Introduction Hi, I'm Alex from the AI First Group. As AI technology rapidly advances, demand for agent development is growing fast. However, getting started with efficient agent development can be challenging. Information about the latest tools is fragmented, and development resources are limited. To tackle this, we've launched Agent Store v1.0, a platform to share internally developed AI agents and centralize our technical know-how. Purpose of Agent Store The Agent Store has two primary purposes: Boost in-house agent development efficiency Shorten development cycle by reusing existing agents Enables rapid builds using templates Build technical know-how Centralize management of in-house Agent-related technologies Facilitate yokoten (horizontal deployment) of best practices Usage Patterns and Target Users Agent Store is a platform where employees can freely develop, share, download, and reuse AI agents. For reusability, we envision it like an app store—users can download agents and deploy them in their own environments. The Agent Store is made up of the following components: Github repository for sharing internally developed agents How CI/CD works for agent development Github repository for Agent Store Usage Format Agent Store v1.0 primarily supports AWS Bedrock agents. We designed the agent’s CI/CD process with an Infrastructure as Code (IaC) approach in mind. Agents shared through the Agent Store are stored as SAM templates in its GitHub repository, making them ready for deployment via CloudFormation. Users looking to reuse an agent can download its SAM template and deploy it to their environment using CloudFormation. Deployment is automated using Github Actions. Those who want to build new agents can also jumpstart development using the blank SAM templates available in the Agent Store. Target Users (v1.0) Engineers looking to start building agents using AWS Bedrock Engineers wanting to share Bedrock-built agents within their organization Engineers looking to discover and utilize existing agents ** Expected Use Cases** Agent Store is designed for the following scenarios: Creating new AI agents Speed up development using Agent Store's CI/CD flow Sharing AI agents Share custom-built agents across your company Reusing shared AI agents Equip existing products with AI agents App development to streamline internal operations Avoid building from scratch and boost development efficiency ** AI agent PoC** Deploy existing agents to quickly conduct PoC Shortening the time required for effect verification ** Acquire know-how for developing AI agents** Learn best practices by looking at similar cases Lowering technical barriers Agent Development, Sharing, and Reuse Flow Using Agent Store ** Flow for developing a new agent** The flow begins by retrieving a blank SAM template from the Agent Store repository, filling it out, and deploying it. For more information about SAM, see here . If you're using an agent's Action Group, make sure to fill out and deploy the templates in this order: ①Lambda, ②Agent. ** Flow for sharing agents ** Prepare a SAM template for the agent you developed and submit a pull request to the Agent Store repo. The agent reviewer will check the content and merge it if there are no problems. Flow for reusing a shared agent The overall process is similar to developing a new agent, but it begins by retrieving the SAM template of a shared agent from the Agent Store. After making any needed changes or additions, you can move on to deployment. Agent Architecture Here's the architecture of the agent. After deployment, the Bedrock agent can invoke and execute Lambda functions configured as Action Groups when needed. Stack management is handled through CloudFormation. You can also build multi-agent collaboration,where multiple agents work together. Future Development Plans To boost adoption of the Agent Store, we're planning a variety of internal study sessions, workshops, and hackathons. Currently, v1.0 is designed for engineers with AWS Bedrock experience (Type A), but we plan to expand our target users in stages. | User type | Description | Support status || ---- | ---- | ---- || Engineer type A | Engineers experienced with AWS Bedrock | Supported in v1.0 || Engineer type B | Engineers interested in agent platforms other than AWS Bedrock | In planning || Non-engineers / Beginners | Employees with no coding or development experience | In planning | Summary Agent Store v1.0 is a platform designed to streamline agent development and foster knowledge sharing. Currently, it's available to AWS Bedrock users, but we plan to expand support to a broader user base and integrate with a wider range of agent frameworks. To make the most of our in-house AI development resources and accelerate innovation, we're committed to actively expanding and evolving Agent Store.

Introduction Hello! I'm Tanachu from the Security and Privacy Group. In this article, I'll cover a recent security incident at our company involving a generative AI chat tool. Although the technical issue is not particularly new, I would like to introduce it because the circumstances under which it occurred were somewhat unusual. Overview of the Case Our company has created an environment where all employees can easily use the AI ​​chat tool. One day, while using the tool, an employee asked the AI a question. When they clicked on one of the links provided in the response, it led to a support scam website. Image of a generative AI chat Image of a support scam website Even though we had security products in place, they couldn't block the messages, and the user was ultimately led to a support scam website. Fortunately, thanks to the employee's calm and quick judgment, we were able to avoid any serious damage. This experience was a clear reminder that, just like with regular web searches, the links provided by generative AI can't always be trusted. Cause of the Incident To find out why the generative AI ended up suggesting a scam support website, we looked up the website it pointed to using the internet archive service WAYBACK MACHINE . We found that the website had actually provided what seemed to be legitimate content in the past. We also discovered several other websites that listed this website as a reference. This suggests that the generative AI may have learned from the past content of the website in question, along with information about the websites it had introduced. As a result, a hallucination-like phenomenon may have occurred, which led the AI to present incorrect information and possibly suggest a link to a scam support website. Here's a summary of how the content on the problematic websites has changed, based on the investigation results. 2012 to early 2018 There was content history matching the domain name during this period. It is assumed that the site was considered reliable at this time. Late 2018 to early 2019 A domain management service sales page was shown, suggesting that the owner might have let go of the domain. Since late 2019 The domain has shown a history of unrelated content, such as medical issues, online casinos, fake warning screens, and domain parking. For information on why security products were unable to detect the virus, check out " Appendix: Research Notes ." Measures for Similar Cases At this point, it seems extremely difficult to take fundamental steps against cases like this, for the following reasons. Challenges in Learning Generative AI One possible reason behind this incident is that the generative AI may have learned from older content on the website in question, as well as from other websites it featured. Even if the content of a website is later updated, it's unlikely that those changes will be reflected in the AI's responses, including any related security risks. The Best Prevention is Awareness What we can take away from this case is that links suggested by generative AI aren't always safe. That's why it's so important to learn from real examples and understand how to respond if you actually encounter one. Summary This case was a somewhat unusual one, showing that links presented by generative AI are not necessarily safe. Depending on the characteristics of the fraudulent site, it may be difficult for security products to detect it. Also, if the site content is changed after the generative AI has learned, it may not be able to reflect the risk. There may not be a solid solution at this point, but learning from cases like this can be a good reminder to stay alert about security when using generative AI. Appendix: Research Notes These are notes on investigating into why the issue wasn't picked up by security products. Please keep in mind this was a simple research, so it's just for reference. 1. Security Vendor Detection Status We looked up the domain of the problematic website using our security tools and VirusTotal . Almost all the vendors flagged it as "safe." 2. Website Source Code After checking the source code of the website in question, it seems there's a mechanism in place that sends a request to "domaincntrol[.]com" (note the missing o after the c) and then uses the response to dynamically decide where to direct the visitor. We tried accessing the site a few times in a safe environment, and found that it redirected us to various other websites, including support scam pages and domain parking websites. This may have allowed the malware to slip past detection by security vendors. 3. Hosting Environment of Support Scam Website The final support scam website is hosted on the "web.core.windows[.]net" domain, presumably utilizing the Microsoft Azure environment. Not just limited to Microsoft Azure, scam websites hosted on cloud services are generally hard to block with security products. That's because blocking cloud service domains outright isn't realistic, given how easy it is to set them up and how much it could impact legitimate business operations. *As of this article's publication, we've confirmed that this support scam website has been taken down from Microsoft Azure. 4. Survey Results Using PublicWWW Using a tool called PublicWWW , which lets you search website source code, we searched the distinctive string "domaincntrol[.]com/?orighost=" found on the problematic websites. The search revealed that this string appears in the code of over 20,000 websites. We also checked a few of those websites in more detail and found that they showed the same behavior — redirecting users to scammy support websites.

はじめに こんにちは。ご覧いただきありがとうございます！ KINTO FACTORY （以下 FACTORY）という今お乗りのクルマをアップグレードできるサービスで、フロントエンド開発をしている Nakamoto です。 今回は、FACTORY 開発Gで取り入れた 改善DAY や、社内での フロントエンド勉強会 を活用して、ページパフォーマンス（CWV）を改善した事例を紹介させていただきます。 改善DAYとフロントエンド勉強会 改善DAY FACTORY 開発Gでは、案件開発している最中で気付いた、技術的負債などの「すぐには対応できない（しなくてもよい）タスク」を、忘れないようにとりあえずチケット化しバックログに残しておく運用になっていました。その運用がずっと続いたところ、日々の案件開発になかなか切れ目が無く、それら改善タスクがバックログに積み上がる一方で消化されることがなく、チケット総数が100件を軽く超えるようになっていました。 そこで、スクラムの振り返りなどで、それらの改善タスクをずっと放置しておくのも問題だという声もあがり、週に１日午後の時間を改善タスクの消化のみにあて、そこにはMTGなどを入れない取り組みをチーム全体で始めてみました（Outlook 上で該当時間をブロックし、他部署からの MTG も入れられないように工夫しています）。 今回は、この 改善DAY を活用し、ずっとできていなかったページパフォーマンス = CWV（Core Web Vitals）のスコア向上を目指すことにしました。 フロントエンド勉強会 また、社内の有志によるフロントエンド勉強会を週に１度開催しており、過去のイベント発表をみんなで見て感想を共有したり、過去〜最新の Baseline をみんなで確認したりと、参加メンバーで都度議題を決め、フロントエンド界隈の技術交流や、実際の開発プロダクトや開発の実情について共有する場というものがあります。 そんな中、勉強会のアウトプットの一つとして、実際のサービスで活かせることがなにかできないか考えるようになり、私の方から題材の一つとして「FACTORYパフォーマンス改善」を提案しました。 実際に参加メンバーみんなで FACTORY ページを検証する枠を作って頂き、合計２回に渡ってライブ検証することができました。 具体的に取り組んだのは以下になります。 ブラウザの Lighthouse を使用して現状のスコアを確認（ネットワークや CPU のスロットリングを適宜設定） 各スコアの改善提案を確認する 分析タグなどページレンダリングに関係のないものをブロックしパフォーマンスの差分を確認 パフォーマンスタブでより詳細なブラウザの動きを確認する キャプチャ画像からレイアウトシフトを確認 これらにより、ブラウザに用意されている検証ツールの使い方や、どのようなところに改善ポイントがあるのか、を明確にすることができました。 :::message フロントエンド勉強会について詳しくは、 こちらの記事 もご覧頂ければと思います！ ::: スコア改善 ここからは、実際に勉強会で得た知見を活用し、どのようにスコア改善を進めたか紹介していきます。 ページパフォーマンスを図る指標として、Core Web Vitals (CWV) がありますが、それらは下記３つの指標に分類されます。 Largest Contentful Paint (LCP): ページの主要なコンテンツがどれだけ速く読み込まれるかを測定 Interaction To Next Paint (INP): ユーザーの操作に対するページの応答性を評価 Cumulative Layout Shift (CLS): ページの視覚的な安定性を測定 FACTORY はサービスの性質上、商品や車種画像の制約が厳しく（商品・車種の色味などが厳格のため）、静的コンテンツ変更（画像圧縮など）は難しかったため、ページ内のコンテンツ配置の変更だけで改善が見込める CLS にまずは焦点を当てました。 Google Search Console を参考に、どのページで CLS スコアが悪いのか確認 SSG により静的ページとして作成し、クライアントでの API アクセス時のロード画面をなくす 画像などのコンテンツロード前後で、高さがシフトしている場所などを探す 実際には、CLS スコアの悪いページにて、ブラウザの「パフォーマンス」タブで確認し、画面キャプチャを見ながらレイアウトシフトしている箇所をひとつひとつ潰していきました。 中でも特定に時間を要したのが、TOPページで発生していた CLS です。 以下のように解析ツールで見てみても、どこがレイアウトシフトしているのかパッと見では特定できませんでした。 ただ、該当の画像あたりを確認すると、 contain-intrinsic-size をcssで定義していることに気づきました。どうやら、こちらのプロパティは比較的新しいもので、非対応のブラウザでは正しく画像のサイズが設定されずレイアウトシフトの原因になっているようでした。 代わりに、画像のサイズ固定を aspect-ratio へ変更しアスペクト比を設定することで、レイアウトシフトを無くすことできました。 結果 今回は、改善DAYでの取り組みと実際の CWV スコアはどうだったのか、両面から振り返ってみたいと思います。 改善DAYでのチケット消化 以下の図は、改善チケットをまとめたボードのチケット解決数を表したものです。 ４月ごろに「改善 DAY」の仕組みを導入しており、グラフ中の赤線が期間中（１ヶ月）に追加したチケット、緑線が完了したチケットを示しております。 4月チケット消化 6月チケット消化 上記はチーム全体の結果になりますが、着実に改善タスクの消費量が増えていることがわかるかと思います。 また、最近は全社的に AI を利用した開発も積極的に取り入れていることもあり、このような改善タスクは「シンプルなタスクな反面、取り掛かるにはコンテキストスイッチなどが発生し人間がやるには腰が重い」作業となり、比較的 AI に任せやすいタスクとも言えます。 そのような面も有り、日々機能追加などの案件の開発も動いている割には、上記のような改善活動にもしっかりコミットできていることが読み取れます。 CWVスコア それでは、改善活動前後での今回のテーマである、CWV スコアがどのように改善されてきたか振り返ります。 PCスコア モバイルスコア 上記のグラフは、Google Search Console で確認できる、URL単位でのパフォーマンススコアの移り変わりになります。 PC / モバイル両方とも 良好URLの数 (緑部分) が増え 不良URL (赤部分) が減少 or ０ となり、大多数のページでパフォーマンス改善することができました。 黄色で表されている 改善が必要なURL が多少残っていますが、こちらは今回対応した CLS スコアだけの結果では無さそうですので、今後はそちらの別指標についても改善していきたいと思います。 まとめ 今回は、FACTORY 開発G で導入している 改善DAY と、社内で開催している フロントエンド勉強会 を活用し、実際に FACTORY のページスコア（CWV）の向上に取り組んだ事例を紹介させて頂きました。 日々、案件を進めるうえでは、納期などの都合でどうしても技術的な負債の消化を後回しにしてしまいがちですが、今後も改善DAYを活用し、そうした技術的負債が溜まらないようにしていくことや、社内勉強会からは、開発しているプロダクト・サービスは違えど、知見や改善案はそんな中からも発見できるので、それらをうまく活用しながら FACTORY のサービスを日々改善し安定運用していきたいと思います！

Introduction Hello! I'm Tanachu from the Security and Privacy Group. In this article, I'll cover a recent security incident at our company involving a generative AI chat tool. Although the technical issue is not particularly new, I would like to introduce it because the circumstances under which it occurred were somewhat unusual. Overview of the Case Our company has created an environment where all employees can easily use the AI ​​chat tool. One day, while using the tool, an employee asked the AI a question. When they clicked on one of the links provided in the response, it led to a support scam website. Image of a generative AI chat Image of a support scam website Even though we had security products in place, they couldn't block the messages, and the user was ultimately led to a support scam website. Fortunately, thanks to the employee's calm and quick judgment, we were able to avoid any serious damage. This experience was a clear reminder that, just like with regular web searches, the links provided by generative AI can't always be trusted. Cause of the Incident To find out why the generative AI ended up suggesting a scam support website, we looked up the website it pointed to using the internet archive service WAYBACK MACHINE . We found that the website had actually provided what seemed to be legitimate content in the past. We also discovered several other websites that listed this website as a reference. This suggests that the generative AI may have learned from the past content of the website in question, along with information about the websites it had introduced. As a result, a hallucination-like phenomenon may have occurred, which led the AI to present incorrect information and possibly suggest a link to a scam support website. Here's a summary of how the content on the problematic websites has changed, based on the investigation results. 2012 to early 2018 There was content history matching the domain name during this period. It is assumed that the site was considered reliable at this time. Late 2018 to early 2019 A domain management service sales page was shown, suggesting that the owner might have let go of the domain. Since late 2019 The domain has shown a history of unrelated content, such as medical issues, online casinos, fake warning screens, and domain parking. For information on why security products were unable to detect the virus, check out " Appendix: Research Notes ." Measures for Similar Cases At this point, it seems extremely difficult to take fundamental steps against cases like this, for the following reasons. Challenges in Learning Generative AI One possible reason behind this incident is that the generative AI may have learned from older content on the website in question, as well as from other websites it featured. Even if the content of a website is later updated, it's unlikely that those changes will be reflected in the AI's responses, including any related security risks. The Best Prevention is Awareness What we can take away from this case is that links suggested by generative AI aren't always safe. That's why it's so important to learn from real examples and understand how to respond if you actually encounter one. Summary This case was a somewhat unusual one, showing that links presented by generative AI are not necessarily safe. Depending on the characteristics of the fraudulent site, it may be difficult for security products to detect it. Also, if the site content is changed after the generative AI has learned, it may not be able to reflect the risk. There may not be a solid solution at this point, but learning from cases like this can be a good reminder to stay alert about security when using generative AI. Appendix: Research Notes These are notes on investigating into why the issue wasn't picked up by security products. Please keep in mind this was a simple research, so it's just for reference. 1. Security Vendor Detection Status We looked up the domain of the problematic website using our security tools and VirusTotal . Almost all the vendors flagged it as "safe." 2. Website Source Code After checking the source code of the website in question, it seems there's a mechanism in place that sends a request to "domaincntrol[.]com" (note the missing o after the c) and then uses the response to dynamically decide where to direct the visitor. We tried accessing the site a few times in a safe environment, and found that it redirected us to various other websites, including support scam pages and domain parking websites. This may have allowed the malware to slip past detection by security vendors. 3. Hosting Environment of Support Scam Website The final support scam website is hosted on the "web.core.windows[.]net" domain, presumably utilizing the Microsoft Azure environment. Not just limited to Microsoft Azure, scam websites hosted on cloud services are generally hard to block with security products. That's because blocking cloud service domains outright isn't realistic, given how easy it is to set them up and how much it could impact legitimate business operations. *As of this article's publication, we've confirmed that this support scam website has been taken down from Microsoft Azure. 4. Survey Results Using PublicWWW Using a tool called PublicWWW , which lets you search website source code, we searched the distinctive string "domaincntrol[.]com/?orighost=" found on the problematic websites. The search revealed that this string appears in the code of over 20,000 websites. We also checked a few of those websites in more detail and found that they showed the same behavior — redirecting users to scammy support websites.

0. Introduction My name is Choi Garamoi , and I am responsible for developing the Android app " KINTO Kantan Moushikomi ." This app uses KMP and shares some business logic with iOS app . This time, I've summarized the results of using Tuist to enable smoother development of a KMP project. 1. Overview In Android Studio, the KMP Application project is created using the New Project Wizard. Once it is created, the Monorepo will look like this: KmpProject/ ├── androidApp/ # Android専用モジュール(Kotlin/Android) ├── iosApp/ # iOS専用モジュール(Swift) └── shared/ # 共通ビジネスロジック(Kotlin/Multiplatform) Similar to Gradle for Android, a build environment suitable for modularization and team development is also important in iOS. This article will show you how to build one using Tuist . 2. Challenges in Xcode Project Xcode manages the information required to build an app in *.xcodeproj , but there are some challenges. Merge conflicts occur frequently : When settings are changed, Xcode automatically updates the project.pbxproj file. This file is in an unstructured text format, which often leads to Git conflicts when multiple people edit it simultaneously. Practically meaningless diffs are generated : Xcode's GUI operations can generate many diffs without any real changes, cluttering the history. Difficult to automate : Many settings are GUI dependent, making it difficult to automate builds using CI/CD or scripts. Difficult to review : project.pbxproj is hard to read, making it difficult to review changes. Scalability is limited : As the team size grows, managing multiple targets and build settings can become cumbersome. The *.xcodeproj directory is like a combination of Gradle and .idea directories in an Android project, so it is not possible to separate local Xcode settings from iOS app build settings. Google Trends also shows that there are more searches for "xcode conflict" than for "xcode dev," indicating that there are more conflicts during development. 3. What is Tuist ? It is a tool that can generate Xcode projects and workspaces in the Swift language and can also build in combination with Xcode terminal tools. Main features are as follows: Modularization support Environment-independent builds (team development oriented) Automation support Swift Package Manager support Other Xcode build tools include Swift Package Manager , XcodeGen , and Bazel . Swift Package Manager : It only provides the dependency management functionality of Gradle (the dependencies block). XcodeGen : Insufficient checking of tool settings makes it prone to human error. Bazel : It is complex to use because it is intended for large-scale projects and is overengineered for small and medium-sized projects. 4. Introducing Tuist The following steps are based on Migrate an Xcode project and reflect the latest information: 4-1. Install Tuist brew update brew upgrade tuist brew install tuist For installation methods other than Homebrew , refer to the Manual . 4-2. Add Tuist Config files Add three files (Manifest files): Tuist.swift , Project.swift , and Tuist/Package.swift . KmpWithSwift/ ├── Tuist.swift ├── Tuist/ │ └── Package.swift ├── Project.swift ├── androidApp/ │ └── ... ├── iosApp/ │ └── ... └── shared/ └── ... 4-3. Add a Module ( Target ) to the Settings Project.swift is the main config file, and you can use the sample from Migrate an Xcode project as is for the other files. 4-3-1. Tuist.swift import ProjectDescription let tuist = Tuist(project: .tuist()) 4-3-2. Project.swift Add target settings and build scripts for KMP common modules. infoPlist : Whole screen setup. scripts : Command to build the KMP common module. import ProjectDescription let project = Project( name: "KmpWithSwift", targets: [ .target( name: "App", destinations: .iOS, product: .app, bundleId: "ktc.garamoi.choi.kmp.with.tuist.App", infoPlist: .extendingDefault( with: [ "UILaunchScreen": [ "UIColorName": "", "UIImageName": "", ], ] ), sources: ["iosApp/iosApp/**"], resources: ["iosApp/iosApp/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ] ) ] ) 4-3-3. Tuist/Package.swift // swift-tools-version: 6.0 import PackageDescription #if TUIST import struct ProjectDescription.PackageSettings let packageSettings = PackageSettings( productTypes: [:] ) #endif let package = Package( name: "App", dependencies: [ ] ) 4-4. Delete the Old Xcode Project Delete ./iosApp/iosApp.xcodeproj . Add *.xcodeproj to ./.gitignore . 4-5. Check Check whether Tuist has been set up correctly. Verify that the Tuist Manifest file can be opened in Xcode. # KmpWithSwiftディレクトリで tuist edit Generate an Xcode project with Tuist. # KmpWithSwiftディレクトリで tuist generate Once Xcode is open, run the app. If the app starts normally, the process is complete. 5. Separate iOS Settings from Common Features The common module ./shared/build.gradle.kts does not properly separate the scope of responsibility for the common business logic build settings and the iOS-specific XCFramework build. kotlin { // ... listOf( iosX64(), iosArm64(), iosSimulatorArm64() ).forEach { it.binaries.framework { baseName = "shared" isStatic = true } } // ... } 5-1. Response If you separate the iOS XCFramework settings below from :shared and move them to ios , you can set them more effortlessly and enhance modularity. it.binaries.framework { baseName = "shared" isStatic = true } 5-2. Procedure Build XCFramework from the ./iosApp/shared module. Update the scripts in the App target ( ./iosApp/iosApp directory). 5-2-1. Add the :iosApp:shared Module Add the ./iosApp/shared/build.gradle.kts file and add the module to ./settings.gradle.kts . No Android settings are required. // ./iosApp/shared/build.gradle.kts plugins { alias(libs.plugins.kotlin.multiplatform) } kotlin { listOf( iosX64(), iosArm64(), iosSimulatorArm64() ).forEach { it.binaries.framework { baseName = "shared" isStatic = true export(projects.shared) } } sourceSets { commonMain.dependencies { api(projects.shared) } } } // ./settings.gradle.kts // ... 省略 ... rootProject.name = "KmpProject" include( ":androidApp", ":iosApp:shared", ":shared" ) Delete the XCFramework configuration from ./shared/build.gradle.kts . // ./shared/build.gradle.kts plugins { alias(libs.plugins.kotlinMultiplatform) alias(libs.plugins.androidLibrary) } kotlin { // ... 省略 ... iosX64() iosArm64() iosSimulatorArm64() // ... 省略 ... } // ... 省略 ... 5-2-2. Tuist Target Update Update the Gradle command in scripts of Project.swift . Change the module in scripts from :shared to the added :iosApp:shared ( ./gradlew :shared:embedAndSignAppleFrameworkForXcode ➡️ ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode ). // ./Project.swift import ProjectDescription let project = Project( name: "KmpWithSwift", targets: [ .target( name: "App", destinations: .iOS, product: .app, bundleId: "ktc.garamoi.choi.kmp.with.tuist.App", infoPlist: .extendingDefault( with: [ "UILaunchScreen": [ "UIColorName": "", "UIImageName": "", ], ] ), sources: ["iosApp/iosApp/**"], resources: ["iosApp/iosApp/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ] ) ] ) 6. Multimodularization As your app scales, modularizing features becomes essential. %%{ init: { 'theme': 'neutral' } }%% graph TB App ==> FeatureA App ==> FeatureB FeatureA --> :iosApp:shared FeatureB --> :iosApp:shared But if each feature requires :iosApp:shared , the Tuist config becomes as follows: // ./Project.swift import ProjectDescription let project = Project( name: "KmpWithSwift", targets: [ .target( name: "App", destinations: .iOS, product: .app, bundleId: "ktc.garamoi.choi.kmp.with.tuist.App", infoPlist: .extendingDefault( with: [ "UILaunchScreen": [ "UIColorName": "", "UIImageName": "", ], ] ), sources: ["iosApp/iosApp/**"], resources: ["iosApp/iosApp/**"], dependencies: [ .target("FeatureA"), .target("FeatureB") ] ), .target( name: "FeatureA", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.FeatureA", infoPlist: .default, sources: ["iosApp/FeatureA/**"], resources: ["iosApp/FeatureA/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ] ), .target( name: "FeatureB", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.FeatureB", infoPlist: .default, sources: ["iosApp/FeatureB/**"], resources: ["iosApp/FeatureB/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ] ) ] ) This configuration has the following two major issues: A common XCFramework will be built for the number of feature modules ( :IOSApp:shared ). Depending on your feature module target settings and build options, there is a risk that the app may use multiple versions of :iosApp:shared . To solve this problem, wrap :iosApp:shared with a Tuist target. 6-1. Add Wrapping Target Add the KmpCore target so that feature modules share Xcode targets instead of directly using the Gradle :shared module. %%{ init: { 'theme': 'neutral' } }%% graph TB App ==> FeatureA App ==> FeatureB FeatureA ==> KmpCore FeatureB ==> KmpCore KmpCore --> :iosApp:shared The source code is in iosApp/shared/** , which is the same as :iosApp:shared , but uses KmpCore as a wrapping target to utilize the namespace generated by KMP and to encapsulate it. As a result, the only target that holds information about the KMP common code is KmpCore . // ./Project.swift import ProjectDescription let project = Project( name: "KmpWithSwift", targets: [ .target( name: "App", destinations: .iOS, product: .app, bundleId: "ktc.garamoi.choi.kmp.with.tuist.App", infoPlist: .extendingDefault( with: [ "UILaunchScreen": [ "UIColorName": "", "UIImageName": "", ], ] ), sources: ["iosApp/iosApp/**"], resources: ["iosApp/iosApp/**"], dependencies: [ .target("FeatureA"), .target("FeatureB") ] ), .target( name: "FeatureA", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.FeatureA", infoPlist: .default, sources: ["iosApp/FeatureA/**"], resources: ["iosApp/FeatureA/**"], dependencies: [.target(name: "KmpCore")] ), .target( name: "FeatureB", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.FeatureB", infoPlist: .default, sources: ["iosApp/FeatureB/**"], resources: ["iosApp/FeatureB/**"], dependencies: [.target(name: "KmpCore")] ), .target( name: "KmpCore", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.KmpCore", infoPlist: .default, sources: ["iosApp/shared/**"], resources: ["iosApp/shared/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ] ) ] ) 6-2. Expose shared via KmpCore Simply the KmpCore target dependency on shared does not allow access from FeatureA and FeatureB to :shared code. Additional configuration is required to allow FeatureA and FeatureB to access the KMP common code (Gradle's :shared module) via KmpCore . First, add the settings configuration to the KmpCore target. // ./Project.swift import ProjectDescription let project = Project( name: "KmpWithSwift", targets: [ // ... 省略 ... .target( name: "KmpCore", destinations: .iOS, product: .framework, bundleId: "ktc.garamoi.choi.kmp.with.tuist.KmpCore", infoPlist: .default, sources: ["iosApp/shared/**"], resources: ["iosApp/shared/**"], scripts: [ .pre( script: """ cd "$SRCROOT" ./gradlew :iosApp:shared:embedAndSignAppleFrameworkForXcode """, name: "Build KMP" ) ], settings: .settings(base: [ "FRAMEWORK_SEARCH_PATHS": "iosApp/shared/build/xcode-frameworks/**", "OTHER_LDFLAGS": "-framework shared" ]) ) ] ) Add the following Swift file so that the KmpCore target exposes the shared namespace in the KmpCore namespace. // ./iosApp/shared/KmpCore.swift @_exported import shared 6-3. Check After building the project in Xcode, FeatureA and FeatureB can access :shared via import KmpCore . For example, if the :shared module has a SomeModel ( shared/src/commonMain/kotlin/ktc/garamoi/choi/kmp/with/tuist/SomeModel.kt ) class, it can be accessed from FeatureA as follows. import Foundation import KmpCore public class SomeFeatureAClass { let model: SomeModel // ... } If a compilation error occurs, the initial build may become unstable due to build order or caching issues. In that case, you can resolve the issue by performing a clean build or building multiple times. 7. Conclusion Xcode's *.xcodeproj is not suitable for automation and team development. I recommend using Tuist as an alternative to *.xcodeproj for Xcode projects. By wrapping the KMP common module's XCFramework generation in an Xcode project target, feature modularization becomes easier. 8. References Kotlin Multiplatform : The official Kotlin project that provides various tools for cross-platform development using the Kotlin language. Gradle : A de-facto build tool for Android and Java projects. Tuist : Build tools for Xcode projects. Swift : An OOP language developed by Apple to replace Objective-C. Xcode : An IDE for Apple platforms. Xcode / Projects and workspaces Swift Package Manager : The official dependency management tool for the Swift language. XcodeGen : A tool to generate Xcode Project in YAML and JSON. Bazel : A build tool developed by Google. Targets large-scale Monorepo . Monorepo Explained : A system for managing multiple software in a single repository. Google Trends : xcode conflict , xcode merge , xcode dev : The proportion of Xcode conflict searches is higher when compared to general Xcode development searches. What is project.pbxproj in Xcode Project configuration / Projects / Project settings : Explanation of the .idea directory in Android Studio and IntelliJ IDEA. Migrate an Xcode project : Manual steps to turn an existing Xcode project into a Tuist project. Homebrew : A system package management tool for macOS. Install Tuist Xcode / Bundles and frameworks / Creating a static framework Swift logo : The official logos can be downloaded below. Kotlin logo Gradle logo Tuist logo KINTO Kantan Moushikomi : Android App KINTO Kantan Moushikomi : iOS App Choi Garamoi

Introduction Hello, I'm hiro, and I joined the company in April 2025! In this article, I interviewed new members who joined us in April 2025 and gathered their first impressions after joining KINTO Technologies. I hope this article will be helpful for those interested in KINTO Technologies (KTC from now on) and serve as a nice reflection for those featured here! Minami Self-introduction I'll be joining the newly established Data Strategy Division from July. **How is your team structured? ** This team handles everything from analysis and proposing business strategies/tactics to implementing measures. I’m looking forward to working with the extremely talented analysts, data scientists, and engineers to grow the company. ** What was your first impression of KTC when you joined? Were there any surprises? ** I was surprised by how high the degree of freedom is in how I can work and spend my time in the office. I’m looking forward to what’s to come, because even though some people are calm, they are secretly full of passion. **What is the atmosphere like on-site? ** The team is relatively young, with a friendly and cheerful atmosphere. I’ll do my best to demonstrate the strengths of the team under the new structure. **How did you feel about writing a blog post? ** I read blog posts before joining KTC, so I hope my posts will be helpful for those who are joining the company. Question from MAo-san to Minami-san Please let me know if you have any recommended travel destinations, either domestic or abroad! I went to Kauai in Hawaii last year and it was amazing! H.N Self-introduction I work in the Business System Development Division and am mainly responsible for the dealer operations area. Recently, my hobby is searching for tasty restaurants near the Muromachi office. **How is your team structured? ** I belong to the Nimbus team within the Business System Development Division, and work on a daily basis with three full-time employees and a partner. ** What was your first impression of KTC when you joined? Were there any surprises? ** There are more opportunities to participate in company events and dinner parties than I had expected, and it looks like I’ll be able to interact with people from other departments, so it has been a pleasant surprise! **What is the atmosphere like on-site? ** Even though they are busy, many of my seniors create an atmosphere where it is easy to ask about problems or questions, which is very helpful as I try to catch up on things every day! **How did you feel about writing a blog post? ** I’m not used to writing these types of articles, including tech blogs, but I hope this will be an opportunity for me to start enjoying it! Question from Minami to H.N Please tell us about an interesting company event that you attended! I haven't been able to attend any company events yet, but I would like to attend the following! KTCBeerBash In-house study groups on generative AI Events that could deepen interactions across departments and teams! K.S Self-introduction I am primarily responsible for improving the UI/UX of the my route app. My hobby is going camping with my family. **How is your team structured? ** The new structure is scheduled to begin in July. The PDM and Development Team will work together to make the apps even better. ** What was your first impression of KTC when you joined? Were there any surprises? ** When I joined the company, the Jimbocho office had just been renovated and is very beautiful. What’s more, the chairs and tables in the break area are all from outdoor manufacturers, making it very stylish! **What is the atmosphere like on-site? ** Everyone on the my route team is kind and will support you with any problems you may have. The welcome party was also great! **How did you feel about writing a blog post? ** I started reading blogs introducing my former seniors more frequently, which became a good opportunity to learn more about the company. Question from H.N.-san to K.S.-san Let me know if you have any recommended campsites or travel destinations that you’ve been to with your family! These are close to Tokyo, children and pets are welcome, and they’re high quality. TACO GLAMP Moroyama Town Yuzu no Sato Auto Campsite Mikabo Kogen Auto Campsite There are also many more. But honestly, as long as there’s a bonfire, anywhere is fine. lol Chiru Self-introduction Nice to meet you!　I am Chiru.　I belong to the Corporate IT Group in the IT/IS Division.　 Until now, I have built my career as a web development engineer, but at KTC, I work hard every day to utilize my engineering skills in corporate IT, working on the company’s internal information systems and supporting our dealers’ IT operations, in order to strengthen the organization! **How is your team structured? ** The team belongs to the Innovation Drive Team! There are nine members on the team including myself, and each person is active in their own area of expertise! The team’s goals are to "make KTC’s IT environment the best it can be," and to "deliver the value created at KTC to the outside world." With these goals in mind, the team aims to be "a group of engineers that maximizes KTC’s value and connects it to external value," not just within the company. ** What was your first impression of KTC when you joined? Were there any surprises? ** My first impression was that there are a lot of energetic people!　 As soon as I joined the company, I noticed that it’s one with a lot of interaction, with company events and regular beer bashes. As for the surprises, the things that had been talked about during the casual meeting and the job interview were the same, so there weren’t any major surprises. However, because it is a group company of a large corporation, I had imagined that the work flow would be rigid and there would be strict restrictions, but that wasn’t the case at all. In fact, I was surprised at how fast-paced things are! **What is the atmosphere like on-site? ** Since the members of my team are based in different locations, we are mostly only together online, but strangely enough, I don’t feel any distance between us.　When we run into problems or have questions, we can communicate immediately via Slack or Zoom, so we’re able to work with a very pleasant atmosphere. When a problem occurs, everyone gathers around asking, "What happened? What’s wrong?", and when we have team meetings, the exchange of opinions gets so lively that we sometimes run out of time. I think it’s great that we have such an active team! **How did you feel about writing a blog post? ** I had been reading tech blogs before I joined the company and knew that I would eventually be writing one, so I thought, "It’s finally time." lol Question from K.S.-san to Chiru-san Please tell me if you know of any delicious restaurants serving set meals near the Nagoya office! I recommend the freshly fried tempura set meals from Tempura & Wine Kojima, located in Yanagibashi Central Market near the office. If you come to Nagoya, let’s go together! MAo Self-introduction I belong to the Corporate IT Group in the IT/IS Division. I’m mainly in charge of visualization, creating BI and improving operations before and after it, working in close proximity to the field. **How is your team structured? ** I belong to the Innovation Drive Team, which consists of about 10 people. ** What was your first impression of KTC when you joined? Were there any surprises? ** Everyone talks to me a lot!! **What is the atmosphere like on-site? ** It’s an atmosphere where everyone can bring their own ideas and think of better solutions. **How did you feel about writing a blog post? ** I was excited about what to write. Question from Chiru-san to MAo-san Tell me what you’re into lately! I like sipping tea while watching the cars go by on the road! I think to myself, "Everyone’s on the move.　I’ll do my best, too!" Finally Thank you everyone for sharing your thoughts after joining our company! There are more and more new members at KINTO Technologies every day! We will be posting more stories from our newcomers across divisions, so stay tuned! And yes: we are still hiring! KINTO Technologies is looking for new teammates to join us across a variety of divisions and roles. For more details, please check here !

** Introduction** Hello, I'm satoshi, and I joined the company in May 2025! In this article, I interviewed new members who joined us in May 2025 and gathered their first impressions after joining KINTO Technologies. I hope this article will be helpful for those interested in KINTO Technologies (KTC) and serve as a nice reflection for those featured here! Y Self-introduction This is Y of the Human Resources Group. I previously worked as an engineer. How is your team structured? The Organizational Human Resources Team I belong to consists of three members, but we often collaborate with the Talent Acquisition Team and the Labor and General Affairs Team within the same group, as well as with the KINTO administration department. **What was your first impression of KTC when you joined? Were there any surprises? ** Many people gave me a calm and mature impression, but communication is very open and friendly. **What is the atmosphere like on-site? ** I can talk to anyone about anything, which is a big help. **How did you feel about writing a blog post? ** This entry doesn't have any tech elements, but I hope that’s okay. Question from Satoshi to Y Please share a cute story about your cat. He seems to like the scent of detergent, so when I fold laundry, he often comes over to sniff, lick, and rub against me. Even freshly washed clothes and towels quickly end up covered in cat hair. D.K Self-introduction I’m in charge of the screening and credit management business area in the Business Systems Development Division. I’m involved in financial systems, and my previous job was in sales finance. How is your team structured? It's actually a one-person team. While continuing to define and develop the product requirements, our next challenge will be to gather members to operate and maintain the product after its release in June next year and build a team. **What was your first impression of KTC when you joined? Were there any surprises? ** I was impressed by the fact that there were more events and in-house demonstration tests related to the latest technologies, such as AI and IoT, than I had expected from the Tech Blog, which was a pleasant surprise. KTC is engaged in a wide range of technology research and product development that is not limited to leasing, and I felt that it was the perfect company for someone who loves new things. **What is the atmosphere like on-site? ** It's an environment where you can feel free to ask questions, seek advice, or chat with people beyond your own team. I often see members engaging in serious discussions, regardless of whether it is work-related or not. We also have a close relationship with KINTO, the profit center, and I feel that the style of product development, where the technical side takes the lead with a sense of ownership, is very characteristic of KTC. **How did you feel about writing a blog post? ** I had been referring to the Tech Blog, so I felt like it was finally my turn. I tried to share my honest opinions as much as possible. I hope this will help people outside the company to get a feel for our atmosphere. Question from Y to D.K Please share your recommended lunch spots around the Muromachi office. It's a rather unassuming place, but Sobayoshi Nihombashi flagship store. This udon and soba restaurant is directly managed by a bonito flakes wholesaler, so the interior is filled with the aroma of dashi. Be sure to order rice as well. It comes with bonito flakes, and the aroma when you eat the bonito rice with a little soy sauce is irresistible! N Self-introduction I'm in charge of quality assurance (QA) for apps in the Quality Assurance Group. My previous job was also in app QA. How is your team structured? The Quality Assurance Group has 11 members in total, and the team I belong to has four members, each responsible for a specific app. **What was your first impression of KTC when you joined? Were there any surprises? ** My impression of KTC was that it was a place with many mature, calm people, but I also got the impression that there are many passionate people who actively share and learn technical information. **What is the atmosphere like on-site? ** The atmosphere is friendly, and you can feel free to ask questions or seek advice. **How did you feel about writing a blog post? ** It's been a while since I last wrote a Tech Blog, but I'm hoping to get used to it as I'll have more opportunities to write in the future. Question from D.K. to N I heard you like comedy, so please tell me who your favorite comedians are these days! It's very specific, but the skit by the comedy duo Tensai Pianist about inspecting a doorknob is the best! Personally, I like all the comedians who appeared in M-1 from around 2016 to 2019. Please be sure to check them out. M.K Self-introduction I manage data in the DataOps Group. I work at Osaka Tech Lab. Previously, I used to work in the fields of online advertising and online media. How is your team structured? There are about 10 members in the group, but in my regular work I team up with another member from Osaka. The group's manager is also in Osaka, which makes communication easy. **What was your first impression of KTC when you joined? Were there any surprises? ** The working style and tools used were similar to those of the companies I had worked for before, so I was able to start working without any discomfort. **What is the atmosphere like on-site? ** There is an atmosphere where it's easy to ask any questions, and I found it easy to catch up. Also, perhaps unique to Osaka Tech Lab, people from other groups would proactively talk to me in the office, which made it easy to fit in. **How did you feel about writing a blog post? ** I also used the Tech Blog when I was looking for a job, so I hope it will be helpful to someone else in the future. Question from N to M.K Since you drive, please tell us some recommended places to go for a drive. I personally use car sharing a lot, and since I don't drive regularly, I try to use highways with two or more lanes in each direction that are safe and comfortable whenever possible. In the Kanto region, I like Chiba and Ibaraki, and in the Osaka area, the Chugoku Expressway is easy to drive on. m Self-introduction I’m based at Osaka Tech Lab and handle app QA in the Quality Assurance Group. Before joining KTC, I worked in development. How is your team structured? The Quality Assurance Group has 11 members in total, and the team I belong to has four members, each responsible for a specific app (I’m on the same team with N). **What was your first impression of KTC when you joined? Were there any surprises? ** I got the impression that KTC is very proactive about process improvements using generative AI. I also felt that many members are highly passionate about technology. **What is the atmosphere like on-site? ** Many members are friendly, which makes it easy to fit in. It's also an environment where I can feel free to ask questions. **How did you feel about writing a blog post? ** I had been reading Tech Blog before joining KTC, so when it was finally my turn, I thought, “At last...!” Question from M.K. to m The Osaka office has been renovated. How does it compare to the previous one? The view is fantastic, and the scenery is really beautiful from morning to night. It also feels more open, and for me personally, it has become a very comfortable environment to concentrate in. satoshi Self-introduction I’m part of the my route Development Division, working on backend development. In my previous job, I was also engaged in backend development in the web field, and before that, I worked as a network engineer at a company in the networking industry. How is your team structured? The Backend Team has four members, plus more than 10 members from partner companies. Since July, the Frontend Team has also joined us in the same office, making it a livelier environment! **What was your first impression of KTC when you joined? Were there any surprises? ** I thought it might be a formal company, but it's not like that at all. We can develop while actively communicating. As for AI, the whole company is very enthusiastic about it, and being able to use AI in all aspects of our work has been a huge help. What is the atmosphere like on-site? We develop products in a friendly way. It's also a very open environment where it’s easy to consult with others. Since my route is a B2C product, we get many inquiries from customers, and every day is pleasantly busy. **How did you feel about writing a blog post? ** I've read tech blogs from various companies before, so I felt a bit sentimental thinking, “It’s finally my turn.” Question from m to satoshi Please tell us something about your hometown. I'm from Kyoto Prefecture!　I grew up in a tough environment with hot, humid summers and bitterly cold winters. I still go back occasionally and enjoy touring Kyoto alongside visitors from overseas. In Closing Thank you everyone for sharing your thoughts after joining our company! There are more and more new members at KINTO Technologies every day! We will be posting more stories from our newcomers across divisions, so stay tuned! And yes: we are still hiring! KINTO Technologies is looking for new teammates to join us across a variety of divisions and roles. For more details, please check here !

Introduction Hello. Hi there. I'm Uehara (@penpen_77777), a backend engineer in the KINTO FACTORY Development Group. I usually use Go and Rust for development, and my preferred editors are Vim and NeoVim. This time, I'll talk about the improvement of test code quality, particularly focusing on how to name test methods . I referred to the following book for this topic. https://book.mynavi.jp/ec/products/detail/id=134252 Challenges related to test code If you write test code on a daily basis, have you ever had the following experiences? You have test code, but you don’t fully understand its purpose, which creates doubts about the reliability of the test results and reduces confidence in the adequacy of the testing. In reviewing test code someone else wrote, you have vaguely approved it even though you don't fully understand it. You have tweaked test code to pass the testing phase on a whim, concerning that you are not able to submit a pull request (PR) if the continuous integration (CI) failed as you don't really know what kind of test you're doing. To solve these problems, why not start by improving your test method names? That's what I would like to propose. Why Do We Need to Improve Test Method Names? Let's look at specific examples of why test method names need to be improved to ensure test code quality. Code Examples E-commerce site system In the e-commerce site system written in Go, we have implemented the following method of purchasing products. If the product is in stock, the order can be placed; otherwise, it returns an error and the order fails. // ECサイトシステム構造体 type ECSystem struct { // 商品ごとの在庫数 stock map[string]int } // 商品を購入するメソッド func (c *ECSystem) Order(itemID string) error { // 商品がない場合はエラーを返す if c.stock[itemID] <= 0 { return ErrOutOfStock } // 商品があれば在庫数を減らす c.stock[itemID]-- // 正常終了 return nil } Test Method Name Before Improvement Suppose that you created the following test code to conduct unit testing for this production code: func Test_正常系_在庫数が0より大きい場合(t *testing.T) { } func Test_異常系_在庫切れエラー(t *testing.T) { } When you look at these names, the following questions come to mind: 🤔 "If the inventory quantity is greater than 0, what is the correct result?" 🤔 "Under what conditions does the out-of-stock error occur?" I personally feel that I see this pattern of test method names surprisingly often. I think this is what happens when we get so caught up in how to test and what to write inside the test method that there's no time left to think about the method name itself. In this case, the sample code and the method implementation are simple, so you can easily guess what the test is about from its name. Meanwhile, the actual product code contains a large number of lines of code for a test method involves a large number of the methods, making us difficult to understand what kind of test it is. Improvement of the First Stage One reason why the name of the test method before improvement is difficult to understand is that the name does not contain either the preconditions or expected results. func Test_正常系_在庫数が0より大きい場合(t *testing.T) { } // 「想定結果」の欠落 func Test_異常系_在庫切れエラー(t *testing.T) { } // 「事前条件」の欠落 To put this the other way around, it is easier to understand if you put both preconditions and expected results in the test method name. Let's unify it into the following format: { Method under test }_{ Preconditions }_{ Expected results } func Test_Order_在庫数が0より大きい場合_正常終了(t *testing.T) { } func Test_Order_在庫数が0の場合_在庫切れエラー(t *testing.T) { } It's a little better, but there's still room for improvement. Problem: Method Name Includes How the Method Is Tested The current test method names focus on how the tests are executed, which makes them harder to read and interpret. 🤔 "The name includes the content of a successful end of the order process... Does that mean the user can buy the product?" 🤔 "The name describes that the order returns an out-of-stock error... Does that mean the user can't buy the product?" In other words, when you read it, your brain has to translate it into the "what"(or what kind of behavior is tested), which adds cognitive load and makes it hard to read. Regarding this naming convention, the book "Unit Testing: Principles, Practices, and Patterns" states the following. I've tried various naming conventions over the past decade, and among them, the most famous and probably the most useless one is: { Method under test } { Preconditions } { Expected results } The argument is that we should think of an appropriate name for each test rather than following a strict naming convention, but personally, I feel that calling it "the most useless" is a bit of an exaggeration. I believe it's very useful if you consider the benefit of standardizing naming convention among team members, by operating with the mindset of following rules if you are unsure how to name a method. Final Improvement: Write the "What" In your test method names, write the "what" (the method behavior), not the "how" (how you test the method). The "how" part (to check a successful end and error occurrence) is implemented in a test method. func Test_商品の在庫がある場合_ユーザは商品を購入できる(t *testing.T) { // ここで正常終了しているかをみる } func Test_商品の在庫がない場合_ユーザは商品を購入できない(t *testing.T) { // ここで在庫エラーが発生しているかをみる } Furthermore, "Unit Testing: Principles, Practices, and Patterns" states the importance of naming methods concisely to help even non-engineers (domain experts) understand them. Why Should We Use Names That Non-Engineers Can Understand? "Since test code is only seen by developers, why don't we have to make it a name that non-engineers can understand?" You might hear such opinion. "Unit Testing: Principles, Practices, and Patterns" addresses this opinion as follows: This is because cryptic names impose a cognitive burden on everyone, regardless of whether they are a developer or not. These names place an extra cognitive load on developers to figure out what the test case actually verifies and how its content relates to which business requirement. Even if you write code that only developers can understand, you'll end up where: It becomes difficult to grasp what the test is verifying and which requirements it corresponds to. Code maintenance becomes difficult. Even the person who wrote it won't be able to read it a few months later. It's hard for other engineers to understand during code reviews. This results in the following challenges related to test code I mentioned at the beginning: You have test code, but you don’t fully understand its purpose, which creates doubts about the reliability of the test results and reduces confidence in the adequacy of the testing. In reviewing test code someone else wrote, you have vaguely approved it even though you don't fully understand it. You have tweaked test code to pass the testing phase on a whim, concerning that you are not able to submit a pull request (PR) if the continuous integration (CI) failed as you don't really know what kind of test you're doing. That's how we get there. Naming Test Methods Clearly Is Hard To be honest, coming up with clear, easy-to-understand test method names is really hard. Why is that? That's because it requires you to take your hands off the keyboard, look away from the monitor, and ask yourself as follows: "What are we actually trying to create?" When you feel like you're drowning in a sea of code, just stop for a moment and consider what problems the method right in front of you is designed to solve and for whom. What role does this object play in the system? Is the task you are currently working on really going to make your users happy? Do we really have a good grasp of the domain knowledge used in this business area? Thinking seriously about test method names is actually about all of this. And then you'll notice that something magical starts to happen when you explore clearer test method names. The test code becomes easier to read. The production code naturally gets more organized. Conversations in the team are becoming smoother. It's just a test method name, but it's so much more. Small improvements lead to happiness for the entire development team. That's the kind of experience I really want you to have. Conclusion This time, I wrote about the test method name. Make the test method name easy to understand to help grasp what kind of test is conducted. Provide the names so clearly that even non-engineers can understand them. If simply improving test method names can enhance the quality of your test code, don't you think it's a cost-effective improvement? I hope this article has given you a sense of the importance of test method names. The book "Unit Testing: Principles, Practices, and Patterns," which I referred to this time, has about 400 pages; meanwhile, the explanation about the test method names is about 6 pages, which is not long at all. However, personally, I feel this is the most important and instructive part of the book. If you're struggling with unit testing, I highly recommend reading " "Unit Testing: Principles, Practices, and Patterns ." I'm sure it will give you the answer to your problems! References https://book.mynavi.jp/ec/products/detail/id=134252

Introduction Hello, I am Ki-yuno and working on frontend development for KINTO FACTORY . In this post, I’d like to share my experience of attending FACTORY’s in-person event as a frontend engineer. The in-person event I’m talking about wasn’t a tech conference, but a large meet-up for car enthusiasts. The frontend engineers joined to help run the FACTORY promotion booth at the venue . Since the audience included people less familiar with IT or the internet, it became a great opportunity to hear feedback from viewpoints quite different from our own as engineers. Event Exhibition Content Our product provides an upgrade service that allows customers to add genuine manufacturer options to their vehicles through online applications, even after purchase. Most customers discover our products through websites or magazine articles and often make their purchases without many chances to see the actual vehicles in advance. At an event like this, we also display vehicles that have been upgraded and cannot be seen on the web. This time, we showcased a Corolla Cross that had undergone meter design customization. “Meter design customization” is a product that allows you to add a new design to the vehicle’s instrument panel. *The image shows Classic Gear. Seeing the actual customized instrument panel is even more exciting than expected! It looks so good that even someone without a driver's license might feel tempted to enroll in driving school on the spot . Introduction to FACTORY and Novelties At the event, we ask the event participants to register their vehicle information on FACTORY. Everyone who registers will get a chance to play a no-lose gacha and take home a novelty gift The novelties are quite impressive, including penlights, tumblers, and original cases for vehicle inspection certificates. The original cases for vehicle inspection certificates we prepared are beautifully designed by our team of creators! They look so good that even someone who doesn't drive at all might tempted to sign a contract for Corolla . Insights from Observing Vehicle Owners Using FACTORY This is where the engineers truly shine. When the vehicle owners actually tried FACTORY, the following issues became apparent. When registering via the QR code provided for guidance, the navigation to FACTORY gets interrupted midway. Tapping the “Terms of conditions” link during registration leads to a page with no way to return to the registration flow. If the user accidentally closes the page after tapping the authentication URL sent by email, there’s no clear path back to resume registration. In the flows we engineers had designed without much deliberate consideration, we identified elements that could cause users to drop off. Especially with the registration process, we had become so accustomed to setting up accounts as a routine part of testing that we overlooked the potential barriers real users might face . Actions Against the Identified Issues As soon as we got back from the event, we took action to address the issues. First, we discovered that the QR code URL used for guidance was different from the one we engineers had expected. Therefore, we resolved this issue by sharing another URL that works correctly. Regarding the issues where users can't return to the registration page from the terms and conditions page, and where there's no way to go back after closing the page opened by tapping the authentication URL, we've communicated the situation and proposed fixes to the responsible team. Conclusion By actually participating in the event and observing users engaging with the service, we realized that there are issues affecting users in ways we hadn’t been aware of. Especially engineers have many opportunities to interact with the product and know the correct patterns of the service flow from the beginning. When you get used to knowing the correct patterns, it's easy to overlook things that are right under your nose, just like in this situation. No matter how user-focused development may be, if nothing evolves, the gap between you and the user will inevitably widen. If you have an opportunity to communicate with users about the product you are developing, I highly recommend that you participate. I believe it's important to return to the basics and reflect on who you're developing for and why. If there's an opportunity, I encourage you to take part. Even if such opportunities aren't available, you can still gain fresh insights by asking unrelated team members within the company to help with user testing or by trying different devices. Hands-on experience makes all the difference. Isn't this what we mean by user-first? Thank you very much for reading! P.S. I exchanged snacks with a stranger sitting next to me on the Shinkansen on my way back, while enjoying highballs. Is this also one of the pleasures of a business trip? It might be. (laughs)

Introduction Hi there. This is emim who joined the company in June 2025! In this article, I interviewed the new members who joined in June 2025 and collected their first impressions after starting work at KINTO Technologies. I hope this article will be helpful for those interested in KINTO Technologies (KTC) and serve as a reflection for the members featured here! Jun Self-introduction I work on a business system for used vehicles as a member of the Business System Group in the Business System Development Division. Two jobs ago, I worked as a PM on contracted development projects at a system integrator. Most recently, I was involved in developing B2B SaaS products at a startup. How is your team structured? Our team handles system development and operations for KINTO's used vehicles. Our team consists of five KTC members including myself. Most of the development (programming) is outsourced to partners, and KTC members mainly handle product management, project management, requirements definition, system design, and operational maintenance. What is the atmosphere like on-site? We're constantly reviewing operations and systems as the business expands, and actively adopting new technologies. It's a dynamic environment where there's never a dull moment. In the system I am currently working on, we use Java for the backend and Vue3 for the frontend. We haven't been able to utilize AI much yet, but we are trying to use GitHub Copilot and Devin in development. What made you decide to join KTC and were there any surprises? I joined KTC because I wanted to develop systems in a company where IT is directly connected to the business. We’d like to dedicate more time to developing solutions that make operations and system management easier, but we haven’t been able to get to that yet. What do you like about the office? There is a small break area with a tea machine, where I can enjoy the sunlight. I always eat lunch there. It’s not especially luxurious, but it offers a refreshing change of pace. Question from S to Jun You mentioned wanting to drive various cars. Please tell me which car you are most interested in right now and why! It's the GR Yaris. I want to try driving a genuine sports car. Nakano  Self-introduction I work in the Digital Transformation Solutions Group, a team that provides digital transformation support for dealerships. I am involved in PdM work and future planning tasks. How is your team structured? The team consists of eight members, including PdM and designers, working on the design and direction of the dealer digital transformation products. We are advancing the project in collaboration with the sales and development teams in the same division. What is the atmosphere like on-site? Everyone is calm, kind, and capable! I was impressed that everyone has not only system development skills but also a deep understanding of and interest in the complex dealership operations. What made you decide to join KTC and were there any surprises? At my previous company, an advertising agency, IT was just one part of the business. I wanted to work for a company where IT is the core focus and knowledgeable professionals gather. My impression hasn't changed since joining. This is a place where experts gather! What do you like about the office? I work in Osaka Tech Lab. I really like the the panoramic view of Osaka from my desk. (It can be seen from any seat.) One of the perks of this office is the mountain view. It helps me unwind between tasks. Question from Jun to Nakano Please share one thing you found amazing after joining KTC🙇 I was amazed by how many proactive and positive people there are! Since I joined, things are constantly moving forward. Everyone's so proactive about their work, technical growth, expanding our sites, and more. (The team spirit at Osaka Tech Lab is seriously incredible!) Kazuki Otaka Self-introduction I am Otaka, who joined the cloud security group in June! I work on cloud security, leveraging CSPM and threat detection mechanisms to monitor compliance with guardrails and drive continuous improvement activities across our multi-cloud environment. I have also written the KTC tech blog articles in the past. Please feel free to read them. (For past articles, click here ) How is your team structured? There are three of us, two in Osaka Tech Lab and one in Jimbocho office. What is the atmosphere like on-site? The atmosphere is calm, and the people are very warm and welcoming. Internal study sessions, lightening talks, and Beer Bashes are frequently held. There are many highly skilled and professional people. I want to do my best not to lag behind! What made you decide to join KTC and were there any surprises? In my previous job, I had many opportunities to work on building systems in on-premise environments. I decided to join KINTO Technologies, which builds systems entirely in the cloud, as I wanted to acquire skills in building and operating systems using cloud environments. I feel that we are in an environment at the forefront of cloud infrastructure operations more than I had imagined, with IaC (Infrastructure as Code) being advanced mainly on AWS and the verification and utilization of generative AI being pursued. What do you like about the office? Usually, it's quiet and calm. But when equipment was suddenly installed in the office and a PoC began, I could really feel the spirit of people trying new things, and I quite liked that. Question from Nakano to Kazuki Otaka Please tell me about the interesting and difficult aspects of security work! Security risks can severely affect the business when issues arise, but on the other hand, overly strict security can obstruct business operations and development. As cyber attacks evolve, finding the balance between implementing and operating necessary security without hindering business growth is challenging, but that's also what makes it interesting. Yuna  Self-introduction I am Yuna, part of the Business System Division's Business System Group, which develops business systems used by dealers. Currently, I work on a renewal project for the system used by dealers during business negotiations. Recently, a car I subscribed through KINTO was delivered, and going for drives every weekend has become my new hobby. How is your team structured? It's a team of three full-time employees including myself. I am working on requirements definition and maintenance operations while receiving daily support from the leader and another team member. I am working steadily to contribute while absorbing new knowledge and skills. What is the atmosphere like on-site? I have been warmly welcomed both in and outside my team. It is a very nice atmosphere. Although KINTO's products and operations are complex with much to learn, I'm catching up smoothly with excellent guidance from my team. What made you decide to join KTC and were there any surprises? I joined as a product manager, continuing from my previous job. To advance my career, I searched for a company where I could pursue what I wanted to do as a product manager. That's how I found KTC. During the interview, I talked with the current manager and leaders about the job details, and I really liked the team's vibe. Those were the deciding factors. I knew before joining that I would be working in a more tech-oriented area than in my previous job. However, once I started, I realized the role required more advanced skills, and I've been learning continuously ever since. What do you like about the office? I work on the 16th floor of the Muromachi office. It is directly connected to Mitsukoshimae Station and Shin-Nihonbashi Station, making it comfortable even on rainy days. There is a Starbucks within the building, and there are many restaurants and shops nearby, making it a very convenient environment. Taking a short walk during lunch break is a good way to refresh myself, and it helps me work better in the afternoon. Question from Kazuki Otaka to Yuna Do you have a favorite among your hobbies of making sweets and baking bread? Once I was also into bread, and I used to go to a bakery near Tokyo Gakugei University! Recently, I've been enjoying making "Mayonnaise Corn Bread" topped with plenty of seasonal summer corn. The sweet corn and savory mayonnaise infuse the fluffy bread dough with flavor. Even the wait while it bakes is a joy. emim  Self-introduction In the Engineering Office, a cross-organizational team, we conduct analysis, create systems, and engage with various divisions and teams from a designer's perspective to enhance the overall development capabilities of the organization. How is your team structured? There are only three members in the team, including myself. One is a manager who focuses on the entire organization while being a front-end developer, and another is focused on improving software processes and development productivity. The other is me. I undertake various initiatives to enhance designers' presence within the development organization. What is the atmosphere like on-site? The Engineering Office is highly distinctive. Everyone works on different things and we're not in one location, yet we collaborate and share information remarkably well. I think this is because the team has members with some unique skills. What made you decide to join KTC and were there any surprises? I've always liked cars but the mobility industry was something unfamiliar to me. Then, I thought that I could apply my skills acquired so far, and I submitted my application. Before joining the company, I was given quite detailed information by my team members. So there wasn't much of a gap. What do you like about the office? Working in Nihonbashi Muromachi makes my commute enjoyable every day. Questions from Yuna to emim I heard you like movies and TV dramas. Are there any films or shows you've seen that have influenced your work in design? Thank you for remembering my hobbies! I really love sci-fi, and I'm always excited when I come across UIs and devices I've never seen before. My decision to pursue design stemmed from my desire to design such unknown/novel devices. I tend to study and approach design with a focus on information architecture, creating systems that can properly deliver information across any type of digital device. Taka  Self-introduction I believe my work is about creating strategies in the space between n=1 (individual cases) and statistical generalizations. I love quantitative data analysis and in-depth interviews for achieving goals, and I could do it forever. The three important impulses that have shaped my life are "Observe," "Weave a story," and "Curate." How is your team structured? We have members with experience at operating companies (from large enterprises to startups), talented data analysts, and skilled engineers. What is the atmosphere like on-site? Culturally, we're a team that values a goal-driven mindset. We value a proactive approach to problem-solving that isn't constrained by convention. What made you decide to join KTC and were there any surprises? I joined because I have a hypothesis that individual-focused marketing is crucial during this period of global transformation in the automotive industry and I wanted to put this into practice and drive change. What do you like about the office? The bright sunlight coming in through the large windows on the 16th floor of the Muromachi office. It's nice to work with a view of the open sky and plenty of natural light, since we're not surrounded by tall buildings. Questions from emim to Taka I heard you've worked in various roles throughout your career. Is there anything you feel is unfinished or that you haven't accomplished yet? Also, what are your ambitions at KTC, and how do you plan to use your best skills here? Well, I've worked in different roles, but I actually feel that my core hasn't changed, and I believe what I've been doing is "design to connect people." The one thing I haven't accomplished yet is starting a business. My ambition is as I wrote why I joined the company! S  Self-introduction I work in a team that develops the front end of KINTO ONE (a new vehicle subscription service). How is your team structured? The team consists of eight engineers (six in Tokyo, one each in Osaka and Fukuoka). We adopt a Scrum development framework with one-week sprints. What is the atmosphere like on-site? I'm the only one based in Osaka, so I primarily communicate with other team members online. The team has a welcoming atmosphere where it's easy to ask questions. When I ask questions in chat, I get quick responses, so I don't have any issues at work. What made you decide to join KTC and were there any surprises? I joined because I believe the mobility sector will continue to evolve, and I wanted to contribute to the product development that supports that growth. I was able to learn thoroughly about the team before joining, so there was mostly no gap between my expectations and reality. What do you like about the office? I like that the office is directly connected to Osaka Station, making commuting easy. I also appreciate how spacious and clean it is, and I find it interesting to see areas designed to look like a garage and roads inside. Question from Taka to S Please tell me if you have any experiences where you talked about something you really like or find interesting, but the other person was put off. (Your true impulses might be hidden there.) I find complete nutrition foods convenient and easy to prepare for my daily meals, so I'm trying products from various manufacturers. My refrigerator is filled with those. When I tell people about it, they often get taken aback. In Closing Thank you everyone for sharing your thoughts after joining our company! There are more and more new members at KINTO Technologies every day! We will be posting more stories from our newcomers across divisions, so stay tuned! And yes, we are still hiring! KINTO Technologies is looking for new teammates to join us across a variety of divisions and roles. For more details, please check here !

はじめに こんにちは、2025年5月入社の satoshi です！ 本記事では、2025年5月入社のみなさまに、入社直後の感想をお伺いし、まとめてみました。 KINTO テクノロジーズ(以下、KTC)に興味のある方、そして、今回参加下さったメンバーへの振り返りとして有益なコンテンツになればいいなと思います！ Y 自己紹介 人事グループのYです。前職ではエンジニアをしていたこともあります 所属チームの体制は？ 私の所属している組織人事チームは3名ですが、同じグループ内の採用チーム・労務総務チームや、KINTO管理部の皆さんとも連携する機会が多くあります KTCへ入社したときの第一印象？ギャップはあった？ 落ち着いた大人な印象の方が多いですが、コミュニケーションはとてもフランクです 現場の雰囲気はどんな感じ？ 何でも相談できるので、とても助かっています！ ブログを書くことになってどう思った？ techな要素は無いエントリですが、大丈夫ですかね笑 satoshi ⇒ Yさんへの質問 飼ってる猫ちゃんのカワイイエピソードを教えてください！ 洗剤の匂いが好きなのか、洗濯物をたたんでいるとよくクンクン・ペロペロ・スリスリしに寄ってきます せっかく洗った服やタオルも、あっという間に猫毛まみれになります笑 D.K 自己紹介 業務システム開発部で、審査・与信管理業務領域を担当しています。 金融システムに関与しており、前職も販売金融でした。 所属チームの体制は？ 実は1人チームです。プロダクトの要件定義と開発を進めながら、来年６月の本リリース後から運用・保守するメンバーを集め、チームビルディングするのが今後の課題です。 KTCへ入社したときの第一印象？ギャップはあった？ テックブログから感じていた以上にAIやIoTなど最新技術情報に関するイベントや社内実証試験が多いことが印象的で、良い意味でのギャップでした。 KTCはリース業務に縛られない幅広い技術の研究やプロダクト開発が行われており、新しいモノ好きに最適な会社だと感じました。 現場の雰囲気はどんな感じ？ チームを超えて気軽に質問・相談・雑談できる雰囲気です。業務内外隔てなく真剣に議論する姿をよく見かけます。 また、業務部門であるKINTOとの距離感が近く、当事者意識を持って技術側がリードしてプロダクトを開発していくスタイルがKTCらしいなと感じています。 ブログを書くことになってどう思った？ TechBlogを参照していたので、とうとう周ってきたなと。 できるだけ率直な意見を記載しました。社外の方が弊社の雰囲気を感じ取る参考になれば幸いです。 Yさん ⇒ D.Kさんへの質問 室町オフィス周辺のおすすめランチを教えてください！ 地味ですが、「そばよし　日本橋本店」です。 鰹節問屋直営のうどん・蕎麦屋なので、店内がだしの香りでいっぱいです。 是非ご飯も注文してみてください。鰹節の削粉がついてくるので、少しだけ醤油をかけて食べるおかかご飯が鰹節の香りがたまりません！ N 自己紹介 QAグループでアプリの方のQAを担当しています。前職もアプリのQAでした。 所属チームの体制は？ QAグループ全体は11名で、私が所属しているチームは４名で各アプリを担当しています KTCへ入社したときの第一印象？ギャップはあった？ KTCへの印象は大人な方が多く穏やかな印象を持っていましたが、熱量が高く技術的な情報を発信されている/学ばれている方が多い印象も加わりました！ 現場の雰囲気はどんな感じ？ 和気藹々としていて気軽に質問したり、相談も出来る雰囲気です！ ブログを書くことになってどう思った？ TechBlogを書くのは久しぶりですが、これから何かと書く機会が増えるので慣れていこうと思っています D.Kさん ⇒ Nさんへの質問 お笑いが好きだと伺っていたので、最近の推し芸人を教えてください！ すごくピンポイントなのですが、天才ピアニストさんのドアノブ点検のコント最高です！ 個人的にM-1 2016~2019あたりの漫才師さんどの方も好きです！ぜひ観てみてください M.K 自己紹介 DataOpsグループでデータの管理をしています。Osaka Tech Labで働いています。 以前はインターネット広告やインターネットメディアの領域にいました。 所属チームの体制は？ グループは全部で10人ほどですが、普段の仕事ではもう一人の大阪のメンバーとチームを組んでいます。 グループのマネージャーも大阪にいるので、コミュニケーションは取りやすい環境にあります。 KTCへ入社したときの第一印象？ギャップはあった？ 今までに働いた会社と働き方や使っているツールが近かったので、違和感なく働き始めることができました。 現場の雰囲気はどんな感じ？ なんでも質問しやすい雰囲気があり、キャッチアップしやすいと感じました。 また、Osaka Tech Lab特有かもしれませんが、違うグループの方にもオフィスで積極的に話しかけてもらえるので馴染みやすかったです。 ブログを書くことになってどう思った？ 私も仕事をさがしていたときTechBlogにお世話になったので、今度は誰かの参考になれば嬉しいです。 Nさん ⇒ M.Kさんへの質問 車を運転されるということで、ドライブでおすすめの場所教えてください！ 私自身はカーシェアをよく使っていて、普段から乗るわけではないので、なるべく安全で快適な片側2車線以上の高速道路を使うようにしています。 関東なら千葉や茨城方面、大阪近辺だと中国自動車道が走りやすくて好きです。 m 自己紹介 OsakaTechLabに所属しており、QAグループにてアプリのQAを担当しています。前職までは開発をしていました。 所属チームの体制は？ QAグループ全体は11名で、私が所属しているチームは４名で各アプリを担当しています。(nさんと一緒のチームです) KTCへ入社したときの第一印象？ギャップはあった？ 生成AIを利用したプロセス改善等に関してとても意欲的である印象を持ちました。また技術に対しても熱量の高い方が多い印象です。 現場の雰囲気はどんな感じ？ 気さくな方が多く馴染みやすい感じです。質問も気軽にできる環境です。 ブログを書くことになってどう思った？ KTC入社前にTechBlogを見ていたので自分もついに、、、！と思っていました笑 M.Kさん ⇒ mさんへの質問 大阪オフィスが新しくなりました。前のオフィスと比べてどうですか？ 見晴らしがとても良いです。（朝から夜までずっと景色が本当に綺麗） 開放感があって個人的にはとても集中しやすい環境になりました。 satoshi 自己紹介 my route開発部でバックエンド開発を行なっています 前職はWeb系で同じくバックエンド開発、前々職はネットワーク系の企業でネットワークエンジニアをやっていました 所属チームの体制は？ バックエンドチームは4人、その他に協力会社の方々が10人以上います 7月からフロントエンドチームも同じオフィスに合流し、賑やかになりました！ KTCへ入社したときの第一印象？ギャップはあった？ 堅い会社なのかなと思いきやそんなことはなく、活発にコミュニケーションを取りながら開発出来ています また、AIに関しては全社的に熱量高く取り組んでいて、業務全般でAIを活用することができ凄く助かってます 現場の雰囲気はどんな感じ？ 仲良く開発しています。相談もとてもしやすい雰囲気です my routeはBtoCのプロダクトのためお客様からの問い合わせも多く、日々わちゃわちゃしています ブログを書くことになってどう思った？ これまで様々な会社のテックブログを読んでいたので、ついに自分もという感慨深い？気持ちです mさん ⇒ satoshiへの質問 出身地について何か語ってください、、！ 出身は京都府です！　夏は高温多湿、冬は極寒の過酷な環境で育ちました 今でもたまに帰り、インバウンドの人々に混じって京都巡りを楽しんでいます さいごに みなさま、入社後の感想を教えてくださり、ありがとうございました！ KINTOテクノロジーズでは日々、新たなメンバーが増えています！ 今後もいろんな部署のいろんな方々の入社エントリが増えていきますので、楽しみにしていただけましたら幸いです。 そして、KINTO テクノロジーズでは、まだまださまざまな部署・職種で一緒に働ける仲間を募集しています！ 詳しくは こちら からご確認ください！

0. はじめに KINTOテクノロジーズのCloud Infrastructure G(CIG)でInfrastructure Architectを担当している劉(YOU)です。 AIの著しい進化に伴い、世界的に生成AIを活用して様々な取り組みを実施することが日常になりました。生成AIをどれだけ使いこなせるかが重要ですが、併せて生成AIを利用することにより発生するリスク対策も重要になります。 弊社の今年の年間テーマとして AIファースト が掲げられており、積極的なAI活用を始め社内外で多くの活動を実施しています。社内ではさまざまな部署が生成AIを活用したアプリケーションの開発をする動きが増えています。しかしそれに比例するように生成AI利用におけるセキュリティ対策の重要性も増しており、アプリケーションの開発スピードを落とすことなく実施できる対策の検討が急務となっています。 社内のクラウド環境に責任を持つCIGでは、社内のSCoEチームが発表している様々な AIセキュリティ関連の資料 を元に、生成AIセキュリティを実現するために何をすべきかという点で取り組みの優先順位を決めました。 OWASP Top 10 for LLM Application 2025 をKTCのクラウド環境に適した内容になるよう整理し、それを実現する方法として生成AIガードレール、特にAWS Bedrock Guardrailsを採用することにしました。 本記事ではこのような背景の中で、我々がAWS Bedrock Guardrailsの導入に向けて取り組んだことを詳しく解説します。下記の事項を中心に前編と後編で分けてご紹介します。 なぜ生成AI活用でセキュリティを確保する必要があるのか 生成AIの安全を担保するために生成AIガードレールがなぜ重要なのか 生成AIガードレールの中でもなぜAWS Bedrock Guardrailsを選択したのか 今までKTCがAWS Bedrock Guardrailsで何をやっているか 前編である本記事では、 生成AIセキュリティの必要性と実現するための生成AIガードレールの概要 についての情報を記載します。後編でご紹介するAWS Bedrock Guardrailsの具体的な説明の前に、「生成AIセキュリティ」と「生成AIガードレール」についての基本的な考え方を整理し、それを踏まえてAWS Bedrock Guardrailsの役割を正確にご理解いただけるような情報をご提供します。なお、生成AIのセキュリティ全領域をカバーするとなると内容が長くなり過ぎるため、生成AIガードレールを中心とした内容を簡単に取り上げます。 後編では、 生成AIガードレール適用のためのAWS Bedrock Guardrails についてまとめる予定です。理論の話がメインの前編とは違い、後編では主にAWSを使った実装ベースの解説を行います。元々は後編のみの記事を書く予定で書き始めたのですが、この話題でセキュリティの前提となる情報を割愛することは難しかったので前編・後編に分割することにしました。AWS Bedrock Guardrailsの取り組みについては後編で重点的に扱いますのでご留意ください。 本文書では LLMs at Scale.ai のJothi Periasamy氏の著書 Guardrails-GEN-AI-Government-Services から主要な考え方を多く参考にさせていただきました。生成AIガードレールに興味があり、深掘りしたいという方は是非ご覧になって下さい。 :::message 本記事にまとめた情報は弊社内のセキュリティルールの内容とは直接関係は有りません。あくまでも 取り組みの参考資料として活用された内容・外部公開されているソースのみを記載 してます。 ::: 1. 生成AIセキュリティの重要性 1-1. 生成AIのセキュリティリスク ここ最近では、生成AIのアップデートに関するニュースを目にしない日はありません。日本国内を見ても、生成AIの導入が加速化し、それとともに企業や公共機関が直面するセキュリティリスクとそれに対応する方法への関心が高まっているように思います。 これから繰り返し生成AIの脅威について取り上げますが、その中でも最も 代表的なセキュリティリスク ^1 には次のようなものがあります。 1-1-1.代表的なセキュリティリスク このようなセキュリティリスクは国内でも深刻に受け止めてられており、日本政府からも各AI事業者に対して積極的に高いセキュリティガバナンスを保つことを要求しています。 海外との交流では2023年G7議長国として、基盤モデル及び生成AIを含む高度なAIシステムを議論する広島AIプロセス ^2 を主導し、国際行動規範を設けました。 国内では、総務省と経済産業省が2024年4月にAI事業者ガイドライン ^3 を発表しました。 このガイドラインは広島AIプロセスの内容を踏襲しており、人間中心、安全性、プライバシー保護など10項目を含めています。 1-1-2. 国内外の生成AIセキュリティに対する動き しかし、政府が積極的にAIセキュリティの推進を行ってはいるものの、 現在はまだガバナンス未整備 の企業が大多数です。その理由としては色々有りますが、客観的な情報を提示しながら考察してみます。 1-2. 統計で見る生成AIセキュリティの現状 日本企業を対象にした生成AIとセキュリティに関する意識調査 ^4 では次のような結果がでています。 1-2-1.生成AIとセキュリティに関する意識調査 この時、回答者が心配したリスク要素として「法的権利の侵害(64%)」、「情報漏洩(61%)」、「ハルシネーション(56%)」、「不正・不具合の混入(34%)」が上位にランクインしており、 前述したセキュリティリスクと実際の企業が感じてる危険要素 ^1 とも結果が合致しています。 特に法的に問題視される内容が1・2位に揃ってランクしており、各企業が個人情報保護法の順守を重要視していることが見て取れます。2024年改正でのウェブスキミング対策 ^5 を見ても、国として流出等発生時の報告·通知義務と安全管理措置の対象が拡大していることがわかります。 生成AIの運用時にも、これらの規定を遵守するための取り組みが欠かせません。 こういった流れを見ると、改めて セキュリティリスクに対する懸念が生成AIの利用に影響を与えている と強く感じます。 総務省の情報通信白書 ^6 によると、業務における生成AIの活用状況の実体は国別に次のような結果が出ています。 1-2-2.業務における生成AIの活用状況 ^6 日本で46.8％（“業務で使用中”と回答した割合）であり、他国と比較するとその割合は低い。“トライアル中”までを含めると、米国、ドイツ、中国の企業は90％程度が使用しており、日本企業は社内向け業務から慎重な導入が進められていることがわかった 日本企業の生成AI使用率は世界的に比べて低い水準ですが、これは主に データ、資産、個人情報などのリスク管理方案およびガバナンス体系の不在 ^7 だと述べています。これを見ても、AIシステム開発の一連のガバナンス政策を計画する段階から商用化後まで、全段階にわたって構築することが重要であることが分かります。 詳細のデータは右のリンクを参照「 IPA DX白書2025 」 前述の調査 ^4 では、回答者の77%が生成AIを使用していますが、その内の27.1%が 生成AIに関するセキュリティ教育 がないと回答し、全回答者の93.6%が「関連ガイドラインを整備中」と答えました。つまり、回答者が属している 企業の大多数が安全なガイドラインを必要 と感じているということです。 1-3.　安全なガイドライン これらのデータを踏まえ、「 安全なガイドラインを作成 」 するために一番重要なことはなんでしょうか？この問いの答えの一つになるのが 構造化された生成AIガードレールの採用 です。ガードレールにはプライバシーリスクや入力値・出力値を検査し、セキュリティプロトコルを強制する統制を可能にし、インジェクション/ハルシネーション、毒性（Toxicity、生成AIが有害なコンテンツを生成するリスク）などのリスクを緩和する仕組みが取り入れられています。 一般的なガードレールは、主に行動を許容するかブロックするかに焦点を当てています。しかし、生成AIにおけるガードレールには、倫理的な運用目標も含まれます。「有害であったり、テーマから外れた出力を検知し、それを予防するメカニズムを導入すること」が、この分野におけるAI主導の運用を実現する鍵となります。これは単に脅威を阻止するだけでなく、AIの動作に直接関与することを意味します。特に、生成AIガードレールを適切に適用する戦略によって、高い透明性、責任性、安全性を確保した状態で生成AIを利用することが可能になります。 2. 生成AIガードレールについて 2-1.　概要 生成AIガードレール とは、生成AIシステムが安全かつ倫理的に動作し、組織の目標や社会の価値観に適合することを保障するための 構造化されたフレームワーク、指針 です。ガードレールは、AIシステムの入力、処理、および出力を制御する役割を果たします。このような制御は、迅速なインジェクション、個人情報の流出、ハルシネーション、偏見といった危険を軽減することで、出力結果が正確で安全かつ関連性のあるものであることを確認するのに役立ちます。特に、組織が法的基準を順守し、倫理的原則を守り、機密情報を保護できるようサポートします。 一般的には、企業が提供するGPT, Claude, Geminiのような基盤モデルの場合、ある程度のセキュリティが自主的に保証されていますが、それでも完璧ではありません。最近の研究 ^8 によると、テストされたすべてのLLM（大規模言語モデル）は基本的な脱獄攻撃に対して依然として非常に脆弱であり、一部のモデルは特別な迂回の試みがなくても有害な結果を提供することが確認されています。そのため、このようなガードレールの重要性はさらに高まっています。 生成AIソリューションでのガードレールは次の3つの段階で実現します。 入力段階 (プロンプト/ユーザー質問) : ユーザー入力の有効性検証と悪意のあるプロンプトブロック 検索段階（拡張コンテンツ） :RAGシステムで検索された情報の品質と関連性検証 出力段階(応答) : 生成された応答の安全性、正確性、適切性の検証 様々なタイプのガードレール制御がありますが、一般的にガードレール制御はこうなります。 2-1-1.一般的なガードレール制御 さらに、これらすべてのコントロールは、ビジネスとセキュリティの要件に応じて高度にカスタマイズできます。 すべてのガードレール アーキテクチャ オプションは、ビジネスの要件とセキュリティ ポリシーによって決定されます。 2-2.　アーキテクチャ ガードレールの実装には様々な方法がありますが、まずは方法論的な部分を整理してみましょう。 単純なRAGアーキテクチャ ^9 は、外部システムと相互作用せず、独自のランタイム環境内でのみ動作し、エージェントが関与しない実装方式です。 2-2-1.単純なRAGアーキテクチャ ナレッジベース、意味検索、順位、ベクトルデータベースのようなLLMおよびそのサポートプロセスと直接相互作用を重視し、カスタマイズされたガードレールコンポーネントのようなガードレールコントロールを使用して、ユーザープロンプトとLLM応答およびナレッジベース検索を制御します。 簡単に設計·実装できる ため、オープンソースソリューションと組み合わせて使用する場合は、この方法を採用することをお勧めします。 エージェントベースのアーキテクチャ ^10 は、外部システムおよびアプリケーション、メモリ、コード インタープリタ、外部システムの呼び出しなど、さまざまなタイプのツールが存在します。 ここでは、エージェント アーキテクチャ タイプによってガードレールの制御が決まります。 2-2-2.エージェントベースのアーキテクチャ 例えば、スーパーバイザーエージェントがいるエージェントアーキテクチャでは、スーパーバイザーエージェントと協業エージェント間の共通ガードレール制御を通じて、より複雑なセキュリティシステムを実現することができます。 しかし、エージェントを活用するアーキテクチャはまだベストプラクティスが成立できてないことで、 複雑度も高いし、実装も非常に難しい 状態になっています。そこで、技術変化を対応しているエンタープライズソリューションを活用したら、検証されたエージェントベースのアーキテクチャをすぐに使えます。 2-3.　実装するための選択肢の比較 2-3-1.ソリューションの種類 次に、企業でガードレールを適用する際に ・オープンソースソリューションを採用して独自にガードレールを構成する ・エンタープライズソリューションを採用してガードレールを構成する について長所と短所を比較してみましょう。 評価項目 Open Source Soulution Enterprise Soulution 初期コスト ◎ △ 人的コスト x ○ ライセンスコスト ◎ x カスタマイズ性 ◎ △ ベンダー依存性 ◎ △ 定期的アップデート △ ◎ 技術的専門性要求 x ○ 専門サポートサービス △ ◎ セキュリティ関連対応力 △ ◎ 2-3-2.ソリューションの長所と短所 非常に良好：◎、良好：○、不良：△、非常に不良：x オープンソースソリューションを利用して実装すると、自社独自の要件とドメインに合わせてカスタマイズできます。 そして、ビジネス要件に合うように内部データとサービスロジックに特化した細かい制御が可能だという点は非常に大きなメリットです。 さらに、他のオープンソースを活用するのと同様に、初期コストが節約されるだけでなく、特定のベンダーロックインも防止できます。 しかし、オープンソースソリューションを利用して実装するということは、 AIに対する高い技術的専門性と開発ができる専門部隊が必要 になります。 そして、該当ガードレールに対して持続的なアップデートとメンテナンスが発生し、専任のAI関連部署が存在しなかった場合、一般的な企業では 人的コストが大幅にかかって しまいます。 そして結局、カスタマイズをした瞬間から自主的にガードレールの評価を進めなければならないため、検証されていない セキュリティホール ^11 が存在する可能性があります。 何よりも安全なガイドラインがない状況であれば、要件を定義することからが問題になります。 その為、上記を運用できない場合はエンタープライズソリューションの利用が有効です。 すぐに使用可能な検証済みのセキュリティ機能を持っており、随時発生するセキュリティイシューに対して持続的なアップデートと専門的なサポートサービスを提供します。 そして生成AIセキュリティに要求される多様な規定を自動的に支援してくれます。 つまり、 「安全なガイドラインの作成」をすぐに享受できる のがエンタープライズソリューションだということです。 ただし、エンタープライズソリューションはライセンスコストや使用量によるコスト増が発生します。 そして、特定ベンダーのガードレールオプションを使用することになれば、特定ベンダーへの依存性が増加することも避けられません。 また、自分たちのビジネス要件に合ったガードレールを実装したい場合、カスタマイズオプションの制限が存在する可能性があります。これは 独自のセキュリティ規定が存在する場合、その規定を準拠できない かも知れません。 もちろん、エンタープライズ ソリューションの欠点を補完した事例も存在します。 私が今まで調べたところ、かなり理想的な形はブルームバーグの ハイブリッドガードレール戦略 があります。 下記はブルンバーグのAIグループ首席エンジニアであるラーマン氏の話 ^12 です。 これらすべてを実現するために、ブルームバーグはオープンソースモデルと商用モデルの両方を使用し、内部で訓練されたモデルも使用しています。 「私たちは特定の技術と強結合されていません」とラーマン氏は言います。 つまり、1つのプラットフォームのガードレールを使用するだけでは十分ではないということです。 ブルームバーグが1つのスタックで成功したとしても、同社は既製のガードレールツールが提供するものを超えることを望んでいるだろうと、彼は言います。 2-3-3.スイスチーズモデル 様々なガードレールを重畳させるスイスチーズ戦略を活用して、特定のガードレールにセキュリティ欠点が発生しても、幾層にも重なったガードレールで問題発生を防止できるようにしました。本当に理想的で優れた方法だとは思いますが、このような方法をする状況は非常に 厳格なセキュリティ規定とリソースが存在する時に行うもの だと思います。 その為、大多数の企業は合理的なガードレールを選定するために、多くの考慮をする必要があります。 もう少し本質的な内容に近付けるためには、ガードレールの設計についての領域に触れることになります。 2-4.　アプローチ・設計 「 Building Guardrails for Large Language Models 」 ^13 という論文ではAIガードレール構築について深層的に扱っています。ここではAIガードレール設計は技術的複雑性と多様な利害関係者の要求事項をバランスよく調和させなければならない複合的な課題だと定めています。 KTCが主に考慮した部分は Conflicting Requirements (相反する要求事項)、 Multidisciplinary Approach (多学際的アプローチ)の二つの側面について扱っております。独自にガードレールの開発はしないため、開発論について扱う残りの二つは除外しました。 相反する要求事項はAIの安全性と性能の間の相反する要求事項を解決することを意味します。 2-4-1.相反する要求事項 全てのガードレールを最初から適用してセキュリティを保障しようとしても、 求める答えを出さないAIなら、AIを使用する目的自体が失われる ことになります。 そのため、最も重要なガードレールから始めて、必要に応じて徐々に範囲拡張することをお勧めします。 ガードレールを徐々に拡張するためには多くの 学際的アプローチ も必要です。 これは、 技術的専門性、倫理的フレームワーク、ガバナンス構造、利害関係者の関与を組み合わせる ことを意味します。 例えば、 弊社ではSCoE(Security Center of Excellence)チーム、AI First部、プラットフォームG、クラウドインフラGなど多様な利害関係者がキックオフから参加しており、AIシステム構築初期から各分野の専門家集団がKTCに必要なガードレールの検討/適用を実施しています。そのガードレールを適用したAIシステムの一つがAgent-store ^14 です。 2-5.　統合(Integration) 最後に、 ガードレールは完全なセキュリティを保証するサービスではない ことを注意する必要があります。 単一のガードレールではすべてのセキュリティリスクを完璧に防御することはできないし、ガードレール以外でも様々な側面からセキュリティリスクを考慮する必要があります。 例としては次のとおりです。 2-5-1.生成AIガードレールの統合 その他にも説明できなかった要素が存在しますが、ガードレールだけで生成AIセキュリティを担保することはできず、 様々な観点での対応が必須 ということを理解していただければと思います。 3. まとめ 生成AIの活用が本格化する中で、個人情報流出やプロンプトインジェクション、ハルシネーションなど、従来にはなかった多様なセキュリティリスクが顕在化しています。日本国内でもAIセキュリティに対する意識は高まりつつあり、政府・民間ともにガイドラインやガバナンスの整備が進められていますが、実際の現場では依然として不安や課題が残っています。 こうした状況において、生成AIガードレールは、AIシステムの安全性・倫理性を担保し、組織の目標や法規制に適合したAI活用を実現するための重要な仕組みとなります。ガードレールは入力・出力段階での検証やフィルタリングを通じて、さまざまなリスクを低減し、AIの有用性と安全性のバランスを実現します。 生成AIガードレールの実装にはオープンソースソリューションやエンタープライズソリューションなど複数の選択肢があり、それぞれにメリット・デメリットがあります。各社のリソースや要件に応じて最適な構成を選択することが重要です。また、生成AIガードレールだけに依存するのではなく、プロンプトエンジニアリングやPCS(People Centric Security)、継続的なモニタリングなど、様々なセキュリティ対策の組み合わせが必要となります。 AIセキュリティの実現には、技術面だけでなく、法務・倫理・ガバナンスなど多様な観点からのアプローチと、いくつもの専門部署の連携が欠かせません。まずは最も重要なリスクから段階的に生成AIガードレールを導入し、状況に応じて拡張していくことが、実践的で現実的な戦略となります。 KTCでも生成AIのセキュリティをどのように保障するかを検討し、多々実施している施策の1つとして生成AIガードレールを導入しています。 次回（後編）の記事では、今回の記事の内容を踏まえ、どういった観点から AWS Bedrock Guardrails の採用に至ったのか、AWS Bedrock Guardrails はどのように機能するのか、そしてAWS Bedrock Guardrailsを通じてどのような試みをしたのかについて取り上げる予定です。ぜひお楽しみに！

こんにちは！SREチームのkasaiです。 KINTOテクノロジーズ株式会社は、「SRE NEXT 2025」にて、プラチナスポンサーとして協賛いたしました！ ブースにお越しいただいた方ありがとうございました！ 参加者の皆様とお話しすることができ、いい刺激になりましたし、さまざまな学びを得ることができました。 SRE NEXTに参加した弊社社員による座談会の様子は、以下の記事で読むことができますので、ぜひご覧ください！ https://blog.kinto-technologies.com/posts/2025-07-18-sre_next_look_back/ ブースでは「あなたのNEXTは？」というお題でアンケートをとらせていただきました。 ご協力いただいた方ありがとうございます！ この記事ではアンケート結果を共有したいと思います。 ボードに貼られた付箋たち（左1日目,右2日目）  2日分の付箋の束 アンケート結果 アンケートへの回答数は2日間で312件でした！ 回答内容をいくつかのカテゴリに分類して共有したいと思います。 ※回答のカテゴリ分類はGeminiを使って分類しています。 SRE・組織文化 (60件) SREの実践や文化の醸成、採用、チームビルディングに関する回答です。 SREを推進できるようになる SRE文化の浸透 エンジニア採用を成功させる ワクワクできるエンジニア組織にする！ Embedded SRE共通基盤 SREとしてどう振る舞うか、SRE的な考えをどう浸透させるかといった話や、採用が難しくもっと人が欲しいといった声が多くあったようです。 私もどうすれば他のチームの人にSRE的な考えをメリットとして感じてもらえるか、上手く伝えられるかを悩んでいるので、とても共感することができました。 AI活用 (58件) AIやLLMを活用した業務効率化や、新しい価値創出に関する回答です。 AI活用をインフラ・SREに Agentic DevOpsの実現 インシデント対応をAIだけでできるようにする AI活用でトイル削減 AI利用で週休7日！！ もうすでに使っていて活用を広げたいと思っている人もいれば、これから使いたいと思っている人もいました。 私も生成AIは使っていますが、コードを書く時の補助程度にしか使っておらず、例えば、インシデント対応をすべてAIでやってもらえるようにするといったことはできていないので、そういうコードを書く時以外にも使えるように挑戦していきたいと思いました。 技術・サービス改善 (58件) SLI/SLO導入、パフォーマンス、技術的負債の解消など、サービス品質向上に関する回答です。 SLI/SLOの導入 パフォーマンスを爆速にしてユーザ体験よくしたい 技術負債の解消 運用を全て自動化したい！ eBPFやっていき SLI/SLOの導入やオブザーバビリティの拡充が多くありました。 私もSLI/SLOについてまだまだ勉強することが多くありますし、導入実績も少ないので、どんどん実践していき知識・知見をためていきたいと思います。 事業・キャリア (41件) 事業への貢献、プロダクト成長、IPO、転職や昇進などキャリアに関する回答です。 ビジネスサイドを理解して仕事する 事業Growth！ IPO CTOになる！ 転職 技術的な話だけではなく、事業に関する話もありました。 私は信頼性に関することを開発側だけではなく、ビジネス側とも会話する必要があると感じていますが、他にも同じような考えの人がいたり、ビジネスをどうグロースさせていくかを考えている人もいたようです。 私自身はまだまだビジネス側と距離がある状態になってしまっているので、この距離を縮めて、SRE的に事業へ貢献できたらと思いました。 登壇・アウトプット (30件) カンファレンス登壇やブログ執筆など、社外への情報発信に関する回答です。 キートーク頑張る 毎月アウトプット PHPカンファレンス2026北海道やります！！ CFPたくさん出す！ Speakerになる カンファレンスという場だったからかもしれませんが、登壇に関するものも多かった印象です。 SRE NEXTに登壇すると書いていた人もいたので、登壇したくなるようなイベントを開催できていることがとても素晴らしいなと思いました。 私もブログや登壇等で、弊社のことについて広め、多くの人にどういう会社なのかということを知っていただけるようにしていきたいと思いました。 その他 (65件) 上記のカテゴリーに当てはまらない、プライベートな目標やユニークな回答です。 サウナ行く！ 南極でペンギン見る 幸せになる 夜ご飯を食べる 旅行に行く 仕事やSREに関係ないことも書いてもらっていました。 健康の維持や気分転換も仕事する上で必要だなと再認識しました。 せっかくなのでこのままGeminiに総括もお願いしました！ 全312件の回答、誠にありがとうございました。今回のアンケート結果からは、現代のエンジニアが持つ、技術、組織、事業、そして個人としての多岐にわたる健全な関心事が鮮明に浮かび上がってきました。 最も多くの回答が集まったのは「SRE・組織文化」であり、これはSREを単なる技術的な役割としてだけでなく、チームや組織全体の文化として捉え、その醸成や発展に強い意欲を持っていることの表れです。僅差で「AI活用」と「技術・サービス改善」が続き、最先端技術への探求心と、サービスの信頼性向上というSREの核となる責務への高い意識が両立していることがわかります。これら3つのカテゴリーがほぼ同数で上位を占めている点は、非常にバランスの取れたエンジニアリング観を象徴していると言えるでしょう。 また、「事業・キャリア」や「登壇・アウトプット」に関する回答も多く、日々の業務を越えて、事業への貢献やコミュニティへの価値還元といった、より広い視野で自らの役割を捉えている方が多いことも印象的です。 そして、「その他」のカテゴリーは、仕事だけでなく、健康やプライベート、個人の夢といったウェルビーイングを大切にする価値観を明確に示しています。 総じて、技術的な卓越性を追求しつつも、組織や人、事業への貢献を忘れず、個人の人生の充実も図るという、現代的で成熟したエンジニア像が浮かび上がる、非常に示唆に富んだアンケート結果でした。 以上がアンケート結果およびそのまとめでした。 SRE NEXT 2025のテーマは「Talk NEXT」です。そのためそれにちなんだお題、またブースに来てくれた人と対話できるようにという思いでこのアンケートをすることに決めました。 抽象度の高いお題にしたことによって、SREsだけではなく、他ロールのエンジニア、ひいてはエンジニア以外の人とも対話することができて、とても良いお題だったと感じています。 回答に関して、昨今のトレンドである生成AI周りの話が多く、SRE領域でAIをどう使っていくかを考えている人が多かった印象です。 また、私自身、システムのメトリクス取得はできていますが、そのデータを使ってどう意思決定をするか、ビジネス側に影響を与え、事業に貢献できるかといったことが、まだまだできていないので、そこができるようになるとSREとしても面白くなっていくと思っていますし、挑戦していきたいなと思いました。 そのほかの回答も共感できるものが多く、当日ブースでは楽しく会話させていただきました。ありがとうございます！ 最後に 最後に改めまして、ブースにお越しいただきありがとうございました！ たいへん多くの方にお越しいただきました。 SRE NEXTの運営の方々も素晴らしいイベントありがとうございました。 スタンプラリーなどの企画のおかげでこれだけ多くの人がブースに訪れてくれたと思います。 来年のSRE NEXTも何かしらの形で関われたらと思います。 また来年のSRE NEXTでお会いしましょう！ We Are Hiring！ KINTOテクノロジーズでは一緒に働く仲間を探しています！ まずは気軽にカジュアル面談からの対応も可能です。少しでも興味のある方は以下のリンクからご応募ください！ https://hrmos.co/pages/kinto-technologies

はじめに こんにちは！KINTO テクノロジーズ クラウドセキュリティGの大高です。 普段は、クラウド環境のガードレールの整備とCSPMや脅威検知を利用した監視と改善活動に取り組んでいます。 現在のセキュリティを取り巻く状況について最新の情報にキャッチアップすべく、 Hardening Designers Conference 2025 に参加しましたので、レポートをお届けします。 Hardening Project とは Hardening Projectは、実践的なサイバーセキュリティスキルの向上を目的とした競技型のイベントです。 プログラムの参加者は脆弱性を抱えたシステムを運用しながら、外部からの攻撃に対して防御・復旧・改善を行い、現場さながらの対応力を養います。 単なる技術力だけでなく、チームワークやドキュメント整備、運用体制の構築など、総合的なインシデント対応力が評価される点が特徴です。 今回参加した、『Hardening Designers Conference 2025』は、10月の競技型イベントに向けて、『Invisible Divide』というテーマをもとにした、ハンズオンとカンファレンスという位置付けのイベントです。 Day1 Hands-on Program ハンズオンでは、『Living off the Land』呼ばれる攻撃手法について体験しました。 Living off the Landとは、攻撃者がシステムに元々備わっている正規ツールや機能を悪用して侵入・操作を行う手法です。例えば、Windows 環境ではPowerShellやWMIなどを使うことで、攻撃を行います。 ポイントは、攻撃者が使用するツールは標準搭載のツールや機能であり、外部から持ち込んだファイルなどを使用しないため、通常のオペレーションとの判別が難しく、セキュリティツールによる検知が困難になるという点です。 攻撃に使われるコマンド例には、かつて私がシステム管理をしていた際にお世話になったコマンドもいくつか含まれていました。 通常の運用の中で使われないツールやコマンドであれば無効化することで対策できるかもしれませんが、頻繁に使用し簡単に無効化できないものであれば、ログを取得して監視するなどしかないのかもしれません。 サーバー攻撃が高度化し、攻撃操作と正規のオペレーションの境界が非常にわかりにくくなっていることを実感したワークショップでした。 Day2・3 Conference Program 2・3日目は、様々なLTやセッションを通して、サイバーセキュリティの文脈における『分断』について、最新技術の共有や取り組みの紹介、トークセッションが行われました。 セキュリティの現場では、さまざまなステークホルダー間に「分断」が存在し、それがHardening（セキュリティ堅牢化）を阻む障害となることがあります。例えば、実際の現場では以下のような分断が発生しています。 開発・運用・セキュリティ担当者間の分断 機能の実装や運用の効率性を重視するあまり、セキュリティが後回しにされることがあります。例えば、パスワード管理やアカウント制御が適切に行われず、脆弱性が生まれることがあります。これを防ぐには、セキュリティを「制約」ではなく「品質の一部」として捉え、開発初期からセキュリティ要件を組み込むセキュリティバイデザインやシフトレフトの取り組みが重要になってきます。 システム利用者とシステム開発者・運用者の分断 システムの利用者は使いやすさを求める一方で、セキュリティの重要性を理解していないことがあり、技術者はシステムへの機能要求とセキュリティの実装の間で板挟みになることがあります。このギャップを埋めるために、ユーザーへの教育とシステムの構築・運用の際に利用者との丁寧なコミュニケーションを図り理解を求める姿勢が必要になります。 ルール策定者と実行者の分断 ルール策定者（セキュリティ担当者）は公的機関や専門機関が公表している様々なガイドラインを参考に理想的なベースラインやルールを定めますが、現場（システム開発・運用担当者）ではシステム上の制約や運用負荷によりベースラインに忠実な実装が困難な場合があります。実際に適用するには、制約や運用負荷を考慮した上で、適切にセキュリティを実装できるように柔軟な対応を行うことが重要です。 攻撃者と防衛者の分断 攻撃者が技術革新と連携によって高度な攻撃を仕掛ける一方、防衛者はコストや関係者の理解不足によりセキュリティ対策が後手に回ることがあります。サイバーセキュリティ被害にあった企業は情報開示をためらい、同様の被害を防ぐための知見が共有されないこともしばしばです。防衛側も情報共有や連携を強化したいところですが、なかなか思うように進まない状況があります。 AIと人間の分断 AIを使用したプログラムコードの生成や生成AIを用いたSOC業務の高度化など、ITの現場では生成AI活用の取り組みが広がっていますが、生成AIは明確な指示がなければセキュリティを考慮することができない場合が多いというのが現状のようです。生成AIの発展は目覚ましいですが、まだ人間とAIの間には、能力に差があるようです。AIを適切に活用するには、プロンプト設計やガードレールの導入など、人間側の工夫がまだまだ不可欠です。 改めて考えると、実に多くの『分断』が存在していることがわかります。 セキュリティについて、こういった切り口から考えたことはなかったため、非常に参考になりました。 『分断』を乗り越えるKINTOテクノロジーズの取り組み 私たちクラウドセキュリティGでは、「ビジネスのためのセキュリティ」を基本方針とし、セキュリティがビジネスの足かせになるのではなく、ビジネスを加速させる存在であるべきだと考えています。 セキュリティ対策は以下の2つの側面から実施しています 予防的ガードレール：アカウントのセキュリティプリセット環境（開発チームに提供する前に最低限必要なセキュリティ設定を事前に実装したアカウント）を提供し、初期段階から安全な設計を支援。 発見的ガードレール：Sysdig、AWS Security Hub、Amazon GuardDutyなどを活用したSOC監視により、リアルタイムでの脅威検知と対応および定期的なPosture管理による、問題のある設定のカイゼン活動を実施。 これらのセキュリティ対策・運用を通して、自社のセキュリティガイドラインを遵守しつつ、開発者が必要なセキュリティを担保された環境かつ自由に安心して開発に集中できる環境を整備する取り組みを進めています。これは、ルール策定者と実行者の分断及び開発・運用・セキュリティ担当者間の分断を乗り越えるための取り組みといえます。 また、AIセキュリティについても少しずつ取り組みを開始しています。（具体的な取り組みについては こちら ）しかし、技術の進化やトレンドの変化が非常に速く、現状では少々後手に回っている印象です。社内においても生成AIの業務利用やプロダクトへの実装は活発に進んでおり、どのようにコントロールを実装し、AIとの分断を乗り越えていくのかが今後のチャレンジとなります。 さらに、IPAが公開している「家づくりで理解する要求明確化の勘どころ」を参考に、KINTOテクノロジーズのシステム開発プロジェクトにおける心構えを見直す取り組みを進めています。これは、システム構築に限らず、セキュリティの観点からも、システム利用者と技術者の間にある分断を意識し、より良い関係性と成果を生み出すための取り組みといえます。IPAの家づくりについては、 こちら を参照ください。 まとめ Hardening Designers Conference 2025を通して、普段自分自身が意識したことのない『分断』という観点から、さまざまなセキュリティの動向を学ぶことができ、有意義な時間となりました。また、自分の組織のセキュリティを『分断』という観点から確認してみることで、今の取り組みについて再確認することができました。 これからも、より良いセキュリティを実現すべく『分断』を乗り越えていく取り組みを継続・改善していきたいと思いました。 さいごに 私の所属するクラウドセキュリティ グループでは、一緒に働いてくれる仲間を募集しています。クラウドセキュリティの実務経験がある方も、経験はないけれど興味がある方も大歓迎です。お気軽にお問い合わせください。 詳しくは、 こちらをご確認ください。

Our Osaka office "Osaka Tech Lab" moved in July. ( Check out the new office here ) The goal for this office was to accelerate innovation, new things, and experimentation and create products from the Osaka Tech Lab. A grassroots movement started to gather people who resonated with this goal—kind of a "follow me!" vibe—and get them involved. That's when the request came to me in the Creative Office at our Tokyo office. I wanted to realize the ambitions of the Osaka office members from a creative perspective! I wanted to be part of making this happen! So I decided to join in and make every effort to contribute to them although my power may be insufficient. (Doing what you want to do—that flexibility is pretty appealing, isn't it?) First, to visualize what the new office should be like as it comes to life, we decided to create a concept and develop a story that would connect to the office's interior design and recruitment promotions. The project title is "Osaka Tech Lab 2.0 STORY." Osaka Tech Lab 2.0 STORY: the Journey towards Our Goal I interviewed the CEO and vice president about a story of what they aim to achieve in the future, starting with the reasons behind the company's decision to establish an office in Osaka. Following the interview, I thought the key part of this new office project's concept would be what we should do to achieve our ideal vision and what kind of place we create. Based on this core idea, we created a slogan (concept words) in simple terms that anyone in the company could understand, to get all members on the same page. By the time this part came up, we were already communicating weekly with the Osaka members and the Tokyo-based production team. This fostered the following mindset: "Let's have a breakthrough!" It was a fun and lively meeting where we could freely discuss what are in our minds, and sometimes a casually spoken word would be adopted as is. (Thanks to the project manager who encouraged us to have fun discussions on this.) And Here Is the Concept Words That We Created: *At the concept planning stage, it was written as "Co-LAB", but we decided to spell "CO-LAB" using all capitals as "CO" contains a broader meaning, rather than an abbreviation for Company. *We played with the words in our slogan. Shown in the above image, the "GO" in "Shu-GO" (to gather) is a pun on "Let's go!" to add a sense of action. Similarly, "SHIN" in "Has-SHIN" (to transmit) is meant to evoke several positive Japanese words that share the sound. The Osaka office members were so fired up that we decided, to use this as our slogan, unlike stuffy traditional concept. The slogan implies the spirit of sharing opinions and ideas and brings them to life, regardless of the members' roles, including designer, engineer, and manager. The Slogan Is Set! Next Up: Wall Design for the Space Where People Gather The Osaka office has a space called Junction, just like the Muromachi office in Tokyo. It's designed to be a place where people both inside and outside the company gather to spark innovation. For this place, we plan to depict a meaningful graphic measuring about 8,400mm wide by 2,500mm high on a wall. This is the graphic we painted on the wall. As it's something that will remain in the office in a long term, it was a very rewarding project for us as creators. The designers at Osaka Tech Lab collaborated with those in Tokyo, brainstorming ideas to put the finishing touches on the design with generative AI. It's a design packed with our slogan, "Shu-GO! Has-SHIN! CO-LAB," and the spirit of "Let's have a breakthrough!" I'll share some interesting design tricks with you next time! Next time, I would like to share another story about the wall design based on the concept of "Shu-GO! Has-SHIN! CO-LAB" with details about which designers are particular, along with the behind-the-scenes of LP creation.

Introduction Hello. I am K. Ichinose, serving as a Product Manager (PdM) at KINTO Technologies Co., Ltd. (hereafter referred to as KTC). "Isn't PdM's job just coming up with ideas and planning?" Many people might think so. In reality, our daily tasks are diverse, and we communicate with a wide range of people. In this article, I will share a typical day in the life of a PdM at KTC, specifically focusing on my role as the PdM for the KINTO FACTORY. I hope you will find the PdM role fascinating and get a clearer picture of what it’s like to work at KTC. What is the Role of PdM at KTC? Generally, PdM is responsible for determining the direction of the product and leading from planning to development, release, and improvement. At KTC, we handle Mobility Services related products. In this role, I am responsible for the service known as KINTO FACTORY (hereafter FACTORY). FACTORY is an upgrade service that allows you to retrofit TOYOTA and LEXUS genuine options at authorized dealerships. This allows you to add the latest features and parts even after purchase, increasing the value and usability of the vehicle. I am mainly work on the developer-oriented area of the "product management triangle" and act as a bridge between business and developers. I have also recently started data analysis. The figure illustrates the role of PdM in three areas: "Business", "Customers", and "Developers". Specifically, we gather ideas and requests, organize them into requirements, create a development schedule, and drive the project forward through to release. Furthermore, in development projects that span multiple products across KTC, internal coordination and collaboration with other teams are also important tasks. A Day in the Life of a PdM Here, I will introduce an example of my daily schedule. (KTC has a flexible work schedule, but I start work at roughly the same time every day. I'm the type of person who can concentrate better with a regular routine.) Time Daily activities 09:30 Start of workday, check emails I check Slack and emails and organize my tasks for the day. I decide whom to contact and what decisions need to be made each day. 10:00 Morning meeting (Daily Scrum) I share progress and issues with the development team. By sharing even small issues early on, we can prevent larger delays later. 10:30 In-team review We review PRD (Product Requirements Document), DesignDoc, and other specification documents. 11:00 Regular meeting with the business team (Toyota or KINTO) We confirm new feature requirements and specifications related to FACTORY. I also communicate proposals and requests from KTC. 12:00 Lunch break Lunch near the office (the area around the company's location in Muromachi is a bit expensive...). 13:00 Requirement organization and proposal document creation I translate the requirements received during the planning stage into concrete requirements and compile them into a format that can be shared with engineers and designers. 15:00 Feasibility and workload estimation for development projects We coordinate with the lead engineers to confirm the implementation method, issues, and required man-hours. We establish a realistic schedule here. 16:00 Regular meetings for all projects within the company We discuss the progress, issues, and schedule adjustments for projects that span multiple products. 17:00 Data analysis: I analyze usage data to understand user trends. I Look for hints for improvement. As needed Responding to inquiries I handle questions about specifications and design within KTC, operational improvements, test improvements, release adjustments, and more. I also handle new features from KINTO/Toyota and operational consultations, among other things. Why It's Great to Work as a PdM at KTC You can contribute to the future of the mobility industry You can be directly involved in this new challenge to enhance the value of your car . You have the chance to communicate with various stakeholders It is inspiring to interact with different collaborators in both inside and outside the company, Toyota, KINTO and to hear opinions from different perspectives. Team Atmosphere It is easy to express opinions regardless of one's position or age, and discussions are positive. Why it is so rewarding FACTORY is a relatively new service that has not yet gained widespread recognition. As a result, there’s significant room for growth, and being involved in shaping the direction of the service allows you to experience its progress firsthand. There is a great sense of achievement when the feature you've worked on gets released and users actually start signing up. For Those Wanting to Join KTC as a PdM In my opinion, there are three essential qualities required to succeed as a PdM at KTC: Communication skills The ability to build trust with stakeholders and communicate information smoothly. Flexibility The ability to positively embrace change and turn it into improvements. Passion for the product A deep understanding of the product you are responsible for and the ability to be dedicated to it. The third point, in particular, is the source of attention to detail, and improvement ideas. Having passion can also positively impact the motivation of the entire team. Conclusion Being a PdM at KTC is a rewarding job in the rapidly changing mobility sector, where you can help develop new services into better forms. I hope this article inspires you to explore the role of a PdM! If you're interested, I hope you will join us to work together at KTC to create the mobility of the future!

FACTORY development team is kicking off a writing festival 🎉 I'm Mizuno from the KINTO FACTORY development group. Hello to those meeting me for the first time—and to those who already know me. My name is Mizuno and I am the group manager of the KINTO FACTORY development group. I usually work as the group manager for the KINTO FACTORY development group, and also take on other product management and progress management roles. Lately, I've been into growing vegetables in my garden. What is the KINTO FACTORY Development Group? The KINTO FACTORY Development Group is a team formed to launch and continuously improve the KINTO FACTORY e-commerce site . The upgrade business for genuine manufacturer parts for Toyota, Lexus, and GR vehicles, which started as a proof of concept about three years ago, was moved into full production two years ago through in-house development and a complete site renewal. Since then, we have continued to add products and improve our e-commerce site. Currently, we operate as follows: Number of members: 12 (as of August 2025) Main roles: Product manager, web director, frontend engineer, backend engineer, QA engineer Team atmosphere: Open and flexible. If something sparks our interest, we dive in. We work together to fulfill requests. Product Introduction KINTO FACTORY is a service that allows you to "evolve" your vehicles after purchase. You can update your vehicles. What's more, you can enjoy a customization experience by applying online and receiving a PDF certificate that verifies your vehicle upgrade. Since the service name includes KINTO, it's easy to mistakenly think that this only applies to KINTO vehicles, but it actually applies to any TOYOTA or LEXUS vehicle you own. There are three main service categories: Upgrades : Add safety features and comfort functions after purchase. For example, "smooth braking" and "parking support brake." Modification : Refresh the interior and exterior. Replacing the seats and steering wheel will give you a new feel. Personalization : Use driving data to tailor your car to better suit your individual style and needs. From a technical point of view, it should be quite interesting as it runs on a microservice architecture on AWS behind the scenes, and the upgrade certificates (limited to products for which upgrades have been carried out) are issued digitally. If you're curious to know what kind of engineers are behind the system, be sure to check out the interviews below and our upcoming blog posts! Frontend Engineer Interview Backend Engineer Interview The writing festival begins ✍️🔥 Now, we've come to the main topic of this post. It's short. The KINTO FACTORY development group has decided to hold the summer tech blog writing festival from August through September! Explain what KINTO FACTORY is. Share technical knowledge. Communicate the team atmosphere. Increase contact with various people. Increase the number of team members who share the same goals. We will start by letting people know about the team members behind KINTO FACTORY through this tech blog. Each member will write about their role and daily experiences. Some members have already posted on the blog, so be sure to check them out! All of us in the KINTO FACTORY Development Group hope you enjoy our articles.

Introduction Hello. Thank you for reading this article! My name is Nakamoto, and I work on developing the frontend for KINTO FACTORY (hereafter FACTORY), a service that enables users to upgrade their current vehicles. This time, I would like to introduce a case where we improved page performance (CWV) by utilizing Kaizen DAY that was implemented in the FACTORY Development Group and the internal frontend study sessions Kaizen DAY and Frontend Study Sessions Kaizen DAY In the FACTORY Development Group, we made it a practice to ticket technical debts and non-urgent tasks noticed during project development, keeping them in the backlog so they wouldn’t be forgotten. As this practice went on, daily project development rarely paused, causing the improvement tasks to accumulate in the backlog, eventually pushing the total number of tickets to over 100. As a result, during Scrum retrospectives, concerns were raised about leaving those improvement tasks unattended. So, as a team, we launched an initiative to dedicate one afternoon each week solely to addressing them, blocking that time in Outlook to prevent meetings from other departments. This time, we decided to use Kaizen Day to focus on improving page performance that we hadn’t been able to tackle until now, which is measured using CWV (Core Web Vitals) scores. Frontend Study Sessions Additionally, we hold a weekly volunteer-led frontend study session where participants choose the topics. These include watching past event presentations together to share insights, reviewing baselines from past to present, exchanging frontend techniques, and sharing practical knowledge about actual development products and processes. I began considering how the outcomes of our study sessions could be applied to actual services, and proposed 'FACTORY performance improvement' as a potential topic. All members coordinated their schedules to review the FACTORY page together, conducting two live verification sessions. We worked on the following. Checked the current scores using the browser's Lighthouse (setting network and CPU throttling as appropriate) Reviewed improvement proposals for each score Blocked analysis tags and other elements unrelated to page rendering to check performance differences Checked more detailed browser behavior with a performance tab. Checked layout shifts from captured images Through these actions, we were able to clarify how to use the verification tools provided by the browser and identify where the improvement points are. :::message For more details about the frontend study session, please also check this article ! ::: Score Improvement From here, I will introduce how we progressed with score improvement by utilizing the insights gained from the study sessions. Core Web Vitals (CWV) are indicators for measuring page performance, which can be classified into the following three metrics. Largest Contentful Paint (LCP): Measures how quickly the main content of the page loads Interaction To Next Paint (INP): Evaluates the responsiveness of the page to user interactions Cumulative Layout Shift (CLS): Measures the visual stability of the page Due to the nature of FACTORY's services, there are strict constraints on product and vehicle images (due to strict color specifications, etc.), making it difficult to change static content (such as image compression), so we first focused on CLS, which can be improved just by changing the content layout on the page. Referencing Google Search Console, checked which pages had poor CLS scores Created static pages using SSG to eliminate loading screens during API access on the client side Looked for areas where height shifts before and after loading content such as images In practice, we examined pages with poor CLS scores using the browser’s Performance tab, and systematically addressed each area causing layout shifts while reviewing the screen captures. Among them, the CLS occurring on the TOP page took a particularly long time to identify. Even when viewed with an analysis tool as shown below, it was not immediately clear where the layout shifts were occurring. However, upon checking the relevant images, I noticed that contain-intrinsic-size was defined in CSS. It seems that this property is relatively new, and in unsupported browsers, the image size is not set correctly, causing layout shifts. Instead, by changing the fixed image size to aspect-ratio and setting the aspect ratio, we were able to eliminate layout shifts. Results This time, I would like to reflect on both the efforts made on Kaizen DAY and the actual CWV scores. Ticket Resolution on Kaizen DAY The following charts show the number of resolved tickets on the board summarizing the improvement tickets. Around April, we introduced the ' Kaizen DAY' system, with the red line in the graph indicating tickets added during the period (one month) and the green line indicating completed tickets. April ticket resolution June ticket resolution The above results are for the entire team, and it can be seen that the completion of improvement tasks is steadily increasing. Recently, the company has been actively incorporating AI into development. Many of these improvement tasks are straightforward but involve frequent context switching, making them cumbersome for humans to handle and therefore well-suited for delegation to AI. Given this aspect, it can be understood that despite ongoing development of feature additions and other projects, there is a solid commitment to the improvement activities as mentioned above. CWV Scores Now, let's reflect on how the CWV scores, which are the theme of this discussion, have improved before and after the improvement activities. PCスコア モバイルスコア The graphs above show the changes in performance scores for individual URLs, which can be checked in Google Search Console. For both PC and mobile, the number of good URLs (green) has increased, and the number of bad URLs (red) has decreased or dropped to zero , leading to performance improvements on the majority of pages. There are still some URLs that need improvement (yellow), but these do not seem to be solely the result of the CLS scores addressed this time. We plan to work on improving those other metrics in the future. Summary This time, I presented a case in which we improved the page scores (CWV) of FACTORY by using Kaizen DAY implemented in the FACTORY development group and internal frontend study sessions . In our day-to-day project work, deadlines and other constraints often lead us to postpone addressing technical debt. However, I intend to continue making use of Kaizen DAY to prevent such debt from accumulating. Through internal study sessions, I can gain valuable insights and improvement ideas from other products and services under development. By applying these ideas effectively, I hope to continuously improve and ensure the stable operation of FACTORY’s services.

初めに こんにちは！ KINTO テクノロジーズ、AI ファーストグループの nicepear と AlexQ です！ AI ファーストグループは、生成 AI の活用推進、ユースケース開発、技術調査、PoC、教育研修など幅広く活動している横串組織です。 今回我々は、AWS Bedrock AgentCore のエージェントを AWS のマネジメントコンソール経由でデプロイしてみたので、その経験を共有できればと思います。 AWS Bedrock AgentCore とは AWS Bedrock AgentCore は、企業が AI エージェントを本格的に開発し、安全かつ大規模に運用するために AWS が提供する新しい基盤サービスです。 公式 によりますと主な要素は以下です： AgentCore Runtime – セッション分離を備え、サンドボックス化された低レイテンシーのサーバーレス環境を提供し、人気のオープンソースフレームワーク、ツール、モデルを含むあらゆるエージェントフレームワークをサポートし、マルチモーダルワークロードと長時間実行エージェントを処理します。 AgentCore Memory – セッションと長期メモリを管理し、エージェントが過去のインタラクションから学習するのをサポートしつつ、モデルに関連コンテキストを提供します。 AgentCore Observability – メタデータのタグ付け、カスタムスコアリング、軌跡の検査、トラブルシューティング/デバッグフィルターを使用して、エージェント実行のステップバイステップのビジュアライゼーションを提供します。 AgentCore Identity – AI エージェントが、ユーザーに代わって、または事前に認可されたユーザーの同意を得てエージェント自身によって、AWS サービス、および GitHub、Salesforce、Slack などのサードパーティーツールやサービスに安全にアクセスできるようにします。 AgentCore Gateway – 既存の API と AWS Lambda 関数をエージェント対応ツールに変換し、MCP などのプロトコルやランタイム検出にわたる統合アクセスを提供します。 AgentCore Browser – エージェントのウェブオートメーションワークフローをスケールするためのマネージドウェブブラウザインスタンスを提供します。 AgentCore Code Interpreter – エージェントが生成したコードを実行するための独立した環境を提供します。 AWS AgentCore Runtime にエージェントをデプロイする方法 AWS AgentCore でのAIエージェントのデプロイメントについて、公式では以下の bedrock-agentcore-starter-toolkit というライブラリを使用するアプローチが紹介されています： https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-getting-started-toolkit.html また、 bedrock-agentcore-starter-toolkit を使わない方法として、boto3 API を使う方法も公式で取り上げられています。 https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/getting-started-custom.html 今回は、公式ドキュメントに記載されていない マネジメントコンソールでの手動デプロイメント を試してみたので、その経験と注意点をご紹介したいと思います。 マネジメントコンソールでのデプロイ手順 大きな手順は以下です： エージェントのソースコードを用意する Docker ファイルを作成する マネジメントコンソールで ECR リポジトリを作成する Docker で ARM64 image を作成し ECR リポジトリにデプロイする AgentCore のマネジメントコンソールでエージェント新規作成する エージェントのソースコードを用意する 今回は公式の Strand Agents を使用してエージェントを構築しました。 また、デプロイ手順をテストするのが目的なため、比較的シンプルな構成にしております。 agentcore.py import os from strands import Agent, tool from strands_tools import calculator from strands.models.litellm import LiteLLMModel from bedrock_agentcore.runtime import BedrockAgentCoreApp app = BedrockAgentCoreApp() os.environ["OPENAI_API_KEY"] = "YOUR_API_KEY" @tool def get_tenki(): """ 天気を調べるためのツール """ return "晴れです。" model = "gpt-4.1" model = LiteLLMModel( model_id=model ) agent = Agent( model=model, tools=[calculator, get_tenki], system_prompt="あなたは賢いエージェントです。ユーザーの指示に応じて、数字の計算を行い、あるいは天気を調べてあげてください。" ) @app.entrypoint def revoke_agent(payload): user_input = payload.get("prompt") response = agent(user_input) print(response.message['content'][0]['text']) return response.message['content'][0]['text'] if __name__ == "__main__": app.run() なお、ディレクトリ構造は以下のようにしております。 AWS-AGENTCORE/ ├── agentcore.py ├── Dockerfile ├── requirements.txt Docker ファイルを作成する 以下のように Docker ファイルを用意しました。 FROM python:3.12-slim WORKDIR /app COPY requirements.txt /app # Install dependencies RUN pip install --no-cache-dir -r requirements.txt # Copy agent file COPY agentcore.py /app ENTRYPOINT ["python", "/app/agentcore.py"] マネジメントコンソールで ECR リポジトリを作成する リポジトリ作成は通常の手順と特に変わりません。 まずはAWS マネジメントコンソールにログインし、ECR にアクセスします。 そして右上の「リポジトリ作成」をクリックします。  リポジトリ名を入力し右下の「作成」をクリックします。  作成が完了したら、リポジトリ一覧で確認できます。  Docker で ARM64 image を作成し ECR リポジトリにデプロイする 基本 ECR リポジトリで表示されるプッシュコマンド順で進めていきます。 プッシュコマンドはここで見つかります：   まずは AWS CLI で、ECR にログインします： aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin account-id.dkr.ecr.us-west-2.amazonaws.com 次に Docker イメージを構築します。ここで、プッシュコマンドの書いた通りに構築するとあとでAgentCoreエージェントを作成する際にエラーになりました。 どうやら原因は、ARM64のDockerコンテナを用意する必要があるところみたいですね。 # エラーを起こしたコマンド docker build -t agentcore/techblog . 公式 でもARM64を使うと書いてありましたね。 Build the image locally for testing: docker buildx build --platform linux/arm64 -t my-agent:arm64 --load . なので、改めて以下のコマンドでイメージを構築しました。 docker build --platform linux/arm64 -t agentcore/techblog . 構築が完了したら、イメージにタグを付けます。 docker tag agentcore/techblog:latest account-id.dkr.ecr.us-east-1.amazonaws.com/agentcore/techblog:latest 最後に、以下のコマンドを実行して、先ほど作成した ECR リポジトリにこのイメージをプッシュします。 docker push account-id.dkr.ecr.us-east-1.amazonaws.com/agentcore/techblog:latest AgentCore のマネジメントコンソールでエージェント新規作成する 最後に、Bedrock AgentCore のマネジメントコンソールにアクセスします。  Agent Runtime に入っていきます。  右上の「Host Agent」をクリックします。  必要な情報を記入していきます。 Name は「agentcore_techblog」にしました。（※ -（ハイフン）も使えると書いてありますが実際使うとエラーになりました。ここにバグがあるかと思います。） Docker image は先ほどプッシュしたやつを選びます。 IAM ロールは、既存のものがあればそれを使えます。なければここで新規作成できるので、今回は新規作成でいきます。  ここでまたエラーになりました。  どうやら、ここで新規作成した IAM ロールの権限が正しく設定されていなかったようです。 IAM で確認しましょう。 先ほど作成した ECR リポジトリが「../agentcore/techblog」に対して、自動で作成された IAM ロールのアクセスできるリソースは「../techblog」になっていますね... これもバグではないかと。  手動で「../agentcore/techblog」に直しましょう。  これで、AgentCore Runtime を無事作成できました。  AgentCore Runtime のエージェントと会話してみる デプロイしたエージェントと会話してみましょう。 公式でもサンプルコードを提供しているので、早速それを使ってみます。 質問内容に関して、今回構築したエージェントはツールを使って天気を調べることができるとなっているので今日の天気について聞いてみましょう。 input_text = "今日の天気は？" response = client.invoke_agent_runtime( agentRuntimeArn="YOUR_AGENT_RUNTIME_ARN", qualifier="<Endpoint Name>", payload=input_text ) うまく返事が返ってきました。  おわりに 今回は、AWS Bedrock AgentCore を使って AI エージェントをマネジメントコンソール経由でデプロイする手順をご紹介しました。 公式ドキュメントでは主に bedrock-agentcore-starter-toolkit や boto3 API を使用したデプロイ方法が紹介されていますが、マネジメントコンソールを使った手動デプロイも可能であることを確認できました。ただし、いくつかの注意点がありました： Docker イメージは必ず ARM64 アーキテクチャで構築する必要がある エージェント名にハイフン（-）を使用するとエラーが発生する可能性がある IAM ロールの自動作成時に ECR リポジトリのリソースパスが正しく設定されない場合がある これらの点に注意すれば、マネジメントコンソールを使ったデプロイも十分可能です。特に、GUI での操作に慣れている方や、小規模な PoC での利用には便利な選択肢となるでしょう。 AWS Bedrock AgentCore は、企業での AI エージェント運用を考える上で非常に待ちかねたサービスです。今後も様々な活用パターンを検証し、知見を共有していきたいと思います。 最後まで読んでいただき、ありがとうございました！

📱 Appium Meetup Tokyo #2 is On the Way! Our Popular Mobile Test Automation Event is Back, and It's Better Than Ever! This is Nakanishi from the Developer Relations Group. The second Appium Meetup Tokyo, following the excitement of the first event, will be held at KINTO Technologies' Muromachi Office on Wednesday, May 28, 2025. The previous session featured practical Appium use cases and dramatic performance improvements, which were very well received by many attendees. 🎯 Highlights of This Event In this event, engineers working on the front lines will share practical know-how and the latest techniques to take mobile app E2E testing and automation to the next level. Tips and practices for cause investigating Appium test failures (Masayuki Wakizaka, MagicPod Inc.) Learn concrete debugging techniques to quickly pinpoint and fix failures in mobile E2E testing! This session will walk through practical examples using Appium Inspector and cover troubleshooting with WebDriverAgent. Initiatives for building a VRT environment for mobile apps (Hidenori Takahashi, Casio Computer Co., Ltd.) Introducing an example of automating visual regression testing (VRT) using Appium in the Flutter app CASIO WATCHES! We'll dive into hands-on approaches for solving issues and boosting efficiency in a Scrum development environment. Goodbye, manual link checks! Fully Automating URL Checks in Native Apps with Appium (Fumiya Oka, Pann Nu Wai, KINTO Technologies) While automating link checks is easy on the web, it's long been considered difficult to achieve in native apps due to technical constraints. We'll share detailed know-how and clever tricks to fully automate link verification in native apps using Appium, overcoming technical roadblocks. A little trick for smooth, stable scrolling with Appium (Taiju Muto, Autify) Get bite-sized techniques that can be used immediately in practice! This session will showcase a few small tweaks that brings big improvements. 🕒 Time Schedule Time Session Contents 18:30 Doors open 19:00 Event starts 19:05 Tips and practices for investigating appium test failures 19:45 Initiatives for building a VRT environment for mobile apps 20:05 Break 20:15 Goodbye manual link checks! Fully automating URL checks in native apps with appium 20:35 A little trick for smooth, stable scrolling with Appium 20:55 Social gathering (on-site only) 21:30 Wrap-up & venue close 🏢 Event Outline Date and time : May 28, 2025 (Wed), 19:00-21:30 (Doors open at 18:30) Venue : KINTO Technologies Muromachi Office (16th floor, Muromachi Furukawa Mitsui Building, 2-3-1 Nihonbashi Muromachi, Chuo-ku, Tokyo) Participation fee : Free Capacity: 20 on-site participants, 50 online participants (Zoom webinar) 🌟 How to Apply If you'd like to join, please sign up early via the event page . Register soon! 💬Recommended Especially for... Those who want to take mobile app test automation to the next level. Anyone interested in adopting or using Appium and learning from real success stories. People looking to learn the latest automation tech and seriously lighten the burden of QA workload. 🚀 Let's Create the Future of Mobile Testing Together! In our last post-event survey, participants showed strong interest in hands-on Appium tips and techniques, and the community interaction was buzzing. This time too, we're bringing even more solid content along with fresh opportunities to connect. We're looking forward to meeting you all! For Those Considering Participating Those who want to fully implement automated testing for mobile apps Those who are interested in Appium and seeking specific examples or know-how Engineers and QA personnel interested in CI/CD-based operations Those who want to improve their testing culture by learning from other companies' experiences If any of the above applies to you, we'd love to have you join us at Appium Meetup Tokyo to exchange the latest insights. Future announcements and detailed information will be provided by @AutifyJapan and @KintoTech_Dev . If you have any questions or suggestions, feel free to reach out. I'm looking forward to seeing you at Appium Meetup Tokyo!