Chatbot? Security?

Minimum

• Experiences

  • ISDA ~ 3 years

  • DevOps Engineer / SRE ~ 4 years

  • Software Engineer  ~ 3 years

  • OOBOX Group ~ 1 year

• Abilities

  • Python

  • Container

  • Cloud Services

  • CI / CD / CM

Who Am I?

1. Get Started

2. Own Your SlackBot

https://bit.ly/2Q5TJWi

https://api.slack.com/apps

Temporarily remember this pair of tokens. We will go back.

Take a break

3. Analyze Slackbot

API Gateway

Jenkins

Lambda
Function

/build Hello

4. Security & Management

HTTPS

• Demo also needs https
  • https://api.sharing315.com (AWS providered)
  • https://build.sharing315.com (Let's encrypt)

API Token

• Log in to the server without the need for a password
• Reject arbitrary request
• Unique token is same as identity
• Trace flow, event, and log

Environment Variables

• Account, password, email, key, license, token, certificate, ...
  • Lambda function (protected by AWS KMS)
  • Jenkins job (protected by Credentials plugin)

Source Code

• SCM (Source control management)
  • Git, SVN
• Backup

Configuration

• SCM (Software Configuration Management)
  • Ansible, Chef, Puppet
• Secret Management
  • Vault
  • Keystore
  • Keychain

Network

• Connection
  • VPC, Security Group
  • VPN
  • Firewall, iptables, fail2ban

Role & Permission

• AWS IAM
  • Group, User, Role
• Jenkins Global Security + Plugin
  • Group, User, Role

5. Amazon Lex