[AWS Black Belt Online Seminar] AWS Config · © 2019, Amazon Web Services, Inc. or its Affiliates....

© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

AWS Webinar

https://amzn.to/JPWebinar https://amzn.to/JPArchive

Security Solutions Architect

2019/06/18

AWS Config

[AWS Black Belt Online Seminar]

https://amzn.to/JPWebinar

https://amzn.to/JPArchive

© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

AWS

Amazon GuardDuty AWS Security Hub


AWS Black Belt Online Seminar

•

•

①吹き出しをクリック②質問を入力③ Sendをクリック

Twitter

#awsblackbelt


• 2019 6 18

AWS (http://aws.amazon.com)

• AWS

AWS

•

• AWS does not offer binding price quotes. AWS pricing is publicly available and is subject to

change in accordance with the AWS Customer Agreement available at

http://aws.amazon.com/agreement/. Any pricing information included in this document is provided

only as an estimate of usage charges for AWS services based on certain information that you

have provided. Monthly charges will be based on your actual use of AWS services, and may vary

from the estimates provided.


•

• AWS Config

• AWS Config Rules

•

•

•


A

A01

2 xx/xx/xx

Corporate data center

DB

Internet

Firewall

Router

L3SW

LB

DB

A

3 xx/xx/xx

Firewall

Router

L3SW

LB


-

-

-

-

B

A01

8 xx/xx/xx

C

A01

8 xx/xx/xx

D

A01

8 xx/xx/xx

E

A01

8 xx/xx/xx

!?!?

A

3 ( )

xx/xx/xx

A

3 ( )

xx/xx/xx


AWS

Tag

AWS Config

Auto Scaling


AWS Config

© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark

AWS Config

•

••

••

•

•AWS Config


AWS Config

AWS Config


AWS Config

•

•

•

•

•

•

•


AWS Config

AWS


AWS

6 3 14:52 1


→


AWS

Customer

gateway

VPN Connection

Internet

gateway

EBS

Elastic network

interface

EC2

EIPNACL

VPC

Route table Subnet

Security

Group


AWS Config AWS

*1:

*1 *1 *1

https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/resource-config-reference.html

https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/resource-config-reference.html


AWS Config


AWS Config Rules


AWS Config


AWS Config Rules

•

•

マネージドルール•

•

カスタムルール•

•


••

•

•

•

••

•


https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/managed-rules-by-aws-config.html

20190618_AWS-Blackbelt_Config_rev6.pptx



Lambda functionAWS Config Rules


https://github.com/awslabs/aws-config-rdk

https://github.com/awslabs/aws-config-rdk


#1

• approved-amis-by-id

• AMI ( )

• required-tags

•

EC2 ‘CostCenter’

• encrypted-volumes

• EBS

• ec2-instance-managed-by-ssm

• EC2 AWS Systems Manager

• vpc-flow-logs-enabled

• VPC (Flow Logs)


#2

• s3-bucket-public-read-prohibited

• Amazon S3

• s3-bucket-public-write-prohibited

• Amazon S3

• rds-snapshots-public-prohibited

• Amazon RDS

• s3-bucket-server-side-encryption-enabled

• Amazon S3 Amazon S3

• access-keys-rotated

•


AWS Config Rules

GitHub

•

•

•

•

https://github.com/awslabs/aws-config-rules


SSM OS

• SSM Inventory

• AWS Config / Config Rules

•

• Config Rules SSM Automation

• CloudWatch Event + Lambda

EC2 SSM Inventory AWS Config

利用禁止ソフトウェア

AWS ConfigRules

CloudWatchEvents

Lambda

Chat

Mail

Config Rulesの「修復アクション」としてSSM Automationを呼び出し

ソフトウェアの変更を時系列で確認コンプライアンス違反を確認

連携を設定


AWS Config

https://aws.amazon.com/jp/blogs/mt/aws-config-best-practices

https://aws.amazon.com/jp/blogs/mt/aws-config-best-practices


AWS Config

#1. AWS Config

→→

#2.

→

#3.

→


AWS Config

#5. S3

→ AWS

→

S3 AWS Managed Rule

• s3-bucket-public-write-prohibited

• s3-bucket-public-read-prohibited


AWS Config

#19. Data aggregation

#20. Organizations aggregator

→→


Central dashboard

that provides an

aggregated view

Multi-account,

multi-region

Integrates with

AWS Organizations

Available at no

additional charge


(2019/06/18 )

•

•

•

https://aws.amazon.com/jp/config/pricing/

https://aws.amazon.com/jp/config/pricing/


AWS

Tag

AWS Config

Auto Scaling


AWS Config / Config Rules


AWS Config https://aws.amazon.com/jp/blogs/mt/aws-config-best-practices/

AWS Config

https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/managed-rules-by-aws-

config.html

AWS Config

https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/select-resources.html

AWS Config

https://aws.amazon.com/jp/config/faq/

https://aws.amazon.com/jp/blogs/mt/aws-config-best-practices/


https://docs.aws.amazon.com/ja_jp/config/latest/developerguide/select-resources.html

https://aws.amazon.com/jp/config/faq/


Q&A

AWS Japan Blog https://aws.amazon.com/jp/blogs/news/

https://aws.amazon.com/jp/blogs/news/


AWS AWS



© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

AWS Webinar

https://amzn.to/JPWebinar https://amzn.to/JPArchive

https://amzn.to/JPWebinar


[AWS Black Belt Online Seminar] AWS Config · © 2019, Amazon Web Services, Inc. or its Affiliates....

Documents

Transcript of [AWS Black Belt Online Seminar] AWS Config · © 2019, Amazon Web Services, Inc. or its Affiliates....