firebirdテクテクテクブログ

1
2
3
4
5
6
7
8

❌ 従来の手動運用                 ✅ 自動化された運用
┌─────────────────────────┐    ┌─────────────────────────┐
│ • 手動パッチ適用         │    │ • 自動化されたパッチ管理 │
│ • 個別サーバー設定       │    │ • コードベース設定管理   │
│ • リアクティブ監視       │    │ • プロアクティブ監視     │
│ • 属人的な運用知識       │    │ • 標準化された手順書     │
│ • 環境依存の設定差分     │    │ • 環境横断一貫性         │
└─────────────────────────┘    └─────────────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│  Code & Config  │    │   Automation    │    │   Operations    │
├─────────────────┤    ├─────────────────┤    ├─────────────────┤
│ • Git Repository│───▶│ • CI/CD Pipeline│───▶│ • Monitoring    │
│ • Terraform IaC │    │ • Packer Images │    │ • Alerting      │
│ • PowerShell    │    │ • Secret Mgmt   │    │ • Log Analysis  │
│ • Policy as Code│    │ • Auto Scaling  │    │ • Maintenance   │
└─────────────────┘    └─────────────────┘    └─────────────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │   Compliance    │
                    │   & Security    │
                    └─────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

# terraform/patch-management.tf
resource "google_compute_instance_group_manager" "windows_group" {
  name = "windows-server-group"
  zone = var.zone

  version {
    instance_template = google_compute_instance_template.windows_template.id
  }

  base_instance_name = "windows-server"
  target_size        = var.instance_count

  # ローリングアップデート設定
  update_policy {
    type                         = "PROACTIVE"
    instance_redistribution_type = "PROACTIVE"
    minimal_action              = "REPLACE"
    max_surge_fixed            = 1
    max_unavailable_fixed      = 0
    min_ready_sec              = 300
  }

  # 自動修復
  auto_healing_policies {
    health_check      = google_compute_health_check.windows_health.id
    initial_delay_sec = 600
  }
}

# パッチ管理用のOSポリシー
resource "google_os_config_os_policy_assignment" "windows_patch_policy" {
  name     = "windows-patch-policy"
  location = var.zone

  os_policies {
    id          = "windows-security-patches"
    description = "Automatic security patch installation"
    mode        = "ENFORCEMENT"

    resource_groups {
      os_filter {
        os_short_name = "windows"
      }

      resources {
        id = "install-security-updates"
        
        exec {
          validate {
            interpreter = "POWERSHELL"
            script      = <<-EOF
              $Updates = Get-WUList -Category "Security Updates"
              if ($Updates.Count -gt 0) { exit 100 } else { exit 101 }
            EOF
          }

          enforce {
            interpreter = "POWERSHELL"
            script      = <<-EOF
              Import-Module PSWindowsUpdate
              Get-WUInstall -Category "Security Updates" -AcceptAll -AutoReboot
            EOF
          }
        }
      }
    }
  }

  rollout {
    disruption_budget {
      percent = 10
    }
    min_wait_duration = "300s"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

# scripts/dynamic-resource-management.ps1
param(
    [string]$ProjectId,
    [string]$Zone,
    [string]$InstanceGroup,
    [int]$MinInstances = 2,
    [int]$MaxInstances = 10,
    [double]$CpuThreshold = 0.8
)

# CloudMonitoringメトリクスの監視
function Monitor-ResourceUtilization {
    param([string]$InstanceGroup)
    
    $MetricQuery = @"
    fetch gce_instance
    | filter resource.instance_name =~ "$InstanceGroup.*"
    | metric 'compute.googleapis.com/instance/cpu/utilization'
    | group_by 1m, [value_utilization_mean: mean(value.utilization)]
    | every 1m
"@

    $CurrentUtilization = Invoke-RestMethod -Uri "https://monitoring.googleapis.com/v1/projects/$ProjectId/timeSeries:query" -Headers $Headers -Method POST -Body $MetricQuery
    
    return $CurrentUtilization.timeSeriesData[-1].values[-1].doubleValue
}

# オートスケーリング決定ロジック
function Decide-Scaling {
    param([double]$CurrentUtilization, [int]$CurrentSize)
    
    $ScalingDecision = @{
        Action = "maintain"
        TargetSize = $CurrentSize
        Reason = ""
    }
    
    if ($CurrentUtilization -gt $CpuThreshold -and $CurrentSize -lt $MaxInstances) {
        $ScalingDecision.Action = "scale_up"
        $ScalingDecision.TargetSize = [Math]::Min($CurrentSize + 1, $MaxInstances)
        $ScalingDecision.Reason = "High CPU utilization: $([Math]::Round($CurrentUtilization * 100, 2))%"
    }
    elseif ($CurrentUtilization -lt ($CpuThreshold * 0.5) -and $CurrentSize -gt $MinInstances) {
        $ScalingDecision.Action = "scale_down"
        $ScalingDecision.TargetSize = [Math]::Max($CurrentSize - 1, $MinInstances)
        $ScalingDecision.Reason = "Low CPU utilization: $([Math]::Round($CurrentUtilization * 100, 2))%"
    }
    
    return $ScalingDecision
}

# 実行ロジック
try {
    $CurrentUtilization = Monitor-ResourceUtilization -InstanceGroup $InstanceGroup
    $CurrentSize = (gcloud compute instance-groups managed describe $InstanceGroup --zone=$Zone --format="value(targetSize)") -as [int]
    
    $Decision = Decide-Scaling -CurrentUtilization $CurrentUtilization -CurrentSize $CurrentSize
    
    if ($Decision.Action -ne "maintain") {
        Write-Output "Scaling decision: $($Decision.Action) to $($Decision.TargetSize) instances. Reason: $($Decision.Reason)"
        
        gcloud compute instance-groups managed resize $InstanceGroup --size=$($Decision.TargetSize) --zone=$Zone
        
        # ログ記録
        $LogEntry = @{
            timestamp = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ")
            action = $Decision.Action
            previous_size = $CurrentSize
            new_size = $Decision.TargetSize
            cpu_utilization = $CurrentUtilization
            reason = $Decision.Reason
        } | ConvertTo-Json
        
        Write-Output $LogEntry | Add-Content -Path "C:\logs\scaling-decisions.log"
    }
    
} catch {
    Write-Error "Scaling operation failed: $($_.Exception.Message)"
    exit 1
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

# terraform/security-monitoring.tf
# セキュリティ イベント ログ の BigQuery エクスポート
resource "google_logging_project_sink" "security_events" {
  name = "windows-security-events"
  
  destination = "bigquery.googleapis.com/projects/${var.project_id}/datasets/${google_bigquery_dataset.security_logs.dataset_id}"
  
  filter = <<-EOT
    resource.type="gce_instance"
    jsonPayload.SourceName="Microsoft-Windows-Security-Auditing"
    (jsonPayload.EventID=4624 OR jsonPayload.EventID=4625 OR jsonPayload.EventID=4648)
  EOT

  unique_writer_identity = true
}

# セキュリティ アラート ポリシー
resource "google_monitoring_alert_policy" "failed_login_attempts" {
  display_name = "Windows Failed Login Attempts"
  combiner     = "OR"
  
  conditions {
    display_name = "Failed login threshold exceeded"
    
    condition_threshold {
      filter         = "resource.type=\"gce_instance\" AND jsonPayload.EventID=4625"
      duration       = "300s"
      comparison     = "COMPARISON_GREATER_THAN"
      threshold_value = 5
      
      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
      }
    }
  }
  
  notification_channels = [google_monitoring_notification_channel.email_alerts.name]
  
  alert_strategy {
    auto_close = "1800s"
  }
}

# 自動応答システム（Cloud Function）
resource "google_cloudfunctions_function" "security_responder" {
  name        = "security-incident-responder"
  runtime     = "python39"
  
  available_memory_mb   = 256
  source_archive_bucket = google_storage_bucket.function_source.name
  source_archive_object = google_storage_bucket_object.security_function_source.name
  entry_point          = "handle_security_alert"

  event_trigger {
    event_type = "google.pubsub.topic.publish"
    resource   = google_pubsub_topic.security_alerts.name
  }

  environment_variables = {
    PROJECT_ID = var.project_id
    ALERT_THRESHOLD = "5"
    ISOLATION_TIMEOUT = "3600"
  }
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231

# scripts/compliance-checker.ps1
param(
    [string[]]$ComplianceStandards = @("CIS", "NIST", "SOC2"),
    [string]$ReportPath = "C:\compliance-reports",
    [switch]$AutoRemediate = $false
)

# コンプライアンス チェック 関数
function Test-CISCompliance {
    $Results = @()
    
    # CIS Control 5.1: Account Management
    $LocalUsers = Get-LocalUser | Where-Object {$_.Enabled -eq $true}
    foreach ($User in $LocalUsers) {
        $LastLogon = (Get-LocalUser -Name $User.Name).LastLogon
        if ($LastLogon -lt (Get-Date).AddDays(-90)) {
            $Results += @{
                Control = "CIS-5.1"
                Status = "FAIL"
                Finding = "User '$($User.Name)' has not logged in for >90 days"
                Severity = "MEDIUM"
                Remediation = "Disable or remove inactive user account"
            }
        }
    }
    
    # CIS Control 9.1: Firewall Configuration
    $FirewallStatus = Get-NetFirewallProfile | Select-Object Name, Enabled
    foreach ($Profile in $FirewallStatus) {
        if ($Profile.Enabled -eq $false) {
            $Results += @{
                Control = "CIS-9.1"
                Status = "FAIL"
                Finding = "Firewall profile '$($Profile.Name)' is disabled"
                Severity = "HIGH"
                Remediation = "Enable Windows Firewall for all profiles"
            }
        }
    }
    
    return $Results
}

function Test-NISTCompliance {
    $Results = @()
    
    # NIST AC-2: Account Management
    $PasswordPolicy = Get-LocalSecurityPolicy | Where-Object {$_.KeyName -eq "MinimumPasswordLength"}
    if ([int]$PasswordPolicy.Value -lt 14) {
        $Results += @{
            Control = "NIST-AC-2"
            Status = "FAIL"
            Finding = "Minimum password length is $($PasswordPolicy.Value), should be ≥14"
            Severity = "HIGH"
            Remediation = "Set minimum password length to 14 characters"
        }
    }
    
    # NIST AU-2: Audit Events
    $AuditPolicies = @(
        "Audit Logon Events",
        "Audit Account Management",
        "Audit Privilege Use"
    )
    
    foreach ($Policy in $AuditPolicies) {
        $AuditStatus = auditpol /get /subcategory:"$Policy" | Select-String "Success and Failure"
        if (-not $AuditStatus) {
            $Results += @{
                Control = "NIST-AU-2"
                Status = "FAIL"
                Finding = "Audit policy '$Policy' not configured for Success and Failure"
                Severity = "MEDIUM"
                Remediation = "Configure audit policy for Success and Failure events"
            }
        }
    }
    
    return $Results
}

# 自動修復機能
function Invoke-AutoRemediation {
    param([object[]]$Findings)
    
    foreach ($Finding in $Findings) {
        Write-Output "Attempting auto-remediation for: $($Finding.Control)"
        
        switch ($Finding.Control) {
            "CIS-9.1" {
                try {
                    Set-NetFirewallProfile -All -Enabled True
                    Write-Output "✅ Enabled Windows Firewall for all profiles"
                } catch {
                    Write-Error "❌ Failed to enable firewall: $($_.Exception.Message)"
                }
            }
            
            "NIST-AC-2" {
                try {
                    net accounts /minpwlen:14
                    Write-Output "✅ Set minimum password length to 14"
                } catch {
                    Write-Error "❌ Failed to set password policy: $($_.Exception.Message)"
                }
            }
            
            default {
                Write-Output "⚠️ No auto-remediation available for $($Finding.Control)"
            }
        }
    }
}

# レポート生成
function New-ComplianceReport {
    param([object[]]$AllFindings, [string]$ReportPath)
    
    $ReportData = @{
        GeneratedAt = Get-Date
        ServerName = $env:COMPUTERNAME
        TotalFindings = $AllFindings.Count
        HighSeverity = ($AllFindings | Where-Object {$_.Severity -eq "HIGH"}).Count
        MediumSeverity = ($AllFindings | Where-Object {$_.Severity -eq "MEDIUM"}).Count
        LowSeverity = ($AllFindings | Where-Object {$_.Severity -eq "LOW"}).Count
        Findings = $AllFindings
    }
    
    # JSON レポート
    $JsonReport = $ReportData | ConvertTo-Json -Depth 3
    $JsonPath = Join-Path $ReportPath "compliance-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
    $JsonReport | Set-Content $JsonPath
    
    # HTML レポート
    $HtmlReport = @"
<!DOCTYPE html>
<html>
<head>
    <title>Compliance Report - $($env:COMPUTERNAME)</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .summary { background: #f0f0f0; padding: 15px; border-radius: 5px; }
        .finding { margin: 10px 0; padding: 10px; border-left: 4px solid #ccc; }
        .high { border-left-color: #d32f2f; }
        .medium { border-left-color: #f57c00; }
        .low { border-left-color: #388e3c; }
    </style>
</head>
<body>
    <h1>Compliance Report</h1>
    <div class="summary">
        <h2>Summary</h2>
        <p>Server: $($env:COMPUTERNAME)</p>
        <p>Generated: $(Get-Date)</p>
        <p>Total Findings: $($ReportData.TotalFindings)</p>
        <p>High: $($ReportData.HighSeverity) | Medium: $($ReportData.MediumSeverity) | Low: $($ReportData.LowSeverity)</p>
    </div>
    
    <h2>Findings</h2>
"@

    foreach ($Finding in $AllFindings) {
        $CssClass = $Finding.Severity.ToLower()
        $HtmlReport += @"
    <div class="finding $CssClass">
        <h3>$($Finding.Control) - $($Finding.Status)</h3>
        <p><strong>Finding:</strong> $($Finding.Finding)</p>
        <p><strong>Severity:</strong> $($Finding.Severity)</p>
        <p><strong>Remediation:</strong> $($Finding.Remediation)</p>
    </div>
"@
    }
    
    $HtmlReport += "</body></html>"
    $HtmlPath = Join-Path $ReportPath "compliance-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').html"
    $HtmlReport | Set-Content $HtmlPath
    
    return @{
        JsonPath = $JsonPath
        HtmlPath = $HtmlPath
    }
}

# メイン実行ロジック
try {
    if (-not (Test-Path $ReportPath)) {
        New-Item -Path $ReportPath -ItemType Directory -Force
    }
    
    $AllFindings = @()
    
    foreach ($Standard in $ComplianceStandards) {
        Write-Output "Checking $Standard compliance..."
        
        switch ($Standard) {
            "CIS" { $AllFindings += Test-CISCompliance }
            "NIST" { $AllFindings += Test-NISTCompliance }
            "SOC2" { 
                # SOC2 チェックは別途実装
                Write-Output "SOC2 compliance check not yet implemented"
            }
        }
    }
    
    # 自動修復の実行
    if ($AutoRemediate -and $AllFindings.Count -gt 0) {
        Write-Output "Performing auto-remediation..."
        Invoke-AutoRemediation -Findings $AllFindings
    }
    
    # レポート生成
    $ReportFiles = New-ComplianceReport -AllFindings $AllFindings -ReportPath $ReportPath
    
    Write-Output "Compliance check completed."
    Write-Output "Reports generated:"
    Write-Output "  JSON: $($ReportFiles.JsonPath)"
    Write-Output "  HTML: $($ReportFiles.HtmlPath)"
    
    # 結果の要約
    $Summary = @{
        TotalFindings = $AllFindings.Count
        HighSeverity = ($AllFindings | Where-Object {$_.Severity -eq "HIGH"}).Count
        AutoRemediationPerformed = $AutoRemediate
    }
    
    Write-Output "Summary: $($Summary | ConvertTo-Json)"
    
} catch {
    Write-Error "Compliance check failed: $($_.Exception.Message)"
    exit 1
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

# terraform/monitoring-dashboard.tf
resource "google_monitoring_dashboard" "windows_operations" {
  dashboard_json = jsonencode({
    displayName = "Windows Server Operations Dashboard"
    mosaicLayout = {
      tiles = [
        {
          width = 6
          height = 4
          widget = {
            title = "System Performance Overview"
            xyChart = {
              dataSets = [
                {
                  timeSeriesQuery = {
                    timeSeriesFilter = {
                      filter = "resource.type=\"gce_instance\" AND resource.label.instance_name=~\"windows-.*\""
                      primaryAggregation = {
                        alignmentPeriod = "60s"
                        perSeriesAligner = "ALIGN_MEAN"
                      }
                    }
                  }
                  plotType = "LINE"
                  targetAxis = "Y1"
                }
              ]
              timeshiftDuration = "0s"
              yAxis = {
                label = "CPU Utilization (%)"
                scale = "LINEAR"
              }
            }
          }
        },
        {
          width = 6
          height = 4
          widget = {
            title = "Security Events"
            scorecard = {
              timeSeriesQuery = {
                timeSeriesFilter = {
                  filter = "resource.type=\"gce_instance\" AND jsonPayload.EventID=4625"
                  primaryAggregation = {
                    alignmentPeriod = "3600s"
                    perSeriesAligner = "ALIGN_RATE"
                  }
                }
              }
              gaugeView = {
                lowerBound = 0
                upperBound = 10
              }
            }
          }
        }
      ]
    }
  })
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# scripts/backup-system.ps1
param(
    [string]$BackupSchedule = "daily",
    [string]$RetentionDays = "30",
    [string[]]$BackupPaths = @("C:\Data", "C:\Applications"),
    [string]$GCSBucket = "company-windows-backups"
)

function New-SystemBackup {
    param(
        [string[]]$Paths,
        [string]$Destination
    )
    
    $BackupId = "backup-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
    $TempPath = "C:\temp\$BackupId"
    
    try {
        # バックアップディレクトリ作成
        New-Item -Path $TempPath -ItemType Directory -Force
        
        # システム状態のバックアップ
        wbadmin start systemstatebackup -backupTarget:$TempPath -quiet
        
        # 指定パスのデータバックアップ
        foreach ($Path in $Paths) {
            if (Test-Path $Path) {
                $ArchiveName = "$BackupId-$(Split-Path $Path -Leaf).zip"
                $ArchivePath = Join-Path $TempPath $ArchiveName
                
                Compress-Archive -Path $Path -DestinationPath $ArchivePath -CompressionLevel Optimal
                Write-Output "✅ Backup created: $ArchivePath"
            }
        }
        
        # Google Cloud Storage へアップロード
        gsutil -m cp -r $TempPath gs://$GCSBucket/$(Get-Date -Format 'yyyy/MM/dd')/
        
        # クリーンアップ
        Remove-Item -Path $TempPath -Recurse -Force
        
        return @{
            Success = $true
            BackupId = $BackupId
            Message = "Backup completed successfully"
        }
        
    } catch {
        return @{
            Success = $false
            BackupId = $BackupId
            Message = "Backup failed: $($_.Exception.Message)"
        }
    }
}

# バックアップ実行
$BackupResult = New-SystemBackup -Paths $BackupPaths -Destination $GCSBucket

# 結果ログ
$LogEntry = @{
    Timestamp = Get-Date
    Operation = "System Backup"
    Result = $BackupResult
} | ConvertTo-Json

Add-Content -Path "C:\logs\backup-operations.log" -Value $LogEntry

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

従来運用 vs 自動化運用の比較:
  
パッチ適用:
  従来: 4時間/月 × 10台 = 40時間
  自動化: 0.5時間/月 (監視のみ) = 95%削減

セキュリティ監査:
  従来: 8時間/四半期
  自動化: 1時間/四半期 (レポート確認) = 87%削減

インシデント対応:
  従来: 平均2時間/件
  自動化: 平均0.5時間/件 = 75%削減

コンプライアンス確認:
  従来: 16時間/年
  自動化: 2時間/年 (最終確認) = 87%削減