AWS Service Namespace を流行らせたい/ AWS Service Namespace to become popular

Transcript

1. ʜʜྲྀߦΒ͍ͤͨɺ
   "84
   4FSWJDF
   /BNFTQBDFΛɻ 
   ઍ༿
   ޾޺ʢνόϢΩʣ
2. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ࣦޮ
   ͠·ͨ͠
3. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ࣦޮ
   ͠·ͨ͠
4. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ɾ2021 APN AWS Top Engineer ࣦޮ
   ͠·ͨ͠
5. ࣗݾ঺հ  ઍ༿ ޾޺ (νόϢΩ) ɾ2020೥1݄ΫϥεϝιουJOINɹɹɹɹ ɾ2021 APN AWS Top Engineer ɾ޷͖ͳAWSαʔϏεɿIAM
6. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM
7. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ
8. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole
9. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole ޷͖ͳAWS Service Namespaceɿtiros
10. ޷͖ͳʜʜ  ޷͖ͳAWSαʔϏεɿIAM ޷͖ͳAWSϦιʔεɿIAMϩʔϧ ޷͖ͳΞΫγϣϯɿsts:AssumeRole ޷͖ͳAWS Service Namespaceɿtiros φχίϨʁʁ
11.  ޷͖ͳ AWS Service Namespace Λ ܾΊ·͠ΐ͏ ϝΠϯςʔϚ
12. "HFOEB  1.AWSαʔϏε͋Δ͋Δ 2.AWS Service Namespace 1.ͱ͸ 2.ௐ΂ํ 3.ΫΠζ 1.ਖ਼Ҿ͖ 2.ٯҾ͖
13.  AWS αʔϏε͋Δ͋Δ ݴ͍͍ͨ
14.  "84αʔϏε͋Δ͋Δ ͦͷ1. ͦͷ2. ͦͷ3.
15.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ͦͷ3.
16.  ଟ͍ɻ ͳΜͰ΋223ݸ͋Δͱ͔…… ɹͳ͍ͱ͔…… ֮͑ΒΕͳ͍Α……
17.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ͦͷ3.
18.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ ͦͷ3.
19.  ઀಄ࣙ
    "84
    ͔
    "NB[PO
    ͔໎͍͕ͪ Ұઆʹ͸ɻ ʮAWSʯ͕ͭ͘ͷ͸…… ɹɹଞͷAWSαʔϏεͱ૊Έ߹ΘͤΔલఏ ɹɹɹɹAWS LambdaɺAWS BackupɺAWS IAM... ʮAmazonʯ͕ͭ͘ͷ͸…… ɹɹ୯ಠͰ࢖͑Δ΋ͷ Amazon EC2ɺAmazon Route53ɺAmazon S3…
20.  ઀಄ࣙ
    "84
    ͔
    "NB[PO
    ͔໎͍͕ͪ ͪΐͬͱ೿ੜͯ͠ ਖ਼໊ࣜশ໎͍͕ͪ໰୊ •Amazon Elastic Compute Cloudʁ •Amazon EC2ʁ •Amazon Simple Storage Serviceʁ •Amazon S3ʁ ͳͲͳͲ…… ΋͔ͯ͠͠ʮAmazon Elastic Compute Cloud (EC2)ʯʁ
21.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ ͦͷ3.
22.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ ͦͷ3. ԿΛ΋ͬͯ”αʔϏε”͔೰Ή
23.  ԿΛ΋ͬͯzαʔϏεz͔೰Ή Ϛωδϝϯτίϯιʔϧج४ʁ Ϋϥ΢υ੡඼Ұཡج४ʁ AWSυΩϡϝϯτج४ʁ
24.  ԿΛ΋ͬͯzαʔϏεz͔೰Ή Ϛωίϯ ੡඼ϖʔδ υΩϡϝϯτ &-# ʮ&$ʯͷ
    Ұ෦ ͋Δ τοϓϖʔδ
    ʹ͋Δ 5SBOTJU
    (BUFXBZ ʮ71$ʯͷ
    Ұ෦ ͋Δ ʮ71$ʯʹ
    ͋Δ .BSLFUQMBDF αʔϏεը໘
    ͕͋Δ ͳ͍ τοϓϖʔδ
    ʹ͋Δ ྫ͑͹……
25.  "84αʔϏε͋Δ͋Δ ͦͷ1. ଟ͍ɻ ͦͷ2. ઀಄ࣙ AWS ͔ Amazon ͔໎͍͕ͪ ͦͷ3. ԿΛ΋ͬͯ”αʔϏε”͔೰Ή ͏ʔΉ…… 🤔
26.  ͦ͜Ͱ AWS Service Namespace Ͱ͢Α ೰ΊΔ͋ͳͨ΁
27.  "84
    4FSWJDF
    /BNFTQBDF
    ͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾ ɾ
28.  "84
    4FSWJDF
    /BNFTQBDF
    ͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾAWS ΋ Amazon ΋͔ͭͳ͍🤗 ɹɹେମུশΛ͓͚֮͑ͯ͹OK ɾ
29.  "84
    4FSWJDF
    /BNFTQBDF
    ͸ ɾج४͕໌֬🤗 ɹɹϦϑΝϨϯεͰఆٛ͞ΕͯΔ ɾAWS ΋ Amazon ΋͔ͭͳ͍🤗 ɹɹେମུশΛ͓͚֮͑ͯ͹OK ɾ਺͸AWSαʔϏεΑΓଟ͍🥺 ɹɹ2022/1/27࣌఺Ͱ301ݸ͋Γ·͢
30.  AWS Service Namespace ͱ͸Կ͔ ࠓ೔ͷຊ୊
31.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ͸ arn:aws:s3:::my_corporate_bucket arn:aws:iam::123456789012:user/Test • AWS ੡඼Λࣝผ͢ΔͨΊͷαʔϏε໊લۭؒ • ARN ʹొ৔͠·͢
32.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition • αʔϏεϓϨϑΟοΫεͱ΋
33.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition • αʔϏεϓϨϑΟοΫεͱ΋ ec2:CreateVpc s3:GetObject Actionͷྫɻ ɹରԠ͢ΔAPI͕ແ͘ݖݶ෇༩ͷͨΊʹͷΈ͋Δ΋ͷ΋
34.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ͸ • IAM JSON ϙϦγʔʹ΋ొ৔͠·͢ • Action • Condition • αʔϏεϓϨϑΟοΫεͱ΋ ec2:CreateVpc s3:GetObject iam:AWSServiceName rds:DatabaseName Actionͷྫɻ ɹରԠ͢ΔAPI͕ແ͘ݖݶ෇༩ͷͨΊʹͷΈ͋Δ΋ͷ΋ Conditionͷྫɻ ɹάϩʔόϧ৚݅Ωʔʹରͯ͠ ɹ αʔϏεݻ༗ͷ৚݅Ωʔͱݺ͹ΕΔ
35.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ͸ • AWS CLI ͷίϚϯυ໊ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍ • ྫ֎΋͋Γ·͢ʢaws con fi gserviceͱ͔ʣ aws sts get-caller-identity aws ecr put-image
36.  "84
    4FSWJDF
    /BNFTQBDF
    ͱ
    "84αʔϏε • 1ର1ʹͳ͍ͬͯΔ͜ͱ͕ଟ͍ • ҰͭͷAWSαʔϏε͕ෳ਺ͷAWS Service NamespaceΛ࣋ͭ͜ͱ΋͋Δ • ҟͳΔAWSαʔϏε͕ಉ͡AWS Service Namespace Λ࣋ͭ͜ͱ΋͋Δ
37.  Ͳ͏΍ͬͯ֬ೝ͢Ε͹Α͍͔ "84
    4FSWJDF
    /BNFTQBDF
38.  ίϚϯυΛୟ͜͏ i=`aws iam generate-service-last-accessed-details --arn arn:aws:iam::aws:policy/AdministratorAccess --output text` \ && sleep 1 \ && aws iam get-service-last-accessed-details --job-id $i --max-items 1000 \ | jq -c '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace]' ࠓ೥ͷ AWS αʔϏε໊લۭؒɺࠓ೥ͷ͏ͪʹɻ 2021 https://dev.classmethod.jp/articles/aws-service- namespace-2021/ ҎԼʹࡌͬͯ·͢ɻ
39.  ͳʹɺͦͷίϚϯυʜʜ AdministratorAccessΛΞΫηεΞυόΠβʔͰ ݟΔͷͱಉ͜͡ͱΛ AWS CLI Ͱ΍ͬͯ·͢ɻ ΞΫηεՄೳͳ ʮαʔϏεʯͱ ࠷ऴΞΫηε࣌ؒΛ දࣔ͢ΔΑ
40.  ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ • αʔϏεೝূϦϑΝϨϯεΛΈΑ͏ • Service Authorization Reference ͳͷͰʮೝՄʯͱ༁ͯ͠΄͘͠΋ ͋Δͱ͔ͳ͍ͱ͔ • αʔϏεϓϨϑΟοΫε͝ͱʹϖʔδ͕࡞ΒΕ͍ͯ·͢ ϙϦγʔઃܭ͢Δ࣌ʹ ֎ͤͳ͍Ͱ͢ΑͶ https://docs.aws.amazon.com/ja_jp/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
41.  ͪΌΜͱϦϑΝϨϯεͰݟ͍ͨ • ʮAWS IAMͱ࿈ܞ͢ΔαʔϏεʯϖʔδ΋େࣄ • AWS IAM ͷυΩϡϝϯτͷҰ෦Ͱ͢ • ͜͜ͰͷʮαʔϏεʯ͸αʔϏεϓϨϑΟοΫε͕ج४Ͱ͢ ϒοΫϚʔΫͯ͠ͳ͍…ʁ ͳΜͰ……ʁ https://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html
42.  IAM ͱ஥ྑ͘ͳΔͳΒ AWSαʔϏε͡Όͳ͘ AWS Service Namespace Λҙࣝ͠Α͏ "84
    4FSWJDF
    /BNFTQBDF
43.  AWS Service Namespace ΫΠζʂʂʂʂʂ νϟϨϯδ͠Α͏
44.  ΍Δ͜ͱ • ਖ਼Ҿ͖ • AWSαʔϏε͔Β໊લۭؒΛߟ͑Δ • ٯҾ͖ • ໊લۭ͔ؒΒAWSαʔϏεΛߟ͑Δ ͜͜Ͱͷʮਖ਼Ҿ͖ʯͱ͔ʮٯҾ͖ʯ͸Θͨ͠ ͕উखʹͦ͏ݺΜͰΔ͚ͩͰ͢ɻ ΑͦͰݴ͏ͱ
    ஏΛ͔͖·͢Α
45.  ਖ਼Ҿ͖ฤ "84
    4FSWJDF
    /BNFTQBDF
    ΫΠζ
46.  ୈҰ໰ "NB[PO
    &$ ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace
47.  ୈҰ໰ "NB[PO
    &$ FD ೉қ౓ɿ AWSαʔϏε AWS Service Namespace ؆୯Ͱ͢Ͷɻ
48.  ୈೋ໰ "NB[PO
    4 ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace
49.  ୈೋ໰ "NB[PO
    4 T ೉қ౓ɿ AWSαʔϏε AWS Service Namespace ๏ଇΘ͔͖ͬͯ·ͨ͠Ͷɻ
50.  ୈࡾ໰ "NB[PO
    71$ ೉қ౓ɿ ʁ AWSαʔϏε AWS Service Namespace
51.  ୈࡾ໰ "NB[PO
    71$ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace FD ʮvpcʯͰ͸͋Γ·ͤΜΑɻ
52.  ໊લۭؒ
    FD
    ଟ͍Αʜʜ • Amazon EC2 actions • Amazon EBS actions • Amazon VPC actions • Amazon IPAM actions • AWS Transit Gateway actions • AWS PrivateLink actions • AWS Client VPN actions • AWS Site-to-Site VPN actions • AWS Outposts actions • AWS Wavelength actions • VM Import/Export actions • AWS Nitro Enclaves https://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query.html
53.  ٯҾ͖ฤ "84
    4FSWJDF
    /BNFTQBDF
    ΫΠζ
54.  ୈҰ໰ "NB[PO
    3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace SET Amazon RDS Ҏ֎ͰԿ͕͋ΔͰ͠ΐ͏ʁ ʁ
55.  ୈҰ໰ "NB[PO
    3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace SET "NB[PO
    %PDVNFOU%# ͦ͏ͳΜͩ……ɻ
56.  ୈೋ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace NFEJBJNQPSU ϝσΟΞܥͷαʔϏε͔ͳʁʁʁʁ ʁ
57.  ୈೋ໰ "NB[PO
    3%4 ೉қ౓ɿ AWSαʔϏε AWS Service Namespace Amazon RDS Custom for Oracle ͷ ɹΠϯετʔϧϝσΟΞʹର͢ΔݖݶΛ෇༩͢ΔͨΊͷ໊લۭؒɻɻ NFEJBJNQPSU
58.  ୈࡾ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace UJSPT ฉ͍ͨ͜ͱ΋ͳ͍Α…… ʁ
59.  ୈࡾ໰ ೉қ౓ɿ AWSαʔϏε AWS Service Namespace UJSPT ਖ਼֬ʹݴ͑͹ Amazon VPC Reachability Analyzer ͕ ɹ΋ͬͱ΋ؔΘΓ͕ڧ͍ "NB[PO
    71$ ڧ͍ͯݴ͑͹
60.  UJSPT
    JT
    Կ https://aws.amazon.com/jp/security/provable-security/ • ਪ࿦πʔϧʁ෼ੳج൫ʁΈ͍ͨͳ΋ͷ • Inspector ΍ΞΫηεΞφϥΠβʔͰ΋࢖༻͞ΕΔ • ઐ༻ͷAPIΛୟ͚ΔΘ͚Ͱͳ͘ڐՄΛ༩͑ΔͨΊʹඞཁ • ྫ͑͹ Inspector v2 ͷαʔϏεϦϯΫϩʔϧͷIAMϙϦγʔΛோΊͯΈΑ͏
61.  ͋ͳͨ͸Կ໰ਖ਼ղͰ͖·͔ͨ͠ʁ "84
    4FSWJDF
    /BNFTQBDF
    ΫΠζ
62.  ·ͱΊ Α͏΍͘ऴΘΓͰ͢
63.  "84
    4FSWJDF
    /BNFTQBDF
    ͸͍͍ͧ IAMʹৄ͘͠ͳΔͳΒආ͚ͯ௨Εͳ͍ 300ݸҎ্΋όϦΤʔγϣϯ͕͋Δ ਪ͠Λݟ͚ͭͯ௥͍͔͚Α͏
64.  ऴΘΓʹɿΘͨ͠ͷࣥ೦ΛோΊ͍ͯͩ͘͞ https://dev.classmethod.jp/articles/aws-services-with-aws-servicenamespaces/ ೥຤೥࢝ͷ࣌ؒΛ๋͛·ͨ͠