Merge pull request #431 feature-NEWDWH2021-1686 into master

This commit is contained in:
朝倉 明日香 2024-09-02 11:14:27 +09:00
commit 9098bdca6c
23 changed files with 342 additions and 0 deletions

View File

@ -0,0 +1,80 @@
# MeDaCA ECR脆弱スキャンツール
## 前提
- `docker cli`インストール済み(WSL想定)
- `AWS CLI`インストール済み
- AWS CLIでアカウント情報設定されていること
## 実行方法
### ECRをビルド、タグ、プッシュする
- `vulnerability-scan`の直下フォルダで以下コマンド実行する
```bash
bash build-push-scanpoint.sh
```
- 実行したコマンド失敗したとき、スクリプトが停止する
- その場合は`build-push-scanpoint`直下から失敗したコマンド単体実行できる
- 例:`bash build-dataimport.sh`
- スクリプトを強制停止したい場合、`Ctrl + C`で停止できる
### ビルドしたECRをlatestに再タグ、プッシュする
- **前提ECRにプッシュした`scan-point`タグのイメージでステージング環境での動作確認が完了していること。**
- `vulnerability-scan`の直下フォルダで以下コマンド実行する
```bash
bash retag-push-latest.sh
```
- 実行したコマンド失敗したとき、スクリプトが停止する
- その場合は`retag-push-latest`直下から失敗したコマンド単体実行できる
- 例:`bash retag-dataimport.sh`
- スクリプトを強制停止したい場合、`Ctrl + C`で停止できる
## フォルダ構成
├── build-push-scanpoint.sh -- 全ECRモジュールをアップデート、Dockerイメージにビルドし、プッシュするスクリプト
├── retag-push-latest.sh -- ビルドしたDockerイメージをlatestの再タグして、ステージング環境と本番環境にプッシュするスクリプト
├── README.md -- 当ファイル
├── build-push-scanpoint
│ ├── build-dataimport.sh -- データ登録機能の脆弱性スキャンスクリプト
│ ├── build-sap-data-decrypt.sh -- SAPデータ登録 SAPデータ復号化機能脆弱性スキャンスクリプト
│ ├── build-check-view-security-option.sh -- Viewセキュリティオプションチェック機能脆弱性スキャンスクリプト
│ ├── build-crm-datafetch.sh -- CRMデータ連携 CRMデータ取得機能脆弱性スキャンスクリプト
│ ├── build-jskult-dbdump.sh -- 実消化&アルトマーク日次バッチ実行前dump取得機能脆弱性スキャンスクリプト
│ ├── build-jskult-batch-daily.sh -- 実消化&アルトマーク日次バッチ機能脆弱性スキャンスクリプト
│ ├── build-jskult-batch-laundering.sh -- 実消化&アルトマーク週次バッチ機能脆弱性スキャンスクリプト
│ ├── build-jskult-webapp.sh -- 実消化&アルトマークWebアプリケーション脆弱性スキャンスクリプト
| ├── build-export-dbdump.sh -- DBダンプ取得機能脆弱性スキャンスクリプト
| └── build-transfer-medpass-data.sh -- medパス社データ転送機能脆弱性スキャンスクリプト
└── retag-push-latest
├── retag-dataimport.sh -- データ登録機能の再タグ本番環境にプッシュスクリプト
├── retag-sap-data-decrypt.sh -- SAPデータ登録 SAPデータ復号化機能再タグ本番環境にプッシュスクリプト
├── retag-check-view-security-option.sh -- Viewセキュリティオプションチェック機能再タグ本番環境にプッシュスクリプト
├── retag-crm-datafetch.sh -- CRMデータ連携 CRMデータ取得機能再タグ本番環境にプッシュスクリプト
├── retag-jskult-dbdump.sh -- 実消化&アルトマーク日次バッチ実行前dump取得機能再タグ本番環境にプッシュスクリプト
├── retag-jskult-batch-daily.sh -- 実消化&アルトマーク日次バッチ機能再タグ本番環境にプッシュスクリプト
├── retag-jskult-batch-laundering.sh -- 実消化&アルトマーク週次バッチ機能再タグ本番環境にプッシュスクリプト
├── retag-jskult-webapp.sh -- 実消化&アルトマークWebアプリケーション再タグ本番環境にプッシュスクリプト
├── retag-export-dbdump.sh -- DBダンプ取得機能再タグ本番環境にプッシュスクリプト
└── retag-transfer-medpass-data.sh -- medパス社データ転送機能再タグ本番環境にプッシュスクリプト
## 作成タイミングと作成方法
### 作成タイミング
- ECRリポジトリにて資材を管理する機能のUAT完了後、脆弱性スキャン手順を作成するタイミングで、当スクリプトをreleaseブランチに登録する。
### 作成方法
- 脆弱性スキャンスクリプトを`build-push-scanpoint`フォルダ配下に作成する。
- `vulnerability-scan/build-push-scanpoint/build-crm-datafetch.sh` を参考にしてスクリプト実装する
- リポジトリによってコマンドの組み方が微妙に異なるため、作成後にレビューを受けること
- 実装したスクリプトを親スクリプト`vulnerability-scan/build-push-scanpoint.sh`に追加する
- 再タグ&本番環境へのPUSHスクリプトを`retag-push-latest`フォルダ配下に作成する。
- `vulnerability-scan/retag-push-latest/retag-dataimport.sh` を参考にしてスクリプト実装する
- 実装したスクリプトを親スクリプト`vulnerability-scan/retag-push-latest.sh`に追加する

View File

@ -0,0 +1,20 @@
#!/bin/bash
#ログイン認証確認
if [[ $(aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com) == *"Login Succeeded"* ]]
then
echo "AWS login succeeded"
cd build-push-scanpoint
bash build-dataimport.sh || { echo "build-dataimport.sh failed"; exit 1; }
bash build-sap-data-decrypt.sh || { echo "build-sap-data-decrypt.sh failed"; exit 1; }
bash build-check-view-security-option.sh || { echo "build-check-view-security-option.sh failed"; exit 1; }
bash build-crm-datafetch.sh || { echo "build-crm-datafetch.sh failed"; exit 1; }
bash build-jskult-dbdump.sh || { echo "build-jskult-dbdump.sh failed"; exit 1; }
bash build-jskult-batch-daily.sh || { echo "build-jskult-batch-daily.sh failed"; exit 1; }
bash build-jskult-batch-laundering.sh || { echo "build-jskult-batch-laundering.sh failed"; exit 1; }
bash build-jskult-webapp.sh || { echo "build-jskult-webapp.sh failed"; exit 1; }
bash build-export-dbdump.sh || { echo "build-export-dbdump.sh failed"; exit 1; }
bash build-transfer-medpass-data.sh || { echo "build-transfer-medpass-data.sh failed"; exit 1; }
else
echo "AWS login failed"
fi

View File

@ -0,0 +1,14 @@
#!/bin/bash
cd ../../lambda/check-view-security-option || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-check-view-security-option-ecr . --no-cache
docker tag mbj-newdwh2021-staging-check-view-security-option-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-check-view-security-option-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-check-view-security-option-ecr:scan-point

View File

@ -0,0 +1,14 @@
#!/bin/bash
cd ../../ecs/crm-datafetch || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-crm-datafetch-ecr . --no-cache
docker tag mbj-newdwh2021-staging-crm-datafetch-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-crm-datafetch-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-crm-datafetch-ecr:scan-point

View File

@ -0,0 +1,11 @@
#!/bin/bash
cd ../../ecs/dataimport/ || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-ecr . --no-cache
docker tag mbj-newdwh2021-staging-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-ecr:scan-point

View File

@ -0,0 +1,13 @@
#!/bin/bash
cd ../../ecs/export-dbdump || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-export-dbdump-ecr . --no-cache
docker tag mbj-newdwh2021-staging-export-dbdump-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-export-dbdump-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-export-dbdump-ecr:scan-point

View File

@ -0,0 +1,13 @@
#!/bin/bash
cd ../../ecs/jskult-batch-daily || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-jskult-batch-daily-ecr . --no-cache
docker tag mbj-newdwh2021-staging-jskult-batch-daily-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-daily-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-daily-ecr:scan-point

View File

@ -0,0 +1,13 @@
#!/bin/bash
cd ../../ecs/jskult-batch-laundering || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-jskult-batch-laundering-ecr . --no-cache
docker tag mbj-newdwh2021-staging-jskult-batch-laundering-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-laundering-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-laundering-ecr:scan-point

View File

@ -0,0 +1,14 @@
#!/bin/bash
cd ../../ecs/jskult-dbdump || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-jskult-dbdump-ecr . --no-cache
docker tag mbj-newdwh2021-staging-jskult-dbdump-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-dbdump-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-dbdump-ecr:scan-point

View File

@ -0,0 +1,14 @@
#!/bin/bash
cd ../../ecs/jskult-webapp || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-jskult-webapp-ecr . --no-cache
docker tag mbj-newdwh2021-staging-jskult-webapp-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-webapp-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-webapp-ecr:scan-point

View File

@ -0,0 +1,12 @@
#!/bin/bash
cd ../../lambda/sap-data-decrypt || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-sap-data-decrypt . --no-cache
docker tag mbj-newdwh2021-staging-sap-data-decrypt:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-sap-data-decrypt:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-sap-data-decrypt:scan-point

View File

@ -0,0 +1,14 @@
#!/bin/bash
cd ../lambda/transfer-medpass-data || { echo "Error: ディレクトリ変更に失敗しました"; exit 1; }
docker pull public.ecr.aws/lambda/python:3.12
pipenv update
aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com
docker build -t mbj-newdwh2021-staging-transfer-medpass-data-ecr . --no-cache
docker tag mbj-newdwh2021-staging-transfer-medpass-data-ecr:latest 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-transfer-medpass-data-ecr:scan-point
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-transfer-medpass-data-ecr:scan-point

View File

@ -0,0 +1,20 @@
#!/bin/bash
#ログイン認証確認
if [[ $(aws ecr get-login-password --region ap-northeast-1 | docker login --username AWS --password-stdin 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com) == *"Login Succeeded"* ]]
then
echo "AWS login succeeded"
cd retag-push-latest
bash retag-dataimport.sh || { echo "retag-dataimport.sh failed"; exit 1; }
bash retag-sap-data-decrypt.sh || { echo "retag-sap-data-decrypt.sh failed"; exit 1; }
bash retag-check-view-security-option.sh || { echo "retag-check-view-security-option.sh failed"; exit 1; }
bash retag-crm-datafetch.sh || { echo "retag-crm-datafetch.sh failed"; exit 1; }
bash retag-jskult-dbdump.sh || { echo "retag-jskult-dbdump.sh failed"; exit 1; }
bash retag-jskult-batch-daily.sh || { echo "retag-jskult-batch-daily.sh failed"; exit 1; }
bash retag-jskult-batch-laundering.sh || { echo "retag-jskult-batch-laundering.sh failed"; exit 1; }
bash retag-jskult-webapp.sh || { echo "retag-jskult-webapp.sh failed"; exit 1; }
bash retag-export-dbdump.sh || { echo "retag-export-dbdump.sh failed"; exit 1; }
bash retag-transfer-medpass-data.sh || { echo "retag-transfer-medpass-data.sh failed"; exit 1; }
else
echo "AWS login failed"
fi

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-check-view-security-option-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-check-view-security-option-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-check-view-security-option-ecr:latest
docker tag mbj-newdwh2021-staging-check-view-security-option-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-check-view-security-option-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-check-view-security-option-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-crm-datafetch-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-crm-datafetch-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-crm-datafetch-ecr:latest
docker tag mbj-newdwh2021-staging-crm-datafetch-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-crm-datafetch-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-crm-datafetch-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-ecr:latest
docker tag mbj-newdwh2021-staging-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-export-dbdump-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-export-dbdump-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-export-dbdump-ecr:latest
docker tag mbj-newdwh2021-staging-export-dbdump-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-export-dbdump-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-export-dbdump-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-jskult-batch-daily-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-daily-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-daily-ecr:latest
docker tag mbj-newdwh2021-staging-jskult-batch-daily-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-batch-daily-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-batch-daily-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-jskult-batch-laundering-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-laundering-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-batch-laundering-ecr:latest
docker tag mbj-newdwh2021-staging-jskult-batch-laundering-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-batch-laundering-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-batch-laundering-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-jskult-dbdump-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-dbdump-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-dbdump-ecr:latest
docker tag mbj-newdwh2021-staging-jskult-dbdump-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-dbdump-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-dbdump-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-jskult-webapp-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-webapp-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-jskult-webapp-ecr:latest
docker tag mbj-newdwh2021-staging-jskult-webapp-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-webapp-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-jskult-webapp-ecr:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-sap-data-decrypt 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-sap-data-decrypt:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-sap-data-decrypt:latest
docker tag mbj-newdwh2021-staging-sap-data-decrypt 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-sap-data-decrypt:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-sap-data-decrypt:latest

View File

@ -0,0 +1,9 @@
#!/bin/bash
docker tag mbj-newdwh2021-staging-transfer-medpass-data-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-transfer-medpass-data-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-staging-transfer-medpass-data-ecr:latest
docker tag mbj-newdwh2021-staging-transfer-medpass-data-ecr 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-transfer-medpass-data-ecr:latest
docker push 826466435614.dkr.ecr.ap-northeast-1.amazonaws.com/mbj-newdwh2021-product-transfer-medpass-data-ecr:latest