bikram-cloud
commented
4 years ago AWS VPC
更新日付：2020-03-26
Structure
【Active Resources】
- VPC
- PRD_IDX_VPC
- Subnet
- PRD_IDX_SUB_PUB_1a
- PRD_IDX_SUB_PUB_1c
- PRD_IDX_SUB_PRI_APP_1a
- PRD_IDX_SUB_PRI_APP_1c
- PRD_IDX_SUB_PRI_APP_1b
- Elastic IP
- PRD_IDX_EIP_BASTION_1a
- PRD_IDX_EIP_NAT_GW_1a
- PRD_IDX_EIP_NAT_GW_1c
- Internet Gateway
- PRD_IDX_INTERNET_GW
- Nat Gateway
- PRD_IDX_NAT_GW_01_1a
- PRD_IDX_NAT_GW_01_1c
- Route
- PRD_IDX_ROUTE_IGW
- PRD_IDX_ROUTE_PRI_APP_1a
- PRD_IDX_ROUTE_PRI_APP_1c
- Network ACL
- PRD_IDX_NETWORK_ACL
- Security Group
- PRD_IDX_PUB_SEC_BASTION
- PRD_IDX_PUB_SEC
- PRD_IDX_PRI_SEC_WEBAPP
- PRD_IDX_PUB_SEC_ELB
- PRD_IDX_SEC_PRI_WEBAPP_1b
- Load Balancer
- PRD-IDX-ALB-PUB
- Load Balancer Target Group
- PRD-IDX-ALB-TRG-PUB
- EC2 Instance
- prd_idk_bastion_1a
- prd_idx_pri_webapp_1a
- prd_idx_pri_webapp_1c
- prd_idx_pri_webapp_1b
- Route53
- Domain: idx.ols.aws.kddi.com
- Certificate Manager
- PRD_IDX_CER_VG (US EAST(N.Virginia) Region)
- CloudFront
- Distribution ID: E3OZG6GEFSTFX5
- S3 Bucket
- PRD_IDX_BUCKET
- WAF
- Web ACL
- CloudFront: PRD_IDX_WEB_ACL
- ALB: PRD_IDX_ALB_ACL
- SQS
- PRD_IDX_SQS.fifo
- DynamoDB
- PRD_IDX_DB
【不要なResources】
- DynamoDB
- PRD_IDX_FAILURE_DB
【Inter-connected Resources】
- Route 53: Domain: idx.ols.aws.kddi.com
- SSL: PRD_IDX_CER_VG
- CloudFront: Distribution ID: E3OZG6GEFSTFX5
- PRD-IDX-ALB-PUB
- PRD_IDX_BUCKET
- PRD-IDX-ALB-PUB
- PRD_IDX_PUB_SEC_ELB
- PRD-IDX-ALB-TRG-PUB
- prd_idx_pri_webapp_1a
- prd_idx_pri_webapp_1c
- PRD_IDX_PUB_SEC_BASTION
- prd_idk_bastion_1a
- PRD_IDX_PUB_SEC
- PRD_IDX_NAT_GW_01_1a
- prd_idx_pri_webapp_1a
- PRD_IDX_NAT_GW_01_1c
- prd_idx_pri_webapp_1c
- PRD_IDX_PRI_SEC_WEBAPP
- prd_idx_pri_webapp_1a
- prd_idx_pri_webapp_1c
- PRD_IDX_SQS.fifo
- prd_idx_pri_webapp_1a
【Current Sturcture】
【Security】
- AIM Role
- アクセス制限
- MFA
- Network ACL
- Inbound: All Traffic
- Outbound: All Traffic
- CloudFront Web ACL
- AWS-AWSManagedRulesAdminProtectionRuleSet
- AWS-AWSManagedRulesAmazonIpReputationList
- AWS-AWSManagedRulesKnownBadInputsRuleSet
- AWS-AWSManagedRulesCommonRuleSet
- AWS-AWSManagedRulesLinuxRuleSet
- AWS-AWSManagedRulesSQLiRuleSet
- ALB Web ACL
- AWS-AWSManagedRulesAdminProtectionRuleSet
- AWS-AWSManagedRulesAmazonIpReputationList
- AWS-AWSManagedRulesKnownBadInputsRuleSet
- AWS-AWSManagedRulesCommonRuleSet
- AWS-AWSManagedRulesLinuxRuleSet
- AWS-AWSManagedRulesSQLiRuleSet
- Security Group
- PRD_IDX_PUB_SEC_BASTION
- Inboud: SSH, Local IP
- Outbound: All Traffic
- PRD_IDX_PUB_SEC
- Inbound: All Traffic: PRD_IDX_PUB_SEC_ELB
- Outbound: All Traffic
- PRD_IDX_PRI_SEC_WEBAPP
- Inbound: SSH: PRD_IDX_PUB_SEC_BASTION, All Traffic: PRD_IDX_PRI_SEC_WEBAPP, PRD_IDX_PUB_SEC_ELB
- Outbound: All Traffic
- PRD_IDX_PUB_SEC_ELB
- Inbound: HTTP/HTTPS: VPC内
- Outbound: All Traffic
- PRD_IDX_SEC_PRI_WEBAPP_1b
- prd_idk_pri_webapp_1b_ubuntu
Extra Security Options:
- AWS Config
- 「Resources」と「Resources」の更新履歴がS3Bucketでログサービス
- VPC Flow Logs
- VPC内のIPトラフィックのログ機能
- CloudWatch Alarms
- Set changes for any Policy changes in key services for example S3, SG, ACL, etc
Security Compliance: https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf VPC Flow Logs: https://dev.classmethod.jp/cloud/aws/introduce-to-vpc-flow-log/
AWS VPC
Structure
【Active Resources】
【不要なResources】
【Inter-connected Resources】
【Current Sturcture】
【Security】
Extra Security Options:
Security Compliance: https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf VPC Flow Logs: https://dev.classmethod.jp/cloud/aws/introduce-to-vpc-flow-log/
【Trusted Advisor】
【To be added】