SREãã¼ã ã®æ©æ¬ã§ããSREé£è¼ã®11æå·ã«ãªãã¾ãã AWSã®å¤ãã®ãªã½ã¼ã¹ã¯IAMã§ã¢ã¯ã»ã¹ãä¸å 管çããã¦ãã¾ãããLambdaã§ã¯ã¦ã¼ã¶ã¼ãå®è¡ãããä»ã®AWSãµã¼ãã¹ããå®è¡ããããããé½åä¸ãæ§ã ãªããªã·ã¼ã絡ãã§ãã¾ãã ç¹ã«ãLambdaãå¼ã³åºã許å¯ãã«ã¤ãã¦ã¯IDï¼ã¢ã¤ãã³ãã£ãã£ï¼ãã¼ã¹ã®ããªã·ã¼ã¨ãªã½ã¼ã¹ãã¼ã¹ã®ããªã·ã¼ã§å 容ã被ããããã©ã¡ãã§è¨å®ãããæ··ä¹±ãã¦ããã±ã¼ã¹ãè¦ããã¾ãã æ¬è¨äºã§ã¯ããããããªã·ã¼äºæ ãterraformã®ä¾ã¨å ±ã«æ´çããæ¨©éè¨å®ã®ãã¹ããã©ã¯ãã£ã¹ãæ¤è¨ãã¾ãã ããããIAMã®ããªã·ã¼ã«ã¤ã㦠ããã¥ã¡ã³ãã«ããã°AWSã®ããªã·ã¼ã¯å®ã«6種é¡ãã®ã¿ã¤ããããã¾ãããã使ç¨é »åº¦ã®é«ããã®ãããã¨ããããã«æåã®IDãã¼ã¹ãé常ã«å¤ãã®ãµã¼ãã¹ã§å ±éãã¦ä½¿ããã¦ãããæ¬¡ãã§2çªç®ã®ãªã½ã¼ã¹ãã¼ã¹ãä¸é¨ãµã¼ãã¹ã§å¿ è¦ã«ãªãã§ãããã
AWS User Notifications ãµã¼ãã¹ãå©ç¨ã㦠AWS ããã¸ã¡ã³ãã³ã³ã½ã¼ã«ã¸ã®ãµã¤ã³ã¤ã³ãã¡ã¼ã«éç¥ããè¨å®ã試ãã¦ã¿ã¾ããã ãµã¤ã³ã¤ã³éç¥ã¯æ¬¡ã®ããã°ã§ãç´¹ä»ãã¦ããéããAmazon EventBridge ã«ã¼ã«ã使ããæ¹æ³ã§ãå®ç¾ã§ãã¾ãããéç¥æãæ´å½¢ããå¿ è¦ãããã¾ãããAWS User Notifications ã§è¨å®ããå ´åã¯éç¥å 容ã AWS å´ã§è¦ããããã¦ãããã¡ãªãããããã¾ãï¼è£ã§ã¯ Amazon EventBridge ã«ã¼ã«ã使ããã¾ãï¼ã åèããã°ã®æ¹æ³ï¼Amazon EventBridge ã§è¨å®ããå ¥åãã©ã³ã¹ãã©ã¼ãã¼ã§éç¥å å®¹ãæ´å½¢ï¼ã®éç¥ä¾ã§ãã æ¬ããã°ã§è¨å®ãã AWS User Notifications ã®éç¥ä¾ã§ãã AWS ããã¸ã¡ã³ãã³ã³ã½ã¼ã«ã¸ã®ãµã¤ã³ã¤ã³éç¥è¨å® ä»åè¨å®ããç°å¢ã¯ AWS Orga
ã¯ããã« S3ã¸ã®ã¢ã¯ã»ã¹ãå¶å¾¡ããããã«æ§ã ãªæ©è½ãããã¾ããããããã¯IAMã®ã¢ã¯ã»ã¹å¶å¾¡ã¨æ··åãã¦èãããããã¨ãå¤ãã両æ¹ã®æ©è½ã®é¢é£ã«ã¤ãã¦ã質åãé常ã«å¤ãåãã¦ãã¾ãã 以åã« S3ã®ã¢ã¯ã»ã¹å¶å¾¡ã¯ã¾ãã·ã³ãã«ã«æãã¦å¯¾å¿ãã¹ã ã¨ããè¨äºãæ¸ãã¾ãããããã®è¨äºã«æ¸ããããã«ãS3ãã±ããããªã·ã¼ã¨IAMããªã·ã¼ã«ã¯ä»¥ä¸ã®ãããªéããããã¾ãã S3ãã±ããããªã·ã¼ã¯ãS3å´ã§ãã¨ã³ãã£ãã£ããè¡ãããã¢ã¯ã»ã¹ã®å¶å¾¡ IAMããªã·ã¼ã®å ´åãã¨ã³ãã£ãã£å´ã§ãS3ã«å¯¾ãã¦è¡ãã¢ã¯ã»ã¹ã®å¶å¾¡ ãã®ããã«ã両è ã§ã¯è¨å®ç®æããã³å¶å¾¡ããæä½ã®ç¢å°ã®æ¹åãç°ãªãã¾ãã åºæ¬ã¯ãã®2ã¤ã§S3ãã±ããããªãã¸ã§ã¯ãã«å¯¾ããã¢ã¯ã»ã¹å¶å¾¡ãè¡ãã¾ããããã®2ã¤ã«å ãã¦ãå ¨ãç°ãªãã¢ã¯ã»ã¹å¶å¾¡ã®è¦ç´ ãå ãããã¨ãããã¾ãã ãã®ä»£è¡¨ä¾ã¨è¨ãã ãPresigned URLã ãä»åã¯åãä¸ã
The path variable in IAM is used for grouping related users and groups in a unique namespace, usually for organizational purposes. From Friendly Names and Paths: If you are using the IAM API or AWS Command Line Interface (AWS CLI) to create IAM entities, you can also give the entity an optional path. You can use a single path, or nest multiple paths as if they were a folder structure. For example,
ããã«ã¡ã¯ã岩åã§ãã 3rd Party 製㮠SaaS 㨠AWS ã¢ã«ã¦ã³ãã飿ºããéãå°ç¨ã® IAM ãã¼ã«ã®ä½æã¨ä½æãããã¼ã«ã«ä»¥ä¸ã®ãããªä¿¡é ¼ããªã·ã¼ãå®ç¾©ãã¦ãç¹å®ã® AWS ã¢ã«ã¦ã³ããã AssumeRole ã許å¯ãããã¨ãããã¾ãã { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::xxxxxxxxxxxx:iamuser" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "xxxxxxxxxxxx" } } } ] } Condition ã«ã¯ sts:ExternalId ã¨ãã
ããã«ã¡ã¯ãè¼ç°ã§ãã ã¿ãªãããID管çãã¦ãã¾ããï¼ ä»åã¯IDãã§ãã¬ã¼ã·ã§ã³ã§IAMãå©ç¨ãã¦ããéã«ãIdPãã屿§(Attribute)ãAWSã®ã¿ã°ã¨ãã¦åãåããã¨ãã§ããSession Tagã®æ©è½ããªãªã¼ã¹ãããã®ã§ç´¹ä»ãã¾ãã New for Identity Federation â Use Employee Attributes for Access Control in AWS | AWS News Blog RBACã¨ABAC è¯ããç¥ãã«ã¯ã¾ãèæ¯ããã ã¢ã¯ã»ã¹å¶å¾¡ã®æ¹å¼ã¨ãã¦RBAC(Role-based Access Control)ããã使ããã¾ããRBACã§ã¯ã権éãå人ã§ã¯ãªãRole(å½¹å²)ã«å²ãå½ã¦ã¦ç®¡çããæ¹æ³ã§ãå人ãã¨ããªã·ã¼ãã¡ã³ããã³ã¹ããªãã¦è¯ããªãã®ã§ã¦ã¼ã¶ãå¢ãã¦ã管çãæ¥½ã«ãªãä»çµã¿ã§ããã ããããããé²ãã§ããã¨ãä»åº¦ã¯
AWSã¢ã¯ã»ã¹ãã¼ã»ãã¥ãªãã£æèåä¸å§å¡ä¼ã£ã¦ä½ï¼ æ¨ä»ãAWSã®ã¢ã¯ã»ã¹ãã¼ãæ¼æ´©ããã¦ãã¾ããã¨ãåå ã§ã¢ã«ã¦ã³ãã¸ã®ä¾µå ¥ãåãã å¤é¡ã®å©ç¨è²»çºçã»æ å ±æ¼æ´©çããªã©é大ãªã»ãã¥ãªãã£äºæ¡ãçºçããã±ã¼ã¹ãå®éã«å¤ã èµ·ãã¦ãã¾ãã ããã§ãã¢ã¯ã»ã¹ãã¼éç¨ã«é¢ããå®å ¨åä¸ã®åçµã¿ãããã°ã§ãç´¹ä»ããä¼ç»ãã¯ããã¾ããã ã¢ã¯ã»ã¹ãã¼ãå©ç¨ããå ´åã¯å©ç¨ããä¸ã§ã®ãªã¹ã¯ãæ£ããçè§£ãã ã»ãã¥ãªãã£å¯¾çãäºåã«é©ç¨ããä¸ã§é©åã«ãå©ç¨ãã ããã AWS CLIãã©ããã使ã£ã¦ãã¾ããï¼ ãã£ããã以ä¸4種é¡ã®ã©ããã使ã£ã¦ããæ¹ã夿°æ´¾ã§ã¯ãªãã§ããããã ãã¼ã«ã«ç«¯æ« AWSå ã«æ§ç¯ãã管çç¨EC2ã«SSHãå©ç¨ãã¦æ¥ç¶ AWSå ã«æ§ç¯ãã管çç¨EC2ã«SSM(ã»ãã·ã§ã³ããã¼ã¸ã£)ãå©ç¨ãã¦æ¥ç¶ AWS CloudShell ä¸ä½ã©ãéãã®ã§ããããã ç¶æ³ã«ãã£ã¦è¯ãæªãã¯ç°ãªã
IAM ã¯ãã¦ã¼ã¶ã¼ãIAM ã°ã«ã¼ãããã¼ã«ãããªã·ã¼ãããã³ãµã¼ãã¼è¨¼ææ¸ã«å¯¾ãã¦ããã¤ãã®ç°ãªã£ã ID ã使ãã¾ãããã®ã»ã¯ã·ã§ã³ã§ã¯ãID ããã³ããããã® ID ã®ä½¿ãæ¹ã«ã¤ãã¦èª¬æãã¾ãã ãã¬ã³ããªåã¨ãã¹ ã¦ã¼ã¶ã¼ããã¼ã«ãã¦ã¼ã¶ã¼ã°ã«ã¼ããã¾ãã¯ããªã·ã¼ã使ããå ´åãã¾ãã¯ãµã¼ãã¼è¨¼ææ¸ãã¢ãããã¼ãããå ´åã¯ãããããããååãä»ãã¾ãããã¨ãã°ãBobãTestApp1ãéçºè ãManageCredentialsPermissionsãProdServerCert ãªã©ãããã¾ãã IAM API ã¾ã㯠AWS Command Line Interface (AWS CLI) ã使ç¨ã㦠IAM ãªã½ã¼ã¹ã使ããå ´åããªãã·ã§ã³ã®ãã¹ã追å ã§ãã¾ããåä¸ã®ãã¹ã使ç¨ãããã¨ããè¤æ°ã®ãã¹ããã©ã«ãã¼æ§é ã¨ãã¦ãã¹ããããã¨ãã§ãã¾ãããã¨ãã°ãä¼ç¤¾ã®çµç¹æ§é ã«
PCI DSS ã«å¯¾å¿ãã¹ã Linux ãµã¼ãã¼ã®æä½å±¥æ´ã S3 ã¸ä¿åããããã°ã¤ã³æã« MFA ã使ç¨ãããã¢ã¤ãã«ã¿ã¤ã ã¢ã¦ããå®è£ ããæ¹æ³ãç´¹ä»ãã¾ãã ããã«ã¡ã¯ã ãæ©å«ãããã§ããããã "No human labor is no human error" ã大好ã㪠ãã¯ã¹ãã¢ã¼ãæ ªå¼ä¼ç¤¾ ã®åäºã§ãã AWS ä¸ã®è¸ã¿å°ãµã¼ãã¼ (ããã§ã¯ Amazon Linux 2 ãæ³å®ãã¦ãã¾ã) ã§ã®æä½å±¥æ´ã S3 ã¸ä¿åããããã°ã¤ã³æã« MFA ã使ç¨ãããã¢ã¤ãã«ã¿ã¤ã ã¢ã¦ããå®è£ ããæ¹æ³ãç´¹ä»ãã¾ãã PCI DSS ã®é¢é£ãã¦ä»¥ä¸ã®ãããªè¦ä»¶ãããããããå®ç¾ããããã«èããæ¹æ³ã§ãã ssh ãã°ã¤ã³ã¯ Google Authenticator ãå©ç¨ããäºè¦ç´ èªè¨¼ã«ããã ssh ãã°ã¤ã³å¾ã®æä½ãã°(ã³ãã³ããã°)ãä¿ç®¡ããã è¸ã¿å°ãµã¼ãã¼ããæ´ã«æ¥åãµ
ããã«ã¡ã¯ã ãæ©å«ãããã§ããããã "No human labor is no human error" ã大好ããªåäº äº®ã§ãã AWS ä¸ã® EC2 ã«å¯¾ãã¦ãªã¢ã¼ãã§ã¡ã³ããã³ã¹ããéã« ç£æ»ã®è¦ä»¶ã§ãµã¼ãã¼ä¸ã®æä½ãã°ãåå¾ãããã°ãªããªãã·ã¹ãã ã¯æ°å¤ãã¨æãã¾ãã ä»åã¯ã»ãã·ã§ã³ããã¼ã¸ã£ã¼ã使ã£ã¦ ãµã¼ãã¼ã¡ã³ããã³ã¹æä½ãã°ãå¾¹åºçã«è¨é²ãã¦ã¿ã¾ãã åæ ä»¥ä¸ã®ãããªåæãç½®ãã¾ããã ãªã¢ã¼ãããã®ã¡ã³ããã³ã¹ã¯å¿ ãè¸ã¿å°ãµã¼ãã¼ãçµç±ãã è¸ã¿å°ãµã¼ãã¼ã¸ã¯ã»ãã·ã§ã³ããã¼ã¸ã£ã¼çµç±ã§ãã°ã¤ã³ãã SSH ãã¼ãã¯éæ¾ããªã è¸ã¿å°ãµã¼ãã¼ã¸ã®ã¢ã¯ã»ã¹è¨±å¯ã¯ IAM ã§ç®¡ç è¸ã¿å°ãµã¼ãã¼ã¯ Amazon Linux 2 ãã°ã¤ã³ã¯ã¡ã¼ã«éç¥ ãã°ã¤ã³å¾ã®æä½ãã°ã¯ S3 ã¸ä¿ç®¡ æºå ãªã¢ã¼ãã¡ã³ããã³ã¹ãè¡ãã¯ã©ã¤ã¢ã³ã PC ã« AWS CLI 㨠Ses
çµç¹å ã® AWS ãªã½ã¼ã¹ã¸çµç¹å¤ã®ç¬¬ä¸è ãã¢ã¯ã»ã¹ããå¿ è¦ãããå ´åã«ã¯ããã¼ã«ã使ç¨ãããã¨ã§ã¢ã¯ã»ã¹è¨±å¯ãå§ä»»ãããã¨ãã§ãã¾ãããã¨ãã°ãçµç¹å ã® AWS ãªã½ã¼ã¹ã®ç®¡çã第ä¸è ã¸å§è¨ãã¦ãããããªå ´åãç¸å½ãã¾ããIAM ãã¼ã«ã使ç¨ãããã¨ã§ãAWS ã»ãã¥ãªãã£èªè¨¼æ å ±ãå ±æãããã¨ãªã第ä¸è ã« AWS ãªã½ã¼ã¹ã¸ã®ã¢ã¯ã»ã¹ã許å¯ãããã¨ãã§ãã¾ãã第ä¸è ã¯ä»£ããã«ãAWS ã¢ã«ã¦ã³ã ã«ä½æãããã¼ã«ãå¼ãåãããã¨ã§ãAWS ãªã½ã¼ã¹ã«ã¢ã¯ã»ã¹ã§ãã¾ããä¿¡é ¼ã¾ã¼ã³ (ä¿¡é ¼ã§ããçµç¹ã¾ãã¯ã¢ã«ã¦ã³ã) å¤ã«ããã¢ã«ã¦ã³ãã®ããªã³ã·ãã«ã«ãã¼ã«ãå¼ãåããã¢ã¯ã»ã¹æ¨©ããããã©ããã«ã¤ãã¦ã¯ããIAM Access Analyzer ã¨ã¯ããåç §ãã¦ãã ããã 第ä¸è ã¯ã以ä¸ã®æ å ±ãæä¾ããå¿ è¦ãããã¾ãããããã®æ å ±ã¯ã第ä¸è ãå¼ãåãããã¨ã®ã§ãããã¼ã«ã®ä½æã«å¿ è¦ã§ãã
ãã®ä¾ã§ã¯ãæ¥ä»ã¨æå»ã«åºã¥ãã¦ã¢ã¯ã·ã§ã³ã¸ã®ã¢ã¯ã»ã¹ã許å¯ãã ID ãã¼ã¹ããªã·ã¼ã使ããæ¹æ³ã示ãã¾ãããã®ããªã·ã¼ã¯ã2020 å¹´ 4 æ 1 æ¥ãã 2020 å¹´ 6 æ 30 æ¥ (UTC) ã®éã«çºçããã¢ã¯ã·ã§ã³ã¸ã®ã¢ã¯ã»ã¹ãå¶éãã¾ãããã®ããªã·ã¼ã§ã¯ãAWS API ã¾ã㯠AWS CLI ããããã®ã¢ã¯ã·ã§ã³ãããã°ã©ã ã§å®äºããããã«å¿ è¦ãªã¢ã¯ã»ã¹æ¨©ã許å¯ãã¾ãããã®ããªã·ã¼ã使ç¨ããã«ã¯ããµã³ãã«ããªã·ã¼ã®ã¤ã¿ãªãã¯ä½ã®ãã¬ã¼ã¹ãã«ãã¼ããã¹ããç¬èªã®æ å ±ã«ç½®ãæãã¾ããæ¬¡ã«ãããªã·ã¼ã®ä½æã¾ãã¯ããªã·ã¼ã®ç·¨éã®æé ã«å¾ãã¾ãã IAM ããªã·ã¼ã® Condition ãããã¯å ã§è¤æ°ã®æ¡ä»¶ã使ç¨ããæ¹æ³ã«ã¤ãã¦ã¯ããæ¡ä»¶å ã®è¤æ°ã®å¤ããåç §ãã¦ãã ããã
ã¡ã«ãã¤SREãã¼ã ã® @tjunã§ãããã®è¨äºã¯ãMerpay Tech Openness Month 2020 ã®19æ¥ç®ã®è¨äºã§ãã 仿¥ã¯ãã¡ã«ãã¤SREãã¼ã ã®ãªãã¬ã¼ã·ã§ã³ã®ããã«éçºãã¦å©ç¨ãã¦ãã Qray(ã¯ã¬ã¤) ã¨ãããã¼ã«ã®è©±ããã¾ãã ã¯ããã« ã¡ã«ãã¤ã§ã¯ãGoogle Cloud Platform(以ä¸GCP)ãå©ç¨ãã¦ãµã¼ãã¹ãæ§ç¯ãåããã¦ãã¾ãã GCPã«ã¯ Cloud Identity and Access Management (IAM) ã¨ããæ¨©é管çã®ä»çµã¿ãããã¾ããIAMãé©åã«ç®¡çãã¦ãã¢ã«ã¦ã³ãã«æä½éã®æ¨©éãä»ä¸ãããã¨ãã¯ã©ã¦ããµã¼ãã¹ãå®å ¨ã«å©ç¨ããããã«ã¯å¿ è¦ãªãã¨ã§ããããã¯SREãæã¤æ¬çªç°å¢ã«å¯¾ããæ¨©éã«ã¤ãã¦ãåæ§ã§ãã§ããã ãæ¬çªç°å¢ã«å¯¾ããæ¨©éãæããªãããã«ãã¦ããããã®ã§ãããé害対å¿ãªã©æ¬çªç°å¢ã§ã®ãªãã¬ã¼ã·ã§ã³
AWSï¼Terraform ã®è¨äºãæ¸ãã®ã£ã¦ãã¾ã好ããããªããã§ããã©ãå¹´æ«ãããï¼ã¤æ¸ãã¦ããããªã¨ãã義åæçãªã¢ã¬ã§ãããã¤ã Terraform v0.7.8 ãã aws_iam_user_login_profile ã追å ããï¼CHANGELOGï¼ãIAM User ã«ãã°ã¤ã³ãã¹ã¯ã¼ããè¨å®ãã¦ãæå·åã㦠state ãã¡ã¤ã«ã«ä¿åã§ããããã«ãªã£ãã®ã§ãã£ã¦ã¿ã¾ããã¨ããããããç¡ãå 容ã§ãããã¾ãã æ¦è¦ Terraformã§IAM Userã使ãã¾ãã管çç»é¢ãã°ã¤ã³ç¨ã®ãã¹ã¯ã¼ãè¨å®ãè¡ãããã¹ã¯ã¼ãã¯æå·åãããç¶æ ã§ terraform.state ã«ä¿åããã¾ãã aws_iam_user_login_profile ã«æ¸ãã¦ããã¾ããã使ç¨ããå ¬ééµã¯ base64 ã§ã¨ã³ã³ã¼ããããã®ãç´æ¸ãããããkeybase ã®ã¦ã¼ã¶ã¼åãå ¥åãããã¨ã«ãªã£ã¦
AWS Security Blog How to Rotate Access Keys for IAM Users Changing access keys (which consist of an access key ID and a secret access key) on a regular schedule is a well-known security best practice because it shortens the period an access key is active and therefore reduces the business impact if they are compromised. Having an established process that is run regularly also ensures the operation
ãã¹ããã©ã¯ãã£ã¹ã¯ãã¢ã¯ã»ã¹ãã¼ã®ãããªé·æçèªè¨¼æ å ±ã使ããã®ã§ã¯ãªããIAM ãã¼ã«ãªã©ã®ä¸æçãªã»ãã¥ãªãã£èªè¨¼æ å ±ã使ç¨ãããã¨ã§ããã¢ã¯ã»ã¹ãã¼ã使ããåã«ãé·æçãªã¢ã¯ã»ã¹ãã¼ã®ä»£æ¿æ¡ã確èªãã¦ãã ããã ã¢ã¯ã»ã¹ãã¼ã¯ãIAM ã¦ã¼ã¶ã¼ã¾ã㯠AWS ã¢ã«ã¦ã³ãã®ã«ã¼ãã¦ã¼ã¶ã¼ ã®é·æçãªèªè¨¼æ å ±ã§ããã¢ã¯ã»ã¹ãã¼ã使ç¨ãã¦ãAWS CLI ã¾ã㯠AWS API (ç´æ¥ã¾ã㯠AWS SDK ã使ç¨) ã«ããã°ã©ã ã§ãªã¯ã¨ã¹ãã«ç½²åãããã¨ãã§ãã¾ãã詳細ã«ã¤ãã¦ã¯ããAWS ã»ãã¥ãªãã£èªè¨¼æ å ±ã使ç¨ãã¦ããã°ã©ã ã§ã¢ã¯ã»ã¹ããããåç §ãã¦ãã ããã ã¢ã¯ã»ã¹ãã¼ã¯ãã¢ã¯ã»ã¹ãã¼ ID (ä¾: AKIAIOSFODNN7EXAMPLE) ã¨ã·ã¼ã¯ã¬ããã¢ã¯ã»ã¹ãã¼ (ä¾: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) ã® 2 ã¤
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}