ããã«ã¡ã¯ãå¾è¤ã§ããä»åã¯AWSæ§æã«ãããè¸ã¿å°ã«ã¤ãã¦ã®è¨äºã§ãã ãã¼ã¿ãã¼ã¹ãªã©ã®ã¤ã³ã¿ã¼ãããã«ç¹ããããªããªã½ã¼ã¹ã«è¸ã¿å°ãªã½ã¼ã¹çµç±ã§ã¢ã¯ã»ã¹ããããã¨ã¯ãã»ãã¥ãªãã£è¨è¨ã¨ãã¦ããããæ§æã ã¨æãã¾ãã ä»åã¯ãã®è¸ã¿å°ãªã½ã¼ã¹ã«ãã¦ã¼ã¶ã¼ãã°ã¤ã³æç¡ãæ¤ç¥ãã¦èªå忢ããããã¸ãã¯ãçµã¿è¾¼ãã æ¹æ³ãå ±æãã¾ãã ã¾ããä¸è¬çã«ããç¨ããããã®ã¯EC2ã ã¨æãã¾ãããä»åã¯ECS on Fargate(以éã¯Fargateã¨ç¥)ã使ãã¾ãããããèªå忢ãã¸ãã¯ã«Lambdaã使ãã¾ããï¼ï¼ã³ã³ããã®ä¸ã§å®çµããã¾ãã è¸ã¿å°ãè¨è¨ããæã«æ°ã«ãªãã㨠ããããè¸ã¿å°ã«ã¤ãã¦è¨è¨ããéã«ä½ãæ°ã«ãªãã®ã§ãããããããã¯OS管çè² æ ã¨èªå忢ã§ãã è¸ã¿å°ã«EC2ãç¨ããã¨OSãããé©ç¨ãªã©ã®éç¨ã³ã¹ããçºçãã¾ããæ¥åç³»ãµã¼ãã§ãªãã®ã«å¿å´ãéãªãã®ã¯ãªãã¹ãé¿ãããã¨ã
ã¯ããã« ç§ã¯å人éçºã§ä¸å±±å½ã¦ããã¨å¸¸ã æã£ã¦ãã¦ããã®ããã«ããã¤ããããããããªãµã¼ãã¹ã®ã¢ã¤ãã¢ãããã¾ããã¨ã³ã¸ãã¢ã§ããã°ã¢ã¤ãã¢ãå ·ç¾åãããã¨ã«èºèºãã¦ã¯ãããªãã¨æãããã§ãããä¸åº¦ãªãªã¼ã¹ãã¦ãã¾ãã¨ã©ã³ãã³ã°ã³ã¹ããçºçããããã§ãä»®ã«å ¨ã人æ°ãã§ãªãã£ãã¨ãããã©ã³ãã³ã°ã³ã¹ãåã®èµ¤åãåãæµããã¨ã«ãªãã¾ãã 䏿¹ãå人éçºè ã¨ããã®ã¯ãããã誰ãã夢è¦ãã¡ãªã®ã§ããªãªã¼ã¹å¾ããºã£ãããã¦ã¦ã¼ã¶ã¼ã大éã«æ¼ãå¯ãã¦ãã¦ãã¾ã£ã¦ãµã¼ãã¼ãã¦ã³ããå¯è½æ§ãèãã¦ãã¾ãã¾ãã ãã®çµæããå ¨ãèª°ãæ¥ãªãã¦ã©ã³ãã³ã°ã³ã¹ãã赤åã«ãªã£ããã©ãããããã¨ããä¸å®ã¨ããã¡ããã¡ãããºã£ã¦ãã¾ã£ã¦ãµã¼ãã¼ãã¦ã³ãã¦ãã£ã³ã¹ãéãããã©ãããããã¨ããä¸å®ããå¿ã®ä¸ã§ãããåããã¨ã«ãªãã¾ãã ããã§ãä»åã¯ãã®2ã¤ã®ä¸å®ã䏿°ã«è§£æ¶ããã使ãããªããã°ã©ã³ãã³ã°ã³ã¹ããéããªã
ã¯ããã« ããã«ã¡ã¯ãæ ªå¼ä¼ç¤¾Flatt Security ã»ãã¥ãªãã£ã¨ã³ã¸ãã¢ã®æ£®å²¡(@scgajge12)ã§ãã æ¬ç¨¿ã§ã¯ãAWS Lambda ã§èµ·ããããèå¼±æ§æ»æããªã¹ã¯ãã»ãã¥ãªãã£å¯¾çã解説ãããµã¼ãã¼ã¬ã¹ã«ãããã»ãã¥ãªãã£ãªã¹ã¯ã«ã¤ãã¦ç´¹ä»ãã¾ãã ã¯ããã« AWS Lambda ã«ã¤ã㦠ãµã¼ãã¼ã¬ã¹ã«ãããã»ãã¥ãªãã£ãªã¹ã¯ AWS Lambda ã§èµ·ããããèå¼±æ§æ»æ Lambda ã§ã®èå¼±æ§æ»æã«ãããªã¹ã¯ èå¼±æ§æ»æã«ããæ´ãªããªã¹ã¯ OS Command Injection XML External Entity (XXE) Insecure Deserialization Server Side Request Forgery (SSRF) Remote Code Execution (RCE) AWS Lambda ã«ãããã»ãã¥ãªãã£å¯¾ç ã»ãã¥ãªãã£
AWS Lambdaã¨ã¯ ã¾ãã¯ç°¡åã«AWS Lambdaï¼ä»¥éãLambdaï¼ã®ããããããã¾ããããã¯ã©ã¦ããµã¼ãã¹ã®ã¸ã£ã³ã«ã¨ãã¦ã¯Function as a Serviceï¼FaaSï¼ã¨å¼ã°ããã¸ã£ã³ã«ã«ä½ç½®ãã¦ãã¦ãã³ã¼ããZIPã«ã¾ã¨ãã¦ã¢ãããã¼ãããã ãã§ç°¡åã«ãã®ã³ã¼ããå®è¡ã§ãããã¤ãµã¼ããæèããªãã¦è¯ããç¹å¾´ã®ãµã¼ãã¹ã§ããLambdaã®å ¨ã¦ãããã§èª¬æããã®ã¯å²æããã¦ããã ãã¾ãããAWSã®å ¬å¼ããã¥ã¡ã³ããBlackbekltã®å 容ãã¿ã¦ããã ããã¨ã§ããçè§£ãæ·±ãããã¨ãã§ããã¨æãã¾ãã
ä¹ ã ã«æºã¾ã£ãããã°ãã¿æ¾åºããããããªã¨ããã®åã«ä¸æ¸ãããæãèµ·ããã¦ããããã¾ãããªã¹ãã¼ã¯ã¨ãªé¢é£ã§æºåéåã§ãã RDSã®ã¹ãã¼ã¯ã¨ãªæ å ±ã¯å½ç¶ãéè¨ãèªååãã¦ãã¤ã§ãè¦ããããã«ãã¦ããã®ã§ãããã¡ããã¨å¿ è¦ããã£ãã®ã§ãä»åã¯ããã¦åçºãã°ãéè¨ããå½¢ã«åãåºãããã®ãç¨æãã¦ã¿ã¾ããã ã¹ãã¼ã¯ã¨ãªãã°ã®å¿ è¦æ§ æè¿ã¯NewRelicã¨ãã§ãã¢ããªã±ã¼ã·ã§ã³ã®å¦çãåå¥ãã¦å¦çæéãªã©ãéè¨ããã®ã§ãããã§èª²é¡ã¨ãªãã¯ã¨ãªã確èªãããããã¾ãã é常ã«ä¾¿å©ãªä»çµã¿ã§ãããã¢ããªã±ã¼ã·ã§ã³å¤ã®ã¸ã§ããªã©ãå®è¡ããã¯ã¨ãªã¯éè¨ãããªããã¨ããè² è·è©¦é¨ã§èª²é¡ãçãåºãã¨ãã ã¨ãã¹ãç°å¢ã«ã¨ã¼ã¸ã§ã³ããã©ã¤ãã©ãªãä»è¾¼ãå¿ è¦ããããã¨ãã£ããã¡ãªããã¨ã¾ã§ã¯è¨ããªãã¾ã§ãé¢åããããã¾ãã ãã®ç¹ãã¹ãã¼ã¯ã¨ãªã¯ãµã¼ãã¼å´ã§è¨é²ãããã®ãªã®ã§ã0.1ç§ã¨ãã§ONã«ãã¦ããã°ã対象
ã¯ããã« ãã®è¨äºã¯ã·ã¹ã³ã®åå¿ã«ãã Cisco Systems Japan Advent Calendar 2018 ã® 18 æ¥ç®ã¨ãã¦æç¨¿ãã¾ãããä»å¹´ã¯ã«ã¬ã³ãã¼ãï¼ã¤ããã¾ãï¼ï¼ 2020å¹´ç(1æç®): https://qiita.com/advent-calendar/2020/cisco 2020å¹´ç(2æç®): https://qiita.com/advent-calendar/2020/cisco2 2017å¹´ç: https://qiita.com/advent-calendar/2017/cisco 2018å¹´ç: https://qiita.com/advent-calendar/2018/cisco 2019å¹´ç: https://qiita.com/advent-calendar/2019/cisco 2020å¹´ç: https://qiita.com/ad
大ããã¯å¤é¨ã¹ãã¬ã¼ã¸ãµã¼ãã¹å©ç¨ã¨ãã¢ããªã±ã¼ã·ã§ã³ã«ãã³ãã«ãã¦ãã¾ãæ¹å¼ã¨2ã¤ã«ãããã¾ãããã³ãã«ã¯ãã¼ã¿ã ãæ´æ°ãã§ããªããã¡ãªããã¯ããã¾ããããæè»½ã§ããLambdaã¯ã¬ã¤ã¤ã¼ã使ãã°å®è¡ããã°ã©ã ã«å¯¾ãã¦å¾ãã追å ã¨ãã§ãã¾ããã容éå¶éãå³ããã§ãã ãªãã¸ã§ã¯ãã¹ãã¬ã¼ã¸ã¯æ¯è¼çãæè»½ã§ãããèªã¿è¾¼ã¿ãããã©ã¤ãã©ãªããã¼ã«ã«ã®ãã¡ã¤ã«ã·ã¹ãã åæã®å ´åã¯ä½¿ãã¾ããããµã¼ãã¼ã¬ã¹ã®æ¹å¼ã«ãã£ã¦ã¯ãä¸åº¦ãã¼ã«ã«ã®ãã¡ã¤ã«ã·ã¹ãã ã«æ¸ãåºãã¦ããå©ç¨ã¨ããå¯è½ã§ã¯ããã¾ãããCloud Runã§ã¯8GBï¼ãã ããããããtmpfsã§æ¸ãã°æ¸ãã»ã©ã¡ã¢ãªãæ¶è²»)ãLambdaã§ã¯500MBã¨å®¹éã«å¶éãããã¾ãã ãã巨大ãªå¦ç¿æ¸ã¿ãã¼ã¿ãæ±ãå ´åã¯ããã¼ã¸ãNFSãµã¼ãã¹ç³»ã®ãã®ã使ãã®ãæçµå½¢ã§ãããããã¡ã¤ã«ã®ãµã¤ãºå¶éãã»ã¼éçå¤ã§ããããã¼ã«ã«ãã¡ã¤ã«ã«ãªãã®ã§ã©ã
ããã«ã¡ã¯ãã¯ã©ã¹ã¡ã½ããã®å²¡ã§ãã ä»åStep Functionsã使ã£ã¦ç°¡åãªETLå¦çãè©¦ãæ©ä¼ããã£ãã®ã§å®éã«ä½ã£ããã®ãå ¬éãã¾ãã ãµã¼ãã¼ã¬ã¹ã§ETLå¦çãã¨ããã°AWS Glueãæµ®ãã¶ãã¨æãã¾ãããä»åã¯Glueã¯ä½¿ãããLambdaã®Pythonã©ã³ã¿ã¤ã ã§Pandasã使ã£ã¦S3ã®ãã¼ã¿ã¨DynamoDBã®ãã¼ã¿ãçµåãããããªå¦çãè¡ã£ã¦ã¿ããã¨æãã¾ãã ã¡ãªã¿ã«ç§ã¯ãã¼ã¿åæã«é¢ããç¥èã¯ã»ã¼çç¡ã§ãããPythonã©ã¤ãã©ãªPandasã使ãäºã§ç°¡åã«ãã¼ã¿å¦çãè¡ãã¾ããã ã·ããªãª ä»åã¯IoTããã¤ã¹ããéããã¦ããæç³»åãã¼ã¿ãS3ã«åºåããã¦ããåæã¨ãã¦ããã®ãã¡ã¤ã«ã¨DynamoDBã«ããããã¤ã¹ã®ãã¹ã¿ãã¼ã¿ã¨çµåãã¦åæãã¼ã¿ã¨ãã¦å¥ã®S3ãã±ããã«åºåãããã¨ãã£ãã·ããªãªãæ³å®ãã¦ãã¾ãã æ§æ ãµã³ãã«ã³ã¼ã ä»åã¯Serverl
Cloud Operator Days Tokyo ã¯ãã¯ã©ã¦ãã®éç¨è ã«ç¦ç¹ãå½ã¦ãæè¡è åãã®æ°ããããã¯ã¤ãã³ãã§ããAWSç°å¢ã®éç¨ãæãããã¢ã¤ã¬ããæ ªå¼ä¼ç¤¾ã®ã¤ã³ãã©ã¨ã³ã¸ãã¢å¤å±æ°ããå®éã«ãã£ã¦ãã¾ã£ããããããç´¹ä»ãåå ã¨å¯¾çãèªãã¾ããã¾ãã¯ãAthenaã§170ä¸åè«æ±ããEC2ã復æ§ã§ããªãããã¨ãããããããããï¼å ¨2åï¼ ããããå ç on AWSå¤å±å仿°ï¼ä»¥ä¸ãå¤å±ï¼ï¼ã§ã¯ãããããå ç on AWSãã¨ãããã¨ã§ãå§ãããã¨æãã¾ãããããããé¡ããã¾ãã仿¥ã¯ãAWSç°å¢ã使ã£ã¦æ¥ã éç¨ãã¦ããä¸ã§çºçãããããããã失æäºä¾ãããã¦ãã®ããããã®åå ã¨ãããããå¾ãããæè¨ã«ã¤ãã¦ãä¼ããããã¨æãã¾ãã 仿¥ãã®ã話ãèããã¿ãªããã®ä¸ã§ããããã¡ã®ç°å¢ã©ãã£ã ã£ãããªï¼ãã¨ãæãããæ¹ãããã£ãããããããã¾ããã仿¥ãä¼ããããã¨ã®ä¸ã§ãã¡ãã£ã¨
ã¯ããã« ããã«ã¡ã¯ã大éªãªãã£ã¹ã®æã§ãã ãVirusTotalãã¨ã¯ãã¡ã¤ã«ãã¦ã§ããµã¤ãã®ãã«ã¦ã§ã¢æ¤æ»ãè¡ãã¦ã§ããµã¤ãã§ãããã¡ã¤ã«ãVirusTotalã«ã¢ãããã¼ããããã¦ã§ããµã¤ãã®URLãæå®ããã°ããã®ãã¡ã¤ã«ãã¦ã§ããµã¤ããããã«ã¦ã§ã¢ãå«ããã©ãããæ¤æ»ãããã¨ãåºæ¥ã¾ããä»åã¯ãã¡ã¤ã³ã«å¯¾ãã¦ã®å¥å ¨æ§ããã§ãã¯ãããããªä»çµã¿ãä½ãæ©ä¼ãããã¾ããã®ã§å®è£ ã¾ã§ã®å 容ãã¾ã¨ãã¦ããããã¨æãã¾ãã æ§ææ¦è¦ ä»åã®æ§ææ¦è¦ãã説æãã¾ãã詳細ã¯å¾è¿°ãã¾ãã â Lambdaå¼ã³åºã ä»åã¯CloudWatchEventsã®ã¹ã±ã¸ã¥ã¼ã«å®è¡ãããªã¬ã¼ã¨ãã¦Lambda(Python3)ãå¼ã³åºãããå®è£ ãã¾ãã â¡ ãã¡ã¤ã³ã®ãªã¹ããåå¾ ãã§ãã¯ããããã¡ã¤ã³åã®ãªã¹ããäºãS3ã«æ ¼ç´ãã¦ããã¾ããåå¾ãããªã¹ãã®å é ããé ã«ãã¡ã¤ã³åãåå¾ããæ¬¡å·¥ç¨ä»¥éã®ãã§ã
ã¯ããã« åæç¥è å°å ¥ pytest moto ç¶æ³è¨å® ãã¹ã対象ã®ã³ã¼ã ãã¹ãã¡ã½ãããæ¸ã ãã£ã¯ã¹ãã£ã¼ãæ¸ã moto ã â¦ï¼ ãã¹ããå®è¡ãã¦ã¿ã ãã¾ã ã¾ã¨ã åè ã¯ããã« ããã«ã¡ã¯ãæè¡4課ã®ä¿ç°ï¼ã»ã ï¼ã§ãã çæ§ã¯ç¾å¨è©±é¡æ²¸é¨°ä¸ã®æ ç» TENET ï¼ããããï¼ããã観ã«è¡ããã¾ããã§ããããï¼æé«ã«æé«ã§ãã®ã§ãçæ§ãä¸å¯ã«ã注æã®ããæ¯éã¨ã観ã¦ããã ãããã§ããããã¦èå¯ãèªãåãã¾ãããã ã¨ããããã§ä»æ¥ã¯ pytest 㨠moto ã§åªåãã¦ããããã¨æãã¾ãã å ·ä½çã«ã¯ DynamoDB ã¸ã®æä½ã moto ã§ã¢ãã¯ãã¦ã pytest ã§åä½ãã¹ããããµã³ãã«ããç´¹ä»ãã¾ãã åæç¥è æç« ãç¡éã«å¢ãããã¨ã¯é¿ãããããã以ä¸ã®ç¥èããæã¡ã®ãã¨ãåæã¨ããã¦ããã ãã¾ãã Python ï¼ã®åºæ¬çãªæ¸ãæ¹ï¼ boto3 åä½ãã¹ãã®æ¦å¿µ
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}