自由でセキュアな環境のつくりかた / Building free and secure cloud environment

Transcript

1. ࣗ༝ͰηΩϡΞͳ؀ڥͷ
 ͭ͘Γ͔ͨ Hokuto Hoshi Head of Infrastructure, Cookpad Inc. [email protected]

2. ੕ ๺ే (΄͠ ΄͘ͱ) / @kani_b • ΫοΫύουגࣜձࣾ
 ΠϯϑϥετϥΫνϟʔ෦ ෦௕


   ݉ ίʔϙϨʔτΤϯδχΞϦϯά෦
 ݉ ؂ࠪҕһձ ؂ࠪิॿऀ • SRE, ηΩϡϦςΟΤϯδχΞ • AWS ೝఆ SA, DevOps ΤϯδχΞ (Professional)

3. https://speakerdeck.com/kanny

4. None

5. Ϩγϐ਺
   ໿ສ඼ ࠃ಺ͷ݄ؒར༻ऀ਺
   ໿ ສਓ
   

6. ରԠݴޠ
   ݴޠΧࠃ ւ֎ͷ݄ؒར༻ऀ਺
   ໿ ສਓ
   

7. ৽͍͠औΓ૊Έ • cookpadTV https://www.cookpad.tv/ • Cookpad DO! https://cookpad.do/ • OiCy

   https://oicy.cookpad.com/ • komerco https://komer.co/ • etc…

8. ΫοΫύουͱΫϥ΢υ • 2011೥ʹ DC ͔Β׬શҠߦ͠ϑϧΫϥ΢υԽ • ଟ͘ͷαʔϏε͕ AWS ͰՔಇ •

   Ұ෦ͷαʔϏε͸ Google Firebase ্ͰՔಇ

9. എܠ • ػೳɺࣄۀͳͲ৽͍͠औΓ૊ΈΛՃ଎͍ͨ͠

10. ౰࣌ͷ૊৫ߏ଄ • ࣄۀ෦ + ػೳԣஅ෦ॺ (e.g. Πϯϑϥ෦) • Πϯϑϥͷ؅ཧ͸શͯΠϯϑϥ෦͕ߦ͏
 (=

    AWS ͷ؅ཧ͸શͯΠϯϑϥ෦) • AWS ʹؔ͢Δϊ΢ϋ΢͸શͯΠϯϑϥ෦ʹू໿ • ηΩϡϦςΟରࡦ΋΄΅Πϯϑϥ෦͕ओಋ ࣄۀ෦ Πϯϑϥ෦ ࣄۀ෦ ࣄۀ෦

11. தԝ؅ཧͷݶք • ςετ༻Πϯελϯε΍ϦιʔεΛ࡞Δͷʹ
 Πϯϑϥ෦Ͱ࡞ۀΛߦ͏ඞཁ͕͋ͬͨ • ηΩϡϦςΟͷϨϏϡʔ΋ • ʮͦ΋ͦ΋ AWS ͷྑ͞Λࡴͯ͠ΔͷͰ͸ʁʁʁʁʁʁʯ

    • αʔϏεͷ҆ఆੑ΍ηΩϡϦςΟΛଛͳΘͣʹ࣮ݱ͍ͨ͠

12. ؅ཧํ਑ͷస׵ • ݖݶͱ੹೚Λ֤։ൃऀʹҠৡ͢Δํ޲ʹγϑτ • ؅ཧ͢΂͖෦෼Λ͓͑ͯ͞Ҡৡ͍ͯ͘͠

13. ։ൃऀ༻ΞΧ΢ϯτ • ։ൃऀͰ͋Ε͹୭Ͱ΋ࣗ༝ʹར༻Ͱ͖Δ AWS ΞΧ΢ϯτ • ຊ൪ͷ AWS ΞΧ΢ϯτͱ෼཭͞Ε͍ͯΔ •

    AWS IAM ͷۭؒΛ෼ׂ͢Δ͜ͱ͕Ͱ͖Δ • ϩάΠϯ͸ SAML ܦ༝

14. ݖݶ؅ཧ • ඞཁͳαʔϏεͷ Admin ݖݶΛ޿͘෇༩ • “ಛఆαʔϏεͷΈڐՄ͠ ͳ͍” ϙϦγʔ \
    

    
    
    
    
    7FSTJPO
    
    
    
    
    
    4UBUFNFOU
    <
    
    
    
    
    
    
    
    
    \
    
    
    
    
    
    
    
    
    
    
    
    
    &⒎FDU
    "MMPX
    
    
    
    
    
    
    
    
    
    
    
    
    /PU"DUJPO
    <
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    DMPVEUSBJM 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    DPOpH 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    EJSFDUDPOOFDU 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    SPVUF 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    SPVUFEPNBJOT 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    BXTQPSUBM.PEJGZ"DDPVOU
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    BXTQPSUBM.PEJGZ#JMMJOH
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    BXTQPSUBM.PEJGZ1BZNFOU.FUIPET
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    JBN$SFBUF6TFS
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    FD$SFBUF7QD
    
    
    
    
    
    
    
    
    
    
    
    
    >
    
    
    
    
    
    
    
    
    
    
    
    
    3FTPVSDF
     
    
    
    
    
    
    
    
    
    ^
    
    
    
    
    >
    ^
    

15. ϩάͷه࿥ • CloudTrail, VPC Flow Logs • AWS શମͷ API

    ϩά΍ VPC ͷ௨৴ϩάΛه࿥Ͱ͖Δ • ຊ൪ΞΧ΢ϯτͷ S3 όέοτʹอ࣋ • ϩάͷมߋ΍࡟আ͸Ͱ͖ͳ͘ͳΔ

16. ϩάͷ෼ੳ • Graylog ʹऔΓࠐΈ෼ੳͰ͖ΔΑ͏ʹ https://speakerdeck.com/mizutani/ohuisuawshuan-jing-wosekiyuritei-jian-shi-surutamefalserokushou-ji

17. AWS Config • EC2 ΍֤छϦιʔεͷมߋཤྺΛه࿥Ͱ͖Δ

18. ࢖͍ํ • Output ઌΛຊ൪ΞΧ΢ϯτ (CloudTrail ͱಉ͡) ʹηοτͯ͠༗ޮԽ • “͜Εมߋͨ͠ͷ୭ͩΖ͏ʁ” Λ୳͢ࡍʹར༻

    • ಛఆͷΠϯελϯε΍ηΩϡϦςΟάϧʔϓͳͲʹඥ͚ͮͯ୳ͤΔ ͷͰศར

19. AWS Config Rules • ઃఆมߋΛτϦΨͱͯ͠ lambda function ͰઃఆΛνΣοΫͰ͖Δ • ηΩϡϦςΟάϧʔϓͷΠϯλʔωοτղ์ͳͲΛνΣοΫ

    • Fail ͨ͠৔߹ Slack ͳͲʹ௨஌ͤ͞Δ • શαʔϏεରԠͯ͠΄͍͠…
20. None

21. awslabs/aws-config-rules • ศརϨϙδτϦ • https://github.com/awslabs/aws-config-rules • Config Rules ʹ࢖͑Δ Lambda

    function ͕͍Ζ͍Ζ͋Δ • EBS ͸҉߸Խ͞Ε͍ͯΔ͔ʁ • IAM Ϣʔβͷ MFA ͸༗ޮԽʁ • etc…

22. Amazon GuardDuty • CloudTrail ΍ VPC FlowLog Λ෼ੳͯ͠Ξϥʔτ • Ξϥʔτͷྫ

    • ීஈ࢖ΘΕͳ͍ IP ͔Βͷ API ίʔϧ • Πϯελϯεͷ௨৴ઌ͕͍ͭ΋ͱҧ͏ • Πϯελϯεͷ௨৴ઌ͕ C&C ͬΆ͍αʔό

23. ΫοΫύουͰͷ࢖͍ํ • Ξϥʔτ͸ GitHub -> PagerDuty ܦ༝Ͱൃใ͠
 ηΩϡϦςΟνʔϜ͕؂ࢹ • ௐࠪ෼ੳʹ

    CloudTrail ΍ Config Λ࢖͏ • ϩά͸ Graylog ʹ஝ੵ • ͪΐͬͱաහͳͷ͕࠷ۙͷ೰Έ

24. ωοτϫʔΫߏ੒ • ౿Έ୆ SSH αʔό͕͋Δ VPC (ຊ൪ΞΧ΢ϯτ) ͔Β
 VPC Peering

    ܦ༝Ͱ઀ଓͰ͖ΔΑ͏ʹ͢Δ • ౿Έ୆Λू໿ (TOTP ΍ FIDO U2F ʹ΋ରԠ͍ͯͯ͠ศར) • Name λάΛ࢖ͬͨਖ਼Ҿ͖ɺٯҾ͖Λఏڙ

25. 
     https://speakerdeck.com/kanny/machine-learning-ops-at-cookpad

26. ։ൃऀΞΧ΢ϯτͷಛ௃ • “໰୊Λະવʹ๷͙” ͜ͱΑΓ “໰୊Λ͋ͱ͔ΒͰ΋͍͍ͷͰݕग़ Ͱ͖Δ” ରࡦʹϑΥʔΧε • ΞΧ΢ϯτʹٻΊΒΕΔॊೈੑͳͲ͔Βߟ͑ͨ݁Ռ •

    AWS αʔϏεΛׂͱૉ๿ʹ࢖ͬͨߏ੒ • ͜͏͍͏ͱ͜Ζ·ͰͰ͖ΔΑ͏ʹͳͬͨɺͱ͍͑Δ

27. ࣮ࡍͷӡ༻ • ։ൃऀΞΧ΢ϯτ͔ΒͷΞϥʔτ͸ଟ͘͸ͳ͍ঢ়گ • ར༻ͷ૯ྔ͸ଟ͍ • EC2 ΠϯελϯεΛىಈͯ͠ͷ࣮ݧ • AWS

    ৽αʔϏεͳͲͷݕূ

28. ·ͱΊ • ηΩϡϦςΟͱࣗ༝͞Λཱ྆ͤͨ͞։ൃ؀ڥΛͭ͘Δ࿩ • ͍ΘΏΔ “ηΩϡϦςΟଆ” ͕Ͳ͏ߟ͑ΒΕΔ͔ʹΑͬͯ
 ࣮ݱͰ͖Δࣗ༝౓͕มΘͬͯ͘Δ • AWS

    αʔϏεΛϑϧʹ࢖ͬͯΈΔ͚ͩͰ΋ׂͱ৭ʑͰ͖Δ • ʮ͏ͪͰ͸͜͏͍͏ײ͡ʯͳͲ͕͋Ε͹ڭ͑ͯ΄͍͠Ͱ͢

29. PR

30. We’re Hiring!!! • Software Engineer (Security) • Software Engineer (Site

    Reliability) • ͦͷଞͷϙδγϣϯ΋͍Ζ͍Ζ͋Γ·͢ • https://cookpad.jobs/

31. Q?