AWS Identity and Access ManagementïŒIAMïŒã«ãããã客æ§ã®ãŠãŒã¶ãŒã® AWS ãµãŒãã¹ããã³ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãå®å šã«ã³ã³ãããŒã«ããããšãã§ããŸããIAM ã䜿çšãããšãAWS ã®ãŠãŒã¶ãŒãšã°ã«ãŒããäœæããã³ç®¡çããã¢ã¯ã»ã¹æš©ã䜿çšã㊠AWS ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããã³æåŠã§ããŸãã
IAM ã®äœ¿çšãéå§ããã«ã¯ã[ä»ããç¡æã§ã詊ã] ãã¿ã³ãã¯ãªãã¯ããŸãããŸãã¯ãæ¢ã« AWS ã«ç»é²æžã¿ã®å Žåã¯ãAWS ãããžã¡ã³ãã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³ããŠããããã® IAM ãã¹ããã©ã¯ãã£ã¹ãéå§ããŸãã
IAM ã¯ç¡æã§ããä»ãã䜿çšãéå§ããŠãã ãã!
AWS ãç¡æã§ã詊ããã ãã
ãŸãã¯ç¡æã§å§ãã »ãŸãã¯ã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³
12 ãæéã® AWS ç¡æå©çšæ ãšã24 æé幎äžç¡äŒã®ã«ã¹ã¿ããŒãµãŒãã¹ããµããŒããã©ãŒã©ã ãªã©ã® AWS ããŒã·ãã¯ãµããŒãæ©èœãå©çšã§ããŸãã
ããŠããŒ:
How to Help Lock Down a Userâs Amazon EC2 Capabilities to a Single VPC
ãç¥ãã
re:Invent 2015: All Security and Compliance Track Breakout Sessions
ããŠããŒ
ãç¥ãã
ã¢ã¯ã»ã¹ã³ã³ãããŒã«ããªã·ãŒããã¹ãããæ°ãã API ã®ç޹ä»
ãç¥ãã
AWS IAM ãå©çšãããšã以äžã®ããšãå¯èœã«ãªããŸãã
IAM ãŠãŒã¶ãŒãšãã®ã¢ã¯ã»ã¹ã管ç â IAM ã§ãŠãŒã¶ãŒãäœæãããŠãŒã¶ãŒã«åå¥ã®ã»ãã¥ãªãã£èªèšŒæ
å ±ïŒã¢ã¯ã»ã¹ããŒããã¹ã¯ãŒããå€èŠçŽ èªèšŒããã€ã¹ïŒãå²ãåœãŠãããäžæçã»ãã¥ãªãã£èªèšŒæ
å ±ããªã¯ãšã¹ãããããšã«ãã£ãŠãAWS ã®ãµãŒãã¹ããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹æš©ããŠãŒã¶ãŒã«ä»äžããŸãããŠãŒã¶ãŒã«ã©ã®æäœã®å®è¡ãèš±å¯ããããã管çè
ãã³ã³ãããŒã«ã§ããŸãã
IAM ããŒã«ãšãã®æš©éã管ç â IAM ã§ããŒã«ãäœæããæš©éã管çããããšã§ããã®ããŒã«ãé©çšãããšã³ãã£ãã£ãŸã㯠AWS ãµãŒãã¹ã®å®è¡å¯èœãªãªãã¬ãŒã·ã§ã³ãã³ã³ãããŒã«ããŸããããŒã«ãã©ã®ãšã³ãã£ãã£ã«é©çšãããã«ã€ããŠãå®çŸ©ã§ããŸãã
ãã§ãã¬ãŒãã£ãããŠãŒã¶ãŒãšãã®æš©éã®ç®¡ç â ID ãã§ãã¬ãŒã·ã§ã³ãæå¹ã«ãããšã瀟å
ã®æ¢åã® IDïŒäŸãã°ãŠãŒã¶ãŒïŒã«ãã AWS ãããžã¡ã³ãã³ã³ãœãŒã«ãžã®ã¢ã¯ã»ã¹ãAWS API ã®åŒã³åºããããã³ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ã§ããŸããã¢ã€ãã³ãã£ãã£ããšã« IAM ãŠãŒã¶ãŒãäœæããå¿
èŠã¯ãããŸããã
äœåãªã³ã¹ãããããã«äœ¿çšã§ãããŠãŒã¶ãŒåãšãã¹ã¯ãŒãã®èªèšŒæ
å ±ã匷åããã»ãã¥ãªãã£æ©èœã§ãã AWS Multi-Factor Authentication ïŒMFAïŒã䜿ã£ãŠãAWS ç°å¢ãä¿è·ããŸããMFA ã¯ãæå¹ãª MFA ã³ãŒããå
¥åããŠãããŒããŠã§ã¢ãŸãã¯ä»®æ³ MFA ããã€ã¹ã®ç©ççææã蚌æããããã«ããŠãŒã¶ãŒã«æ±ããŸãã
IAM ã䜿ããšãAWS ãµãŒãã¹ API ãæå®ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãã³ã³ãããŒã«ããããšãã§ããŸãããŸããæ¡ä»¶ä»ãã§ãŠãŒã¶ãŒã« AWS ã®äœ¿çšæš©éãäžããããšãå¯èœã§ããæå®ã§ããæ¡ä»¶ã«ã¯ãæé垯ãã¢ã¯ã»ã¹å
ã® IP ã¢ãã¬ã¹ãSSL ã䜿çšããŠãããã©ãããå€èŠçŽ èªèšŒããã€ã¹ã«ããèªèšŒæžã¿ãã©ãããªã©ããããŸãã
ã¢ãã€ã«ããã©ãŠã¶ããŒã¹ã®ã¢ããªã±ãŒã·ã§ã³ãã AWS ãªãœãŒã¹ã«å®å
šã«ã¢ã¯ã»ã¹ã§ããããã«ããããã«ãäžæçãªã»ãã¥ãªãã£èªèšŒæ
å ±ããªã¯ãšã¹ãã§ããŸããããã«ãããç¹å®ã® AWS ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãããããããèšå®ããæéã®ã¿èš±å¯ã§ããŸãã
IAM ã䜿çšãããšãAWS ãããžã¡ã³ãã³ã³ãœãŒã«ã AWS ãµãŒãã¹ API ãžã®ãã§ãã¬ãŒã·ã§ã³ã¢ã¯ã»ã¹æš©ããMicrosoft Active Directory ãªã©ã®æ¢åã® ID ã·ã¹ãã ã䜿çšããŠåŸæ¥å¡ãã¢ããªã±ãŒã·ã§ã³ã«ä»äžããããšãã§ããŸããSAML 2.0 ããµããŒããã ID 管çãœãªã¥ãŒã·ã§ã³ãã©ãã§ã䜿çšã§ããŸãããŸããAmazon ã®ãã§ãã¬ãŒã·ã§ã³ãµã³ãã«ïŒAWS Console SSO ã API ãã§ãã¬ãŒã·ã§ã³ïŒããèªç±ã«ã䜿ããã ããã
äœåãªã³ã¹ãããããã«äœ¿çšã§ãããŠãŒã¶ãŒåãšãã¹ã¯ãŒãã®èªèšŒæ
å ±ã匷åããã»ãã¥ãªãã£æ©èœã§ãã AWS Multi-Factor Authentication ïŒMFAïŒã䜿ã£ãŠãAWS ç°å¢ãä¿è·ããŸããMFA ã¯ãæå¹ãª MFA ã³ãŒããå
¥åããŠãããŒããŠã§ã¢ãŸãã¯ä»®æ³ MFA ããã€ã¹ã®ç©ççææã蚌æããããã«ããŠãŒã¶ãŒã«æ±ããŸãã
AWS ã«ã¯ãIT å°éå®¶ãéçºè
ããæè»æ§ãåŒŸåæ§ã倱ãããšãªãã¢ã¯ã»ã¹å¶åŸ¡ãè¡ãããã®ãã¹ããã©ã¯ãã£ã¹ã®äžèЧããããŸããIAM ã®ãã¹ããã©ã¯ãã£ã¹ã®è©³çްãªèª¬æãå
¥æããã«ã¯ãïŒãã®æ®µèœã®å³åŽã®ããã¯ã¹ã«ããïŒre:Invent 2014 ã®èšé²ãããã»ãã·ã§ã³ãåç
§ããŠãã ããã
Users â åã ã®ãŠãŒã¶ãŒãäœæããã
Groups â ã°ã«ãŒãã䜿ã£ãŠæš©éã管çããã
Permissions â æå°éã®æš©éãä»äžããã
Auditing â AWS CloudTrail ããªã³ã«ããŸãã
Password â 匷åãªãã¹ã¯ãŒãããªã·ãŒãæ§æããã
MFA â ç¹æš©ãŠãŒã¶ãŒã«å¯ŸããŠãMFA ãæå¹åããã
Roles â EC2 ã€ã³ã¹ã¿ã³ã¹ã«å¯Ÿã㊠IAM ããŒã«ã䜿çšããã
Sharing â IAM ããŒã«ã䜿ã£ãŠãã¢ã¯ã»ã¹ãå ±æããã
Rotate â ã»ãã¥ãªãã£èªèšŒæ å ±ã宿çã«ããŒããŒã·ã§ã³ããã
Condition â æ¡ä»¶ã䜿ã£ãŠãç¹æš©çã¢ã¯ã»ã¹ãããã«å¶éããã
Root â ã«ãŒãã®äœ¿çšãåæž / åé€ããã
ãµã€ã³ã¢ããã¯ç°¡åïŒç¡æç¯å²å
ã§å¯Ÿè±¡è£œåã 12 ãµæç¡æã§ã詊ãããã ããŸã ã
AWS ç¡æå©çšæ ã®è©³çްã¯ãã¡ã â«
AWS ã¢ã«ãŠã³ãäœæã®æµãã¯ãã¡ã »
å°å ¥ã«é¢ããã質åããèŠç©ããªã©ãäžæãªç¹ã¯ããæ°è»œã«æ¥æ¬æ åœããŒã ãŸã§ãçžè«ãã ããã

