セキュアアーキテクチャのシナリオ

シナリオ1：最小権限によるEC2からS3へのアクセス

# IAM policy for least-privilege EC2 -> S3 read
{
  'Version': '2012-10-17',
  'Statement': [{
    'Effect': 'Allow',
    'Action': ['s3:GetObject'],
    'Resource': 'arn:aws:s3:::my-app-bucket/*'
  }]
}

# Attach role to EC2 instance
aws ec2 associate-iam-instance-profile \
  --instance-id i-1234567890abcdef0 \
  --iam-instance-profile Name=EC2S3ReadRole

シナリオ2：RDSデータベースのデータの暗号化

# Create an encrypted RDS instance
aws rds create-db-instance \
  --db-instance-identifier prod-postgres \
  --db-instance-class db.t3.medium \
  --engine postgres \
  --master-username admin \
  --master-user-password SecurePass123! \
  --storage-encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/mrk-abc123 \
  --allocated-storage 100

シナリオ3：S3バケット — パブリックアクセスのブロック

# Block all public access at account level
aws s3control put-public-access-block \
  --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

# Deploy Config rule to detect violations
aws configservice put-config-rule \
  --config-rule '{"ConfigRuleName": "s3-bucket-public-read-prohibited", "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"}}'

シナリオ4：データベース層のVPC分離

# Create RDS security group allowing only the app tier SG as source
aws ec2 create-security-group \
  --group-name rds-sg \
  --description 'RDS security group' \
  --vpc-id vpc-abc123

aws ec2 authorize-security-group-ingress \
  --group-id sg-rds \
  --protocol tcp \
  --port 5432 \
  --source-group sg-app  # app tier security group ID only

シナリオ5：データベース認証情報のローテーション

# Store RDS credentials in Secrets Manager
aws secretsmanager create-secret \
  --name prod/myapp/rds \
  --secret-string '{"username":"admin","password":"OldPass123!","host":"rds-endpoint.amazonaws.com","port":5432}'

# Enable automatic rotation every 30 days
aws secretsmanager rotate-secret \
  --secret-id prod/myapp/rds \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123:function:SecretsManagerRDSPostgreSQLRotationSingleUser \
  --rotation-rules AutomaticallyAfterDays=30

シナリオ6：通常と異なるAPIアクティビティの検出

# Enable GuardDuty in a Region
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES

# EventBridge rule to react to GuardDuty HIGH severity findings
aws events put-rule \
  --name guardduty-high-severity \
  --event-pattern '{
    "source": ["aws.guardduty"],
    "detail-type": ["GuardDuty Finding"],
    "detail": {"severity": [{"numeric": [">=", 7]}]}
  }'

シナリオ7：悪意のあるリクエストをブロックするWAF

# Create WAF Web ACL with SQL injection protection
aws wafv2 create-web-acl \
  --name AppProtection \
  --scope REGIONAL \
  --default-action Allow={} \
  --rules '[{
    "Name": "AWSManagedRulesSQLiRuleSet",
    "Priority": 1,
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesSQLiRuleSet"
      }
    },
    "OverrideAction": {"None": {}},
    "VisibilityConfig": {"SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "SQLi"}
  }]' \
  --region us-east-1

シナリオ8：クロスアカウントでのロール引き受け

# Trust policy in workload account (allows security account to assume role)
{
  'Version': '2012-10-17',
  'Statement': [{
    'Effect': 'Allow',
    'Principal': {
      'AWS': 'arn:aws:iam::SECURITY_ACCOUNT_ID:root'
    },
    'Action': 'sts:AssumeRole'
  }]
}

# From security account: assume role in workload account
aws sts assume-role \
  --role-arn arn:aws:iam::WORKLOAD_ACCOUNT_ID:role/SecurityAuditRole \
  --role-session-name audit-2024-01

シナリオ9：SCPによるアクションの制限

# SCP to deny GPU instance types in non-prod OU
{
  'Version': '2012-10-17',
  'Statement': [{
    'Sid': 'DenyGPUInstances',
    'Effect': 'Deny',
    'Action': 'ec2:RunInstances',
    'Resource': 'arn:aws:ec2:*:*:instance/*',
    'Condition': {
      'StringLike': {
        'ec2:InstanceType': ['p3.*', 'p4d.*', 'g4.*', 'g5.*']
      }
    }
  }]
}

シナリオ10：コンプライアンスのための監査証跡

# Create multi-region trail with integrity validation
aws cloudtrail create-trail \
  --name compliance-trail \
  --s3-bucket-name central-audit-logs-123 \
  --is-multi-region-trail \
  --enable-log-file-validation \
  --include-global-service-events

aws cloudtrail start-logging --name compliance-trail

シナリオ11：プライベートなS3アクセスのためのVPCエンドポイント

# Create S3 Gateway VPC Endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-abc123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-private-1a rtb-private-1b

# Result: route table automatically gets a route:
# Destination: pl-63a5400a (S3 prefix list)
# Target: vpce-xyz456 (the Gateway Endpoint)
# EC2 instances now reach S3 privately at no endpoint cost

クイックチェック

レッスンの振り返り