Mohamed Wali AWS Security Reference Architecture AWS Communtity Day Midwest 2023

1. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Security Reference
Architecture
Visualize your security
Mohamed Wali
Solutions Architect
Amazon Web Services

2. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What we’ll cover
• What the AWS Security Reference
Architecture (AWS SRA) is
and why it matters to you
• Highlights
• How to navigate the
documents and code Amazon
GuardDuty
AWS Certificate
Manager (ACM)

3. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Security Reference Architecture (AWS SRA)
Amazon
GuardDuty
AWS Certificate
Manager (ACM)

4. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why build a security reference architecture?

5. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How the AWS SRA can help you
1. Define target state for your own security architecture
2. Review (and revise) the designs and capabilities you have
already implemented
3. Bootstrap the implementation of your own security architecture
4. Learn more about AWS security services and capabilities
5. Drive a discussion of organizational responsibilities for security

6. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s look at the architecture

7. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security foundations

8. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS SRA: High-level account structure

9. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS SRA: Show all
the security services
Amazon
GuardDuty
AWS Certificate
Manager (ACM)

10. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security OU: Tooling account

11. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security OU: Log Archive account

12. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Infrastructure OU: Shared Services account

13. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workloads OU: Application account
Application

14. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workloads OU: Application account

15. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security at all layers
AWS Well-Architected Framework

16. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Your AWS environment in layers

17. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting the AWS organization and OUs

18. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting accounts

19. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting network

20. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting principals

21. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting resources

22. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS SRA code repository

23. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Current available code examples
AWS
CloudTrail
AWS Config
aggregator
AWS Config
conformance
packs
AWS Security
Hub
AWS Firewall
Manager
Amazon
Macie
Amazon
GuardDuty
AWS Organizations AWS Organizations
with delegated admin
Default account configurations
AWS IAM
Access Analyzer
IAM password
policy
Amazon EBS
default encryption
Amazon S3
public access block

24. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Public GitHub repository
Self-service
Focused on AWS Control
Tower environments
Built from AWS experience
working
with customers
(high quality)
Environment testing

25. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What else is included?
Architecture diagram
Resource descriptions
Deployment instructions
Least privilege
Post-deployment events
CloudTrail solution

26. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Where to find it
AWS prescriptive guidance
Code repository

27. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Q&A

28. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
Mohamed Wali
Solutions Architect
Amazon Web Services