʹ͸ɺීஈͲ͓ΓͷঝೝϑϩʔΛεΩοϓͯ͠࡞ۀͯ͠͠·͍͕ͪʹͳΔ ঝೝ
45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ࣗಈԽ͞ΕͨঝೝϑϩʔΛ࣮ݱ͢Δ • ࡞ۀʹඞཁͳ࠷খݶͷݖݶ΍௨৴ڐՄΛɺΦϯσϚϯυʹ෇༩͢Δ ঝೝ
46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • ChatOpsʹΑͬͯঝೝϑϩʔΛ࣮ݱ͢Δ • ਃ੥ऀ͸ɺSlackΛ࢖ͬͯ࡞ۀ಺༰ͷਃ੥Λߦ͏ • ਃ੥ͷ಺༰ʹɺඞཁͳIAMͷݖݶ΍ɺ௨৴ઌͷ৘ใΛهड़͢Δ • ঝೝऀ͸ɺSlack্Ͱ಺༰Λ֬ೝ͠ɺਃ੥಺༰͕ద੾Ͱ͋Ε͹ঝೝ͢Δ • ঝೝͷ಺༰Λ΋ͱʹɺݖݶͷ෇༩ͱ௨৴ͷڐՄΛΞϓϦέʔγϣϯ͕ࣗಈͰߦ͏ • ࡞ۀͷऴྃ࣌ʹɺ෇༩͞Εͨݖݶͱ௨৴ͷڐՄͷࣗಈ࡟আΛߦ͏ ঝೝ
47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T ঝೝ • STREAMͰͷӡ༻ͷߏ੒ਤ
48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ࣗಈԽʹΑΓɺঝೝͷӡ༻ͷ࣌ؒͱख͕ؒ࡟ݮ͞ΕΔ • ӡ༻ͷख͕ؒখ͍͞ͷͰɺۓٸ࣌ʹྫ֎ӡ༻Λ͢Δ͜ͱͳ͘ରԠ͕ՄೳͱͳΔ • ࡞ۀʹඞཁͳ࠷খݶͷݖݶͱ௨৴ڐՄʹ੍ݶ͢Δ͜ͱͰɺ
 ਃ੥͞Εͨ࡞ۀҎ֎ͷૢ࡞͕ߦΘΕΔϦεΫΛ࠷খԽͰ͖Δ • ఆظతʹࣗಈ࡟আΛ͢Δ͜ͱͰෆඞཁͳݖݶ΍௨৴ڐՄ͕࢒ͬͯ͠·͏͜ͱΛ๷͙ • ঝೝ͕νϟοτͷՄࢹԽ͞Εͨ؀ڥͰߦΘΕΔͨΊɺۓٸ࣌ʹ΋ॊೈͳରԠ͕ূ੻Λ࢒্ͨ͠ ͰՄೳͱͳΔ ঝೝ
49. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ηΩϡϦςΟϞχλϦϯά
50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ηΩϡϦςΟϞχλϦϯάͱ͸ • ෆਖ਼ΞΫηεΛൃݟ͢ΔͨΊɺෆ৹ͳΞΫςΟϏςΟΛ؂ࢹ͢Δ͜ͱ • ͢΂ͯͷϦεΫΛࣄલʹ೺Ѳ͠༧๷͢Δ͜ͱ͸Ͱ͖ͳ͍ͱ͍͏ߟ͑ʹجͮ͘ ηΩϡϦςΟϞχλϦϯά
51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷྫ • αʔό΍ωοτϫʔΫػثͷϩάΛɺಉҰσʔληϯλ಺ͷू໿αʔόʹసૹ • ू໿αʔό্ʹ؂ࢹϓϩάϥϜΛσϓϩΠ • ҰఆִؒͰ؂ࢹϓϩάϥϜΛ࣮ߦͯ͠ෆ৹ͳΞΫςΟϏςΟ͕ͳ͍͔ΛνΣοΫ • ΞυϗοΫͳௐࠪ΍෼ੳ͸ɺू໿αʔό্ͷϩάʹରͯ͠awk΍grep౳ͷίϚϯυΛ࣮ߦ ηΩϡϦςΟϞχλϦϯά
52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ඇΫϥ΢υωΠςΟϒͳख๏ͷΠϝʔδ ηΩϡϦςΟϞχλϦϯά
53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷख๏ͷ໰୊఺ • ؂ࢹ͕ਖ਼͘͠Քಇ͍ͯ͠Δ͜ͱΛอূ͢ΔͨΊͷଟ͘ͷखؒ • ग़ྗͷఀࢭͷݕ஌ • ϩάͷվ͟Μͷݕ஌ • ؂ࢹϓϩάϥϜͷվ͟Μͷݕ஌ • ෆ৹ͳΞΫςΟϏςΟͷݕ஌·Ͱͷ͕࣌ؒ௕Ҿ͖͗ͯ͢͠·͏ • grep΍awkͰϩάͷߴ౓ͳௐࠪ΍෼ੳΛ͢Δͷ͸େม ηΩϡϦςΟϞχλϦϯά
54. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • Ϋϥ΢υωΠςΟϒͳख๏ • ϩάΛΫϥ΢υετϨʔδʹอଘ • ؂ࢹϓϩάϥϜΛ “Function as a Service” ͳ؀ڥʹσϓϩΠ • ΠϕϯτυϦϒϯͰͷ؂ࢹ ηΩϡϦςΟϞχλϦϯά
55. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ • ϩάอଘઐ༻ͷAWSΞΧ΢ϯτΛ༻ҙ • ͜ͷAWSΞΧ΢ϯτͷIAMͷݖݶ͸ɺଞͷAWSΞΧ΢ϯτΑΓ΋ݫ͘͠؅ཧ • ֤छϩάΛɺΫϩεΞΧ΢ϯτΞΫηεͰอଘ • S3্ͷϩά͸ɺ S3 Object LockʹΑΓ࡟আ΍্ॻ͖ΛෆՄೳʹ • ϩά؂ࢹ༻ͷϓϩάϥϜΛLambda Functionͱͯ͠σϓϩΠ • CodeSha256Λ࢖ͬͯվ͟ΜΛ֬ೝ • CloudTrail ΍ AWS Config ͷ௨஌ΛSNSͰड৴ͯ͠ɺ؂ࢹ༻ͷϓϩάϥϜΛ࣮ߦ • S3 Bucketͷϩάʹରͯ͠ΫΤϦΛ͔͚ΔͨΊͷAthenaͷςʔϒϧΛ༻ҙ ηΩϡϦςΟϞχλϦϯά
56. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • S3 Object Lock ͱ͸ • ࢦఆͨ͠อ࣋ظؒதɺS3ͷΦϒδΣΫτ͕࡟আ͞Εͳ͍Α͏ʹ͢Δػೳ • ͍ΘΏΔ WORM (Write Once Read Many) ͳετϨʔδͱͯ͠S3Λར༻Ͱ͖Δ • ٻΊΒΕΔσʔλͷอޢͷϨϕϧʹԠͯ͡2ͭͷϞʔυ͕ར༻Մೳ • ΨόφϯεϞʔυ • ϧʔτΞΧ΢ϯτ౳ɺݖݶ͕͋Ε͹Object LockࣗମΛղআ͢Δ͜ͱ͕Մೳ • ΑͬͯΦϒδΣΫτΛ࡟আ͢Δ͜ͱ͕Մೳ • ίϯϓϥΠΞϯεϞʔυ: • ͍͔ͳΔϢʔβ΋Object Lockͷղআ͸ෆՄೳ • ΑͬͯઈରʹΦϒδΣΫτ͸࡟আ͢Δ͜ͱ͕Ͱ͖ͳ͍ ηΩϡϦςΟϞχλϦϯά
57. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • CodeSha256 ͱ͸ • Lambda Functionʹొ࿥͞ΕͨίʔυͷSHA256ͷϋογϡ஋ • खݩͷਖ਼͍͠ίʔυͱൺֱ͢Δ͜ͱͰɺվ͟ΜΛݕ஌Ͱ͖Δ $ aws lambda list-functions \ —query "Functions[*].[FunctionName,CodeSha256,LastModified]" \ —output table ------------------------------------------------------------------------------------------------------- | ListFunctions | +-----------------------+----------------------------------------------+------------------------------+ | root-activity-monitor | mVlZR3E2rvLT0ALp8WyUo8bmbV/6qx1t2Dow9hmkLII= | 2019-05-04T15:51:38.210+0000 | | aws-config-monitor | CSi58x6MPRtSJPwtG/m70rsY6ybrXXadGqCcj51/+PU= | 2019-05-10T06:58:02.772+0000 | +-----------------------+----------------------------------------------+------------------------------+ $ shasum -a 256 root-activity-monitor.zip | awk '{print $1}' | xxd -r -p | base64 mVlZR3E2rvLT0ALp8WyUo8bmbV/6qx1t2Dow9hmkLII= ηΩϡϦςΟϞχλϦϯά
58. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • STREAMͰͷӡ༻ͷߏ੒ਤ ηΩϡϦςΟϞχλϦϯά
59. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • ͜ͷӡ༻ͷϝϦοτ • ϩάͷվ͟Μ΍࡟আΛ๷͙͜ͱ͕؆୯ • IAMͷݖݶͷ؅ཧ΍S3 Object LockʹΑΔԸܙ • ؂ࢹϓϩάϥϜͷվ͟ΜΛݕ஌͢Δ͜ͱ͕؆୯ • CodeSha256ʹΑΔԸܙ • ϋʔυ΢ΣΞ΍OS΍ϥϯλΠϜͷϨΠϠʔͷվ͟Μ͸ࣗ෼͕ͨͪέΞ͠ͳͯ͘Α͍ • ෆਖ਼ΞΫηεΛૣظʹൃݟͰ͖Δ͜ͱ͕ظ଴͞ΕΔ • AthenaʹΑͬͯɺෳࡶͳௐࠪ΍෼ੳ΋؆୯ʹ࣮ࢪͰ͖Δ ηΩϡϦςΟϞχλϦϯά
60. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. ࠓޙͷల๬
61. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T • OpsαʔόͷϢʔβϏϦςΟ޲্ • ݱࡏ͸ɺOpsαʔόͷىಈ͔Βຊ൪؀ڥ΁ͷΞΫηε·Ͱͷ࡞ۀऀͷεςοϓ਺͕গ͠ଟ͍ • ΋͏গ͠γʔϜϨεʹ࢖͑ΔΑ͏ͳ࢓૊ΈΛ༻ҙ͍ͨ͠ • ۓٸ࣌ͷରԠͷεϐʔυΞοϓ • ࡞ۀऀͷମݧΛ޲্ • Pritunl ZeroͷWebαʔϏε༻Proxyͷར༻ • STREAMʹ͸ɺγεςϜͷߏ੒্ෳ਺ͷ͞·͟·ͳ؅ཧը໘͕ଘࡏ͢Δ • ͦΕΒͷ؅ཧը໘ͷΞΫηείϯτϩʔϧͷϕʔεϥΠϯ͕Ҿ্͖͛ΒΕΔ ࠓޙͷల๬
62. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Atsushi Ishibashi Twitter: @bashi0501 Satoshi Tajima Twitter: @s_tajima