IDプロバイダー設計

// 条件付きアクセスポリシーの設計
interface ConditionalAccessPolicy {
  name: string;
  conditions: {
    userGroups: string[];
    devicePlatforms?: string[];
    locations?: string[];
    riskLevel?: 'low' | 'medium' | 'high';
    clientApp?: string[];
  };
  grantControls: {
    mfaRequired: boolean;
    compliantDeviceRequired: boolean;
    approvedAppRequired: boolean;
    sessionControls?: {
      signInFrequency: string;
      persistentBrowser: boolean;
    };
  };
  targetResources: string[];
}

const policies: ConditionalAccessPolicy[] = [
  {
    name: '開発者 - 通常アクセス',
    conditions: {
      userGroups: ['developers'],
      devicePlatforms: ['macOS', 'linux'],
      riskLevel: 'low',
    },
    grantControls: {
      mfaRequired: true,
      compliantDeviceRequired: true,
      approvedAppRequired: false,
      sessionControls: {
        signInFrequency: '12h',
        persistentBrowser: false,
      },
    },
    targetResources: ['gitlab', 'jira', 'confluence', 'grafana', 'sonarqube'],
  },
  {
    name: '開発者 - 高権限アクセス',
    conditions: {
      userGroups: ['developers', 'sre-team'],
      riskLevel: 'low',
    },
    grantControls: {
      mfaRequired: true,
      compliantDeviceRequired: true,
      approvedAppRequired: true,
      sessionControls: {
        signInFrequency: '1h',  // 高権限は1時間で再認証
        persistentBrowser: false,
      },
    },
    targetResources: ['argocd', 'harbor', 'vault', 'aws-console'],
  },
  {
    name: '外部パートナー - 制限アクセス',
    conditions: {
      userGroups: ['external-partners'],
    },
    grantControls: {
      mfaRequired: true,
      compliantDeviceRequired: false,  // BYOD許可
      approvedAppRequired: true,
      sessionControls: {
        signInFrequency: '4h',
        persistentBrowser: false,
      },
    },
    targetResources: ['jira', 'confluence'],  // 限定的なアクセスのみ
  },
  {
    name: '高リスクサインイン - ブロック',
    conditions: {
      userGroups: ['all-users'],
      riskLevel: 'high',
    },
    grantControls: {
      mfaRequired: true,
      compliantDeviceRequired: true,
      approvedAppRequired: true,
    },
    targetResources: ['all'],
  },
];

MFAポリシー

ゼロトラストネットワーク構成

# Cloudflare Access / Google IAP 風のゼロトラストプロキシ設定
# 各アプリケーションへのアクセスルール

applications:
  - name: GitLab
    domain: gitlab.devhub.example.com
    type: self-hosted
    identity_providers:
      - okta
    policies:
      - name: developer-access
        decision: allow
        include:
          - group: developers
          - group: sre-team
        require:
          - mfa: true
          - device_posture:
              os_version_min: "14.0"  # macOS Sonoma以上
              disk_encrypted: true
              firewall_enabled: true

  - name: ArgoCD
    domain: argocd.devhub.example.com
    type: self-hosted
    policies:
      - name: sre-only-access
        decision: allow
        include:
          - group: sre-team
        require:
          - mfa: true
          - device_posture:
              os_version_min: "14.0"
              disk_encrypted: true
              screen_lock: true
      - name: developer-readonly
        decision: allow
        include:
          - group: developers
        require:
          - mfa: true
        session_duration: 4h

  - name: AWS Console
    domain: aws.devhub.example.com
    type: saml
    policies:
      - name: admin-access
        decision: allow
        include:
          - group: platform-admins
        require:
          - mfa: true
          - device_posture:
              managed: true
              disk_encrypted: true
        session_duration: 1h

  - name: Jira-Confluence
    domain: "*.atlassian.devhub.example.com"
    type: saml
    policies:
      - name: all-internal
        decision: allow
        include:
          - group: all-employees
          - group: external-partners
        require:
          - mfa: true

VPN廃止ロードマップ

データ分類ポリシー

interface DataClassification {
  level: 'Restricted' | 'Confidential' | 'Internal' | 'Public';
  examples: string[];
  encryptionRequired: boolean;
  accessControl: string;
  retentionPeriod: string;
  dlpRules: string[];
}

const classifications: DataClassification[] = [
  {
    level: 'Restricted',
    examples: ['本番DBクレデンシャル', 'APIシークレット', 'SSH秘密鍵', '暗号化キー'],
    encryptionRequired: true,
    accessControl: 'Vault + 動的認証情報 + 監査ログ必須',
    retentionPeriod: '使用後即時失効（リース管理）',
    dlpRules: ['コードリポジトリへのコミット禁止', 'ログ出力禁止', 'コピー禁止'],
  },
  {
    level: 'Confidential',
    examples: ['ソースコード', '設計ドキュメント', '脆弱性レポート', '人事情報'],
    encryptionRequired: true,
    accessControl: 'RBAC + プロジェクトベースの認可',
    retentionPeriod: 'プロジェクト終了後3年',
    dlpRules: ['外部共有時は承認必須', '透かし付き印刷のみ'],
  },
  {
    level: 'Internal',
    examples: ['チケット情報', '議事録', '開発ガイドライン'],
    encryptionRequired: false,
    accessControl: '認証済みユーザー全員',
    retentionPeriod: '5年',
    dlpRules: ['外部共有禁止'],
  },
  {
    level: 'Public',
    examples: ['公開ドキュメント', 'OSSコード', 'ブログ記事'],
    encryptionRequired: false,
    accessControl: '制限なし',
    retentionPeriod: '無期限',
    dlpRules: ['機密情報の混入チェック'],
  },
];

Vault シークレット管理設計

# Vault設定例
vault:
  auth_methods:
    - type: kubernetes
      config:
        kubernetes_host: "https://kubernetes.default.svc"
    - type: oidc
      config:
        oidc_discovery_url: "https://okta.example.com"
        default_role: developer

  secret_engines:
    # 動的データベース認証情報
    - path: database/
      type: database
      roles:
        - name: readonly
          db_name: production
          creation_statements: "CREATE ROLE '{{name}}' WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO '{{name}}';"
          default_ttl: 1h
          max_ttl: 24h

    # Transit暗号化エンジン
    - path: transit/
      type: transit
      keys:
        - name: pii-encryption
          type: aes256-gcm96
          auto_rotate_period: 30d

    # KV シークレット
    - path: secret/
      type: kv-v2
      config:
        max_versions: 10

  policies:
    developer:
      - path: "secret/data/dev/*"
        capabilities: ["read", "list"]
      - path: "database/creds/readonly"
        capabilities: ["read"]
    sre:
      - path: "secret/data/*"
        capabilities: ["create", "read", "update", "delete", "list"]
      - path: "database/creds/*"
        capabilities: ["read"]
      - path: "transit/encrypt/pii-encryption"
        capabilities: ["update"]

全体アーキテクチャ

graph TD
    User["ユーザー（任意の場所）<br/>社用Mac / BYOD / モバイル"]

    subgraph ControlPlane["ゼロトラスト制御プレーン"]
        IdP["IdP<br/>(Okta)"]
        DeviceTrust["Device Trust<br/>(Jamf)"]
        PolicyEngine["Policy Engine"]
    end

    User --> ControlPlane
    ControlPlane --> IAP["Identity-Aware Proxy<br/>(Cloudflare Access)"]

    IAP --> GitLab["GitLab"]
    IAP --> Jira["Jira"]
    IAP --> ArgoCD["ArgoCD"]
    IAP --> Grafana["Grafana"]
    IAP --> AWS["AWS"]

    classDef user fill:#6c757d,stroke:#495057,color:#fff
    classDef control fill:#e94560,stroke:#c23050,color:#fff
    classDef proxy fill:#0d6efd,stroke:#0a58ca,color:#fff
    classDef app fill:#198754,stroke:#146c43,color:#fff

    class User user
    class IdP,DeviceTrust,PolicyEngine control
    class IAP proxy
    class GitLab,Jira,ArgoCD,Grafana,AWS app

KPI