CloudMapperãšã¯
æ®æ®µAmazon Web Services(AWS)ã®èšèšãæ§ç¯ãè¡ãã«ããã£ãŠãAWSãªãœãŒã¹ãã©ã®ããã«æ§æãããããã®ãããã¯ãŒã¯æ§æãã©ããªã£ãŠããã®ããçŽè§£ãããã«ãdraw.ioãCacooã䜿ã£ãŠæ§æå³ãæžãããšãã¡ããã¡ãããããšæããŸãã
èšèšã®æ®µéã§ã¯ç¢ºãã«ãããã®ããŒã«ã䜿çšããŠã©ã®ãããªæ§æã«ããããã©ã®ãããªAWSãªãœãŒã¹ã®é 眮ãè¡ãããæ€èšããã®ã«ã¯ãšãŠãæçšãªã®ã§ãããã©ã®AWSãªãœãŒã¹(äŸãã°EC2ã€ã³ã¹ã¿ã³ã¹ãšãECSãµãŒãã¹ãšã)ã«ã©ãããSecurity Groupãã¢ã¿ãããããŠããã®? ãšããInternet Gatewayããç®çã®AWSãªãœãŒã¹ã«å¯ŸããŠã¡ãããšè«ççã«éä¿¡ã§ããç¶æ ã«ãªã£ãŠããã®? ãšãã£ãå å®¹ãæ§æå³äžã§èªã¿åãã®ã¯ãªããªã倧å€ã§ãããäŸãã°æ³å®éãã®éä¿¡ãã§ããªããšãã£ãäºè±¡ã«å¯ŸããŠãããŒãžã¡ã³ãã³ã³ãœãŒã«ãVPCãããŒãã°ã ãã§è§£æãè¡ãã®ã«ã¯ãããªãã«èŠåŽãããã®ããŸã宿 ã ãšæããŸãã
ãããè£å®ããŠãAWSãªãœãŒã¹çŸ€ãå®éã®AWSç°å¢ããåéããŠããããã¯ãŒã¯æ§æå³ãšããŠèœãšã蟌ãã§ãããã®ããCloudMapperãšããããŒã«ã§ãã
ããŒã«ã«ã®ç°å¢ã«æ§ç¯ããŠã¿ã
CloudMapperèªäœã®æ§ç¯æé ã¯ãããŸããŸãªWebãµã€ãäžã§è§£èª¬ãããŠããã®ã§ãããããã§ã¯ããŒã«ã«ã®ç°å¢ã§ããMacBook Pro (16-inch, 2019, Intel / macOS Monterey 12.2.1)äžã«æ§ç¯ããŠã¬ããŒãåºåããŠããæé ããã§ããã ã詳现ã«èšè¿°ããŠããããšæããŸãã
åææ¡ä»¶
ãŸãã¯ããããã¯ãŒã¯æ§æå³ãäœæããã察象ã®AWSç°å¢ã«ã以äžã®IAMããªã·ãŒãå°ãªããšãã¢ã¿ãããããŠããIAMãŠãŒã¶ãŒãäœæããŠããå¿ èŠããããŸãã
- ViewOnlyAccess (ReadOnlyAccessã§ãå¯èœ)
- SecurityAudit
ãŸããããŒã«ã«ã®ç°å¢äžã«ãå°ãªããšãPythyon3.8以äžãã€ã³ã¹ããŒã«æžã¿ã§ããå¿ èŠããããŸããREADME.mdã§ã¯Python3.7ã§ãåãçãªããšãæžããŠããã®ã§ããã3.8ã«ã¯ãªã£ãŠããã»ããããã®ããªãšæããŸãã
ããã«ãã®IAMãŠãŒã¶ãŒããããããããSecret KeyãšSecret Access KeyãååŸããŠããå¿ èŠããããŸãããåç¥ã®éããSecret KeyãšSecret Access Keyã¯æŒãåºããšå€§å€ãªããšã«ãªãã®ã§ç®¡çã«ã¯ååã«æ°ãã€ããŠãã ããã
CloudMapperãã€ã³ã¹ããŒã«ããŠãã
ããã§ã¯ããŒã ãã£ã¬ã¯ããªäžã«ã€ã³ã¹ããŒã«ããŠããããšãåæãšããŠããŸãã以äžã®ã³ãã³ããé æ¬¡å®è¡ããŠã€ã³ã¹ããŒã«ããŠãããŸãã
% git clone https://github.com/auto-labs/cloudmapper.git
% brew install autoconf automake libtool jq
% python3 -m venv foobar
% source foobar/bin/activate
(foobar) % pip install --prefer-binary -r requirements.txt- GitHubããCloudMapperã®ãœãŒã¹ã³ãŒãäžåŒãcloneããŠãã
- Homebrewã䜿çšããŠãåäœãããããã«å¿ èŠãªã©ã€ãã©ãªãã€ã³ã¹ããŒã«ãã
- pythonã®ä»®æ³ç°å¢ãæ§æãã(ããã§ã¯ä»®æ³ç°å¢ãšããŠfoobarãšããåç§°ã«ããŠããŸã)
- ä»®æ³ç°å¢äžã§ãCloudMapperã®åäœã«å¿ èŠãªè¿œå ã¢ãžã¥ãŒã«ãèšè¿°ãããŠãã”requirements.txt”ã®å 容ããã€ããªã§ã€ã³ã¹ããŒã«ãã
AWS CLIã®ç°å¢èšå®ãããŠãã
ããã§ã¯åææ¡ä»¶ã®äžã§æžãèšããIAMãŠãŒã¶ãŒã®Secret KeyãšSecret Access Keyã®æ å ±ã
% aws configureã§ç»é²ããŠãããŸããããã¯è©³çްã¯çããŸããããªãŒãžã§ã³ã¯”ap-northeast-1″(æ±äº¬ãªãŒãžã§ã³)ã§ãåºå圢åŒã¯”json”ã§åé¡ãããŸããã
ãããŸã§ã§CloudMapperã®äžé£ã®ã€ã³ã¹ããŒã«ãšäºåæºåã¯å®äºã§ãã
CloudMapperãå®è¡ããããã®äºåæºåããã
CloudMapper㯔config.json”ãšããJSONãã¡ã€ã«ã®äžã«åæèšå®æ å ±ãæã¡ãŸãããã®äžèº«ã¯ãã©ããã£ããããã¡ã€ã«åã§ãã©ãã®AWSã¢ã«ãŠã³ãããååŸãããæ å ±ãåç §ããããèšè¿°ãããŠããŸãããã®åæèšå®æ å ±ããããããååŸããããã«ã以äžã®æ å ±ããPythonã®ä»®æ³ç°å¢äžã§ã³ãã³ãå®è¡ããŠèšå®ããŠãããŸãã
(foobar) % python3 cloudmapper.py configure add-account --config-file config.json --name (ãããã¡ã€ã«å) --id (ååŸå¯Ÿè±¡ã®AWS Account) --default DEFAULT
(foobar) % python3 cloudmapper.py configure add-account --config-file config.json --name (å¥ã®ãããã¡ã€ã«å) --id (ååŸå¯Ÿè±¡ã®AWS Account)ããã©ã«ãã§ã¯1è¡ç®ã§èšå®ããé ç®ã䜿çšãããã®ã§ãå¥ã®ãããã¡ã€ã«ã«åãæ¿ããããšãã¯2è¡ç®ã䜿çšããããšãã£ãã€ã¡ãŒãžã§ãã
AWSç°å¢ã®ãªãœãŒã¹æ å ±ãåéãã
ããã§å®éã«CloudMapperãå®è¡ãããããã¯ãŒã¯æ§æå³ãåºåããã®ã«å¿ èŠãªAWSç°å¢ã®ãªãœãŒã¹æ å ±ãååŸããŠãããŸããæ³šæç¹ãšããŠã¯ãä»®ã«ap-northeast-1äžã®AWSãªãœãŒã¹ã ããååŸããããŠãããããšããããAWSãªãœãŒã¹ãåéãã«ãããã®ã§ãã°ããŒãã«ãªãœãŒã¹ãå«ããŠãå šãªãŒãžã§ã³ã®AWSãªãœãŒã¹ã®æ å ±åéãè¡ãããã§ãããã®ãããç°å¢ã«ããããŸãããååå®è¡ã«ã¯æå ã®èšæž¬ã§ã¯ã³ãã³ãã®å®è¡ãçµãããŸã§ã«å€§äœ30åçšåºŠããããŸãããPythonã®ä»®æ³ç°å¢äžã§ã以äžã®ã³ãã³ããå®è¡ããŸãã
(foobar) % python3 cloudmapper.py collect --config config.json --account (ãããã¡ã€ã«å)ã¬ããŒãåºåã®æºåãè¡ã
äžèšã®ã³ãã³ãã§AWSç°å¢ã®ãªãœãŒã¹æ å ±ãåéãçµããããã¬ããŒãåºåã®æºåã®ããã«ãPythonã®ä»®æ³ç°å¢äžã§ã以äžã®ã³ãã³ããå®è¡ããŸãããã®æºåèªäœã¯ãæ§ç¯ãããŠããAWSãªãœãŒã¹ã軜ããã®ã§ããã°ãã£ãšããéã«å®è¡ãå®äºããŸãã
(foobar) % python3 cloudmapper.py prepare --config config.json --account (ãããã¡ã€ã«å)ã¬ããŒããåºåããŠã¿ã
ã¬ããŒãåºåã®æºåãå®äºããããCloudMapperãå éšçã«æã£ãŠããWebãµãŒãæ©èœãå©çšããŠã¬ããŒãåºåãããããã«ãPythonã®ä»®æ³ç°å¢äžã§ä»¥äžã®ã³ãã³ããå®è¡ããŸãã
(foobar) % python3 cloudmapper.py webserverãããŸã§å®äºããããhttp://127.0.0.1:8000/ ã«ãWebãã©ãŠã¶äžã§ã¢ã¯ã»ã¹ããŸãããããšããããªæãã®ã¬ããŒããåºåããããšæããŸãã(以äžã¯ãããŸã§ãäžäŸã§ã)

ç¡äºã«ãããã¯ãŒã¯æ§æå³ãåºåãããŸãããã¡ãã£ãšåœ¢ãäžæ°å¥œã§ãããããããã®AWSãªãœãŒã¹ã¢ã€ã³ã³ããç¢å°ã®éšåãã¯ãªãã¯ãããšãã©ããªèšå®ã§AWSãªãœãŒã¹ãæ§æãããŠããŠãã©ããã£ããããã¯ãŒã¯æ§æã«ãªã£ãŠããããjson圢åŒã§è¡šç€ºãããŸãã
ææ
ãããªããã§ããããã¯ãŒã¯æ§æå³ãåºåããããšãã§ããã®ã§ãããäŸãã°VPCå€ã«æ§æãããAWS LambdaãAmazon S3ãšãã£ãæ å ±ã¯ã©ããã¹ã¿ã³ãã¢ãã³ã§ã¯åºåããããšãã§ããªãããã§ãããã ããAmazon API Gatewayã«çŽã¥ããããVPC LambdaããVPC Endpointçµç±ã§çŽã¥ããããS3ãã±ãããªã©ã¯åºåãããæš¡æ§(å ·äœçãªæ€èšŒã¯ãŸã ã§ããŠããŸãããããµã³ãã«ãèŠãéãã§ã¯ã©ã®ããã«èŠåããããŸã)ã
ãªã®ã§ãçšéãšããŠã¯ããããã¯ãŒã¯æ§æãçŽè§£ãããããã©ãã«ã·ã¥ãŒãã£ã³ã°ã«ããã£ãŠSecurity Groupãæ£ãã察象ãšãªãAWSãªãœãŒã¹ã«ã¢ã¿ãããããŠããŠéä¿¡å¯èœãªã®ããè§£æããçšéã«ã¯éåžžã«æçšãªã®ã§ã¯ãªãããšæããŸãã
ããŒã«ã«ç°å¢ãžã®æ§ç¯èªäœã¯éåžžã«ç°¡åã§ãåŸ ã¡æéãå«ããŠ2æéçšåºŠã§å®äºããŠããŸãã®ã§ãæ§æå³ã ãã§ã¯ãããã¯ãŒã¯æ§æãããŸãå¯èŠåã§ããªããªãšããæ©ã¿ãæãããŠããæ¹ã«ã¯ãéåžžã«è¯ãããŒã«ãªã®ã§ã¯ãªãããšæããŸããã














