SlideShare a Scribd company logo
AWS Security Best
Practices
Shibu Basheer
CTO
Cabot Technology Solutions Pvt Ltd
Topics
1. IAM
2. STS
3. Organisation
4. Cloudtrail
5. Cloudwatch
6. AWS Config
7. Secret Manager
8. Others
Policies / Compliance
Well Architected Framework
IAM
● Create individual users
● MFA
● Use groups to assign to assign permissions to users.
● Grant Least Privilege
● Use AWS Managed Policies
● Do not share access keys
● Use Roles for Applications that run in EC2
● Use STS to generate temporary security credentials (apps, web applications)
STS
● Security Token Service
● Avoid hard coding access key IDs in code
● Use STS for temporary access to aws services
● STS service will generate temporary accessKeyID, secretAccessKey and
sessionToken
● Cognito
● OpenId connect
AWS Organizations
● Manage multiple aws accounts under one account
● Restrict resources
● Billing Entities
● Business Units
● Environments (dev, test, prod)
Cloudtrail
● Log/Record every API call.
● Used for auditing any information
● Automate remediation on incidents
Cloudwatch
● Logs from things - Applications, devices, services
● Alarms
● Rules
● Logs
● Dashboard
AWS Config
● Infrastructure keeps changing
● AWS Config keeps track of everything that changed in AWS
● Compliance Rules
○ E.g. EIP Attached
○ Cloudtrail Enabled
● Prebuilt and Custom Rules
Secret Manager
● Rotate RDS passwords
● Store security credentials
● Retrieve via API calls.
● No hard coding of DB passwords in code
Other items
● VPC Flow logs
● Security Groups
● EC2 Key Pairs
Other Services
● AWS Inspector
○ Security Assessment Service
○ Scan vulnerabilities
● Macie
○ Discover sensitive data stored in your infrastructure
● Guard Duty
○ Threat detection service
○ Uses data from vpc flow logs, cloudtrail logs, and dns
● KMS (Key management Service)
○ Store keys that encrypts your data
Thank you!
Shibu Basheer
Linkedin / Twitter / Instagram
@shibubasheer
shibu@cabotsolutions.com

More Related Content

More from AWS User Group Kochi

ACDKOCHI19 - Opening Keynote - Building an Innovation mindset
ACDKOCHI19 - Opening Keynote - Building an Innovation mindsetACDKOCHI19 - Opening Keynote - Building an Innovation mindset
ACDKOCHI19 - Opening Keynote - Building an Innovation mindset
AWS User Group Kochi
 
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWSACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
AWS User Group Kochi
 
ACDKOCHI19 - Next Generation Data Analytics Platform on AWS
ACDKOCHI19 - Next Generation Data Analytics Platform on AWSACDKOCHI19 - Next Generation Data Analytics Platform on AWS
ACDKOCHI19 - Next Generation Data Analytics Platform on AWS
AWS User Group Kochi
 
ACDKOCHI19 - IAM Everywhere
ACDKOCHI19 - IAM EverywhereACDKOCHI19 - IAM Everywhere
ACDKOCHI19 - IAM Everywhere
AWS User Group Kochi
 
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
AWS User Group Kochi
 
ACDKOCHI19 - Demystifying amazon sagemaker
ACDKOCHI19 - Demystifying amazon sagemakerACDKOCHI19 - Demystifying amazon sagemaker
ACDKOCHI19 - Demystifying amazon sagemaker
AWS User Group Kochi
 
ACDKOCHI19 - Building a serverless full-stack AWS native website
ACDKOCHI19 - Building a serverless full-stack AWS native websiteACDKOCHI19 - Building a serverless full-stack AWS native website
ACDKOCHI19 - Building a serverless full-stack AWS native website
AWS User Group Kochi
 

More from AWS User Group Kochi (7)

ACDKOCHI19 - Opening Keynote - Building an Innovation mindset
ACDKOCHI19 - Opening Keynote - Building an Innovation mindsetACDKOCHI19 - Opening Keynote - Building an Innovation mindset
ACDKOCHI19 - Opening Keynote - Building an Innovation mindset
 
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWSACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
ACDKOCHI19 - Enterprise grade security for web and mobile applications on AWS
 
ACDKOCHI19 - Next Generation Data Analytics Platform on AWS
ACDKOCHI19 - Next Generation Data Analytics Platform on AWSACDKOCHI19 - Next Generation Data Analytics Platform on AWS
ACDKOCHI19 - Next Generation Data Analytics Platform on AWS
 
ACDKOCHI19 - IAM Everywhere
ACDKOCHI19 - IAM EverywhereACDKOCHI19 - IAM Everywhere
ACDKOCHI19 - IAM Everywhere
 
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
ACDKOCHI19 - Turbocharge Developer productivity with platform build on K8S an...
 
ACDKOCHI19 - Demystifying amazon sagemaker
ACDKOCHI19 - Demystifying amazon sagemakerACDKOCHI19 - Demystifying amazon sagemaker
ACDKOCHI19 - Demystifying amazon sagemaker
 
ACDKOCHI19 - Building a serverless full-stack AWS native website
ACDKOCHI19 - Building a serverless full-stack AWS native websiteACDKOCHI19 - Building a serverless full-stack AWS native website
ACDKOCHI19 - Building a serverless full-stack AWS native website
 

Recently uploaded

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
Edge AI and Vision Alliance
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Tosin Akinosho
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
Antonios Katsarakis
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Neo4j
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Neo4j
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
Pablo Gómez Abajo
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Alpen-Adria-Universität
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
saastr
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
Hiroshi SHIBATA
 
AppSec PNW: Android and iOS Application Security with MobSF
AppSec PNW: Android and iOS Application Security with MobSFAppSec PNW: Android and iOS Application Security with MobSF
AppSec PNW: Android and iOS Application Security with MobSF
Ajin Abraham
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
Zilliz
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
Zilliz
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
ScyllaDB
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
akankshawande
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
Tatiana Kojar
 

Recently uploaded (20)

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
 
Monitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdfMonitoring and Managing Anomaly Detection on OpenShift.pdf
Monitoring and Managing Anomaly Detection on OpenShift.pdf
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 
Artificial Intelligence and Electronic Warfare
Artificial Intelligence and Electronic WarfareArtificial Intelligence and Electronic Warfare
Artificial Intelligence and Electronic Warfare
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
 
AppSec PNW: Android and iOS Application Security with MobSF
AppSec PNW: Android and iOS Application Security with MobSFAppSec PNW: Android and iOS Application Security with MobSF
AppSec PNW: Android and iOS Application Security with MobSF
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
 

AWSUGKOCHI - SEP - 2019 - Meetup - An Introduction in to AWS Infrastructure Security Best Practices

  • 1. AWS Security Best Practices Shibu Basheer CTO Cabot Technology Solutions Pvt Ltd
  • 2. Topics 1. IAM 2. STS 3. Organisation 4. Cloudtrail 5. Cloudwatch 6. AWS Config 7. Secret Manager 8. Others
  • 3. Policies / Compliance Well Architected Framework
  • 4.
  • 5. IAM ● Create individual users ● MFA ● Use groups to assign to assign permissions to users. ● Grant Least Privilege ● Use AWS Managed Policies ● Do not share access keys ● Use Roles for Applications that run in EC2 ● Use STS to generate temporary security credentials (apps, web applications)
  • 6.
  • 7. STS ● Security Token Service ● Avoid hard coding access key IDs in code ● Use STS for temporary access to aws services ● STS service will generate temporary accessKeyID, secretAccessKey and sessionToken ● Cognito ● OpenId connect
  • 8.
  • 9.
  • 10.
  • 11. AWS Organizations ● Manage multiple aws accounts under one account ● Restrict resources ● Billing Entities ● Business Units ● Environments (dev, test, prod)
  • 12. Cloudtrail ● Log/Record every API call. ● Used for auditing any information ● Automate remediation on incidents
  • 13. Cloudwatch ● Logs from things - Applications, devices, services ● Alarms ● Rules ● Logs ● Dashboard
  • 14. AWS Config ● Infrastructure keeps changing ● AWS Config keeps track of everything that changed in AWS ● Compliance Rules ○ E.g. EIP Attached ○ Cloudtrail Enabled ● Prebuilt and Custom Rules
  • 15. Secret Manager ● Rotate RDS passwords ● Store security credentials ● Retrieve via API calls. ● No hard coding of DB passwords in code
  • 16. Other items ● VPC Flow logs ● Security Groups ● EC2 Key Pairs
  • 17. Other Services ● AWS Inspector ○ Security Assessment Service ○ Scan vulnerabilities ● Macie ○ Discover sensitive data stored in your infrastructure ● Guard Duty ○ Threat detection service ○ Uses data from vpc flow logs, cloudtrail logs, and dns ● KMS (Key management Service) ○ Store keys that encrypts your data
  • 18. Thank you! Shibu Basheer Linkedin / Twitter / Instagram @shibubasheer shibu@cabotsolutions.com