Ukuqinisekisa ku-AWS Client VPN: izimvume ze-IAM akuzona indlela yokungena
Izimvume zekhonsoli azikuqinisekisi umhubhe. Qhathanisa izindlela zesitifiketi, i-AD ne-SAML, bese ubheka ukuthi ukudluliswa kwephothi nge-SSM kufanele nini nesizindalwazi esisodwa esiyimfihlo.
Ukunikeza umsebenzisi imvume yokwakha noma yokuchaza indawo yokugcina ye-AWS Client VPN akumvumeli ukuthi axhumane nayo. Lezi izinhlobo ezimbili ezihlukene zobunikazi: i-IAM ilawula izingcingo ze-AWS API, futhi indawo yokugcina yamukela kuphela izindlela zokuqinisekisa iklayenti ezilungiselelwe kuyo. Ngakho umsebenzisi angaba nezimvume ezibanzi zekhonsoli kodwa angabi nalutho iklayenti le-VPN elingakwazi ukulwethula. Nquma ukuthi iyiphi indlela indawo yokugcina eyithembayo, bese unquma ukuthi umhubhe ogcwele uyisimo esifanele yini sokufinyelela okunikezayo.
Ubunikazi be-API akubona ubunikazi bomhubhe
Lapho othile ethi «indima ye-IAM ixhunyiwe, kungani i-VPN isehluleka», impendulo ivamise ukuba ukuthi asikho isinyathelo ohambweni lokuxhumana esike sifunde leyo ndima. Iklayenti lethula isitifiketi, igama lomsebenzisi nephasiwedi ye-AD, noma isitatimende se-SAML. Indawo yokugcina iqinisekisa esisodwa salokho bese inikeza ikheli.
I-IAM isabalulekile, kodwa kamuva nakwenye indawo: ukwakha indawo yokugcina, ukuxhuma amanethiwekhi amancane, ukushicilela imizila nokubhala imithetho yegunya kuyizenzo ze-API. Gcina lezo zimvume zilinganiselwe kubasebenzi abazidingayo esikhundleni sokunikeza wonke umsebenzisi amandla okubhala kabusha imithetho yokufinyelela yendawo yokugcina.
Khetha phakathi kwezindlela ezisekelwa indawo yokugcina
I-AWS Client VPN yamukela ukuqinisekisa okuhlanganyelwe okusekelwe kusitifiketi, ukuqinisekisa kwe-Active Directory nokuqinisekisa okuhlanganyelwe okusekelwe ku-SAML. Isitifiketi seseva siyadingeka kungakhathaliseki ukuthi iyiphi indlela yeklayenti oyikhethayo, futhi ukulungiselelwa okuhlanganisa izindlela kudinga ukuthi kokubili kuphumelele, hhayi okukodwa.
| Client method | What the user presents | Where the work sits |
|---|---|---|
| Mutual certificate | A client certificate the endpoint trusts | Certificate authority, issuing and revoking per user |
| Active Directory | Domain credentials | Directory reachable from the endpoint's VPC |
| SAML federation | An assertion from an identity provider | IdP application, attribute mapping, client support |
Izitifiketi zishibhe kakhulu ukuzisungula futhi kulula kakhulu ukuziphatha kabi ngesilinganiso esikhulu, ngoba wonke umsebenzisi udinga ubufakazi futhi konke ukuhamba kudinga ukukhanselwa. Ukuqinisekisa ngohlu lwamabhuku kudlulisela lowo mjikelezo wokuphila ohlelweni olukhona. Umfelandawonye ukudlulisela kumhlinzeki wobunikazi futhi wengeza isinyathelo sesiphequluli kuklayenti.
Funda ukulungiselelwa kwendawo yokugcina uqobo ngaphambi kokulungisa iklayenti. Uma ukuqinisekisa okuhlanganyelwe kunikwe amandla eduze kwendlela esekelwe kumsebenzisi, iklayenti elinesitifiketi esivumelekile kodwa elingenayo i-akhawunti yohlu lwamabhuku lizohluleka noma kunjalo, futhi iphutha livamise ukubonakala njengenkinga evamile yokuxhawulisana.
Umfelandawonye akukona ukudlulisa okhiye bokufinyelela
Ukulungiselelwa kwe-SAML akukufaki okhiye bokufinyelela be-IAM noma ithokheni yendima ethathiwe emhubheni. Umhlinzeki wobunikazi uqinisekisa umuntu, ubuyisela isitatimende, futhi indawo yokugcina iyasamukela ngaphansi kokuthenjwa okukulungiselele. Isikhathi esiwumphumela siyisikhathi se-VPN, hhayi isikhathi se-AWS API.
Lowo mehluko unquma ukuthi ubani angaxilonga ini. Izinkinga ze-IdP zivela njengephutha lesiphequluli noma seklayenti ngaphambi kokuba kube khona umhubhe, kuyilapho izinkinga zomhubhe zivela ngemva kwesitatimende esiphumelelayo. Buza ukuthi iyiphi kulezi ezimbili oyibukayo ngaphambi kokuvula noma iyiphi ikhonsoli.
Ngemva kokungena, imizila negunya kusazothatha isinqumo
Ukuqinisekisa kunikeza isikhathi ikheli; akunikezi isikhathi indawo ekuyiwa kuyo. Imizila yendawo yokugcina itshela iklayenti ukuthi idlulisele kumaphi amanethiwekhi amancane, imithetho yegunya inquma ukuthi abaphi abasebenzisi abangafinyelela kukuphi kulawo manethiwekhi amancane, futhi amaqembu okuphepha kanye nezimvume zendawo ekuyiwa kuyo zinquma okunye.
Yingakho umsebenzisi oqinisekiswe ngempumelelo angase ahluleke ukufinyelela isizindalwazi. Hlola ukuxhumana kwethebula lemizila ngenethiwekhi encane, umthetho wegunya weqembu lomsebenzisi kanye neqembu lokuphepha endaweni ekuyiwa kuyo ngalolo hlelo, ngoba ngakunye kukhiqiza uhlobo oluhlukile lokuphelelwa yisikhathi.
Esizindalwazini esisodwa esiyimfihlo, qhathanisa nokudluliswa kwephothi
Uma umsebenzi wangempela uwukuxhumana okugunyaziwe okukodwa okuya esizindalwazini esisodwa esiyimfihlo, umhubhe wamanethiwekhi ogcwele uyisinqumo hhayi imfuneko. I-AWS Systems Manager Session Manager ingavula isikhathi sokudlulisa iphothi esiya kunodi ephethwe nge-IAM, futhi leyo nodi ifinyelela isizindalwazi kunethiwekhi eyimfihlo. Umsebenzisi akakaze athole ikheli le-VPC. Inodi ephethwe iyona kuphela isisetshenziswa esingafinyelela iphothi lesizindalwazi, futhi lokho ngokuvamile yikho okwakudingwa ukubuyekezwa kokuphepha. Abasebenzisi bese bedinga iklayenti lendawo kanye nomyalo wesikhathi esikhundleni sephrofayela ye-VPN.
Ukushintshana kungubukhulu ngokumelene nemibandela yokuqala. Ukudluliswa kwephothi kudinga i-ejenti ye-SSM kunodi ephethwe, ukufinyeleleka kwenethiwekhi kusuka kuleyo nodi kuye esizindalwazini, isengezo se-Session Manager emshinini womsebenzisi kanye nemvume yokuqalisa leso sikhathi esithile. Akusona isiqondiso sokungena kuyo yonke inethiwekhi encane, futhi ngeke sithwale amaphrothokholi angahleliwe njengoba kwenza umhubhe.
Noma ngabe yikuphi, gcina ubunikazi besizindalwazi uqobo endaweni yaso. Ukuqinisekiswa kwe-TLS nokuqinisekisa kwesizindalwazi akunyamalali ngoba indlela igunyazwe yi-IAM, futhi isikhathi esigunyaziwe asisho lutho mayelana namathebula umsebenzisi angawafunda.
Khetha ngokwebukhulu nomjikelezo wokuphila: umhubhe lapho abasebenzisi abaningi bedinga izindawo eziningi futhi ungakwazi ukuphatha umjikelezo wokuphila wesitifiketi noma wohlu lwamabhuku; isikhathi sokudlulisa lapho abantu abambalwa bedinga isevisi eyodwa futhi ungathandi ukusabalalisa amakheli enethiwekhi. Noma ngabe yikuphi, rekhoda indlela yokuqinisekisa, umthetho wegunya kanye nokungena esizindalwazini njengamaqiniso amathathu ahlukene, ngoba kwehluleka ngokwahlukana.