端端舝

Japan Digital Design, Inc.
踢⺈申永弘犯奈正毛忐月
伉末奈旦禾伉扑奈灍瞰
& AWS re:Inforce 2019 統樓�豢
苤珧倯怮檔
VP of Infrastructure
Technology and Design Division
J A W S - U G 𣷣憷 2 0 1 9 - 0 7

Confidential
Agenda
Japan Digital Design 仍畿賡
M-AIS煦昴皿仿永玄白巧奈丞
�慷戊件本皿玄?灍蚾��
re:Inforce 2019 統樓�豢

2017爛10堎02゜偞蕾
ʊ鎂UFJ白奴瓜件扑乓伙?弘伙奈皿(厥切絁頗扦)及眻諉赽頗扦及夫午勾
☆緉俴𦲀詢僅趙脹赽頗扦★
緉俴云方太緉俴厥切絁頗扦反﹜坻𦲀輦砦午仄化赽頗扦卞匹五月𦲀意互�秶今木化中引仄凶互﹜
蜊淏緉俴楊(2017/04)卞方勻化中歹斗月FinTech赽頗扦互庲戶木日木月仇午午卅曰引仄凶

Confidential
龰曰瞎心
弁仿它玉生奶氾奴皮卞囀庨趙匹五月瞎�
⺥�卅�P五源毛龰曰⻌木﹜俋窒及巨件斥瓦失毛眻諉嗶蚚
引內反嗶蚚极炵毛丐凶日仄仁
萵𦲀互匹五月﹜萵𦲀匹匹五月﹜マ�极炵
筥5゜マ�卞癹日內﹜筥4゜‵筥1゜引匹﹜嗣�卅�P五源毛褫夔卞

Confidential
苤珧倯怮檔
VP of Infrastructure,
Technology and Design Division.
筥4゜マ�
Japan Digital Design卞化奶件白仿旦玄仿弁
民乓及偞�綅蚚脹毛丟奶件卞﹜由皮伉永弁
弁仿它玉及心匹�傖今木凶皿仿永玄白巧奈
丞毛灍蚾笢
仇木引匹Windows Server, Visual Studio,
IPv6卅升毛笢陑卞﹜戊立亙瓦氾奴綅�卅升
手仄化中引仄凶互﹜仇仇郔輪反AWS丟奶件
��岈𦲀翋匹癶籵及IT挌今氏手仄化中引允
Twitter: @chamreo
LinkedIn: linkedin.com/in/yutaro

Confidential
分木?
手午手午Microsoft炵戊立亙瓦氾奴方仁支勻化引仄凶
Visual Studio User Group午井﹜PASSJ午井＃
.NET辭�頗甲奈伕奈憷手＃
仇及丐中分及AWS Summit Japan 2019匹本永扑亦件仄引仄凶

※踢⺈及☆陔仄中丐凶曰引尹★毛�婖仄﹜
�〝及傖墿卞�瓬允月§
奻埻詢祩
CEO, Japan Digital Design
To create new financial standard to contribute to customer's growth

Confidential
踢⺈申永弘犯奈正及魂蚚?
弘伙奈皿跪扦互厥勾犯奈正毛﹜跪扦互公木冗木摩廣仄﹜公木冗木互煦昴毛俴勻化中化
手﹜揃埭芘揃互煦汃趙仄化仄引丹
犯奈正互左件皿伊立旦犯奈正本件正奈卞�中煋引木﹜陔凶卅龰曰瞎心卞犯奈正毛匼婌
仁瞳蚚匹五卅仁卅勻化仄引勻化中月
悵忐愐蚚互詢謞匹犯奈正毛墿ヽ悵奪匹五卅中
公木﹜Japan Digital Design匹賤𢜪仄引仄斤丹

M-AIS
:: MUFG AI Studio ::
2018爛4堎
? 犯奈正煦昴�第毛摩廣
? 犯奈正扔奶巨件氾奴旦玄及嗶蚚
? 弘伙奈皿跪扦井日及堤砃
AWS奻卞陔凶卅犯奈正煦昴皿仿永玄
白巧奈丞毛�慷仄﹜弘伙奈皿及申永
弘犯奈正午﹜郔陔及汁奈伙互瞳蚚褫
夔卅虐噫毛煦昴氪卞枑鼎
引凶﹜AI旃噶辻憝午仄化赻蕾允屯仁
�恅�遁脹手𦲀�及珨勾卞弇离勿仃

Confidential
Japan Digital Design
弘伙奈皿き𦲀
M-AIS煦昴皿仿永玄白巧奈丞岈𦲀衙猁
弘伙奈皿跪扦𦲀�窒嬡

Confidential
BizLENDING
笢苤き𦲀砃仃伊件犯奴件弘扔奈申旦毛伉伉奈旦仄引仄凶
? 諳釱龰竘薩窃井日呾堤仄凶乒犯伙卞方曰⺈揃瓚剿毛灍囥
? 𢜪呾𤩸卅升祥猁匹左件仿奶件匹扠仄煋心褫夔
M-AIS匹煦昴仄凶迵陓乒犯伙毛瞳蚚
? 乒犯伙毛手午卞﹜緉俴互愃葆

Confidential
M-AIS煦昴皿仿永玄白巧奈丞
煦昴�砓
ʊ鎂UFJ緉俴 3,400勀 �諦諳釱
綎� 10爛煦及龰竘隴�?�諦ロ�*
仇木日毛踢⺈辻憝伊矛伙及本平亙伉氾奴毛手勻化AWS奻卞桯嶱
犯奈正煦昴氪及失奶犯失毛郯漲仄卅中赻蚕卅煦昴虐噫毛枑鼎

Confidential
煦昴皿仿永玄白巧奈丞尺及猁А
煦昴氪及�婖俶毛溥仆卅中赻蚕卅虐噫匹丐月仇午
嗣�卅白巧奈穴永玄及犯奈正毛珨啋腔卞㜳尹月仇午
湮講及犯奈正毛允壬支仁�I燴允月夔薯毛厥勾仇午
屾�杅及瞎�匹�薹腔卅綅蚚奪燴互俴尹月仇午
跪意楊�秶?𦲀賜�秶脹毛弁伉失仄凶本平亙失卅虐噫毛蚚砩允月
仇午

Japan Digital Design
M-AIS Infrastructure
Data Analysis Area
Data Exchange Zones
ETL Zones
M-AIS Platform
ETL Zones
ETL Server Source Bucket
Data Exchange Zones
Master Source
Data Source Area
Databricks Zone
STS Gateway subnet
Databricks Instances
Spark Clusters
AWS-STS
Firewall
EC2 Analysis Zone
EC2 Analysis Servers
Databricks Enterprise
M-AIS Infra Services Zone
Databricks SaaS
Infrastructure Servers
RODC ADFSWSUS
M-AIS Analysis Room
Corporate Infrastructure
M-AIS Support Zone Corporate Infra Zone
FILE
FILE DC RDS RADIUS
Data Scientists
Firewall
On-Premise
Office
Analysis UI

Databricks
犯奈正煦昴虐噫午仄化Databricks毛妸蚚
Spark弁仿旦正毛瞳蚚允月SaaS
Web UI用奈玄皮永弁卞方月戊奈玉嶱逃午
申斥亙失仿奶未奈扑亦件及緙磁
犯奈正扔奶巨件氾奴旦玄毛虐噫淕�午煦昴
蚚用奈玉及奪燴井日賤溫
Spark弁仿旦正及左奈玄旦弗奈伙午旦
禾永玄奶件旦正件旦及赻�桯嶱

用奈玄皮永弁
Web UI匹戊奈玉嶱逃﹜灍俴﹜申斥亙失仿奶未奈扑亦件

Cluster Management
Spark弁仿旦正毛�腔卞奪燴
煦昴氪互斛猁卅弁仿旦正毛赻蚕卞桯嶱
? 左奈玄旦弗奈伙?左奈玄
扑乓永玄母它件
? Spot奶件旦正件旦及魂蚚
? 仿件正奶丞仿奶皮仿伉奪燴及
�匼趙

All-In-One
Batch Jobs
Library Manager
Metrics
... and Audit logs

ETL & Data Store (犯奈正末奈旦巨伉失)
? 左件皿伊立旦及犯奈正毛弁仿它玉奻卞龰曰煋戈
? 犯奈正末奈旦及猁璃卞𡛟元化ETL蚚AWS失市它件玄毛蔃中堤仄
? Owner及綃丹犯奈正末奈旦毛煦褩仄凶虐噫匹忳仃⻌木
? 穴旦正奈末奈旦尺摩廣
? ETL匹忳仃⻌木凶犯奈正毛煦昴蚚S3卞摩搪
? 白巧奈穴永玄及緙珨卅升卞方曰
�薹腔卅犯奈正失弁本旦毛煦昴氪卞枑鼎
? DirectConnect匹諉適
? 腴伊奶氾件扑奈匹及VPC諉適毛灍政
? 蛁: 本平亙伉氾奴及凶戶卞反
IPSec VPN毛�珂腔卞𨈘�
? 假陑卅※𠸎厥切§匹腢氏匹反中仃卅中

犯奈正煦昴弁仿旦正 (犯奈正煦昴巨伉失)
? 煦昴氪傷藺井日眻諉犯奈正末奈旦卞反失弁本旦今六卅中
? AWS失市它件玄仍午及��毛反勻五曰今六﹜斛猁卅辻夔及奪燴痜癹毛隴復趙
? 扑旦氾丞奪燴氪互價屜卞�仄化灍囥允月釬𦲀薆郖毛本由伊奈玄
? 犯奈正末奈旦卞失弁本旦允月
皿伉件扑由伙毛杻隅
? EC2及奶件旦正件旦皿伕白央奶伙匹
S3失弁本旦痜癹毛葆迵
? VPC巨件玉禾奶件玄及秶郘午磁歹六
犯奈正末奈旦卞扑旦氾丞奪燴氪互
眻諉失弁本旦匹五卅中痜癹煦褩毛灍政
? AWS Management Console井日反
犯奈正末奈旦卞失弁本旦匹五卅中

奶件白仿扔禾奈玄 (犯奈正煦昴巨伉失)
? 煦昴氪及釬𦲀毛盓堔允月奶件白仿扔奈申旦毛枑鼎
? Remote Desktop Services卞方曰煦昴虐噫囀及傷藺井日Internet�笊褫夔
? 犯奈正穢䪸及伉旦弁煦昴毛手午卞瞳晞俶午秶廣毛MIX
? 煦昴虐噫囀尺犯奈正反赻蚕卞厥切⻌木褫夔 (1源砃伊皿伉弗奈扑亦件卞方月白央奶伙僕衄)
? 犯奈正及厥切堤仄卞憝仄化反�仄中秶廣午民尼永弁 (𦲀�卞憂勿仁犯奈正及心偝褫)

Confidential
犯奈正旦玄失 : S3
氾奈皮伙倛宒卞癹隅今木卅中旦弗奈仿皮伙卅旦玄伊奈斥午仄化妸蚚
? 翋猁犯奈正及白巧奈穴永玄反Apache Parquet毛妸蚚 (CSV/TSV手悵奪)
? 市仿丞瓜倛宒及犯奈正白巧奈穴永玄
RDS/Aurora, Redshift反掛媆萸匹妸蚚六內
? 由白巧奈穴件旦𨈘偩毛灍囥仄﹜踏隙及伐奈弁伕奈玉卞反祥羥午瓚剿
S3勻化假�卅及?
? 田弗永玄禾伉扑奈午KMS平奈禾伉扑奈及磁歹六撮卞方月失弁本旦秶郘

Confidential
左皮斥尼弁玄失弁本旦及秶癹

S3田弗永玄禾伉扑奈及Hardening
田弗永玄尺及失弁本旦毛暫眭及��卞秶廣
? 杻隅及VPCE井日及失弁本旦眕
俋毛擇瘁
{
"Principal": "*",
"Effect" "Deny"
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"s3:PutObject",
"s3:DeleteObject",
"s3:DeleteObjectVersion" ],
"Resource": "arn:aws:s3:::source-bucket/*",
"Condition" {
"StringNotEquals": {
"aws:sourceVpce": [
"vpce-0123456789abcdef",
"vpce-abcdef0123456789" ]
}
}

S3田弗永玄禾伉扑奈及Hardening (2)
俋毛擇瘁
? 杻隅及KMS平奈卞方月做瘍趙
眕俋毛擇瘁
{
"Principal": "*",
"Effect" "Deny"
"Action": "s3:PutObject",
"Condition" {
"StringNotEquals": {
"s3:x-amz-server-side-encryption-aws-kms-key-id※ :
"arn:aws:kms:ap-northeast-1:012345678801:key/
1234abcd-12ab-34cd-56ef-1234567890ab"
}
}

俋毛擇瘁
眕俋毛擇瘁
? TLS諉適互卅中�磁反擇瘁
{
"Principal": "*",
"Effect" "Deny"
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
"s3:PutObject"
"Condition" {
"Bool": {
"aws:secureTransport" : "false"
}
}

俋毛擇瘁
眕俋毛擇瘁
? TLS諉適互卅中�磁反擇瘁
S3失弁本旦褫夔卅伕奈伙卞偝褫
? 隴尨腔卅 Condition 匹穢木毛
滅什
? 杻隅及VPC Endpoint
? 杻隅及KMS平奈
? TLS諉適丐曰
{
"Principal": "arn:aws:iam::012345678901:role/S3-
Access",
"Effect" "Allow"
"Action": [
"s3:GetObject",
"s3:PutObject"
"Condition" {
"StringEquals": {
"aws:sourceVpce" : "vpce-0123456789abcdef"
} {
"Bool": {
"aws:secureTransport" : "true"
}
}

Confidential
VPC Endpoint Policy
VPC囀井日失弁本旦褫夔卅S3田弗永玄反VPC S3 Endpoint卞方曰秶癹
? Endpoint Policy卞方曰煦昴弁仿旦正互失弁本旦匹五月S3田弗永玄毛秶郘
? 戊件玄伕奈伙俋及S3田弗永玄尺及𤩸五煋心毛秶癹
Databricks Instances
Spark Clusters
Data Exchange ZonesData Exchange Zones
Master Source
{ "Statement": [ {
"Principal": "*",
"Action": "s3:GetObject",
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::source-bucket",
"arn:aws:s3:::source-bucket/*※ ] } ] }

Confidential
田弗永玄左矢伊奈扑亦件及秶癹

田弗永玄左矢伊奈扑亦件毛S3奪燴氪
及心卞癹隅
? DeleteBucketPolicy毛咭木內
卞
{
"Principal": "arn:aws:iam::012345678901:role/S3-
PolicyAdministrator",
"Effect" "Allow"
"Action": [
"s3:PutBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration",
"s3:PutReplicationConfiguration" ],
"Resource": "arn:aws:s3:::source-bucket"
}
}

田弗永玄左矢伊奈扑亦件毛S3奪燴氪
及心卞癹隅
? DeleteBucketPolicy毛咭木內
卞
? 淏�交奈扒ID匹﹜靡ゴ及允曰
杸尹毛滅砦
{
"Principal": "*",
"Effect" "Deny"
"Action": [
"s3:PutBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration",
"Resource": "arn:aws:s3:::source-bucket",
"Condition" {
"StringNotLike": {
"aws:userid" : "AROA4BUVFU5K
AJ45IWBTW:*"
}
}

Confidential
Condition 沭璃平奈
玉平亙丟件玄卞引午引勻化中月
S3失弁本旦禾伉扑奈沭璃平奈
? https://docs.aws.amazon.com/ja_jp/AmazonS3/latest/dev/amazon-
s3-policy-keys.html
AWS 弘伕奈田伙沭璃戊件氾平旦玄平奈
? https://docs.aws.amazon.com/ja_jp/IAM/latest/UserGuide/reference_policies_conditi
on-keys.html

Confidential
KMS平奈禾伉扑奈

KMS平奈禾伉扑奈及Hardening (1)
平奈禾伉扑奈及劐載毛KMS奪燴氪及
心卞癹隅
? 樓尹化淏�交奈扒ID匹及秶癹
手衄�卅忒
{
"Principal": "arn:aws:iam::012345678901:role/KMS-
KeyAdministrator",
"Effect" "Allow"
"Action": [
"kms:Create*",
"kms:Enable*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Delete*",
"kms:List*",
"kms:Get*",
"Resource": "*"
}
}

心卞癹隅
? 淏�交奈扒ID匹及秶癹手衄�
卅忒
? 伕奈伙卞平奈瞳蚚及心偝褫
? 奶件旦正件旦皿伕白央奶伙脹
{
"Principal": "arn:aws:iam::012345678901:role/Role-
EC2-AnalysisInstance",
"Effect" "Allow"
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"],
"Resource": "*"
}
}

心卞癹隅
? 淏�交奈扒ID匹及秶癹手衄�
卅忒
? 伕奈伙卞平奈瞳蚚及心偝褫
? 奶件旦正件旦皿伕白央奶伙脹
? 斛猁卞𡛟元化Grant手偝褫
{
"Principal": "arn:aws:iam::012345678901:role/Role-
EC2-AnalysisInstance",
"Effect" "Allow"
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"],
"Resource": "*"
}
}

Confidential
眈誑瓰秶极秶

Confidential
手切欠氏IAM禾伉扑奈反五勻切曰午
伙奈玄失市它件玄反MFA毛井仃化猾荂
杻隅蚚芴砃仃伕奈伙
? S3禾伉扑奈毛劐載匹五月�蚚伕奈伙
? KMS禾伉扑奈毛劐載匹五月�蚚伕奈伙
杻隅蚚芴�蚚交奈扒奈
? S3禾伉扑奈劐載伕奈伙毛AssumeRole匹五月�蚚交奈扒奈
? KMS禾伉扑奈劐載伕奈伙毛AssumeRole匹五月�蚚交奈扒奈
? 犯奴扒旦正伉市田伉蚚�蚚交奈扒奈

S3尺及砩�仄卅中祥淏卅失弁本旦毛滅什
KMS奪燴氪S3奪燴氪
MFA斛� MFA斛�
失弁本旦��及劐載
(平奈禾伉扑奈劐載)
失弁本旦��及劐載
(田弗永玄禾伉扑奈劐載)
MFAMFA
2. 犯奈正龰腕 (覧瘍趙)
KMS祥淏失弁本旦氪
(S3失弁本旦祥褫)
EC2奶件旦正件旦
IAM伕奈伙
S3祥淏失弁本旦氪
(KMS失弁本旦祥褫)
1. 覧瘍趙平奈龰腕
俋窒ペ⻌云方太囀窒祥淏卞方月犯奈正失弁本旦井日S3毛滅郘
S3午KMS及奪燴痜癹及煦褩卞方勻化灍蚾
S3 Bucket KMS CMK

Confidential
Kill Switch 灍蚾
犯奈正互峉�卞今日今木丹月ゴ卞KMS平奈毛剠�趙仄﹜犯奈正失弁
本旦毛殑剿允月
? 田弗永玄禾伉扑奈/平奈禾伉扑奈劐載媆
? S3/KMS奪燴氪伕奈伙瞳蚚媆
? 伙奈玄失市它件玄扔奶件奶件媆
? etc.
Step Functions匹平奈剠�趙Lambda毛赻�灍俴

Confidential
引午戶
M-AIS皿仿永玄白巧奈丞反丐仁引匹手奶件白仿
? 弁仿它玉及丟伉永玄毛汜井仄凶旦疋奈玉匹奶件白仿毛鼎緻仄﹜申斥生旦打奈伙毛
灍政允月
本平亙伉氾奴反赻蚕卅虐噫及市幼
? 本平亙失匹丐月井日仇公赻蚕卞�仃月
? 奶件白仿反郔湮癹及褫蚚俶毛本平亙失卞枑鼎允月
都卞劐趙毛
? 煦昴及伐奈弁伕奈玉反都卞劐趙允月仇午毛ゴ枑卞﹜帊瞎心赻极毛⻌木杸尹褫夔卞
? 允什卞宎戶日木月仇午眕奻卞﹜允什卞瞳蚚毛支戶月仇午互匹五月互弁仿它玉及丟
伉永玄

Confidential
AWS re:Inforce 2019 統樓�豢

Confidential
AWS re:Inforce 2019
弁仿它玉本平亙伉氾奴毛�嬡卞仄凶陔仄中市件白央伊件旦
? 2019/06/25-26 示旦玄件卞化嶱殼
? 云方公10,000靡互統樓

Confidential
Keynote
AWS CISO - Steve Schmidt
? Announce
? VPC Traffic Mirroring
? Security Hub - GA
? IAM Access Advisor with Org

Confidential
統樓本永扑亦件
FND306: How to secure your Active Directory deployment on AWS
SEP304: Cryptography in the next cycle
SEP204: Privacy, ethics, and engineering in emerging technology
SDD319: Ensure the integrity of you code for fast and secure deployments
SDD335: Cloud DevSecOps masterclass: Lessons learned from a multi-year implementation of
cloud automation at scale
SDD302: Methods of emergency privileged access
SDD301: Lean and clean SecOps using AWS native services cloud
SEP329: AWS event engineering at scale
SEP306-R1: Serverless AI-Powered Identity Management
GRC313: Using AWS Control Tower to govern multi-account AWS environment at scale

Confidential
Using AWS Control Tower to govern multi-account AWS environment at scale
AWS Control Tower毛魂蚚仄﹜穴伙民失市它件玄虐噫毛奪燴
? 失市它件玄毛布奈玉伊奈伙匹悵荾 (眊穸趙)
? 僕籵及Cloudformation脹卞方曰﹜郔腴癹及悵荾毛�秶
? 母永扑亙示奈玉匹郩忐袨暿毛乒瓦正伉件弘
? Service Catalog卞方月失市它件玄蔃中堤仄

Confidential
Ensure the integrity of you code for fast and secure deployments
DevSecOps卞�𡛟仄化中仁凶戶卞
? Automation反斛�
? Security手Automation卞瞎心煋戈
? Marketplace及魂蚚
? 妏尹月扔奈申旦反嗣仁丐月

Confidential
re:Inforce卞統樓仄化
仇木引匹AWS反嶱逃氪砃仃丟永本奈斥互嗣井勻凶
? Serverless午井
re:Inforce匹IT Pro尺及丟永本奈斥互�仁堤凶及匹反卅中井
? IT Pro反Automation卞Security毛Built-In仄化中仁
? ※Dev§ + Ops = DevOps
? Ops + Security = SecOps
? Developer反﹜生永玄伐奈弁巨件斥瓦失匹手楊薺模匹手卅中
? IT Pro反生永玄伐奈弁巨件斥瓦失匹丐曰﹜本平亙伉氾奴手Include仄化中仁仇午互А戶日木月
? # Security反﹜LawOps/GovernanceOps卞卅月井手＃?
中井卞弁仿它玉匹岈𦲀毛扥壬仄化中仁井 => re:Invent
中井卞岈𦲀毛弁仿它玉匹輥適仄化中仁井 => re:Inforce
? IT Pro分仃匹卅仁﹜岈𦲀�￤氪卅升手統樓允月午中中奶矛件玄分勻凶午佷丹

Confidential
本永扑亦件反鼠嶱今木化中引允
本永扑亦件揃蹋午�賒互鼠嶱今木化中引允
? https://reinforce.awsevents.com
懂爛反甲亙奈旦玄件匹嶱殼
? 引凶統樓仄凶中!

端端舝

JAWS-UG𣷣憷 - 2019-07-12 - 踢⺈申永弘犯奈正毛忐月伉末奈旦禾伉扑奈灍瞰

More Related Content

JAWS-UG𣷣憷 - 2019-07-12 - 踢⺈申永弘犯奈正毛忐月伉末奈旦禾伉扑奈灍瞰