AWS WAFのログが3時間しか見れないのでなんとかしてみる

Ops JAWS #10

Transcript

1. AWS WAFͷϩά͕ 3͔࣌ؒ͠ݟΕͳ͍ͷͰ ͳΜͱ͔ͯ͠ΈΔ Ϋϥεϝιουגࣜձࣾ ιϦϡʔγϣϯΞʔΩςΫτ ৿Ӭେࢤ
2. ࣗݾ঺հ
3. ɹɹɹɹɹɹ৿Ӭ େࢤ(@morimoritaitai) AWSࣄۀ෦ ιϦϡʔγϣϯΞʔΩςΫτ ✦ झຯ : ήʔϜ / ञ / Χϝϥ ✦ ڵຯ : Security / OpsࣗಈԽ ✦ ޷͖:Config/CloudTrail/IAM/PHD ✦ ྘৭ͷαʔϏε͕޷͖ͳϑϨϯζ ✦ AWSೝఆࢿ֨5ף
4. ձࣾ঺հ
5. ϒϩάͷձࣾ
6. AWS WAF࢖ͬͯ·͔͢ʁ
7. AWS WAFͱ͸ • CloudFrontͱALBʹ࢓ࠐΊΔϚωʔδυWAF • IPΞυϨε੍ݶ/จࣈྻ੍ݶ/SQLΠϯδΣΫ γϣϯ/XSSରࡦͳͲجຊతͳWAFཁ݅͸ຬͨ ͤΔ • ͦΜͳʹෳࡶͳઃఆ͸ग़དྷͳ͍͚Ͳ؆қͳ WAF͕΄͍͠ͳΒ͘͢͝ศར
8. AWS WAFศརͳΜͰ͕͢ɺ 1఺͍͚ͨͩͳ͍͜ͱ͕…
9. Πϕϯτϩά͕3͔࣌ؒ͠ ݟΕͳ͍໰୊
10. ४ϦΞϧλΠϜͷ ΠϯγσϯτରԠͱߟ͑Ε͹ ෼͔Βͳ͘͸ͳ͍
11. Ͱ΋΍ͬͺΓΠϕϯτϩά͸ ޙ͔Β֬ೝͰ͖ΔΑ͏ʹ͍ͨ͠
12. ͳΜͱ͔ͯ͠ΈΔ
13. ߏ੒Λߟ͑Δ • AWS WAFͷΠϕϯτ͸CloudWatchͰݕ஌ • CloudWatchͷΞϥʔτΛSNSͰൃใ • SNSͰLambdaΛൃՐ • Lambda͕AWS WAFͷϩάΛऔಘ͠S3΁อଘ
14. ߏ੒ਤ ᶃ Πϕϯτൃੜ ᶄΞϥʔϜൃใ ᶅ SNS௨஌ ᶆ ϩάऔಘ ᶇ ϩάอ؅ WAF CloudWatch SNS Lambda S3
15. SNSτϐοΫ࡞੒
16. CloudWatchΞϥʔτ࡞੒ 1ͭͰ΋ϒϩοΫ͕͋Ε͹ SNSͰ௨஌
17. ϩάอ؅༻S3όέοτ࡞੒
18. Lambda༻IAMϩʔϧ࡞੒ • AmazonS3FullAccess • AWSWAFReadOnlyAccess • AWSLambdaBasicExecutionRole
19. LambdaϑΝϯΫγϣϯ࡞੒ • https://github.com/Tmorinaga/aws-waf-logger/blob/master/aws-waf-logger.py
20. LambdaϑΝϯΫγϣϯ࡞੒ SNSΛΠϕϯτιʔεʹ
21. LambdaϑΝϯΫγϣϯ࡞੒ ؀ڥม਺ͰS3όέοτ໊ࢦఆ ࡞੒ͨ͠IAM RoleΛࢦఆ
22. ࢼ͢ Α͋͘ΔSQLΠϯδΣΫγϣϯྫ
23. ࢼ͢ ϒϩοΫ͞Εͨ
24. 5෼ޙ
25. ࢼ͢ S3ʹϩά͕֨ೲ͞Εͨʂ͢͝ʔ͍ʂ
26. ஫ҙ఺ • AWS WAFଆͷ࢓༷ͰPOSTͷத਎͸ݟΕͳ͍ • ݟΕΔΑ͏ʹͳΓ·ͤΜ͔Ͷɻɻɻʁ • Sample Requests͸100͔݅͠औΕͳ͍ͷͰɺ Ұؾʹ100݅Ҏ্ͷ߈ܸ͕དྷΔͱऔಘ࿙ΕΔ
27. ࠷ޙʹ • ͍ͭެࣜରԠͯ͠΋͓͔͘͠ͳ͍ͷͰυΩυ Ω͠ͳ͕ΒίʔυΛॻ͍ͯ·ͨ͠ • POSTͷத਎Λه࿥͍ͨ͠…ʂ • ϓϧϦΫ͍ͩ͘͞ • https://github.com/Tmorinaga/aws-waf- logger/blob/master/aws-waf-logger.py
28. JAWS DAYS2017ʹొஃ͠·͢ • Security JAWSͷҰһͱͯ͠AWS Configʹ͍ͭͯ೤͘ޠΓ·͢ • ଞʹ΋Sec-JAWSϝϯόʔ͕ొஃͯ͠WAFʹ͍ͭͯ΋஻Γ·͢