æ¬èšäºã¯ç±³åœæé 7æ 31 æ¥ã«å
¬éãããã Implementing Defense-in-Depth Security for AWS CodeBuild Pipelines ãã翻蚳ãããã®ã§ãã æè¿ã®ã»ãã¥ãªãã£ç ç©¶ã«ããã AWS Security Bulletin AWS-2025-016 ã§ææžåãããŠããããã«ã CI/CD ãã€ãã©ã€ã³èšå®ã®éèŠæ§ã泚ç®ãããŠããŸãããã®æçš¿ã§ã¯ãæ¢åã®ã¬ã€ãã³ã¹ãšæšå¥šäºé
ãäžã€ã®ã¬ã€ãã«ãŸãšããŸãã ç¶ç¶çã€ã³ãã°ã¬ãŒã·ã§ã³ãšç¶ç¶çãããã€ã¡ã³ãïŒ CI/CD ïŒã®å®è·µã¯ãéçºããŒã ãå¹ççãã€ç¢ºå®ã«ãœãããŠã§ã¢ãæäŸããã®ã«åœ¹ç«ã¡ãŸãã AWS CodeBuild ã¯ãGitHubãGitLabããã®ä»ã®ãœãŒã¹ã³ãŒã管çïŒ SCM ïŒã·ã¹ãã ãªã©ã®ãœãŒã¹ã³ãŒããªããžããªãšçµ±åãããããŒãžããã«ããµãŒãã¹ãæäŸããŸãããã®ã¬ã€ãã§ã¯ GitHub ã®äŸã䜿çšããŠããŸãããã»ãã¥ãªãã£ã®ååãš Webhook èšå®ã®ã¢ãããŒãã¯ããµããŒãããŠããä»ã®ãœãŒã¹ã³ãŒã管çã·ã¹ãã ã«ãé©çšã§ããŸãã ãã ããç¹å®ã®èšå®ã«ã¯æ³šææ·±ãé
æ
®ãå¿
èŠã§ãã é©åãªã»ãã¥ãªãã£å¶åŸ¡ãšè
åšã¢ãã«ã®æç¢ºãªçè§£ãªãã«ãä¿¡é Œã§ããªããªããžããªã®ã³ã³ããªãã¥ãŒã¿ãŒããã®èªåãã«ãªã¯ãšã¹ããã«ãã䜿çšããªãããšãåŒ·ãæšå¥šããŸãã ãã®èšå®ã«ãããä¿¡é Œã§ããªãã³ãŒãããªããžããªã®èªèšŒæ
å ±ãç°å¢å€æ°ã«ã¢ã¯ã»ã¹ã§ããç¶æ
ã§ãã«ãç°å¢å
ã§å®è¡ãããå¯èœæ§ããããŸããWebhook èšå®ã¯ãã©ã®ãªããžããªã€ãã³ãããã«ããããªã¬ãŒãããã«ãããã»ã¹äžã«ã©ã®ã³ãŒããå®è¡ãããããæ±ºå®ããŸãã CI/CD ã䟡å€ãããã®ã«ããèªååã®å©ç¹ãç¶æããªãããé©åãªã»ãã¥ãªãã£å¢çãç¶æããããã«ã¯ããããã®èšå®ãçè§£ããããšãäžå¯æ¬ ã§ãã ã»ãã¥ãªãã£ããŒã ãš DevOps ãšã³ãžãã¢ã¯ããããã®å®çšçãªã¢ãããŒãã䜿çšããŠãéçºé床ãç¶æããªããã»ãã¥ãªãã£ç®æšãæºããããã« AWS CodeBuild ãèšå®ã§ããŸããè
åšã¢ãã«ã®è©äŸ¡ãæå°æš©éã¢ã¯ã»ã¹ããã€ãã©ã€ã³èšå®ã®ç¶ç¶çãªç£èŠãéèŠããã Webhook èšå®ãä¿¡é Œå¢çãå®è£
æŠç¥ã«ã€ããŠèª¬æããŸãã ãã€ãã©ã€ã³ã®ã»ãã¥ãªãã£ã«é¢ããèå¯ è²¬ä»»å
±æã¢ãã« ã§ã¯ã AWS ãåºç€ãšãªã AWS CodeBuild ã€ã³ãã©ã¹ãã©ã¯ãã£ã®ã»ãã¥ãªãã£ã管çããäžæ¹ã§ãã客æ§ã¯ãã€ãã©ã€ã³ã®èšå®ãã¢ã¯ã»ã¹å¶åŸ¡ãããã³ãã«ãç°å¢å
ã§å®è¡ãããã³ãŒãã®ã»ãã¥ãªãã£ã«è²¬ä»»ãè² ããŸãããã®ãããªå
±æã®è²¬ä»»ã¯ããã€ãã©ã€ã³èªäœã®ã»ãã¥ãªãã£ãèããäžã§éèŠã§ãã AWS CodeBuild ããã«ãªã¯ãšã¹ããèªåçã«åŠçããéã«ã¯ããªããžããªã®èªèšŒæ
å ±ãç°å¢å€æ°ãæ©å¯æ§ã®é«ãå¯èœæ§ã®ããæ
å ±ã«ã¢ã¯ã»ã¹ã§ããç°å¢ã§ã³ãŒãããã«ãããŸããããã«ããããã€ãã©ã€ã³ã®ã»ãã¥ãªãã£ã«é¢ããç¹å®ã®èæ
®äºé
ãçããŸãïŒ ãªããžããªã¢ã¯ã»ã¹: AWS CodeBuild ãããžã§ã¯ãã¯ããœãŒã¹ã³ãŒãã®èªã¿åããš Webhook ã®äœæã®ããã«ãªããžããªã®èªèšŒæ
å ±ãå¿
èŠãšããŸãããããã®èªèšŒæ
å ±ã¯ãèšå®ã«åºã¥ããŠç°ãªãç¹å®ã®æš©éãæäŸããŸãã ãã«ãã®å®è¡: ãã«ãããã»ã¹ã§ã¯ãååŸãããœãŒã¹ã³ãŒããå®è¡ããŸããããã«ã¯ããã«ãã¹ã¯ãªãããäŸåé¢ä¿ã®å®çŸ©ããã«ãªã¯ãšã¹ãããã®ãã¹ããã¡ã€ã«ãªã©ãå«ãŸããå ŽåããããŸãã ãã«ãç°å¢: AWS CodeBuild ç°å¢ã¯ããã«ãããã»ã¹ã«å¿
èŠãªç°å¢å€æ°ãAWS èªèšŒæ
å ±ããŸãã¯ãã®ä»ã®èšå®ããŒã¿ã«ã¢ã¯ã»ã¹ã§ããå ŽåããããŸãã ä¿¡é Œå¢çã®ç¢ºç« 广çãªãã€ãã©ã€ã³ã®ã»ãã¥ãªãã£ã¯ãããŸããŸãªã¿ã€ãã®ã³ãŒãã®ã³ã³ããªãã¥ãŒã·ã§ã³ã«å¯Ÿããä¿¡é Œå¢çãæç¢ºã«å®çŸ©ããããšããå§ãŸããŸãïŒ å
éšã®ã³ã³ããªãã¥ãŒã¿ãŒ : çµç¹ã®ã¢ã¯ã»ã¹ç®¡çããã»ã¹ãéããŠæ€èšŒãããããªããžããªãžã®æžã蟌ã¿ã¢ã¯ã»ã¹æš©ãæã€ããŒã ã¡ã³ããŒã å€éšã®ã³ã³ããªãã¥ãŒã¿ãŒ : ãã©ãŒã¯ããããªããžããªãããã«ãªã¯ãšã¹ããéä¿¡ãããçµç¹å€ã®ã³ã³ããªãã¥ãŒã¿ãŒã èªååŠç : ãã«ãããã»ã¹ã®äžéšãšããŠæåã¬ãã¥ãŒãªãã§å®è¡ãããã³ãŒãã ãããã®ä¿¡é Œå¢çã¯ãç¹å®ã®ç°å¢ã®è
åšã¢ããªã³ã°ã®åºç€ãšãªããŸãã å
éšããã³ä¿¡é Œã§ããç°å¢ ã§ã¯ãã³ã³ããªãã¥ãŒã¿ãŒã®ãã£ã«ã¿ãªã³ã°ãšæå°æš©éå¶åŸ¡ã䜿çšããŠãèªååã«ããå€ãäŸåããããšãã§ããŸãã ãããªãã¯ããã³ãªãŒãã³ãœãŒã¹ãããžã§ã¯ã ã§ã¯ãä¿¡é Œã§ããªãã³ã³ããªãã¥ãŒã·ã§ã³ãåŠçããåºæã®ãªã¹ã¯ãããããããã峿 Œãªå¶åŸ¡ãå¿
èŠã§ãããããã®ç°å¢ã§ã¯ããã峿 ŒãªWebhookãã£ã«ã¿ãªã³ã°ãå
æ¬çãªæ¿èªããã»ã¹ããŸãã¯åŸã§èª¬æããã»ã«ããã¹ã GitHub Actions ã©ã³ããŒã®ã¢ãããŒããæå¹ã§ãã éèŠãªååã¯ãç¹å®ã®ãªã¹ã¯ãããã¡ã€ã«ãšã³ã³ããªãã¥ãŒã¿ãŒã®ä¿¡é Œã¬ãã«ã«åºã¥ããŠãã»ãã¥ãªãã£å¶åŸ¡ãšéçºé床ã®éã®é©åãªãã©ã³ã¹ãèŠã€ããããšã§ãããããã®èæ
®äºé
ã念é ã«çœ®ããŠãçŸåšã® AWS CodeBuild Webhook èšå®ãè©äŸ¡ããã³èšå®ããæ¹æ³ãèŠãŠãããŸãããã ã»ãã¥ã¢ãª Webhook ã®èšå® Webhook ã¯ãå€éšã€ãã³ãã AWS CodeBuild ããã»ã¹ãããªã¬ãŒããéã«æšå¥šãããã¡ã«ããºã ã§ããé©åã«èšå®ããããšãWebhook ã¯ãªããžããªã®å€æŽã«å¿çããŠãã«ãããã»ã¹ãèªååãã匷åã§å¹ççãªæ¹æ³ãæäŸããŸãããã ããäžé©å㪠Webhook èšå®ã¯ãä¿¡é Œã§ããªãã³ãŒããç¹æš©ç°å¢ã§å®è¡ãããããšãèš±å¯ããŠããŸããã»ãã¥ãªãã£ã®è匱æ§ãçããå¯èœæ§ããããŸãã Webhook èšå®ã®ã»ãã¥ãªãã£ã¯ãã©ã®ã€ãã³ãããã«ããããªã¬ãŒãããããããã®ãã«ããã©ã®ã¬ãã«ã®ã¢ã¯ã»ã¹æš©ãæã€ãããã«ãããã»ã¹äžã«ã©ã®ã³ãŒããå®è¡ãããããã©ãã ãæ£ç¢ºã«çè§£ããŠãããã«ããã£ãŠããŸãããã®ã»ã¯ã·ã§ã³ã§ã¯ãã»ãã¥ã¢ãª Webhook èšå®ã®äœæãè©äŸ¡ãèšå®ãããã³ç¶æã«å¯Ÿããå
æ¬çãªã¢ãããŒããæäŸããŸãã çŸåšã® Webhook ã®èšå®ã®è©äŸ¡ æ¢åã® AWS CodeBuild ãããžã§ã¯ãã確èªããŠãçŸåšã® Webhook èšå®ãçè§£ããããšããå§ããŸãããã以äžã® AWS CLI ã³ãã³ãã䜿çšãããšããã®æ
å ±ãäœç³»çã«åéããããšãã§ããŸããïŒ # ãªãŒãžã§ã³å
ã®ãã¹ãŠã®CodeBuild ãããžã§ã¯ããäžèŠ§è¡šç€º aws codebuild list-projects --region us-west-2 # 詳现ãªèšå®æ
å ±ãååŸããŠåæ aws codebuild batch-get-projects --region us-west-2 \ --names $(aws codebuild list-projects --region us-west-2 \ --query 'projects[*]' --output text | tr '\n' ' ') ãããã®ã³ãã³ããå®è¡ããéã¯ãåºåã® webhook ã»ã¯ã·ã§ã³ã«ç¹ã«æ³šæããŠãã ããããã®ã»ã¯ã·ã§ã³ã«ã¯ãã©ã®ãªããžããªã€ãã³ãããã«ããããªã¬ãŒããããæ£ç¢ºã«æ±ºå®ãã filterGroups èšå®ãå«ãŸããŠããŸãã çŸåšã®èšå®ã確èªããæ¹æ³ãçè§£ãããšããã§ãäžè¬çãªèšå®ãã¿ãŒã³ãšãã®ã»ãã¥ãªãã£ãžã®åœ±é¿ãèŠãŠãããŸãããã Webhook èšå®ãã¿ãŒã³ äžè¬ç㪠Webhook ã®èšå®ãã¿ãŒã³ãçè§£ããããšã§ãæœåšçãªã»ãã¥ãªãã£äžã®æžå¿µç¹ãçŽ æ©ãç¹å®ããé©åãªæ¹åãå®è£
ã§ããããã«ãªããŸãã以äžã®ãã¿ãŒã³ã¯ã Webhook ã®èšå®ã«å¯ŸããããŸããŸãªã¢ãããŒãã衚ããããããã«ç¹å®ã®ã»ãã¥ãªãã£ãžã®èæ
®äºé
ããããŸãã æ³š: ãããã®ãã¿ãŒã³ãå©çšããããšã¯æšå¥šãããŸãããæ³šæãå¿
èŠãªèšå®ãç¹å®ããããã®åèãšããŠç޹ä»ããŠããŸãã èŠçŽããå¿
èŠãªèšå® â ãã«ãªã¯ãšã¹ãã®èªååŠç { "webhook": { "payloadUrl": "https://codebuild.us-west-2.amazonaws.com/webhooks", "filterGroups": [ [ { "type": "EVENT", "pattern": "PULL_REQUEST_CREATED,PULL_REQUEST_UPDATED,PULL_REQUEST_REOPENED", "excludeMatchedPattern": false } ] ] } } ãã®èšå®ã«ããããã«ãªã¯ãšã¹ããäœæã§ããã³ã³ããªãã¥ãŒã¿ãŒããã«ãç°å¢ã§ã®ã³ãŒãå®è¡ãããªã¬ãŒã§ããããã«ãªããŸããä¿¡é Œã§ããªããªããžããªã®ã³ã³ããªãã¥ãŒã¿ãŒããã®ãã«ãªã¯ãšã¹ãã®èªåãã«ãã¯å©çšããªãããšãåŒ·ãæšå¥šããŸãã å³åº§ã«ç¢ºèªãå¿
èŠãªèšå® â ã€ãã³ããã£ã«ã¿ãªã³ã°ãªã { "webhook": { "payloadUrl": "https://codebuild.us-west-2.amazonaws.com/webhooks", "filterGroups": [] } } ãã£ã«ã¿ãªã³ã°ãè¡ããªãã®ã§ããã®èšå®ã§ã¯å¹
åºããªããžããªã€ãã³ãã§ãã«ããããªã¬ãŒãããå¯èœæ§ããããŸãã æšå¥šãããã»ãã¥ã¢ãª Webhook èšå® 以äžã®èšå®ã¯ãèªååã®å©ç¹ãšé©åãªã»ãã¥ãªãã£å¶åŸ¡ã®ãã©ã³ã¹ãåãã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã衚ããŠããŸãããããã®ãã¿ãŒã³ã¯ãCI/CD ã®äŸ¡å€ã§ããéçºé床ãç¶æããªãããã»ãã¥ãªãã£ãªã¹ã¯ã軜æžããã®ã«åœ¹ç«ã¡ãŸãã ããã·ã¥ããŒã¹ã®ãã«ãïŒã»ãšãã©ã®ãŠãŒã¹ã±ãŒã¹ã§æšå¥šïŒ ããã·ã¥ããŒã¹ã®ãã«ãã¯ããªããžããªãžã®æžã蟌ã¿ã¢ã¯ã»ã¹æš©ãæã€ãŠãŒã¶ãŒã®ã¿ããã«ããããªã¬ãŒã§ããããšã確å®ã«ããŸããããã¯ãã³ã³ããªãã¥ãŒã¿ãŒããªããžããªã®ã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ãéããŠãã§ã«æ€æ»ãããŠããããšãæå³ããŸãã { "webhook": { "payloadUrl": "https://codebuild.us-west-2.amazonaws.com/webhooks", "filterGroups": [ [ { "type": "EVENT", "pattern": "PUSH", "excludeMatchedPattern": false } ] ] } } å€éšããã®ãªãŒãã³ãœãŒã¹ã³ã³ããªãã¥ãŒã·ã§ã³ã«å€§ããäŸåããŠããçµç¹ã§ã¯ããã®ã¢ãããŒãã¯å¶éãå³ããããå ŽåããããŸããäŸãã°ãå€éšã®ã³ã³ããªãã¥ãŒã¿ãŒããæ¯æ¥æ°åä»¶ã®ãã«ãªã¯ãšã¹ããåãåã人æ°ã®ãªãŒãã³ãœãŒã¹ãããžã§ã¯ãã§ã¯ããã«ããå®è¡ãããåã«åã³ã³ããªãã¥ãŒã·ã§ã³ãæåã§ããŒãžããå¿
èŠããããã³ã³ããªãã¥ãŒã·ã§ã³ã®ã¬ãã¥ãŒããã»ã¹ã倧å¹
ã«é
ããªã£ãŠããŸããŸãããã®ãããªå Žåãã³ã³ããªãã¥ãŒã¿ãŒã§ãã£ã«ã¿ãªã³ã°ããããã«ãããã»ã«ããã¹ãåã® GitHub Actions ã©ã³ããŒã®ã¢ãããŒããããé©åãããããŸããã ã³ã³ããªãã¥ãŒã¿ãŒã«ãããã«ãã®ãã£ã«ã¿ãªã³ã°ïŒä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒã®ã¿æšå¥šïŒ { "webhook": { "payloadUrl": "https://codebuild.us-west-2.amazonaws.com/webhooks", "filterGroups": [ [ { "type": "EVENT", "pattern": "PULL_REQUEST_CREATED,PULL_REQUEST_UPDATED", "excludeMatchedPattern": false }, { "type": "GITHUB_ACTOR_ACCOUNT_ID", "pattern": "^(12345678|87654321|11223344)$", "excludeMatchedPattern": false } ] ] } } ãã®èšå®ã«ãããç¹å®ã®ä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒããã®ãã«ãªã¯ãšã¹ãã®ãã«ããå¯èœã«ãªããŸãã éèŠ: ãã£ã«ã¿ãªã³ã°ã¯ GitHub ã®ã¢ã«ãŠã³ã ID ã«é©çšããããªããžããªã®æææš©ã«ã¯é©çšãããŸããããã©ãŒã¯ããããªããžããªããäœæ¥ããã³ã³ããªãã¥ãŒã¿ãŒã¯ããã«ãç°å¢ã§å®è¡ãããä¿¡é Œã§ããªãã³ãŒããåŒãç¶ãæã¡èŸŒããå¯èœæ§ããããŸãã ç°å¢ã§ãããã®èšå®ãå®è£
ããåã«ãã¹ã ãŒãºãªç§»è¡ãä¿é²ããã®ã«åœ¹ç«ã€ä»¥äžã®éèŠãªèŠçŽ ãæ€èšããŠãã ããã Webhook èšå®ã®å®è£
æé 以äžã®Webhook ã»ãã¥ãªãã£å¯Ÿçãå®è£
ããéã¯ã次ã®ãããªããåºç¯ãªãã©ã¯ãã£ã¹ãèæ
®ããŠãã ããïŒ è
åšã¢ããªã³ã°: ã¢ãããŒããéžæããåã«ãç¹å®ã®ãªã¹ã¯ãããã¡ã€ã«ãè©äŸ¡ããŸãã Infrastructure as Code : æ¬çªç°å¢ã®å®è£
ã«ã¯ Infrastructure as CodeïŒIaCïŒããŒã«ã䜿çšããŸãã æ®µéçãªå®è£
: èŠ³å¯æéãèšããŠå€æŽã段éçã«å®è£
ããŸãã ãã¹ããšããŒã«ããã¯: 鿬çªç°å¢ã§æåã«å€æŽãæ€èšŒããŸãã 以äžã®å®è£
ã¢ãããŒãã¯ãæãå¶éçãªãã®ããããèªååãããèšå®ãžãšç§»è¡ããŸããçµç¹ã®ãªã¹ã¯èš±å®¹åºŠãšéçšèŠä»¶ã«æãé©ããã¢ãããŒããéžæããŠãã ããã ãã®3段éã®ããã»ã¹ã¯ãã»ãã¥ãªãã£ã³ã³ãããŒã«ãç¶æããªããæãå¶éçãªã¢ãããŒãããããèªååãããèšå®ãžãšç§»è¡ããŸããåã¹ãããã¯åã®ã¹ãããã«åºã¥ããŠæ§ç¯ããããã€ãã©ã€ã³ãä¿è·ããããã®å€å±€çãªã»ãã¥ãªãã£å¯ŸçãäœæããŸãã æ³š: 以äžã®äŸã¯ã AWS CLI ã䜿çšããŠèª¬æããŸããåæ§ã®èšå®æé ã¯ã AWS CodeBuild ã®ãããžã§ã¯ãèšå®ãã AWS ãããžã¡ã³ãã³ã³ãœãŒã«ã䜿çšããŠå®è¡ããããšãå¯èœã§ãã ã¹ããã1: ããã·ã¥ã®ã¿ã®ãã«ããèšå® ããã·ã¥ããŒã¹ã®ãã«ãã¯ãæ€èšŒãããã³ã³ããã¥ãŒã¿ãŒã®ã¿ããã«ããããªã¬ãŒã§ããããšã確å®ã«ããŸãããã®ã¢ãããŒãã¯ãã³ã³ããªãã¥ãŒã¿ãŒãã³ãŒããããã·ã¥ããåã«ããªããžããªã®ã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ãéããŠãã§ã«æ€æ»ãããŠããå¿
èŠããããããããå®å
šã§ãã ããã·ã¥ã€ãã³ãã§ã®ã¿ããªã¬ãŒãããããã« Webhook ãèšå®ããŸãïŒ aws codebuild update-webhook \ --project-name your-project-name \ --filter-groups '[ [ { "type": "EVENT", "pattern": "PUSH", "excludeMatchedPattern": false } ] ]' ã¹ããã2: ãã©ã³ãããŒã¹ã®ãã£ã«ã¿ãªã³ã°ãå®è£
ãã©ã³ãããŒã¹ã®ãã£ã«ã¿ãªã³ã°ã¯ãç¹å®ã®ãã©ã³ããžã®å€æŽã«å¯ŸããŠã®ã¿ãã«ããããªã¬ãŒãããããšã確å®ã«ããããšã§ãããã«ã»ãã¥ãªãã£ã®å±€ã远å ããŸãããã®ã¢ãããŒãã¯ããªããžããªå
ã®ãã¹ãŠã®ãã©ã³ããåãã»ãã¥ãªãã£èŠä»¶ããªã¹ã¯ãããã¡ã€ã«ãæã€ããã§ã¯ãªãããšãèæ
®ããŠããŸãã äŸãã°ã main ãæ¬çªãã©ã³ããžã®å€æŽã¯ãéåžžããã£ãŒãã£ãŒãã©ã³ããéçºãã©ã³ããžã®å€æŽããã峿 Œãªã»ãã¥ãªãã£å¶åŸ¡ãå¿
èŠãšããŸãããã©ã³ãããŒã¹ã®ãã£ã«ã¿ãªã³ã°ãå®è£
ããããšã§ãåãã©ã³ãã®éèŠæ§ãå
¬éç¯å²ã«åºã¥ããŠãé©åãªã»ãã¥ãªãã£å¯Ÿçãé©çšã§ããŸãã ç¹å®ã®ãã©ã³ãã«å¯Ÿãããã£ã«ã¿ãªã³ã°ãèšå®ããŸãïŒ aws codebuild update-webhook \ --project-name your-project-name \ --filter-groups '[ [ { "type": "EVENT", "pattern": "PUSH" }, { "type": "HEAD_REF", "pattern": "^refs/heads/(main|develop|release/.*)$" } ] ]' ã¹ããã3: ã³ã³ããªãã¥ãŒã¿ãŒã®ãã£ã«ã¿ãªã³ã°ãèšå® ã³ã³ããªãã¥ãŒã¿ãŒãã£ã«ã¿ãªã³ã°ã¯ãä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒã«å¯ŸããŠã¯èªååãèš±å¯ãããã®ä»ã®ã³ã³ããªãã¥ãŒã¿ãŒã«å¯ŸããŠã¯æåã¬ãã¥ãŒãèŠæ±ããããšã§ããã«ãªã¯ãšã¹ãã®ãã«ãã管çã§ããŸãããã®ã¢ãããŒãã¯ãã³ã³ããªãã¥ãŒã¿ãŒããšã«ãªã¹ã¯ãããã¡ã€ã«ãç°ãªãããšãèæ
®ããããã«å¿ãã察å¿ãè¡ããã®ã§ãã ã³ã³ããªãã¥ãŒã¿ãŒãã£ã«ã¿ãªã³ã°ãå®è£
ããæåã®ã¹ãããã¯ãä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒã® GitHub ã®ãŠãŒã¶ãŒ ID ãç¹å®ããããšã§ãã ä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒã® GitHub ãŠãŒã¶ãŒ ID ãååŸããŸãïŒ curl -H "Authorization: token YOUR_GITHUB_TOKEN" \ https://api.github.com/users/trusted-username ä¿¡é Œã§ããã³ã³ããªãã¥ãŒã¿ãŒã®ãŠãŒã¶ãŒ ID ãååŸãããããããã®ã³ã³ããªãã¥ãŒã¿ãŒã«å¯ŸããŠã®ã¿èªåãã«ããèš±å¯ããããã« Webhook ã®ãã£ã«ã¿ãªã³ã°ãèšå®ã§ããŸãïŒ aws codebuild update-webhook \ --project-name your-project-name \ --filter-groups '[ [ { "type": "EVENT", "pattern": "PULL_REQUEST_CREATED,PULL_REQUEST_UPDATED" }, { "type": "GITHUB_ACTOR_ACCOUNT_ID", "pattern": "^(1234567|2345678|3456789)$" } ] ]' éèŠ: ã³ã³ããªãã¥ãŒã¿ãŒã®èš±å¯ãªã¹ãã¯ãããŒã ã¡ã³ããŒã®å€æŽã«å¿ããŠç¶ç¶çãªã¡ã³ããã³ã¹ãå¿
èŠã§ããããŒãžã§ã³ç®¡çã§ Webhook ã®èšå®ãšã³ã³ããªãã¥ãŒã¿ãŒãªã¹ãã管çããããã«ã CloudFormation ã®äŸ ã®ãã㪠Infrastructure as Code ãã³ãã¬ãŒãã®äœ¿çšãæ€èšããŠãã ããã Webhook ãã£ã«ã¿ãªã³ã°ã¯ãã©ã®ã€ãã³ãããã«ããããªã¬ãŒããããå¶åŸ¡ããããšã§ãæåã®ã»ãã¥ãªãã£ã¬ã€ã€ãŒãæäŸããŸãããã ããå
æ¬çãªãã€ãã©ã€ã³ã»ãã¥ãªãã£ã«ã¯ããã«ããå®è¡æã«å©çšå¯èœãªæš©éãšèªèšŒæ
å ±ã«é¢ãã远å ã®å¶åŸ¡ãå¿
èŠã§ããæ¬¡ã®ã»ã¯ã·ã§ã³ã§ã¯ãé©åãªã¢ã¯ã»ã¹å¶åŸ¡ãšèªèšŒæ
å ±ç®¡çãéããŠå€å±€çãªã»ãã¥ãªãã£ãå®è£
ããæ¹æ³ã«ã€ããŠèª¬æããŸãã ã¢ã¯ã»ã¹å¶åŸ¡ãšèªèšŒæ
å ±ç®¡ç ãã®ã»ã¯ã·ã§ã³ã§ã¯ããã«ãããã»ã¹ã§å©çšå¯èœãªæš©éãå¶éãããªããžããªã¢ã¯ã»ã¹ããŒã¯ã³ã«é©åã«æš©éç¯å²ãèšå®ããæœåšçãªã»ãã¥ãªãã£åé¡ãå°ã蟌ããããã®åé¢ç°å¢ãäœæããå
·äœçãªã¢ãããŒãã«ã€ããŠèª¬æããŸãããããã®ãã©ã¯ãã£ã¹ã¯ãèªååããã CI/CD ã¯ãŒã¯ãããŒã®éçšäžã®ã¡ãªãããç¶æããªãããå€å±€çãªã»ãã¥ãªãã£å¯Ÿçãå®è£
ããããã«é£æºããŠæ©èœããŸãã æå°æš©éã¢ã¯ã»ã¹ã®å®è£
AWS CodeBuild ãããžã§ã¯ãã¯ããã«ãããã»ã¹äžã« AWS ãªãœãŒã¹ã«ã¢ã¯ã»ã¹ããããã« IAM ãµãŒãã¹ããŒã«ãå¿
èŠã§ããæå°æš©éã®ååã§ã¯ãåããŒã«ã¯æå³ãããæ©èœãå®è¡ããããã«å¿
èŠãªæå°éã®æš©éã®ã¿ãæã€ã¹ãã§ããç°ãªãã¿ã€ãã®ãã«ãã«å¯ŸããŠãç®çã«å¿ããåå¥ã® IAM ããŒã«ãäœæããããšã§ããã«ãç°å¢ãžã®äžæ£ã¢ã¯ã»ã¹ã®æœåšçãªåœ±é¿ã軜æžã§ããŸãã 以äžã®äŸã¯ãç°ãªããã«ãã·ããªãªã«å¯Ÿããæå°éã® IAM ããŒã«ãæ§é åããæ¹æ³ã瀺ããŠããŸãããããã®äŸã¯ãç¹å®ã®èŠä»¶ã«åºã¥ããŠã«ã¹ã¿ãã€ãºãããã«ããå®éã«å¿
èŠãšããæš©éã®ã¿ã远å ããåºçºç¹ãšããŠæ©èœããŸãã ãµãŒãã¹ããŒã«èšå® ç¹å®ã®ãã«ãã¿ã€ãã«å¿
èŠãªæš©éã®ã¿ãæäŸããæå°éã® IAM ããŒã«ãäœæããŸãïŒ ãã¹ã/æ€èšŒãã«ãããŒã« { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/test-*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": "arn:aws:s3:::your-test-artifacts-bucket/*" } ] } ãªãªãŒã¹ãã«ãããŒã«ïŒãã¹ãçšãšã¯å¥ã«äœæïŒ { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": "arn:aws:s3:::your-production-artifacts-bucket/*" }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:PutImage" ], "Resource": "arn:aws:ecr:*:*:repository/your-production-repo" } ] } CodeBuild ã»ãã¥ãªãã£ã®ããã® IAM Access Analyzer ã®æŽ»çš AWS IAM Access Analyzer ã¯ããã«ãå®è¡æã®å®éã® CloudTrail ã¢ã¯ãã£ããã£ã«åºã¥ããŠã AWS CodeBuild ãµãŒãã¹ããŒã«ã®æå°æš©éããªã·ãŒãçæã§ããŸããããã¯ãã«ããè¡ãç¹å®ã®AWS APIåŒã³åºããåæããããšã§ãå¿
èŠãªæš©éãäºæž¬ããããã®æšæž¬ã§è¡ãäœæ¥ãæé€ããŸãã CodeBuild ãããžã§ã¯ããäžå®æéå®è¡ããåŸã Access Analyzer ã®ããªã·ãŒçææ©èœã䜿çšããŠæé©åãããããªã·ãŒãäœæããŸãããã®ã¢ãããŒãã¯ãå¿
èŠãªæš©éãããã«ã¯ããããªãè€éãªãã«ãããã»ã¹ã«ç¹ã«äŸ¡å€ããããŸãã 詳现ãªå®è£
æé ã«ã€ããŠã¯ã IAM Access Analyzer ã®ããã¥ã¡ã³ã ãåç
§ããŠãã ããã èªèšŒæ
å ±ã®æš©éç¯å²ãšéä¿¡å
èªèšŒ å€éšããã®ã³ã³ããªãã¥ãŒã·ã§ã³ãåŠçããéããªããžããªã¢ã¯ã»ã¹ããŒã¯ã³ã«å¯Ÿããæå°æš©éã®ååãéèŠã«ãªããŸããäžæ£ãªãŠãŒã¶ãŒãä¿¡é Œã§ããªããã«ããéããŠããŒã¯ã³ã«ã¢ã¯ã»ã¹ããå ŽåãããŒã¯ã³ãé©åã«æš©éç¯å²èšå®ãããŠããã°ããã«ãããã»ã¹ã«å¿
èŠãªæš©éã®ã¿ã«æœåšçãªåœ±é¿ãå¶éã§ããŸãã ãã®ãªã¹ã¯ã軜æžããããã«ãæå°éã®æš©éã§ GitHub ã®Fine-grained Personal Access Token ãèšå®ããŸããäžé©åã«ã¢ã¯ã»ã¹ãããå Žåã§ããé©åãªæš©éç¯å²ãæã€ããŒã¯ã³ã¯ããœãŒã¹ã³ãŒãïŒãã«ãªã¯ãšã¹ããéããŠãã§ã«ã¢ã¯ã»ã¹å¯èœïŒã®èªã¿åããšã¹ããŒã¿ã¹ã¡ãã»ãŒãžã®æžã蟌ã¿ã®ã¿ãå¯èœã§ããã³ãŒãã®ããã·ã¥ããªããžããªèšå®ã®å€æŽããŸãã¯ä»ã®ãªããžããªãžã®ã¢ã¯ã»ã¹ã¯ã§ããŸããã 以äžã®æš©éã¯ãå€éšããã®ãã«ãªã¯ãšã¹ããåŠçããããã«å¿
èŠãªæå°éã®ã¢ã¯ã»ã¹ã衚ããããŒã¯ã³ã®æš©éç¯å²ãå¿
é ã®æäœã®ã¿ã«å¶éããæ¹æ³ã瀺ããŠããŸãïŒ contents:read â ãªããžããªãœãŒã¹ã³ãŒããžã®èªã¿åãå°çšã¢ã¯ã»ã¹ïŒãã«ãªã¯ãšã¹ããéããŠãã§ã«ã¢ã¯ã»ã¹å¯èœïŒ statuses:write â ã³ãããã¹ããŒã¿ã¹ã¡ãã»ãŒãžã®æžã蟌ã¿ã®ã¿ïŒã³ãŒããèšå®ã®å€æŽã¯äžå¯ïŒ metadata:read â åºæ¬çãªãªããžããªæ
å ±ïŒååã説æãå
¬éã¹ããŒã¿ã¹ïŒãžã®ã¢ã¯ã»ã¹ éèŠ: 察象ãªããžããªã®ã¿ã«å¶éããã Fine-grained Personal Access Token ã䜿çšããŠãã ãããããããªããšããã«ãããã»ã¹ã«å¿
èŠãªç¯å²ãè¶
ããŠä»ã®ãªããžããªãžã®ã¢ã¯ã»ã¹ãèš±å¯ããŠããŸãå¯èœæ§ããããŸãã ãã®æš©éç¯å²ãèšå®ããã¢ãããŒãã«ãããããŒã¯ã³ãäžé©åã«ã¢ã¯ã»ã¹ãããå Žåã§ãããã®æœåšçãªåœ±é¿ã¯ããã§ã«ã¢ã¯ã»ã¹å¯èœãªæ
å ±ã®èªã¿åããšã¹ããŒã¿ã¹ã¡ãã»ãŒãžã®æžã蟌ã¿ã«éå®ãããŸãããã®ããŒã¯ã³ã¯ãã³ãŒãã®ããã·ã¥ããªããžããªèšå®ã®å€æŽãWebhookã®äœæããŸãã¯ä»ã®ãªããžããªãžã®ã¢ã¯ã»ã¹ã¯ã§ããŸããã èªèšŒæ
å ±ã®ä¿åãšããŒããŒã·ã§ã³ 以äžã®äŸã¯ãAWS Secrets Manager ã䜿çšããŠãããã®ããŒã¯ã³ãå®å
šã«ä¿åããã³åç
§ããæ¹æ³ã瀺ããŠããŸãã AWS Secrets Manager ã¯ãèªåããŒããŒã·ã§ã³æ©èœãä¿åæããã³è»¢éæã®æå·åããã«ããã°ãèšå®ãã¡ã€ã«ã§ããŒã¯ã³ãå
¬éãããããšãé²ããã现ããªã¢ã¯ã»ã¹å¶åŸ¡ãæäŸããŸãããã®ã¢ãããŒãã«ãããããŒã¯ã³ã¢ã¯ã»ã¹ã®ç£æ»èšŒè·¡ãç¶æããªãããè€æ°ã® CodeBuild ãããžã§ã¯ãéã§ã®äžå
çãªããŒã¯ã³ç®¡çãå¯èœã«ãªããŸãã # Fine-grained ããŒã¯ã³ãAWS Secrets Managerã«ä¿å aws secretsmanager create-secret \ --name "codebuild/github-pat-limited" \ --description "Limited GitHub PAT for external PR processing" \ --secret-string '{"token":"ghp_your_limited_token_here"}' # æš©éç¯å²ãèšå®ãããèªèšŒæ
å ±ã§ CodeBuild ãããžã§ã¯ããäœæ aws codebuild create-project \ --name external-pr-processor \ --source '{ "type": "GITHUB", "location": "https://github.com/your-org/your-repo.git", "sourceCredentialsOverride": { "serverType": "GITHUB", "authType": "PERSONAL_ACCESS_TOKEN", "token": "{{resolve:secretsmanager:codebuild/github-pat-limited:SecretString:token}}" }, "reportBuildStatus": false }' \ --service-role arn:aws:iam::account:role/minimal-test-build-role äžå
åãããã¹ãã¬ãŒãžã«ãããèªèšŒæ
å ±ã®ããŒããŒã·ã§ã³ãå¯èœã«ãªããã€ã³ãã©ã¹ãã©ã¯ãã£ã®æŽæ°ãå¿
èŠãªããŒãã³ãŒããããããŒã¯ã³ãšæ¯èŒããŠãé²åºæéãæå°éã«æããããšãã§ããŸãã ãã«ãç°å¢ã®åé¢ é©åãªãã«ãç°å¢ã®ã»ãã¥ãªãã£ç®¡çã確ç«ããããšã§ããã€ãã©ã€ã³ã®å®å
šæ§ãç¶æã§ããŸãããã®ã¢ãããŒãã®åºç€ãšãªãã®ã¯ããã¹ããã«ããšãªãªãŒã¹ãã«ãã®åé¢ãå®è£
ããããšã§ããããã«ãããèªèšŒæ
å ±ã®æš©éææ Œãé²ããæœåšçãªäžæ£ã¢ã¯ã»ã¹ã®ç¯å²ãå¶éããããšãã§ããŸãã ãããã¯ãŒã¯åé¢ã¯ãããäžã€ã®ä¿è·å±€ã§ããå€éšã³ãŒããåŠçãããã«ãå°çšã® VPC ããæ
éã«å¶éãããã¢ãŠãããŠã³ãã¢ã¯ã»ã¹ãæã€å°çšã®ã»ãã¥ãªãã£ã°ã«ãŒããäœæããŠèšå®ããŸãããããã®ã»ãã¥ãªãã£ã°ã«ãŒãã¯ãæ£åœãªäŸåé¢ä¿ãããŠã³ããŒãããããã® HTTPS ãã©ãã£ãã¯ãªã©ãå¿
èŠãªæ¥ç¶ã®ã¿ãèš±å¯ããä¿¡é Œã§ããªãã³ãŒãã«ãã£ãŠæªçšãããå¯èœæ§ãããäžèŠãªãããã¯ãŒã¯ã¢ã¯ã»ã¹ããããã¯ããå¿
èŠããããŸãã AWS CodeBuild ãããžã§ã¯ããæŽæ°ããæå®ããããµãããããšå¶éãããã»ãã¥ãªãã£ã°ã«ãŒããå«ãé©å㪠VPC èšå®ã䜿ãããã®ãããã¯ãŒã¯åé¢ã掻çšããããã«ããŸãã 人ã«ããã¬ãã¥ãŒã²ãŒããæã€ãã«ãã¹ããŒãžãã€ãã©ã€ã³ã»ãã¥ãªãã£ è€æ°ã®ãã€ãã©ã€ã³ã¹ããŒãžã«ãããã»ãã¥ãªãã£ã³ã³ãããŒã«ã®å®è£
ã¯ãç¹ã«å€éšããã®ã³ã³ããªãã¥ãŒã·ã§ã³ãåŠçããéã«ãé©åãªæ€èšŒãšæ¿èªããã»ã¹ãæäŸããã®ã«åœ¹ç«ã¡ãŸãããã®ã¢ãããŒãã¯ãèªåã¹ãã£ã³ãšäººã«ããç£èŠãçµã¿åãããŠãæ¬çªç°å¢ã«å°éããåã«åé¡ãç¹å®ããŸãã ã³ãŒãæ€æ»ã®çµ±å ãã«ãããã»ã¹äžã« Automated Security Helper ãªã©ã®ã»ãã¥ãªãã£ããŒã«ãèªåçã«å®è¡ããããã«ãã«ã仿§ãèšå®ããŸãããããããã®ããŒã«ã¯ãã³ãŒãã»ãã¥ãªãã£åé¡ãšäŸåé¢ä¿ã®åé¡ãã¹ãã£ã³ããã¬ãã¥ãŒçšã®è©³çްãªã¬ããŒããçæããŸãã ãã¹ãŠã®ã¹ãã£ã³ãå®äºã§ããããã«ãåé¡ãèŠã€ãã£ãå Žåã§ããã«ããæåŸãŸã§ç¶è¡ããããã«æ§æããäžã§ã察å¿ãå¿
èŠãªã»ãã¥ãªãã£äžã®åé¡ãå«ãŸãããã«ãã¯èªåçã«å€±æãããããã«ããŸãããã¹ãŠã®ã¹ãã£ã³ã®ææç©ãä¿åããŠãã»ãã¥ãªãã£ããŒã ã«æ¿èªå€æã®ããã®è©³çްæ
å ±ãæäŸããŸãã æåæ¿èªã«ããã²ãŒã ã³ãŒããèªåã»ãã¥ãªãã£ã¹ãã£ã³ã«åæ ŒããåŸãæçµæ€èšŒã®ããã«äººéã®ã¬ãã¥ã¢ãŒãé¢äžãããæåæ¿èªã²ãŒããèšå®ããŸããããã«ãããæ©å¯æ§ã®é«ãç°å¢ã«é²ãåã«é©åãªäººéã«ããã¬ãã¥ãŒã確ä¿ã§ããŸãã ãã®ã»ã¯ã·ã§ã³ã§è§£èª¬ãããã¢ã¯ã»ã¹å¶åŸ¡ãšèªèšŒæ
å ±ç®¡çã®ãã©ã¯ãã£ã¹ã¯ã AWS CodeBuild ã®ãã€ãã©ã€ã³ã®å€å±€é²åŸ¡ã»ãã¥ãªãã£ãå®è£
ããããã®å
·äœçã§å®çšçãªã¢ãããŒããæäŸããŸãããããã®å¶åŸ¡ã¯é£æºããŠè€æ°ã®ä¿è·å±€ãäœæãã CI/CD ã«ããèªååã䟡å€ãããã®ã«ããéçšäžã®å©ç¹ãç¶æããŸãã 代æ¿ã¢ãããŒã â GitHub Actions ã®ã»ã«ããã¹ããã ã©ã³ã㌠AWS CodeBuild ã® GitHub Actions ã»ã«ããã¹ãããã©ã³ããŒæ©èœã¯ããªããžããªèªèšŒæ
å ±ããã«ãç°å¢ããåé¢ãã AWS CodeBuild Webhook åŠçã®ä»£ããã« GitHub Actions ã®å®è¡ãã¬ãŒã ã¯ãŒã¯ã䜿çšããããšã§ããã®ã¬ã€ãã§èª¬æããèšå®ã®åé¡ã«å¯ŸåŠããŸãã å€éšããã®ã³ã³ããªãã¥ãŒã·ã§ã³ãèªåçã«åŠçããå¿
èŠãããçµç¹ã§ã¯ãé©åãªã¢ã¯ã»ã¹å¶åŸ¡ã§ã©ã³ããŒãèšå®ããæ°žç¶çãªã¢ã¯ã»ã¹ãæå°éã«æããããã«äžæçãªã©ã³ããŒã䜿çšããã©ã³ããŒç®¡çã®æšæºçãªã»ãã¥ãªãã£å¯Ÿçãé©çšããŠãã ããã èšå®ã®è©³çްã¯ã AWS CodeBuild ããã¥ã¡ã³ã ãã芧ãã ããã远å ã®å®è£
ã¬ã€ãã³ã¹ã«ã€ããŠã¯ã AWS CodeBuild Managed Self-Hosted GitHub Action Runners ã®ããã°æçš¿ ããåç
§ãã ããã ç£èŠãšã³ã³ãã©ã€ã¢ã³ã¹ åã®ã»ã¯ã·ã§ã³ã§èª¬æããã»ãã¥ãªãã£ã³ã³ãããŒã«ã¯ããã«ãæã®ä¿è·ãæäŸããŸãããå
æ¬çãªå€å±€é²åŸ¡ã»ãã¥ãªãã£ã«ã¯ããã€ãã©ã€ã³ã®ã¢ã¯ãã£ããã£ãšèšå®å€æŽãžã®ç¶ç¶çãªå¯èŠåãå¿
èŠã§ããç£èŠãšã³ã³ãã©ã€ã¢ã³ã¹ã®è¿œè·¡ã¯ãã»ãã¥ãªãã£ãã¬ãŒã ã¯ãŒã¯ã®æçµå±€ãšããŠæ©èœããèšå®ã®éžè±ã®æ€åºãã¢ã¯ã»ã¹ãã¿ãŒã³ã®ç£æ»ãé·æçãªã»ãã¥ãªãã£äœå¶ã®ç¶æã«åœ¹ç«ã¡ãŸãã AWS CloudTrail ã¯ãAWS CodeBuild ãå«ã AWS ãµãŒãã¹ã«å¯ŸããŠè¡ããã API åŒã³åºãã®è©³çްãªãã°ãæäŸããŸããCloudTrail ãã°ãæå¹ã«ããããšã§ãç°å¢å
ã®ãã¹ãŠã®ãã«ãé¢é£ã¢ã¯ãã£ããã£ã®å
æ¬çãªç£æ»èšŒè·¡ãäœæã§ããŸãã AWS Config ã¯ãAWS CodeBuild ãããžã§ã¯ãã®æ§æãæç³»åã§è¿œè·¡ãããããžã§ã¯ãã®ã€ã³ãã³ããªãšèšå®å€æŽã®å®å
šãªå±¥æŽãæäŸããŸããããã«ã¯ãWebhook ã®å€æŽããªãœãŒã¹ã®é¢ä¿æ§ãç°å¢å
šäœã§ã®ã³ã³ãã©ã€ã¢ã³ã¹è¿œè·¡ãå«ãŸããŸããAWS Config ãèšå®ããŠãAWS CodeBuild ãããžã§ã¯ããç£èŠããWebhook ãã£ã«ã¿ãŒãªã©ã®ã»ãã¥ãªãã£äžéèŠãªèšå®ã倿Žããããšãã«éç¥ãåãåãããã«ããããšãã§ããŸãã 詳现ã«ã€ããŠã¯ãAWS CodeBuild ã®ããã¥ã¡ã³ãã«ããAWS Config ã®ãµã³ãã« ããåç
§ãã ããã çµè« AWS CodeBuild ãã€ãã©ã€ã³ã®å€å±€é²åŸ¡ã®ã»ãã¥ãªãã£å¯Ÿçãå®è£
ããã«ã¯ãããŸããŸãªã»ãã¥ãªãã£èæ
®äºé
ã«å¯ŸåŠããéå±€åãããå¶åŸ¡ãå¿
èŠã§ããæã广çãªã¢ãããŒãã¯ãWebhook ãã£ã«ã¿ãªã³ã°ãã¢ã¯ã»ã¹å¶åŸ¡ãèªèšŒæ
å ±ç®¡çãç£èŠãçµã¿åãããŠå
æ¬çãªä¿è·ãæäŸããããšã§ãããã®ã¬ã€ãã§èª¬æãããããã®å€å±€çãªãã©ã¯ãã£ã¹ãå®è£
ããããšã§ãå
ç¢ãªãã€ãã©ã€ã³ã»ãã¥ãªãã£ã確ç«ããªããéçºé床ãç¶æã§ããŸãã èŠããŠããã¹ãéèŠãªååïŒ ãŸãè
åšã¢ãã«ãè©äŸ¡ãã â ç°ãªããããžã§ã¯ãã«ã¯ç°ãªãã»ãã¥ãªãã£ã¢ãããŒããå¿
èŠã§ã ç°ãªãã¿ã€ãã®ã³ã³ããªãã¥ãŒã¿ãŒéã§æç¢ºãªä¿¡é Œå¢çã確ç«ãã Webhookãã£ã«ã¿ãªã³ã°ã䜿çšããŠãã«ããããªã¬ãŒãããã¿ã€ãã³ã°ãå¶åŸ¡ãã ãã«ãç°å¢ã«æå°æš©éã¢ã¯ã»ã¹ãå®è£
ãã AWS Config ãšCloudTrail ã䜿çšããŠèšå®ã宿çã«ç£èŠããã³ç£æ»ãã AWS Secrets Manager ãŸã㯠SSM Parameter Store ã«ã·ãŒã¯ã¬ãããä¿åããããŒããŒã·ã§ã³ãæå¹ã«ãã AWS CodeBuild ã¯ããã€ãã©ã€ã³ã䟡å€ãããã®ã«ããéçšäžã®ã¡ãªãããç¶æããªããããããã®ã»ãã¥ãªãã£å¯Ÿçãå®è£
ããæè»æ§ãæäŸããŸããç¹å®ã®ãªã¹ã¯ãããã¡ã€ã«ãšéçšèŠä»¶ã«åºã¥ããŠããã®ã¬ã€ãã®èšå®ãšè»œæžçãé©çšããŠãã ãããçµç¹ã®ããŒãºãé²åããäžã§ãã€ãã©ã€ã³ã®ã»ãã¥ãªãã£ãç¶æããããã«ã宿çãªèšå®ã®ç¢ºèªãšæŽæ°ã圹ç«ã¡ãŸãã CI/CDã»ãã¥ãªãã£ãã¹ããã©ã¯ãã£ã¹ãå®è£
ããããã®è¿œå ã®å®çšçãªã¬ã€ãã«ãæåŸ
ãã ããããã®æçš¿ã«ã€ããŠè³ªåããã£ãŒãããã¯ãããå Žåãæã圹ç«ã€ãããã¯ã®ææ¡ãå«ããŠã re:Post : Begimher ã§æ°ããã¹ã¬ãããéå§ãããã AWS ãµããŒãã«ãåãåãã ãã ããã 翻蚳ã¯ããœãªã¥ãŒã·ã§ã³ã¢ãŒããã¯ãã®é森ãæ
åœããŸãããåæã¯ ãã¡ã ã§ãã Daniel Begimher Danielã¯ãã¯ã©ãŠãã»ãã¥ãªãã£ãã¢ããªã±ãŒã·ã§ã³ã»ãã¥ãªãã£ãã€ã³ã·ãã³ã察å¿ãœãªã¥ãŒã·ã§ã³ãå°éãšãã Global Services Security çµç¹ã®ã·ãã¢ã»ãã¥ãªãã£ãšã³ãžãã¢ã§ããAWS Security and Compliance Technical Field Community å
ã® Application Securityãã©ãŒã«ã¹ãšãªã¢ ãå
±åãªãŒããããã¹ãŠã®AWSèªå®ãä¿æãããªãŒãã³ãœãŒã¹ã®ã³ãŒãã¹ãã£ã³ããŒã«ã§ãã Automated Security HelperïŒASHïŒ ãäœæããŸããã