IAMの地味なUpdateをご紹介_掲載用.pdf

Transcript

1. Ops JAWS Meetup#17 re:Invent2019 Recap IAMͷ஍ຯͳUpdateΛ͝঺հ
2. ࠓ೥΋໨ΛҾͨ͘͘͞Μͷൃද͕͋Γ·ͨ͠ w&,4͕͍ͭʹ'BSHFUFରԠʂ
   
   
   
   
   
   
   IUUQTBXTBNB[PODPNKQCMPHTOFXTBNB[POFLTPOBXTGBSHBUFOPXHFOFSBMMZBWBJMBCMF
   w%FFQγϦʔζͱͯ͠%FFQ
   $PNQPTFS͕஥ؒೖΓʂ
   
   
   
   
   
   IUUQTBXTBNB[PODPNKQEFFQDPNQPTFS
   w"*ܥαʔϏεͷ6QEBUF͕໨നԡ͠ʂ
   
3. ओཁαʔϏεͷ঺հ͸ଞͷํʹ͓೚ͤͯ͠ɺ
   ࢲ͔Β͸஍ຯͳ6QEBUFΛҰ͚ͭͩ͝঺հ͠·͢
4. ͝঺հ͢Δ6QEBUF *".ϩʔϧೝূ৘ใͷ࠷ऴ࢖༻೔͕࣌
   औಘͰ͖ΔΑ͏ʹͳΓ·ͨ͠ʂʂ
   https://aws.amazon.com/jp/about-aws/whats-new/2019/11/identify-unused-iam-roles-easily-and-remove-them-confidently-by-using-the-last-used-timestamp/
5. Ϛωδϝϯτίϯιʔϧ
6. 
   BXT
   JBN
   HFUSPMF
   SPMFOBNF
   UFTUSPMF
   \
   
   
   
   
   3PMF
   \
   ɾ
   ɾ
   ɾ
   
   
   
   
   
   
   3PMF-BTU6TFE
   \
   
   
   
   
   
   
   
   
   
   
   -BTU6TFE%BUF5YYYYYY;
   
   
   
   
   
   
   
   
   
   
   3FHJPO
   BQOPSUIFBTU $-*
7. ஍ຯ͗͢ΔΞοϓσʔτ wϖʔδʹٴͿ#MBDL
   #FMUࢿྉʹ ͸هࡌແ͠
   w"84+ُా͞ΜͷϒϩάͰ͸ߦ͚ͩ ঺հ
8. ࠷ऴ࢖༻೔͕࣌औಘͰ͖ΔͱͲ͏͍͏৔໘Ͱ
   ϋοϐʔʹͳΕΔ͔આ໌͍͖ͯ͠·͢
9. ͪΐͬͱ࣭໰ Έͳ͞Μ*".࢖ͬͯ·͔͢ʁ
10. "84࢖ͬͯΔ
    㲈
    *".࢖ͬͯΔ "84Λ࢖༻͢Δ্Ͱɺ*".͸΄΅ඞਢ
11. *".͓͞Β͍ *". "84
    *EFOUJUZ
    BOE
    .BOBHFNFOU
    "84ར༻ʹؔ͢ΔೝূೝՄΛ࢘ΔαʔϏε
    w*".Ϣʔβ
    ‣ "84αʔϏε΁ͷΞΫηεΛߦ͏ݸਓɺγεςϜ͕ར༻͢Δ
    w*".άϧʔϓ
    ‣ ಉҰ໾ׂΛ࣋ͭ*".ϢʔβΛάϧʔϓԽ͢Δ
    w*".ϩʔϧɹɹˡࠓ೔ͷϝΠϯ
    ‣ "84αʔϏεʹରͯ͠"84αʔϏε΁ͷૢ࡞ݖݶΛ༩͑Δ
    w*".ϙϦγʔ
    ‣ "84αʔϏε΁ͷΞΫηεݖݶΛ·ͱΊͨ΋ͷ
12. *".ϩʔϧ͸૿৩͕ͪ͠ wϦιʔεϨϕϧͰ෇༩͢ΔݖݶΛ෼͚Α͏ͱ͢ΔͱϦιʔε਺෼*".ϩʔ ϧ͕ඞཁʹͳΔ
    wϚωδϝϯτίϯιʔϧ͔ΒͷϦιʔε࡞੒࣌ʹϙϦγʔΛΑ͠ͳʹ෇༩ ͨ͠*".ϩʔϧΛ࡞੒ͯ͘͠ΕΔ͜ͱ͕͋Δ
13. ະ࢖༻ͷ*".ϩʔϧ࢒Γ΍͍͢໰୊ wϦιʔε࡟আ࣌͸Ұॹʹ࡟আͯ͘͠Εͳ͍
    w*".ϩʔϧࣗମʹ͸՝͕ۚൃੜ͠ͳ͍ͷͰɺ
 ҙࣝతʹ࡟আ͠Α͏ͱͳΓʹ͍͘
    w୨Է͠͠Α͏ʹ΋ɺؔ܎֤ॴ͕ଟ͗͢Δͱɺ
 ͍͍ͪͪώΞϦϯάͯ͠ΒΕͳ͍
14. ະ࢖༻ͷ*".ϩʔϧ͕͋Δͱμϝʁ w؅ཧෛՙ͕૿͑Δ
    wҙਤ͠ͳ͍"84αʔϏεʹؔ࿈͚ͮΒΕΔϦεΫ͕૿͑Δ
15. ະ࢖༻ͷ*".ϩʔϧ͸
    ͪΌΜͱແޮԽPS࡟আ͠·͠ΐ͏ʂ
16. ະ࢖༻ͷ*".ϩʔϧΛݟ͚ͭΔ ࠷ऴ࢖༻೔͔࣌Β
    Ұఆظؒܦա͍ͯ͠Δ*".ϩʔϧΛະ࢖༻ͱΈͳ͢
17. ୨Էࣗ͠ಈԽ खಈ୨Է͠͸৭ʑͱ൵͠Έ͕ଟ͍ͷͰ
    "84
    $POpH
    3VMFTΛ࢖ͬͯࣗಈԽ͠Α͏ʂ
18. "84
    $POpH
    3VMFT͓͞Β͍ w"84
    $POpH
    3VMFT
    ‣"84αʔϏε͕ɺఆٛͨ͠ઃఆঢ়ଶͱͳ͍ͬͯΔ͔ΛධՁ
    ‣"84͕ఏڙ͢ΔϚωʔδυϧʔϧͱϢʔβଆͰࣗ༝ʹධՁ಺༰Λ ఆٛͰ͖ΔΧελϜϧʔϧ͕͋Δ
    ‣ධՁճ਺ʹର͢Δ՝ۚͱͳ͓ͬͯΓ͓͍҆ ೥݄d
19. "84
    $POpH
    3VMFTΛ༻͍ͨࣗಈ୨Է͠ 
    ఆظతʹ$POpH
    3VMFΛىಈ
    
    -BNCEBΛݺͼग़͢
    
    *".ϩʔϧͷྻڍͱ࠷ऴ࢖༻೔࣌Λऔಘ͢Δ"1*Λݺͼग़͢
    
    *".
    "1*ͷ݁ՌΛ-BNCEBʹฦ͢
    
    ४ڌඇ४ڌͷ݁ՌΛ$POpHʹઃఆ ࠷ऴ࢖༻೔͔࣌Βʓʓ೔ؒܦա͍ͯ͠Δ͔ΛνΣοΫ͢ΔΧελϜϧʔϧ https://aws.amazon.com/jp/blogs/security/continuously-monitor-unused-iam-roles-aws-config/
20. "84
    $POpH
    3VMFT݁Ռ
21. ࣗಈम෮΋Մೳʂ 44.
    "VUPNBUJPOͱ࿈ܞͨ͠ඇ४ڌϦιʔεͷࣗಈम෮
    wϩʔϧࣗମͷ࡟আ
    wϩʔϧ͸อ࣋͢Δ͕ɺશڋ൱͢ΔϙϦγʔΛΞλον
22. ·ͱΊ w *".ϩʔϧͷ࠷ऴར༻೔͕࣌෼͔ΔΑ͏ʹͳΓ·ͨ͠
    w ະ࢖༻*".ϩʔϧΛࣗಈ୨Էͯ͠͠ɺηΩϡϦςΟΛ୲อ ͠·͠ΐ͏
23. ͝੩ௌ
    ͋Γ͕ͱ͏͍͟͝·ͨ͠