AWS customers benefit from more than 1,800 security and compliance controls. Learn how these features offer visibility, agility, and control, raising the bar on cloud security over legacy environments. AWS Config can help you achieve compliance in real-time. You will have the opportunity to see how AWS Config empowers users to achieve continuous compliance through its AWS Config rules, and when used alongside AWS Lambda.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
© 2017, Amazon Web Services, Inc. or its Affiliates, All rights reserved.
Achieving Continuous Compliance using
AWS Config
Ankush Chowdhary, Head Security Risk & Compliance - APJ, Worldwide
Public Sector, AWS

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key steps to ensure Governance & Compliance
Understand your IT environment & document all
compliance requirements
Design and implement controls to meet the
organization’s compliance requirements
Identify and document controls owned by 3rd parties &
verify that all control objectives are being met

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Why Automate?
• Hard to keep track of
resource inventory
• Numerous compliance
requirements (CIS
benchmarks, PCI, HIPAA)
• Continuous assessment
• Growth is good, but it
comes with its challenges

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Config
• Continuous recording of configuration and inventory of
AWS resources, includes deleted
• Check compliance with desired configuration using rules and
view resource relationships
• OS level patches, installed applications, network
configuration with EC2 Systems Manager
• Pre-built rules by AWS, Custom rules using AWS Lambda
• Configuration and Compliance change notifications

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How AWS Config Works?
Record changing
resources
AWS Config
Config Rules
History, Snapshot
Notifications
API Access
Normalized

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Some common use cases
Continuous
Monitoring
Continuous
Assessment
Change
Management
Operational
Troubleshooting

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Key Features of AWS Config
Config Rules Config Resource history Config Software History
Config Snapshots Resource Relationships Cloud Governance
Dashboard

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo – Security Policy 1
• Ensure VPC Flow Logs are enabled, and cannot be
turned off.

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo – Security Policy 2
• All unused access keys should be disabled if they have
not been used for x number of days.

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo – Security Policy 3
• Only approved security groups can be applied to web
servers, un-approved ports should be removed
immediately.

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo – Security Policy 4
• Ensure the password policy is applied, check for IAM
Password policy and remediate if not in line with
internal/external compliance requirements.

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
© 2017, Amazon Web Services, Inc. or its Affiliates, All rights reserved.
Thank You!