This document provides an overview of security on AWS. It discusses AWS' shared responsibility model where AWS is responsible for security of the cloud, while customers are responsible for security in the cloud. It also describes AWS Identity and Access Management (IAM) which allows customers to control access to AWS services and resources. IAM enables creation of users and groups, assigning permissions with policies, and offers features like multi-factor authentication. The document recommends security best practices including deleting root credentials, activating MFA, and monitoring activity.

1. Module 3 :
Security Overview

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Topics
Introduction to AWS Security
The AWS Shared Responsibility Model
AWS Access Control and Management
AWS Security Resources and Features

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Introduction to AWS Security

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Introduction to AWS Security
Security is of the utmost importance to AWS.
• Approach to security
• AWS environment controls
• AWS offerings and features

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Keep Your Data Safe
Resilient infrastructure
High security
Strong safeguards

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Continual Improvement
Rapid innovation
Constantly evolving security services

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pay For What You Need
Advanced security services
Address real-time emerging risks
Meeting needs at a lower operational cost

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Meet Compliance Requirements
Governance-enabled features
• Additional oversight
• Security control
• Central automation

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security Products and Features
Tools
• Access from AWS and partners
• Use for monitoring and logging

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Network Security
Built-in firewalls
Encryption in transit
Private/dedicated connections
Distributed denial of service (DDoS)
mitigation

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Inventory and Configuration Management
Deployment tools
Inventory and configuration tools
Template definition and management tools

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Encryption
Encryption capabilities
Key management options
• AWS Key Management Service
Hardware-based cryptographic key storage options
• AWS CloudHSM

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Access Control and Management
Identity and Access Management (IAM)
Multi-factor authentication (MFA)
Integration and federation with corporate directories
Amazon Cognito
AWS Single Sign-On

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Monitoring and Logging
Tools and features to reduce your risk profile:
• Deep visibility into API calls
• Log aggregation and options
• Alert notifications

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace
Qualified partners to market/sell software to AWS
customers
Online software store that can run on AWS

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Shared Responsibility Model

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Responsibility Model

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security of the Cloud
Protection of the AWS global infrastructure is top priority
Availability of third-party reports

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security of the Cloud
Amazon EC2
Amazon EBS
AWS Foundation Services
Unmanaged services Managed Services
Amazon DynamoDB
Amazon RDS
Amazon Redshift
Amazon EMR
Amazon WorkSpaces

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security in the Cloud
What to store
Which AWS services
In what location
In what content format and structure
Who has access

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security in the Cloud
Customers retain control
Changes to model depend on services

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Access Control and Management

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM
Control access to AWS resources
• Authentication
• Authorization
Controls access to services such as:
Compute
Storage
Database
Application services

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM
Create users and groups
Grant permissions
User Group Permissions Role

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM
Functionality
Manage
• Users and their access
• Roles and their permissions
• Federate users and their permissions
IAM Corp

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Account Root User
Account root user has complete access to all
AWS Services.

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Account Root User
Recommendations
1. Delete root user access
keys.
2. Create an IAM user.
3. Grant administrator
access.
4. Use IAM credentials to
interact with AWS.
IAM

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM: Authentication
Programmatic access
• Enables access key ID and secret access key
Management console access
• Uses AWS account name and password
• MFA prompts for code

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM: Authorization
Access AWS services
• Grant authorization
Assign permissions
• Create an AWS IAM policy

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM: Policy Assignment
IAM Policy
IAM User IAM Group IAM Roles

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Let’s take a look at the AWS IAM DEMO

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM DEMO

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM Best Practices
Delete AWS root account access keys
Activate multi-factor authentication (MFA)
Give IAM users only the permissions they must have
Use IAM groups
Apply an IAM password policy

34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM Best Practices
Roles
• Use roles for applications
• Use roles instead of sharing credentials
Credentials
• Rotate credentials regularly
• Remove unnecessary users and credentials
Use policy conditions for extra security
Monitor activity in your AWS account

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
End of Module 3
Test Your Knowledge