1. 1. OpsJAWS#3 AWSCongRules
2. 2. @oko_chang http://facebook.com/yanase.hideaki http://okochang.hatenablog.jp HR106
3. 3.
4. 4. Serverworks AWS 3201200 APN Premier Consulting Partner APN Managed Service Program 4
5. 5. Cloud Automator
6. 6. Cloud Automator () AWS(Amazon Web Services) AWS AWS AWS AWS CLOUD AUTOMATOR
7. 7. http://slideshare.net/ okochang/
8. 8. Agenda AWS Cong Rules AWS Cong Rules AWS Managed Cong Rules Custom Cong Rules Custom Cong Rules 8
9. 9. AWS Cong Rules 9
10. 10.
11. 11. () Trusted Advisor https://github.com/serverworks/aws-spec https://github.com/k1LoW/awspec
12. 12. AWS Cong Rules AWS Cong AWS 12
13. 13. EC2 IAM CloudTrail
14. 14. CloudTrail EBS EIP
15. 15.
16. 16. AWS Cong Rules 16
17. 17. AWS Cong AWS CongAWS S3SNS
18. 18. Amazon S3
19. 19. Amazon SNS AWS Cong
20. 20. AWS Lambda AWS Custom Rule Node.js Java Python
21. 21. AWS Identity Access Management AWS AWS CongIAM Custom RuleLambda FunctionIAM
22. 22. 22
23. 23. AWS Cong AWS Cong Rules SKIP Settings Resouce types to record Amazon S3 Bucket Amazon SNS Topic IAM Role
24. 24. AWS Cong 24 h#ps://console.aws.amazon.com/cong/home?region=us-east-1
25. 25. 25
26. 26. 26
27. 27. 27
28. 28. 28
29. 29. 29
30. 30. Managed Cong Rule 30
31. 31. Managed Cong Rule AWSCloudTrail n
32. 32. Managed Rule 32
33. 33. Managed Rule 33
34. 34. 34
35. 35. 35
36. 36. 36
37. 37. 37
38. 38. 38
39. 39. 39
40. 40. Custom Cong Rule 40
41. 41. Custom Cong Rule VPCFlow Logs VPC
42. 42. VPCID 42
43. 43. Custom Rule 43
44. 44. Custom Rule 44
45. 45. Custom Rule 45
46. 46. Blue print 46
47. 47. Lambda function 47
48. 48. AWS JavaScript Python
49. 49. 49 h#p://bit.ly/206LSqk
50. 50.
51. 51. def evaluate_owlog(vpc_id) ....... # VPC Flow Logs def evaluate_compliance(vpc_id)....... # def lambda_handler(event, context)....... #
52. 52. EventContext Event congRuleName invokingEvent resourceType noticationCreationTime resultToken ruleParameters Context
53. 53. AWS put_evaluations ComplianceResourceType AWS::EC2::VPC, AWS::EC2::Instance ComplianceResourceId ID vpc-xxxxxx, i-xxxxxxxx, sg-xxxxxxxx ComplianceType COMPLIANTNON_COMPLIANT OrderingTimestamp
54. 54. Lambda function 54
55. 55. IAM 55 h#p://bit.ly/1ScRJpR
56. 56. IAM 56
57. 57. Lambda function 57
58. 58. Lambda functionARN 58
59. 59. Lambda functionARN 59
60. 60. 60
61. 61. 61
62. 62. 62
63. 63. 63
64. 64. Custom Cong Rule 64
65. 65. VPC Flow Logs 65
66. 66. VPC Flow Logs 66
67. 67. VPC Flow LogsIAM 67
68. 68. VPC 68
69. 69. VPC 69
70. 70. 70
71. 71. 71
72. 72. 72
73. 73. S3 CloudWatch Logs Cong Rules Lambda function
74. 74. AWS Cong RulesAWS AWS Cong Rules AWS
75. 75. OpsJAWS AWS Partner SATips http://aws.typepad.com/aws_partner_sa/2015/06/aws-ops.html DoorKeeper: OpsJAWS https://opsjaws.doorkeeper.jp/
76. 76. http://cloudautomator.com