The document discusses networking and security services on AWS. It begins with an introduction to Amazon Virtual Private Cloud (Amazon VPC) which provides logical isolation for workloads in AWS. It describes how subnets divide the VPC and control internet accessibility. It also discusses security tools like network access control lists, security groups, route tables and how services like Elastic Load Balancing (ELB) and Amazon Route 53 can be used to configure DNS settings. The document outlines the shared responsibility model for security between AWS and customers and security services like IAM, AWS CloudTrail and AWS Trusted Advisor.

1. 2 9 S E P T E M B E R 2 0 2 2 | A P A C
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

2. Introduction to AWS services
Networking & security
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Jack Romanous
Associate Technical Trainer
Amazon Web Services

3. Networking
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. Amazon Virtual Private Cloud (Amazon VPC)
Amazon
VPC
Provides logical
isolation for
your workloads
Dev Test
Allows custom access
controls and security
settings for your resources
Your private
network space in
the AWS Cloud
VPC
AWS Cloud
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. Using subnets to divide your VPC
A subnet is a segment or partition of
a VPC’s IP address range where you
can isolate a group of resources
Subnets define internet accessibility
Private subnets
• No routing table entry to an
internet gateway
• Not directly accessible from the
public internet
Availability Zone A
Public subnet
Private subnet
Availability Zone B
Public subnet
Private subnet
VPC
10.0.0.0/21 (10.0.0.0-10.0.7.255)
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. Route table
Structure your infrastructure
• Network access control lists (ACLs)
• Allow/deny traffic in and out of subnets
• Hardens security as a secondary level of
defense at the subnet level
Internet
gateway
Network ACL Subnet SG
Security groups
• Used to allow traffic to/from at the
network interface (instance) level
• Usually administered by
application developers
VPC
EC2
instance 1
10.1.1.6
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. Elastic Load Balancing (ELB)
A managed load balancing service that distributes
incoming application traffic across multiple Amazon EC2
instances, containers, and IP addresses
Elastic Load
Balancing
High
availability
Health
checks
Security
features User
traffic
ELB
App
App
App
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

8. Amazon Route 53
Amazon
Route 53
configure DNS settings
• Provides tools for flexible, high-
performance, highly available
architectures on AWS
• Multiple routing options
N.Virginia Singapore
Route 53 is a highly available and scalable cloud
Domain Name System (DNS) service
• DNS translates domain names
into IP addresses
www.example.com
• Able to purchase and manage
domain names and automatically
VPC VPC
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. Putting it all together
Amazon EC2
Auto Scaling group
EC2 instances
AWS Cloud
Clients Internet
gateway
Amazon
Route 53
ELB
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. Security
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. Security is our top priority
Designed for
security
Constantly
monitored
Highly
automated
Highly
available
Highly
accredited
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

12. Shared responsibility model
Customer
responsibility
AWS
responsibility
AWS foundation services
Compute Storage Databases Networking
AWS global infrastructure
Availability Zones
Regions Edge locations
Platform, applications, identity and access management
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Operating system, network, and firewall configuration
Customer data
Network traffic
protection (encryption,
integrity, identity)
Client-side data
encryption and data
integrity authentication
Server-side encryption
(file system and/or data)

13. AWS Identity and Access Management (IAM)
Securely control access to your AWS resources
• Assign granular permissions to users, groups, or
roles
• Share temporary access to your AWS account
• Federate users in your corporate network or
with an internet identity provider
IAM
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. IAM
Permissions
Create
Defines permissions
to control which AWS
resources users can access
Helps you to meet identity
and access control standards
• Authentication
• Authorization
Users
A person or application
that interacts with AWS
Groups
Collection of users with
identical permissions
Roles
Temporary privileges that
an entity can assume
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Policies
IAM components

15. Amazon S3 access control: General
Anyone
else
Private
Anyone
else
Public
Controlled
access
Some services support resource-based policies, such as S3 bucket policies
Default Public Access policy
Owner Owner Owner
User A
User B
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. AWS CloudTrail
Track user activity and API usage in your AWS account
• Continuously monitor user activities and record
API calls
• Useful for compliance auditing, security analysis,
and troubleshooting
• Log files are delivered to Amazon S3 buckets
AWS
CloudTrail Who? Where?
When?
What?
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
API security-relevant information

17. What is AWS Trusted Advisor?
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A service providing guidance to help you reduce cost,
increase performance, and improve security

18. Thank you for attending AWSome Day Online Conference
We hope you found it interesting! A kind reminder to complete the survey.
Let us know what you thought of today’s event and how we can improve the event
experience for you in the future.
aws-apj-marketing@amazon.com
twitter.com/AWSCloud
facebook.com/AmazonWebServices
youtube.com/user/AmazonWebServices
linkedin.com/company/amazon-web-services
twitch.tv/aws
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. Test your knowledge
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. Thank you!
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.