[B! iam] kiririmodeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kiririmode id:kiririmode

iamã«é–¢ã™ã‚‹kiririmodeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (33)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

MFAèªè¨¼ã‚’ä½¿ã£ãŸAssumeRoleã§ã‚·ãƒ³ãƒ—ãƒ«ã«Terraformã‚’å®Ÿè¡Œã™ã‚‹(aws configure export-credentials) | DevelopersIO
kiririmode 2025/05/03
terraformä»¥å¤–ã®ãƒ„ãƒ¼ãƒ«ãªã—ã«mfaè¦ã®switchroleã«å¯¾å¿œã§ãã‚‹ã®ã‹

terraform

aws

iam
ãƒªãƒ³ã‚¯
AWS Lambda ã®ã‚¢ã‚¯ã‚»ã‚¹è¨±å¯ã‚’ç´è§£ã - KAYAC Engineers' Blog
SREãƒãƒ¼ãƒ ã®æ©‹æœ¬ã§ã™ã€‚SREé€£è¼‰ã®11æœˆå·ã«ãªã‚Šã¾ã™ã€‚ AWSã®å¤šãã®ãƒªã‚½ãƒ¼ã‚¹ã¯IAMã§ã‚¢ã‚¯ã‚»ã‚¹ã‚’ä¸€å…ƒç®¡ç†ã•ã‚Œã¦ã„ã¾ã™ãŒã€Lambdaã§ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå®Ÿè¡Œã—ãŸã‚Šä»–ã®AWSã‚µãƒ¼ãƒ“ã‚¹ã‹ã‚‰å®Ÿè¡Œã•ã‚ŒãŸã‚Šã™ã‚‹éƒ½åˆä¸Šã€æ§˜ã€…ãªãƒãƒªã‚·ãƒ¼ãŒçµ¡ã‚“ã§ã„ã¾ã™ã€‚ ç‰¹ã«ã€ŒLambdaã‚’å‘¼ã³å‡ºã™è¨±å¯ã€ã«ã¤ã„ã¦ã¯IDï¼ˆã‚¢ã‚¤ãƒ‡ãƒ³ãƒ†ã‚£ãƒ†ã‚£ï¼‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒªã‚·ãƒ¼ã¨ãƒªã‚½ãƒ¼ã‚¹ãƒ™ãƒ¼ã‚¹ã®ãƒãƒªã‚·ãƒ¼ã§å†…å®¹ãŒè¢«ã‚‹ãŸã‚ã€ã©ã¡ã‚‰ã§è¨å®šã™ã‚‹ã‹æ··ä¹±ã—ã¦ã„ã‚‹ã‚±ãƒ¼ã‚¹ã‚‚è¦‹ã‚‰ã‚Œã¾ã™ã€‚ æœ¬è¨˜äº‹ã§ã¯ã“ã†ã—ãŸãƒãƒªã‚·ãƒ¼äº‹æƒ…ã‚’terraformã®ä¾‹ã¨å…±ã«æ•´ç†ã—ã€æ¨©é™è¨å®šã®ãƒ™ã‚¹ãƒˆãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã‚‚æ¤œè¨Žã—ã¾ã™ã€‚ ãã‚‚ãã‚‚IAMã®ãƒãƒªã‚·ãƒ¼ã«ã¤ã„ã¦ ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã«ã‚ˆã‚Œã°AWSã®ãƒãƒªã‚·ãƒ¼ã¯å®Ÿã«6ç¨®é¡žã‚‚ã®ã‚¿ã‚¤ãƒ—ãŒã‚ã‚Šã¾ã™ãŒã€ã€Œä½¿ç”¨é »åº¦ã®é«˜ã„ã‚‚ã®ã‹ã‚‰ã€ã¨ã‚ã‚‹ã‚ˆã†ã«æœ€åˆã®IDãƒ™ãƒ¼ã‚¹ãŒéžå¸¸ã«å¤šãã®ã‚µãƒ¼ãƒ“ã‚¹ã§å…±é€šã—ã¦ä½¿ã‚ã‚Œã¦ãŠã‚Šã€æ¬¡ã„ã§2ç•ªç›®ã®ãƒªã‚½ãƒ¼ã‚¹ãƒ™ãƒ¼ã‚¹ãŒä¸€éƒ¨ã‚µãƒ¼ãƒ“ã‚¹ã§å¿…è¦ã«ãªã‚‹ã§ã—ã‚‡ã†ã€‚
kiririmode 2024/10/03
Lambdaã‚’å‘¼ã³å‡ºã™æ™‚ã®permissionã¯idãƒ™ãƒ¼ã‚¹ã€ãƒªã‚½ãƒ¼ã‚¹ãƒ™ãƒ¼ã‚¹ã€ãã‚‚ãã‚‚è¦ã‚‰ãªã„ã¨ã„ã†ãƒ‘ã‚¿ãƒ¼ãƒ³ãŒæ··åœ¨ã€‚

lambda

aws

iam
ãƒªãƒ³ã‚¯
AWS User Notificationsã§ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã¸ã®ã‚µã‚¤ãƒ³ã‚¤ãƒ³ã‚’é€šçŸ¥ã™ã‚‹ | DevelopersIO
AWS User Notifications ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã—ã¦ AWS ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã¸ã®ã‚µã‚¤ãƒ³ã‚¤ãƒ³ã‚’ãƒ¡ãƒ¼ãƒ«é€šçŸ¥ã™ã‚‹è¨å®šã‚’è©¦ã—ã¦ã¿ã¾ã—ãŸã€‚ ã‚µã‚¤ãƒ³ã‚¤ãƒ³é€šçŸ¥ã¯æ¬¡ã®ãƒ–ãƒã‚°ã§ã‚‚ç´¹ä»‹ã—ã¦ã„ã‚‹é€šã‚Šã€Amazon EventBridge ãƒ«ãƒ¼ãƒ«ã‚’ä½œæˆã™ã‚‹æ–¹æ³•ã§ã‚‚å®Ÿç¾ã§ãã¾ã™ãŒã€é€šçŸ¥æ–‡ã‚’æ•´å½¢ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã—ãŸã€‚AWS User Notifications ã§è¨å®šã™ã‚‹å ´åˆã¯é€šçŸ¥å†…å®¹ã‚’ AWS å´ã§è¦‹ã‚„ã™ãã—ã¦ãã‚Œã‚‹ãƒ¡ãƒªãƒƒãƒˆãŒã‚ã‚Šã¾ã™ï¼ˆè£ã§ã¯ Amazon EventBridge ãƒ«ãƒ¼ãƒ«ãŒä½œæˆã•ã‚Œã¾ã™ï¼‰ã€‚ å‚è€ƒãƒ–ãƒã‚°ã®æ–¹æ³•ï¼ˆAmazon EventBridge ã§è¨å®šã—ã€å…¥åŠ›ãƒˆãƒ©ãƒ³ã‚¹ãƒ•ã‚©ãƒ¼ãƒžãƒ¼ã§é€šçŸ¥å†…å®¹ã‚’æ•´å½¢ï¼‰ã®é€šçŸ¥ä¾‹ã§ã™ã€‚ æœ¬ãƒ–ãƒã‚°ã§è¨å®šã™ã‚‹ AWS User Notifications ã®é€šçŸ¥ä¾‹ã§ã™ã€‚ AWS ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã¸ã®ã‚µã‚¤ãƒ³ã‚¤ãƒ³é€šçŸ¥è¨å®š ä»Šå›žè¨å®šã™ã‚‹ç’°å¢ƒã¯ AWS Orga
kiririmode 2023/06/12
User Notificationsã‚’ä½¿ã£ã¦ã€ãƒžãƒã‚³ãƒ³ãƒã‚°ã‚¤ãƒ³ã‚’ãƒ¡ãƒ¼ãƒ«é€šçŸ¥ã™ã‚‹

monitoring

aws

iam
ãƒªãƒ³ã‚¯
Serverless IAM Roles Per Function - Serverless Framework: Plugins
kiririmode 2022/11/23
serverless frameworkã§function blockã«iam roleã‚’è¨˜è¿°ã§ãã‚‹ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã€‚provider levelã®ãƒãƒ¼ãƒ«ã®ä¸Šæ›¸ãã€ç¶™æ‰¿ã‚‚é¸æŠžå¯èƒ½

serverlessframework

iam
ãƒªãƒ³ã‚¯
Amazon S3 Presigned URLã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚’æ·±å €ã‚Šã™ã‚‹ - Qiita
ã¯ã˜ã‚ã« S3ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶å¾¡ã™ã‚‹ãŸã‚ã«æ§˜ã€…ãªæ©Ÿèƒ½ãŒã‚ã‚Šã¾ã™ãŒã€ã“ã‚Œã‚‰ã¯IAMã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã¨æ··åŒã—ã¦è€ƒãˆã‚‰ã‚Œã‚‹ã“ã¨ãŒå¤šãã€ä¸¡æ–¹ã®æ©Ÿèƒ½ã®é–¢é€£ã«ã¤ã„ã¦ã€è³ªå•ã‚’éžå¸¸ã«å¤šãå—ã‘ã¦ã„ã¾ã™ã€‚ ä»¥å‰ã« S3ã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã¯ã¾ãšã‚·ãƒ³ãƒ—ãƒ«ã«æ‰ãˆã¦å¯¾å¿œã™ã¹ã ã¨ã„ã†è¨˜äº‹ã‚’æ›¸ãã¾ã—ãŸãŒã€ã“ã®è¨˜äº‹ã«æ›¸ã„ãŸã‚ˆã†ã«ã€S3ãƒã‚±ãƒƒãƒˆãƒãƒªã‚·ãƒ¼ã¨IAMãƒãƒªã‚·ãƒ¼ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªé•ã„ãŒã‚ã‚Šã¾ã™ã€‚ S3ãƒã‚±ãƒƒãƒˆãƒãƒªã‚·ãƒ¼ã¯ã€S3å´ã§ã€ã‚¨ãƒ³ãƒ†ã‚£ãƒ†ã‚£ã‹ã‚‰è¡Œã‚ã‚Œã‚‹ã‚¢ã‚¯ã‚»ã‚¹ã®åˆ¶å¾¡ IAMãƒãƒªã‚·ãƒ¼ã®å ´åˆã€ã‚¨ãƒ³ãƒ†ã‚£ãƒ†ã‚£å´ã§ã€S3ã«å¯¾ã—ã¦è¡Œã†ã‚¢ã‚¯ã‚»ã‚¹ã®åˆ¶å¾¡ ã“ã®ã‚ˆã†ã«ã€ä¸¡è€…ã§ã¯è¨å®šç®‡æ‰€ãŠã‚ˆã³åˆ¶å¾¡ã™ã‚‹æ“ä½œã®çŸ¢å°ã®æ–¹å‘ãŒç•°ãªã‚Šã¾ã™ã€‚ åŸºæœ¬ã¯ã“ã®2ã¤ã§S3ãƒã‚±ãƒƒãƒˆã‚„ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã«å¯¾ã™ã‚‹ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚’è¡Œã„ã¾ã™ãŒã€ã“ã®2ã¤ã«åŠ ãˆã¦ã€å…¨ãç•°ãªã‚‹ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã®è¦ç´ ãŒåŠ ã‚ã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ ãã®ä»£è¡¨ä¾‹ã¨è¨€ãˆã‚‹ ã€ŒPresigned URLã€ ã‚’ä»Šå›žã¯å–ã‚Šä¸Šã’
kiririmode 2022/09/11
iam

aws

s3
ãƒªãƒ³ã‚¯
In AWS IAM, What is the Purpose/Use of the "Path" Variable?
The path variable in IAM is used for grouping related users and groups in a unique namespace, usually for organizational purposes. From Friendly Names and Paths: If you are using the IAM API or AWS Command Line Interface (AWS CLI) to create IAM entities, you can also give the entity an optional path. You can use a single path, or nest multiple paths as if they were a folder structure. For example,
kiririmode 2022/05/21
IAM Roleã«è¨å®šé …ç›®ã¨ã—ã¦å˜åœ¨ã™ã‚‹ Path ã®ç›®çš„

iam
ãƒªãƒ³ã‚¯
IAM ãƒãƒ¼ãƒ«ã®ä¿¡é ¼ãƒãƒªã‚·ãƒ¼ã§è¨å®šã™ã‚‹å¤–éƒ¨ ID(sts:ExternalId) ã«ã¤ã„ã¦ | DevelopersIO
ã“ã‚“ã«ã¡ã¯ã€å²©åŸŽã§ã™ã€‚ 3rd Party è£½ã® SaaS ã¨ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’é€£æºã™ã‚‹éš›ã€å°‚ç”¨ã® IAM ãƒãƒ¼ãƒ«ã®ä½œæˆã¨ä½œæˆã—ãŸãƒãƒ¼ãƒ«ã«ä»¥ä¸‹ã®ã‚ˆã†ãªä¿¡é ¼ãƒãƒªã‚·ãƒ¼ã‚’å®šç¾©ã—ã¦ã€ç‰¹å®šã® AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‹ã‚‰ AssumeRole ã‚’è¨±å¯ã™ã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::xxxxxxxxxxxx:iamuser" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "xxxxxxxxxxxx" } } } ] } Condition ã«ã¯ sts:ExternalId ã¨ã‚ã‚Š
kiririmode 2022/05/19
externalIdã¯æ··ä¹±ã—ãŸä»£ç†å•é¡Œã‚’è§£æ±ºã™ã‚‹ã‚‚ã®ã€‚ ã‚ˆãã‚ã‹ã‚‰ãªã„ã®ã¯ãªãœCognitoãŒSNSã‚’åˆ©ç”¨ã™ã‚‹ã¨ãã« externalIdãŒå¿…è¦ãªã®ã‹â€¦

iam

aws
ãƒªãƒ³ã‚¯
[UPDATE]ãƒ•ã‚§ãƒ‡ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã§ã‚¿ã‚°ã‚’æ¸¡ã›ã‚‹STSã®æ–°æ©Ÿèƒ½Session TagãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸ #reinvent | DevelopersIO
ã“ã‚“ã«ã¡ã¯ã€è‡¼ç”°ã§ã™ã€‚ ã¿ãªã•ã‚“ã€IDç®¡ç†ã—ã¦ã„ã¾ã™ã‹ï¼Ÿ ä»Šå›žã¯IDãƒ•ã‚§ãƒ‡ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã§IAMã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹éš›ã«ã€IdPã‹ã‚‰å±žæ€§(Attribute)ã‚’AWSã®ã‚¿ã‚°ã¨ã—ã¦å—ã‘å–ã‚‹ã“ã¨ãŒã§ãã‚‹Session Tagã®æ©Ÿèƒ½ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸã®ã§ç´¹ä»‹ã—ã¾ã™ã€‚ New for Identity Federation â€“ Use Employee Attributes for Access Control in AWS | AWS News Blog RBACã¨ABAC è‰¯ã•ã‚’çŸ¥ã‚‹ã«ã¯ã¾ãšèƒŒæ™¯ã‹ã‚‰ã€‚ ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã®æ–¹å¼ã¨ã—ã¦RBAC(Role-based Access Control)ãŒã‚ˆãä½¿ã‚ã‚Œã¾ã™ã€‚RBACã§ã¯ã€æ¨©é™ã‚’å€‹äººã§ã¯ãªãRole(å½¹å‰²)ã«å‰²ã‚Šå½“ã¦ã¦ç®¡ç†ã™ã‚‹æ–¹æ³•ã§ã€å€‹äººã”ã¨ãƒãƒªã‚·ãƒ¼ã‚’ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã—ãªãã¦è‰¯ããªã‚‹ã®ã§ãƒ¦ãƒ¼ã‚¶ãŒå¢—ãˆã¦ã‚‚ç®¡ç†ãŒæ¥½ã«ãªã‚‹ä»•çµ„ã¿ã§ã—ãŸã€‚ ã—ã‹ã—ã“ã‚Œã‚‚é€²ã‚“ã§ãã‚‹ã¨ã€ä»Šåº¦ã¯
kiririmode 2021/12/04
ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¿ã‚°ã®ãƒ¦ãƒ¼ã‚¹ã‚±ãƒ¼ã‚¹ã€‚Idpã‹ã‚‰attributeã‚’é€£æºã—ã€ABACã‚’è¡Œã†ãŸã‚

aws

iam
ãƒªãƒ³ã‚¯
AWSã®CLIä½œæ¥ã¯ã©ã“ã§è¡Œã†ï¼Ÿ å®‰å…¨ã«ç®¡ç†ã™ã‚‹ãƒ‘ã‚¿ãƒ¼ãƒ³ã¨ãƒ¡ãƒªãƒ‡ãƒ¡é›† | DevelopersIO
AWSã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ„è˜å‘ä¸Šå§”å“¡ä¼šã£ã¦ä½•ï¼Ÿ æ˜¨ä»Šã€AWSã®ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’æ¼æ´©ã•ã›ã¦ã—ã¾ã†ã“ã¨ãŒåŽŸå› ã§ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¸ã®ä¾µå…¥ã‚’å—ã‘ã€ å¤šé¡ã®åˆ©ç”¨è²»ç™ºç”Ÿãƒ»æƒ…å ±æ¼æ´©ç–‘ã„ãªã©é‡å¤§ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£äº‹æ¡ˆãŒç™ºç”Ÿã™ã‚‹ã‚±ãƒ¼ã‚¹ãŒå®Ÿéš›ã«å¤šã€…èµ·ãã¦ã„ã¾ã™ã€‚ ãã“ã§ã€ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼é‹ç”¨ã«é–¢ã™ã‚‹å®‰å…¨å‘ä¸Šã®å–çµ„ã¿ã‚’ãƒ–ãƒã‚°ã§ã”ç´¹ä»‹ã™ã‚‹ä¼ç”»ã‚’ã¯ã˜ã‚ã¾ã—ãŸã€‚ ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’åˆ©ç”¨ã™ã‚‹å ´åˆã¯åˆ©ç”¨ã™ã‚‹ä¸Šã§ã®ãƒªã‚¹ã‚¯ã‚’æ£ã—ãç†è§£ã—ã€ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’äº‹å‰ã«é©ç”¨ã—ãŸä¸Šã§é©åˆ‡ã«ã”åˆ©ç”¨ãã ã•ã„ã€‚ AWS CLIã€ã©ã“ã‹ã‚‰ä½¿ã£ã¦ã„ã¾ã™ã‹ï¼Ÿ ã–ã£ãã‚Šã€ä»¥ä¸‹4ç¨®é¡žã®ã©ã‚Œã‹ã‚’ä½¿ã£ã¦ã„ã‚‹æ–¹ãŒå¤šæ•°æ´¾ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ ãƒãƒ¼ã‚«ãƒ«ç«¯æœ« AWSå†…ã«æ§‹ç¯‰ã—ãŸç®¡ç†ç”¨EC2ã«SSHã‚’åˆ©ç”¨ã—ã¦æŽ¥ç¶š AWSå†…ã«æ§‹ç¯‰ã—ãŸç®¡ç†ç”¨EC2ã«SSM(ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒžãƒãƒ¼ã‚¸ãƒ£)ã‚’åˆ©ç”¨ã—ã¦æŽ¥ç¶š AWS CloudShell ä¸€ä½“ã©ã†é•ã†ã®ã§ã—ã‚‡ã†ã‹ã€‚ çŠ¶æ³ã«ã‚ˆã£ã¦è‰¯ã—æ‚ªã—ã¯ç•°ãªã‚‹
kiririmode 2021/05/29
aws

iam

ssm

security
ãƒªãƒ³ã‚¯
IAM ID - AWS Identity and Access Management
IAM ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã€IAM ã‚°ãƒ«ãƒ¼ãƒ—ã€ãƒãƒ¼ãƒ«ã€ãƒãƒªã‚·ãƒ¼ã€ãŠã‚ˆã³ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã«å¯¾ã—ã¦ã„ãã¤ã‹ã®ç•°ãªã£ãŸ ID ã‚’ä½¿ã„ã¾ã™ã€‚ã“ã®ã‚»ã‚¯ã‚·ãƒ§ãƒ³ã§ã¯ã€ID ãŠã‚ˆã³ãã‚Œãžã‚Œã® ID ã®ä½¿ã„æ–¹ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ ãƒ•ãƒ¬ãƒ³ãƒ‰ãƒªåã¨ãƒ‘ã‚¹ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã€ãƒãƒ¼ãƒ«ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚°ãƒ«ãƒ¼ãƒ—ã€ã¾ãŸã¯ãƒãƒªã‚·ãƒ¼ã‚’ä½œæˆã™ã‚‹å ´åˆã€ã¾ãŸã¯ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã™ã‚‹å ´åˆã¯ã€ã‚ã‹ã‚Šã‚„ã™ã„åå‰ã‚’ä»˜ã‘ã¾ã™ã€‚ãŸã¨ãˆã°ã€Bobã€TestApp1ã€é–‹ç™ºè€…ã€ManageCredentialsPermissionsã€ProdServerCert ãªã©ãŒã‚ã‚Šã¾ã™ã€‚ IAM API ã¾ãŸã¯ AWS Command Line Interface (AWS CLI) ã‚’ä½¿ç”¨ã—ã¦ IAM ãƒªã‚½ãƒ¼ã‚¹ã‚’ä½œæˆã™ã‚‹å ´åˆã€ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã®ãƒ‘ã‚¹ã‚’è¿½åŠ ã§ãã¾ã™ã€‚å˜ä¸€ã®ãƒ‘ã‚¹ã‚’ä½¿ç”¨ã™ã‚‹ã“ã¨ã‚‚ã€è¤‡æ•°ã®ãƒ‘ã‚¹ã‚’ãƒ•ã‚©ãƒ«ãƒ€ãƒ¼æ§‹é€ ã¨ã—ã¦ãƒã‚¹ãƒˆã™ã‚‹ã“ã¨ã‚‚ã§ãã¾ã™ã€‚ãŸã¨ãˆã°ã€ä¼šç¤¾ã®çµ„ç¹”æ§‹é€ ã«
kiririmode 2020/12/06
IAMã«ã¯ãƒ•ãƒ¬ãƒ³ãƒ‰ãƒªåã‚„ARNã¨ã¯åˆ¥ã«ã€åŒåã®IAM IDã¨ã¯åˆ¥å€‹ã«ä¸€æ„è˜åˆ¥åãŒå˜åœ¨ã™ã‚‹

iam

aws
ãƒªãƒ³ã‚¯
PCI DSSå¯¾å¿œ AWS ä¸Šã®è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã§ã®æ“ä½œãƒã‚°å–å¾—ã€MFAã€ã‚¢ã‚¤ãƒ‰ãƒ«ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆã‚’å®Ÿç¾ | DevelopersIO
PCI DSS ã«å¯¾å¿œã™ã¹ã Linux ã‚µãƒ¼ãƒãƒ¼ã®æ“ä½œå±¥æ´ã‚’ S3 ã¸ä¿å˜ã™ã‚‹ã€ãƒã‚°ã‚¤ãƒ³æ™‚ã« MFA ã‚’ä½¿ç”¨ã™ã‚‹ã€ã‚¢ã‚¤ãƒ‰ãƒ«ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆã‚’å®Ÿè£…ã™ã‚‹æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€‚ ã”æ©Ÿå«Œã„ã‹ãŒã§ã—ã‚‡ã†ã‹ã€‚ "No human labor is no human error" ãŒå¤§å¥½ããª ãƒã‚¯ã‚¹ãƒˆãƒ¢ãƒ¼ãƒ‰æ ªå¼ä¼šç¤¾ ã®å‰äº•ã§ã™ã€‚ AWS ä¸Šã®è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ (ã“ã“ã§ã¯ Amazon Linux 2 ã‚’æƒ³å®šã—ã¦ã„ã¾ã™) ã§ã®æ“ä½œå±¥æ´ã‚’ S3 ã¸ä¿å˜ã™ã‚‹ã€ãƒã‚°ã‚¤ãƒ³æ™‚ã« MFA ã‚’ä½¿ç”¨ã™ã‚‹ã€ã‚¢ã‚¤ãƒ‰ãƒ«ã‚¿ã‚¤ãƒ ã‚¢ã‚¦ãƒˆã‚’å®Ÿè£…ã™ã‚‹æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ PCI DSS ã®é–¢é€£ã—ã¦ä»¥ä¸‹ã®ã‚ˆã†ãªè¦ä»¶ãŒã‚ã‚Šã€ã“ã‚Œã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã«è€ƒãˆãŸæ–¹æ³•ã§ã™ã€‚ ssh ãƒã‚°ã‚¤ãƒ³ã¯ Google Authenticator ã‚’åˆ©ç”¨ã—ãŸäºŒè¦ç´ èªè¨¼ã«ã—ãŸã„ ssh ãƒã‚°ã‚¤ãƒ³å¾Œã®æ“ä½œãƒã‚°(ã‚³ãƒžãƒ³ãƒ‰ãƒã‚°)ã‚’ä¿ç®¡ã—ãŸã„ è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰æ›´ã«æ¥å‹™ã‚µ
kiririmode 2020/11/01
SSMæ“ä½œãƒã‚°

aws

iam

ssm
ãƒªãƒ³ã‚¯
SSM ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼ã§ã‚µãƒ¼ãƒãƒ¼ä¸Šã®æ“ä½œãƒã‚°ã‚’å–å¾— | DevelopersIO
ã“ã‚“ã«ã¡ã¯ã€‚ ã”æ©Ÿå«Œã„ã‹ãŒã§ã—ã‚‡ã†ã‹ã€‚ "No human labor is no human error" ãŒå¤§å¥½ããªå‰äº• äº®ã§ã™ã€‚ AWS ä¸Šã® EC2 ã«å¯¾ã—ã¦ãƒªãƒ¢ãƒ¼ãƒˆã§ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã™ã‚‹éš›ã« ç›£æŸ»ã®è¦ä»¶ã§ã‚µãƒ¼ãƒãƒ¼ä¸Šã®æ“ä½œãƒã‚°ã‚’å–å¾—ã—ã‘ã‚Œã°ãªã‚‰ãªã„ã‚·ã‚¹ãƒ†ãƒ ã¯æ•°å¤šã„ã¨æ€ã„ã¾ã™ã€‚ ä»Šå›žã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼ã‚’ä½¿ã£ã¦ ã‚µãƒ¼ãƒãƒ¼ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹æ“ä½œãƒã‚°ã‚’å¾¹åº•çš„ã«è¨˜éŒ²ã—ã¦ã¿ã¾ã™ã€‚ å‰æ ä»¥ä¸‹ã®ã‚ˆã†ãªå‰æã‚’ç½®ãã¾ã—ãŸã€‚ ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯å¿…ãšè¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã‚’çµŒç”±ã™ã‚‹ è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã¸ã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼çµŒç”±ã§ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ SSH ãƒãƒ¼ãƒˆã¯é–‹æ”¾ã—ãªã„ è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹è¨±å¯ã¯ IAM ã§ç®¡ç† è¸ã¿å°ã‚µãƒ¼ãƒãƒ¼ã¯ Amazon Linux 2 ãƒã‚°ã‚¤ãƒ³ã¯ãƒ¡ãƒ¼ãƒ«é€šçŸ¥ ãƒã‚°ã‚¤ãƒ³å¾Œã®æ“ä½œãƒã‚°ã¯ S3 ã¸ä¿ç®¡ æº–å‚™ ãƒªãƒ¢ãƒ¼ãƒˆãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã‚’è¡Œã†ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆ PC ã« AWS CLI ã¨ Ses
kiririmode 2020/11/01
ssmã§ã®æ“ä½œãƒã‚°æœ‰åŠ¹åŒ–ã¨æŽ¥ç¶šæ™‚ãƒ¡ãƒ¼ãƒ«

ssm

iam

aws

devops
ãƒªãƒ³ã‚¯
ç¬¬ä¸‰è€…ãŒæ‰€æœ‰ã™ã‚‹ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ - AWS Identity and Access Management
çµ„ç¹”å†…ã® AWS ãƒªã‚½ãƒ¼ã‚¹ã¸çµ„ç¹”å¤–ã®ç¬¬ä¸‰è€…ãŒã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹å¿…è¦ãŒã‚ã‚‹å ´åˆã«ã¯ã€ãƒãƒ¼ãƒ«ã‚’ä½¿ç”¨ã™ã‚‹ã“ã¨ã§ã‚¢ã‚¯ã‚»ã‚¹è¨±å¯ã‚’å§”ä»»ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ãŸã¨ãˆã°ã€çµ„ç¹”å†…ã® AWS ãƒªã‚½ãƒ¼ã‚¹ã®ç®¡ç†ã‚’ç¬¬ä¸‰è€…ã¸å§”è¨—ã—ã¦ã„ã‚‹ã‚ˆã†ãªå ´åˆãŒç›¸å½“ã—ã¾ã™ã€‚IAM ãƒãƒ¼ãƒ«ã‚’ä½¿ç”¨ã™ã‚‹ã“ã¨ã§ã€AWS ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èªè¨¼æƒ…å ±ã‚’å…±æœ‰ã™ã‚‹ã“ã¨ãªãç¬¬ä¸‰è€…ã« AWS ãƒªã‚½ãƒ¼ã‚¹ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’è¨±å¯ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ç¬¬ä¸‰è€…ã¯ä»£ã‚ã‚Šã«ã€AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ ã«ä½œæˆã—ãŸãƒãƒ¼ãƒ«ã‚’å¼•ãå—ã‘ã‚‹ã“ã¨ã§ã€AWS ãƒªã‚½ãƒ¼ã‚¹ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ãã¾ã™ã€‚ä¿¡é ¼ã‚¾ãƒ¼ãƒ³ (ä¿¡é ¼ã§ãã‚‹çµ„ç¹”ã¾ãŸã¯ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ) å¤–ã«ã‚ã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ãƒ—ãƒªãƒ³ã‚·ãƒ‘ãƒ«ã«ãƒãƒ¼ãƒ«ã‚’å¼•ãå—ã‘ã‚‹ã‚¢ã‚¯ã‚»ã‚¹æ¨©ãŒã‚ã‚‹ã‹ã©ã†ã‹ã«ã¤ã„ã¦ã¯ã€ã€ŒIAM Access Analyzer ã¨ã¯ã€ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚ ç¬¬ä¸‰è€…ã¯ã€ä»¥ä¸‹ã®æƒ…å ±ã‚’æä¾›ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã‚‰ã®æƒ…å ±ã¯ã€ç¬¬ä¸‰è€…ãŒå¼•ãå—ã‘ã‚‹ã“ã¨ã®ã§ãã‚‹ãƒãƒ¼ãƒ«ã®ä½œæˆã«å¿…è¦ã§ã™ã€‚
kiririmode 2020/09/20
externalIDãŒå¿…è¦ãªç†ç”±

aws

iam
ãƒªãƒ³ã‚¯
AWS: æ—¥ä»˜ã¨æ™‚åˆ»ã«åŸºã¥ã„ã¦ã‚¢ã‚¯ã‚»ã‚¹ã‚’è¨±å¯ã—ã¾ã™ - AWS Identity and Access Management
ã“ã®ä¾‹ã§ã¯ã€æ—¥ä»˜ã¨æ™‚åˆ»ã«åŸºã¥ã„ã¦ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’è¨±å¯ã™ã‚‹ ID ãƒ™ãƒ¼ã‚¹ãƒãƒªã‚·ãƒ¼ã‚’ä½œæˆã™ã‚‹æ–¹æ³•ã‚’ç¤ºã—ã¾ã™ã€‚ã“ã®ãƒãƒªã‚·ãƒ¼ã¯ã€2020 å¹´ 4 æœˆ 1 æ—¥ã‹ã‚‰ 2020 å¹´ 6 æœˆ 30 æ—¥ (UTC) ã®é–“ã«ç™ºç”Ÿã™ã‚‹ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶é™ã—ã¾ã™ã€‚ã“ã®ãƒãƒªã‚·ãƒ¼ã§ã¯ã€AWS API ã¾ãŸã¯ AWS CLI ã‹ã‚‰ã€ã“ã®ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’ãƒ—ãƒã‚°ãƒ©ãƒ ã§å®Œäº†ã™ã‚‹ãŸã‚ã«å¿…è¦ãªã‚¢ã‚¯ã‚»ã‚¹æ¨©ã‚’è¨±å¯ã—ã¾ã™ã€‚ã“ã®ãƒãƒªã‚·ãƒ¼ã‚’ä½¿ç”¨ã™ã‚‹ã«ã¯ã€ã‚µãƒ³ãƒ—ãƒ«ãƒãƒªã‚·ãƒ¼ã®ã‚¤ã‚¿ãƒªãƒƒã‚¯ä½“ã®ãƒ—ãƒ¬ãƒ¼ã‚¹ãƒ›ãƒ«ãƒ€ãƒ¼ãƒ†ã‚ã‚¹ãƒˆã‚’ç‹¬è‡ªã®æƒ…å ±ã«ç½®ãæ›ãˆã¾ã™ã€‚æ¬¡ã«ã€ãƒãƒªã‚·ãƒ¼ã®ä½œæˆã¾ãŸã¯ãƒãƒªã‚·ãƒ¼ã®ç·¨é›†ã®æ‰‹é †ã«å¾“ã„ã¾ã™ã€‚ IAM ãƒãƒªã‚·ãƒ¼ã® Condition ãƒ–ãƒãƒƒã‚¯å†…ã§è¤‡æ•°ã®æ¡ä»¶ã‚’ä½¿ç”¨ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ã¯ã€ã€Œæ¡ä»¶å†…ã®è¤‡æ•°ã®å€¤ã€ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚
kiririmode 2020/09/12
AWSã§ã‚‚æ™‚é™ã‚’æŒã£ãŸæ¨©é™å¤‰æ›´ã¯ã§ãã‚‹ã€‚ä¸€æ™‚çš„ã«ãƒãƒ¼ãƒ«ã‚’è¿½åŠ ã—ã¦æ™‚é™æ€§ã‚’æŒã£ãŸãƒãƒªã‚·ãƒ¼ã‚’æŒãŸã›ã‚¹ã‚¤ãƒƒãƒãƒãƒ¼ãƒ«ã—ã¦ä½œæ¥ã—ã¦ã‚‚ã‚‰ãˆã°è‰¯ã„

aws

iam

devops
ãƒªãƒ³ã‚¯
æ¨©é™ã‚’Qray -SREã¸ã®ä¸€æ™‚çš„ãªæœ¬ç•ªç’°å¢ƒæ¨©é™ä»˜ä¸Žã®ã—ãã¿- | ãƒ¡ãƒ«ã‚«ãƒªã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°
ãƒ¡ãƒ«ãƒšã‚¤SREãƒãƒ¼ãƒ ã® @tjunã§ã™ã€‚ã“ã®è¨˜äº‹ã¯ã€Merpay Tech Openness Month 2020 ã®19æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ ä»Šæ—¥ã¯ã€ãƒ¡ãƒ«ãƒšã‚¤SREãƒãƒ¼ãƒ ã®ã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã®ãŸã‚ã«é–‹ç™ºã—ã¦åˆ©ç”¨ã—ã¦ã„ã‚‹ Qray(ã‚¯ãƒ¬ã‚¤) ã¨ã„ã†ãƒ„ãƒ¼ãƒ«ã®è©±ã‚’ã—ã¾ã™ã€‚ ã¯ã˜ã‚ã« ãƒ¡ãƒ«ãƒšã‚¤ã§ã¯ã€Google Cloud Platform(ä»¥ä¸‹GCP)ã‚’åˆ©ç”¨ã—ã¦ã‚µãƒ¼ãƒ“ã‚¹ã‚’æ§‹ç¯‰ã—å‹•ã‹ã—ã¦ã„ã¾ã™ã€‚ GCPã«ã¯ Cloud Identity and Access Management (IAM) ã¨ã„ã†æ¨©é™ç®¡ç†ã®ä»•çµ„ã¿ãŒã‚ã‚Šã¾ã™ã€‚IAMã‚’é©åˆ‡ã«ç®¡ç†ã—ã¦ã€ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã«æœ€ä½Žé™ã®æ¨©é™ã‚’ä»˜ä¸Žã™ã‚‹ã“ã¨ãŒã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã‚’å®‰å…¨ã«åˆ©ç”¨ã™ã‚‹ãŸã‚ã«ã¯å¿…è¦ãªã“ã¨ã§ã™ã€‚ã“ã‚Œã¯SREãŒæŒã¤æœ¬ç•ªç’°å¢ƒã«å¯¾ã™ã‚‹æ¨©é™ã«ã¤ã„ã¦ã‚‚åŒæ§˜ã§ã€ã§ãã‚‹ã ã‘æœ¬ç•ªç’°å¢ƒã«å¯¾ã™ã‚‹æ¨©é™ã‚’æŒãŸãªã„ã‚ˆã†ã«ã—ã¦ãŠããŸã„ã®ã§ã™ãŒã€éšœå®³å¯¾å¿œãªã©æœ¬ç•ªç’°å¢ƒã§ã®ã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³
kiririmode 2020/09/12
æœ¬ç•ªã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ç”¨ã®æ¨©é™å¤‰æ›´ã¨æ‰¿èªã®ã‚·ã‚¹ãƒ†ãƒ ã€‚æ™‚é–“ãƒ™ãƒ¼ã‚¹ã§ã®æ¨©é™ä»˜ä¸Žä¾¿åˆ©ãã†ã€‚

terraform

iam

gcp

devops
ãƒªãƒ³ã‚¯
Terraform Registry
kiririmode 2020/08/04
terraformã§ã‚³ãƒ³ã‚½ãƒ¼ãƒ«ãƒã‚°ã‚¤ãƒ³å¯èƒ½ãªãƒ¦ãƒ¼ã‚¶ã‚’ä½œã‚‹å ´åˆã¯pgpã‹keybaseã®ãƒ¦ãƒ¼ã‚¶åãŒå¿…è¦ã€‚ã•ã™ãŒã«keybaseã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’è¦æ±‚ã™ã‚‹ã®ã¯å¤§è¢ˆè£Ÿã‹ã‚‚ã€‚ã€‚ã€

terraform

aws

iam
ãƒªãƒ³ã‚¯
Terraformï¼‹GPG ã§ IAM User ã«ãƒã‚°ã‚¤ãƒ³ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’è¨å®š | å¤–é“çˆ¶ã®åŒ
AWSï¼‹Terraform ã®è¨˜äº‹ã‚’æ›¸ãã®ã£ã¦ã‚ã¾ã‚Šå¥½ãã˜ã‚ƒãªã„ã‚“ã§ã™ã‘ã©ã€å¹´æœ«ãã‚‰ã„ï¼‘ã¤æ›¸ã„ã¦ãŠã“ã‹ãªã¨ã„ã†ç¾©å‹™æ„Ÿçš„ãªã‚¢ãƒ¬ã§ã™ã€ãƒã‚¤ã€‚ Terraform v0.7.8 ã‹ã‚‰ aws_iam_user_login_profile ãŒè¿½åŠ ã•ã‚Œï¼ˆCHANGELOGï¼‰ã€IAM User ã«ãƒã‚°ã‚¤ãƒ³ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’è¨å®šã—ã¦ã€æš—å·åŒ–ã—ã¦ state ãƒ•ã‚¡ã‚¤ãƒ«ã«ä¿å˜ã§ãã‚‹ã‚ˆã†ã«ãªã£ãŸã®ã§ã‚„ã£ã¦ã¿ã¾ã—ãŸã¨ã„ã†ã€ãŸã‚ã„ç„¡ã„å†…å®¹ã§ã”ã–ã„ã¾ã™ã€‚ æ¦‚è¦ Terraformã§IAM Userã‚’ä½œæˆã—ã¾ã™ã€‚ç®¡ç†ç”»é¢ãƒã‚°ã‚¤ãƒ³ç”¨ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰è¨å®šã‚‚è¡Œã„ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æš—å·åŒ–ã•ã‚ŒãŸçŠ¶æ…‹ã§ terraform.state ã«ä¿å˜ã•ã‚Œã¾ã™ã€‚ aws_iam_user_login_profile ã«æ›¸ã„ã¦ã‚ã‚Šã¾ã™ãŒã€ä½¿ç”¨ã™ã‚‹å…¬é–‹éµã¯ base64 ã§ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã—ãŸã‚‚ã®ã‚’ç›´æ›¸ãã™ã‚‹ã‹ã€keybase ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼åã‚’å…¥åŠ›ã™ã‚‹ã“ã¨ã«ãªã£ã¦
kiririmode 2020/08/04
Terraformã§ã‚³ãƒ³ã‚½ãƒ¼ãƒ«ãƒã‚°ã‚¤ãƒ³å¯èƒ½ãªãƒ¦ãƒ¼ã‚¶ã‚’ä½œã‚‹å ´åˆã¯gpgãŒå¿…é ˆâ€¦ï¼Ÿ

terraform

iam

aws
ãƒªãƒ³ã‚¯
AWS: Mejore el registro de CloudTrail para el rol asumido
kiririmode 2020/06/26
assume-roleæ™‚ã®sessionnameã‚’ãƒ¦ãƒ¼ã‚¶åã«å¼·åˆ¶ã™ã‚‹ã“ã¨ã§èª°ãŒå®Ÿè¡Œã—ãŸã‹ã‚’cloudtrailã§ã‚ã‹ã‚‹ã‚ˆã†ã«ã™ã‚‹æ–¹æ³•ã€‚ã—ãªã„å ´åˆã¯åŒä¸€ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã®assume-roleå®Ÿè¡Œãƒã‚°ã‚’é¡ã‚‹ã“ã¨ã«ãªã‚‹

aws

iam
ãƒªãƒ³ã‚¯
How to Rotate Access Keys for IAM Users | Amazon Web Services
AWS Security Blog How to Rotate Access Keys for IAM Users Changing access keys (which consist of an access key ID and a secret access key) on a regular schedule is a well-known security best practice because it shortens the period an access key is active and therefore reduces the business impact if they are compromised. Having an established process that is run regularly also ensures the operation
kiririmode 2020/06/23
ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã®å…¬å¼æŽ¨å¥¨ãªãƒãƒ¼ãƒ†ãƒ¼ã‚·ãƒ§ãƒ³æ–¹æ³•

aws

iam

devops
ãƒªãƒ³ã‚¯
IAM ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’ç®¡ç†ã—ã¾ã™ã€‚ - AWS Identity and Access Management
ãƒ™ã‚¹ãƒˆãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã¯ã€ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã®ã‚ˆã†ãªé•·æœŸçš„èªè¨¼æƒ…å ±ã‚’ä½œæˆã™ã‚‹ã®ã§ã¯ãªãã€IAM ãƒãƒ¼ãƒ«ãªã©ã®ä¸€æ™‚çš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èªè¨¼æƒ…å ±ã‚’ä½¿ç”¨ã™ã‚‹ã“ã¨ã§ã™ã€‚ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’ä½œæˆã™ã‚‹å‰ã«ã€é•·æœŸçš„ãªã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã®ä»£æ›¿æ¡ˆã‚’ç¢ºèªã—ã¦ãã ã•ã„ã€‚ ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã¯ã€IAM ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¾ãŸã¯ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ãƒ«ãƒ¼ãƒˆãƒ¦ãƒ¼ã‚¶ãƒ¼ ã®é•·æœŸçš„ãªèªè¨¼æƒ…å ±ã§ã™ã€‚ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’ä½¿ç”¨ã—ã¦ã€AWS CLI ã¾ãŸã¯ AWS API (ç›´æŽ¥ã¾ãŸã¯ AWS SDK ã‚’ä½¿ç”¨) ã«ãƒ—ãƒã‚°ãƒ©ãƒ ã§ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«ç½²åã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚è©³ç´°ã«ã¤ã„ã¦ã¯ã€ã€ŒAWS ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£èªè¨¼æƒ…å ±ã‚’ä½¿ç”¨ã—ã¦ãƒ—ãƒã‚°ãƒ©ãƒ ã§ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã€ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚ ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã¯ã€ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ ID (ä¾‹: AKIAIOSFODNN7EXAMPLE) ã¨ã‚·ãƒ¼ã‚¯ãƒ¬ãƒƒãƒˆã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ (ä¾‹: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) ã® 2 ã¤
kiririmode 2020/06/23
â€œã‚¯ãƒã‚¹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚¢ã‚¯ã‚»ã‚¹æ¨©é™ã‚’ä»˜ä¸Žã™ã‚‹å¿…è¦ãŒã‚ã‚‹å ´åˆã€‚ IAM ãƒãƒ¼ãƒ«ã‚’ä½¿ç”¨ã—ã¦ã‚¢ã‚«ã‚¦ãƒ³ãƒˆé–“ã®ä¿¡é ¼ã‚’ç¢ºç«‹ã—ã€ä¿¡é ¼ã§ãã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¸åˆ¶é™ã•ã‚ŒãŸã‚¢ã‚¯ã‚»ã‚¹è¨±å¯ã‚’ 1 ã¤ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ä»˜ä¸Žã—ã¾ã™ã€‚â€

aws

iam
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸