Download to read offline
![© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS IAM Hierarchy of Privileges
AWS Account
Owner (Root)
AWS IAM
User
Temporary
Security
Credentials
Permissions Example
Unrestricted access to all
enabled services and
resources.
Action: *
Effect: Allow
Resource: *
(implicit)
Access restricted by
Group and User policies
Action:
[‘s3:*’,’sts:Get*’]
Effect: Allow
Resource: *
Access restricted by
generating identity and
further by policies used
to generate token
Action: [ ‘s3:Get*’ ]
Effect: Allow
Resource:
‘arn:aws:s3:::mybucket/*’
Enforce principle of least privilege with Identity and Access Management (IAM)
users, groups, and policies and temporary credentials.](https://image.slidesharecdn.com/new-module5-security-overview-191024205408/75/Pitt-Immersion-Day-Module-5-security-overview-25-2048.jpg)
Uploaded byEagleDream Technologies
Pitt Immersion Day Module 5 - security overview
The document provides an overview of AWS cloud security concepts, including the shared responsibility model and identity and access management (IAM). It discusses how AWS is responsible for security of the cloud, including physical and network security of data centers, while customers are responsible for security in the cloud, such as operating systems and applications. The document also describes IAM principles for authentication, authorization, and auditing using tools like IAM users, policies, and CloudTrail.
More Related Content
Similar to Pitt Immersion Day Module 5 - security overview
![[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-themodernstackbuildingwebaiapplicationswithserverless-251124030844-388cf04f-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...](https://cdn.slidesharecdn.com/ss_thumbnails/md-mobileengineerandsoftwareengineerarewestillrelevantsidiqpermana-251127010650-55224ef1-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
Pitt Immersion Day Module 5 - security overview
- 1. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.
- 2. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Dustin Potter, dustin.potter@eagledream.com Date Security Essentials & Best Practices
- 3. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Overview Overview of the AWS cloud security concepts such as the AWS Security Center, Shared Responsibility Model, and Identity and Access Management.
- 4. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 1 AWS Security
- 5. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. What are your perceptions on cloud security?
- 6. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. At AWS, cloud security is job zero. All AWS customers benefit from a data center and network architecture built to satisfy the requirements of the most security-sensitive organizations.
- 7. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Glacier Vault Lock & SEC Rule 17a-4(f) Broad Accreditations & Certifications See https://aws.amazon.com/compliance/programs/ for full list
- 8. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 2 Shared Responsibility Model
- 9. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Shared Responsibility Model Facilities Physical security Compute infrastructure Storage infrastructure Network infrastructure Virtualization layer (EC2) Hardened service endpoints Rich IAM capabilities Network configuration Security groups OS firewalls Operating systems Applications Proper service configuration AuthN & acct management Authorization policies + = Customer . • Scope of responsibility depends on the type of service offered by AWS: Infrastructure, Container, Abstracted Services • Understanding who is responsible for what is critical to ensuring your AWS data and systems are secure!
- 10. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Client-side Data Encryption Server-side Data Encryption Network Traffic Protection Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Customer content Shared Responsibility Model Customers are responsible for their security and compliance IN the Cloud AWS is responsible for the security OF the Cloud CustomerAWS
- 11. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Your own accreditation Meet your own security objectives Your own certifications Your own external audits Customer scope and effort is reduced Better results through focused efforts Built on AWS consistent baseline controls CustomerAWS
- 12. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. • Amazon has been building large-scale data centers for many years. • Important attributes: – Non-descript facilities – Robust perimeter controls – Strictly controlled physical access – Two or more levels of two-factor authentication • Controlled, need-based access. • All access is logged and reviewed. • Separation of Duties – Employees with physical access don’t have logical privileges. AWS Responsibilities Physical Security of Data Center
- 13. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. • Host (hypervisor) operating system • Individual SSH keyed logins via bastion host for AWS admins • All accesses logged and audited • Guest (EC2 Instance) operating system • Customer controlled (customer owns root/admin) • AWS admins cannot log in • Customer-generated keypairs • Stateful firewall • Mandatory inbound firewall, default deny mode • Customer controls configuration via Security Groups AWS Responsibilities EC2 Security • IP Spoofing prohibited at host OS level. • Packet sniffing (promiscuous mode) is ineffective (protected at hypervisor level). • Unauthorized Port Scanning a violation of TOS and is detected/blocked. • Inbound ports blocked by default. Network Security
- 14. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. • Most updates are done in such a manner that they will not impact the customer. • Changes are authorized, logged, tested, approved, and documented. • AWS will communicate with customers, either via email, the AWS Service Health Dashboard (http://status.aws.amazon.com/), or the AWS Personal Health Dashboard (https://phd.aws.amazon.com/) when there is a potential for service being affected. AWS Responsibilities Configuration Management • Scalable, fault tolerant services. • All availability zones (AZs) are always on. • There is no “Disaster Recovery Datacenter” • All managed to the same standards • Robust Internet connectivity • Each AZ has redundant, Tier 1 ISP Service Providers • Resilient network infrastructure Built for “Continuous Availability”
- 15. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. • Proprietary disk management prevents customers from accessing each other’s data. • Disks wiped prior to use. • Disks can also be encrypted by the customer for additional security. AWS Responsibilities Disk Management • All storage devices go through process using techniques from: • DoD 5220.22-M (“National Industrial Security Program Operating Manual “). • NIST 800-88 (“Guidelines for Media Sanitization”). • Ultimately devices are: • Degaussed. • Physically destroyed. Storage Device Decommissioning
- 16. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Under the AWS Shared Responsibility Model AWS Responsibility? or Customer Responsibility? Configuring the Security Group rules that determine which ports are open on the EC2 Linux instance Toggling on the Server-side encryption feature for S3 buckets Patching the operating system with the latest security patches Installing camera systems to monitor the physical datacenters Shredding disk drives before they leave a datacenter Preventing packet sniffing at the hypervisor level Securing the internal network inside the AWS datacenters
- 17. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Under the AWS Shared Responsibility Model AWS Responsibility? or Customer Responsibility? Configuring the Security Group rules that determine which ports are open on the EC2 Linux instance Toggling on the Server-side encryption feature for S3 buckets Patching the operating system with the latest security patches Installing camera systems to monitor the physical datacenters Shredding disk drives before they leave a datacenter Preventing packet sniffing at the hypervisor level Securing the internal network inside the AWS datacenters
- 18. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 3 Identity and Access Management
- 19. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. What is Identity Management? “…the management of individual principals, their authentication, authorization, and privileges …with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks.” (Wikipedia)
- 20. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AAA with AWS Authenticate IAM Username/Password Access Key (+ MFA) Federation Authorize IAM Policies Audit CloudTrail
- 21. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Operating Systems • Identities: Developers, and/or Systems Engineers Applications • Identities: Application Users, Application Administrators Considerations for Layers of Principals Amazon Web Services • Identities: Developers, Solutions Architects, Testers, Software/Platform • Interaction of AWS Identities: • Provisioning/deprovisioning EC2 instances and EBS storage. • Configuring Elastic Load Balancers. • Accessing S3 Objects or data in DynamoDB. • Accessing data in DynamoDB. • Interacting with SQS queues. • Sending SNS notifications.
- 22. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Principals • Access to specific services. • Access to console and/or APIs. • Access to Customer Support (Business and Enterprise). IAM Users, Groups and Roles • Access to specific services. • Access to console and/or APIs. Temporary Security Credentials • Access to all subscribed services. • Access to billing. • Access to console and APIs. • Access to Customer Support. Account Owner ID (Root Account)
- 23. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Identity Authentication Authentication: How do we know you are who you say you are? AWS Management Console API access Login with Username/Password with optional MFA (recommended) Access API using Access Key + Secret Key, with optional MFA ACCESS KEY ID Ex: AKIAIOSFODNN7EXAMPLE SECRET KEY Ex: UtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY For time-limited access: Call the AWS Security Token Service (STS) to get a temporary AccessKey + SecretKey + session token For time-limited access: a Signed URL can provide temporary access to the Console
- 24. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Authorization and Privileges Authorization: What are you allowed to do? Account Owner (Root) • Privileged for all actions. IAM Policies • Privileges defined at User and Resource Level Note: Always associate the account owner ID with an MFA device and store it in a secured place!
- 25. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS IAM Hierarchy of Privileges AWS Account Owner (Root) AWS IAM User Temporary Security Credentials Permissions Example Unrestricted access to all enabled services and resources. Action: * Effect: Allow Resource: * (implicit) Access restricted by Group and User policies Action: [‘s3:*’,’sts:Get*’] Effect: Allow Resource: * Access restricted by generating identity and further by policies used to generate token Action: [ ‘s3:Get*’ ] Effect: Allow Resource: ‘arn:aws:s3:::mybucket/*’ Enforce principle of least privilege with Identity and Access Management (IAM) users, groups, and policies and temporary credentials.
- 26. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Identity and Access Management (IAM) Securely control access to AWS services and resources for your users. Username/ User Manage groups of users Centralized Access Control • Password for console access. • Policies for controlling access AWS APIs. • Two methods to sign API calls: • X.509 certificate • Access/Secret Keys • Multi-factor Authentication (MFA) Optional Configurations:
- 27. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. LDAP Directories Identity and Access Management User DB Common approaches for Applications and Operating Systems Local User Databases AWS Directory Service Domain Controller • On-premise accessed over VPN. • Replicated to AWS (read-only or read/write) • Federated (one-way trusts, ADFS). • Managed Samba-based directories via AWS Directory Services. • Local Password (passwd) files • Local Windows admin accounts • User Databases
- 28. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Directory Service Managed service for Active Directory Use your existing Corporate Credentials for • AWS-based applications • AWS Management Console AD Connector Connect to your on- premises Active Directory. Integrates with existing RADIUS MFA solutions. Simple AD A Microsoft Active- Directory compatible directory powered by Samba 4. Microsoft AD Based on Microsoft Active Directory in Windows Server 2012 R2. Supports adding trust relationships with on-premises domains. Extend your schema using MS AD
- 29. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 4 Encryption
- 30. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. How are you currently encrypting your data?
- 31. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Encryption Protecting data in-transit and at-rest. Details about encryption can be found in the AWS Whitepaper, “Securing Data at Rest with Encryption”. Encryption In-Transit HTTPS SSL/TLS VPN / IPSEC SSH Encryption At-Rest Object Database Filesystem Disk
- 32. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Encryption at Rest Volume Encryption EBS Encryption Filesystem Tools AWS Marketplace/Partner Object Encryption S3 Server Side Encryption (SSE) S3 SSE w/ Customer Provided Keys Client-Side Encryption Database Encryption Redshift Encryption RDS PostgreSQL KMS RDS MYSQL KMS RDS ORACLE TDE/HSM RDS MSSQL TDE
- 33. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Certificate Manager AWS Certificate Manager (ACM) makes it easy to provision, manage, deploy, and renew SSL/TLS certificates on the AWS platform.
- 34. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Key Management Service Customer Master Key(s) Data Key 1 Amazon S3 Object Amazon EBS Volume Amazon Redshift Cluster Data Key 2 Data Key 3 Data Key 4 Managed service to securely create, control, rotate, and use encryption keys.
- 35. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS CloudHSM AWS CloudHSM AWS Administrator – manages the appliance You – control keys and crypto operations Amazon Virtual Private Cloud Help meet compliance requirements for data security by using a dedicated Hardware Security Module appliance with AWS. • Dedicated, single-tenant hardware device • Can be deployed as HA and load balanced • Customer use cases: • Oracle TDE • MS SQL Server TDE • Setup SSL connections • Digital Rights Management (DRM) • Document Signing
- 36. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 5 Configuration Management
- 37. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Amazon Inspector • Vulnerability Assessment Service • Built from the ground up to support DevSecOps • Automatable via APIs • Integrates with CI/CD tools • On-Demand Pricing model • Static & Dynamic Rules Packages • Generates Findings
- 38. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS WAF
- 39. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS CloudTrail Web service that records AWS API calls for your account and delivers logs. Who? When? What? Where to? Where from? Bill 3:27pm Launch Instance us-west-2 72.21.198.64 Alice 8:19am Added Bob to admin group us-east-1 127.0.0.1 Steve 2:22pm Deleted DynamoDB table eu-west-1 205.251.233.176
- 40. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS CloudWatch Monitoring services for AWS Resources and AWS-based Applications. Monitor and Store Logs Set Alarms (react to changes) View Graphs and Statistics Collect and Track Metrics What does it do? How can you use it? React to application log events and availability Automatically scale EC2 instance fleet View Operational Status and Identify Issues Monitor CPU, Memory, Disk I/O, Network, etc. CloudWatch Logs / CloudWatch Events CloudWatch Alarms CloudWatch Dashboards CloudWatch Metrics
- 41. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. VPC Flow Logs • Agentless • Enable per ENI, per subnet, or per VPC • Logged to AWS CloudWatch Logs • Create CloudWatch metrics from log data • Alarm on those metrics AWS account Source IP Destination IP Source port Destination port Interface Protocol Packets Bytes Start/end time Accept or reject
- 42. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. VPC Flow Logs • Amazon Elasticsearch Service • Amazon CloudWatch Logs subscriptions
- 43. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Service Catalog Self-service portal for creating and managing resources in AWS. Administrator CloudFormation TemplateCreate Portfolio w/Permissions Service Catalog Product Notifications Portfolio Product A Product B Deployed Stack(s) Notifications Launch Products Browse Products EndUsers • Create and manage approved catalogs of resources. • End users browse and launch products via self-service portal. • Control user access to applications or AWS resources per compliance needs. • Extensible via API to existing self-service frameworks.
- 44. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Config Managed service for tracking AWS inventory and configuration, and configuration change notification. AWSConfig EC2 VPC EBS CloudTrail Change Management Audit Compliance Security Analysis Troubleshooting Discovery
- 45. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 6 Additional Best Practices
- 46. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Trusted Advisor Leverage Trusted Advisor to analyze your AWS resources for best practices for availability, cost, performance and security.
- 47. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Amazon Macie Leverage Amazon Macie to help prevent data loss in AWS.
- 48. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Marketplace Security Partners Infrastructure Security Logging & Monitoring Identity & Access Control Configuration & Vulnerability Analysis Data Protection
- 49. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Enforce consistent security on your hosts Launch instance EC2 AMI catalog Running instance Your instance Hardening Audit and logging Vulnerability management Malware protection Whitelisting and integrity User administration Operating system Configure instance Configure and harden EC2 instances based on security and compliance needs. Host-based Protection Software Restrict Access Where Possible Launch with IAM Role
- 50. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Defense-in-Depth AWS Compliance Program Third Party Attestations Physical Security Groups VPC Configuration Network Web App Firewalls Bastion Hosts Encryption In-Transit Hardened AMIs OS and App Patch Mgmt. IAM Roles for EC2 IAM Credentials SystemSecurity Logical Access Controls User Authentication Encryption At-Rest DataSecurity
- 51. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. 7 AWS Security Center
- 52. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Security Center Comprehensive security portal to provide a variety of security notifications, information and documentation. Security Whitepapers • Overview of Security Process • AWS Risk and Compliance • AWS Security Best Practices Security Bulletin Security Resources Vulnerability Reporting Penetration Testing Requests Report Suspicious Emails http://aws.amazon.com/security
- 53. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Security Blog http://blogs.aws.amazon.com/security/ Subscribe to the blog – it’s a great way to stay up-to- date on AWS security and compliance. Security Resources http://aws.amazon.com/security/security-resources/ Developer Information, Articles and Tutorials, Security Products, and Whitepapers
- 54. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. AWS Compliance List of compliance, assurance programs and resources: http://aws.amazon.com/compliance/. Glacier Vault Lock & SEC Rule 17a-4(f) 27018
- 55. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ? Questions
- 56. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.
- 57. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.
- 58. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.
- 59. © 2019, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.
Editor's Notes
- #9 Start the session off with this question to engage the audience, and spark discussion. Get a sense of where their understanding of cloud security is. This will also give you (the presenter) a sense of the areas to focus on during the presentation
- #14 There’s a shared responsibility to accomplish security and compliance objectives in AWS cloud. There are some elements that AWS takes responsibility for, and others that the customer must address. The outcome of the collaborative approach is positive results seen by customers around the world.
- #15 We look after the security OF the cloud, and you look after your security IN the cloud.
- #16 Segway to talk about FedRAMP potentially and share your experiences from around the world!
- #21 This is a quick quiz to keep the audience engaged, and test their understanding of the AWS Shared Responsibility Model which is one of the most important take-aways we want attendees to have. If they get any answer wrong, use that opportunity to further clarify why the answer is a wrong one.
- #22 This is a quick quiz to keep the audience engaged, and test their understanding of the AWS Shared Responsibility Model which is one of the most important take-aways we want attendees to have. If they get any answer wrong, use that opportunity to further clarify why the answer is a wrong one.
- #24 IAM allows you to implement a comprehensive access control on AWS resources. IAM is giving you the ability to Authenticate, Authorize, Log all access. -> Authenticate, including regular credentials or with strong authentication for your privilege users (or everybody), as well authenticate an other AWS accounts or even trust other Identity Providers -> Authorize with granularity who can do what. Therefore you can implement Least Privilege and Segregation of Duties. -> And finally, Log every allow and deny in CloudTrail, for troubleshoot or audit purposes. Basically when you think Access control with AWS resources then think IAM… Every time.
- #26 Key takeaway here is: Identities for Applications and Operating Systems are outside of the scope of AWS IAM
- #27 Temporary credentials duration lasts from 15 minutes to 12 hours
- #28 The key takeaway here is that you use different approaches to login to the Console vs API access.
- #29 Account Owner Can do anything IAM Policies User Level Resource Level
- #31 A username for each user Groups to manage multiple users Centralized access control Optional provisions: Password for console access Policies to control access to AWS APIs Two methods to sign API calls: X.509 certificate Access Key ID + Secret Access Key Multifactor Authentication
- #32 LDAP Directories: EC2 instances access on-premise directory servers via VPN. Directory servers replicated to AWS as read-only or read/write directory servers on EC2 instance(s). Create federation via one-way trust or Active Directory Federation Services. Leverage AWS Directory Services for Samba-based directory services.
- #35 Use this question as a conversation starter to discuss the value of encryption, why it’s not just for financial services and healthcare, and how AWS not only provides for encryption, but makes it easier.
- #36 For customers with HIPAA compliance requirements. Keep hidden otherwise.
- #38 This slide is not about teaching what encryption is or the differences between transit and rest. It is about mentioning that not only do we provide our customers the ability to encrypt their data as it sits and flows through and in/out of our environment, but that we provide many services and features that make it easier. You should call out KMS, CloudHSM, VGW, EBS encryption, ELB SSL offloading, RDS Oracle TDE, MSSQL TDE, S3 object encryption, etc. If the customer is currently not encrypting data (either in transit or at rest), this might be a good place to discuss the differences and emphasis the need to do so under the shared responsibility model.
- #40 Provision trusted SSL/TLS certificates from AWS for use with AWS resources: Elastic Load Balancing Amazon CloudFront distributions AWS handles the muck Key pair and CSR generation Managed renewal and deployment Domain validation (DV) through email Available through AWS Management console, CLI, or API
- #41 AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys. AWS Key Management Service is integrated with several other AWS services to help you protect your data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs. Integrated with AWS SDKs and AWS services: S3, EBS, AWS Import/Export Snowball, RDS, Redshift, CodeCommit, CloudTrail, EMR, Kinesis Firehose, Elastic Transcoder, SES, WorkSpaces, WorkMail Centralized control. Easy and automatic key rotation (KMS keeps track of old keys for decryption) *New Feature*: Bring your own keys to KMS
- #42 The most important part about the CloudHSM service is that you and only you control the keys stored on the HSM. Because of the properties of the HSM that we discussed earlier, separation of duties and physical protection of the keys, and third party validation, you can trust that the HSM is securely storing your keys so that you and only you have access to the keys. AWS manages and monitors the HSM appliances, but does not have access to the keys. In fact, if you lose the access to your credentials, AWS can’t help you recover your key material. You can recover from your own backup if you have a backup with the required credentials. The CloudHSM appliances are inside your VPC, so you can use familiar network security groups and ACLs to limit access to the HSM. We use SafeNet Luna SA HSMs with the service today. CloudHSM customers are using it to protect master keys for database encryption such as Oracle TDE or MS SQL Server TDE, With Apache to protect the private key used to set up SSL connections, for Digital Rights Management (DRM), and for document signing. You can find out more about CloudHSM at aws.amazon.com/cloudhsm
- #44 Inspector is an automated security assessment service to help improve the security and compliance of applications deployed on AWS.
- #45 Let’s talk about why we built the WAF based on customer feedback. WAF was initially a CDN offering, but now integrates with ELB as well WAFs help protect web sites & applications against attacks that cause data breaches and downtime. General WAF use cases Protect from SQL Injection (SQLi) and Cross Site Scripting (XSS) Prevent Web Site Scraping, Crawlers, and BOTs Mitigate DDoS (HTTP/HTTPS floods) Gartner reports that main driver of WAF purchase (25-30%) is PCI compliance
- #46 Who made the API call? When was the API call made? What was the API call? Which resources were acted up on in the API call? Where was the API call made from and made to? Stored durably in S3 Discuss ways to consume CloudTrail logs (Console, CLI, Splunk, SumoLogic, AlertLogic, Loggly, DataDog, etc.)
- #47 You can use Amazon CloudWatch to gain system-wide visibility into resource utilization, application performance, and operational health. You can use these insights to react and keep your application running smoothly.
- #48 No Agents! Just Turn it on. No really, Ill wait. Enable per ENI, per Subnet or per VPC All network traffic data is logged to CloudWatch logs so you get durable storage but also all the analysis features such as filter queries and metric creation And then Create Alarms on those metrics Collected, processed and stored in ~10 minute capture windows into Cloudwatch Logs
- #49 Or roll your own real time network dashboard with the new Amazon Elasticsearch Service Also based on a CloudWatch Logs Subscription filter that tees Flow Log data into a Kinesis stream and a stream reader then takes data and puts it into Elasticsearch See Jeff’s blog post where he details how to setup this VPC Flow Dashboard in a few clicks
- #51 AWS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. With AWS Config you can discover existing AWS resources, export a complete inventory of your AWS resources with all configuration details, and determine how a resource was configured at any point in time. These capabilities enable compliance auditing, security analysis, resource change tracking, and troubleshooting. Use Cases: Security analysis: Am I safe? Audit compliance: Where is the evidence? Change management: What will this change affect? Troubleshooting: What has changed? Discovery: What resources exist?
- #52 A Config Rule represents desired configurations for a resource and is evaluated against configuration changes on the relevant resources, as recoded by AWS Config. The results of evaluating a rule against the configuration of a resource are available on a dashboard. Using Config Rules, you can assess your overall compliance and risk status from a configuration perspective, view compliance trends over time and pinpoint which configuration change caused a resource to drift out of compliance with a rule. Notes: This slide is very similar to the previous one. It adds the concept of Config Rules. It should be noted that although the “Changing Resources” are moved off the page with the animation, they are still important and not being replaced. We’re just making room. It’s probably a good idea to read all the Config Rule faqs from the public page to make sure you’re comfortable discussing the different elements.
- #54 Discuss the Four Pillars of being Well Architected and how TA helps you with this. These are the reasons most of our customers use AWS. Give some examples of some of the checks in at least two pillars.
- #55 Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property, and provides customers with dashboards and alerts that give visibility into how this data is being accessed or moved. The fully managed service continuously monitors data access activity for anomalies, and generates detailed alerts when it detects risk of unauthorized access or inadvertent data leaks. Amazon Macie utilizes machine learning to automatically classify and provide visibility to understand where important business data exists across an AWS environment. Features include: automated content classification, data access and context about whether a user account or group of user accounts are exhibiting unusual behavior. Amazon Macie starts by identifying and protecting the data that attackers are likely to target. Amazon Macie automatically learns jargon, internal project names, and estimates the business value for each object and file across a company's network within S3. For large organizations, this can be hundreds of millions of documents.
- #56 AWS Security Partners offer hundreds of industry-leading products that are equivalent, identical to, or integrate with existing controls in your on-premises environments. These products complement the existing AWS services to enable you to deploy a comprehensive security architecture and a more seamless experience across your cloud and on-premises environments. Infrastructure Security Designed to identify and protect your applications and data from cyber-attacks and other advanced threats vectors. Logging & Monitoring Maintain visibility and auditability of activity in your application infrastructure, while providing policy-driven alerting, and reporting. Identity & Access Control Help define and manage access policies to enforce business governance including, user authentication, SSO, and enforcement. Configuration & Vulnerability Analysis Help inspect your application deployments for security risks and vulnerabilities, while providing priorities and advice to assist with for remediation. Data Protection Assist with safeguarding your data from unauthorized disclosure and modification, through encryption, key management, and policy-driven controls.
- #57 Discuss the importance of hardening the EC2 instances. Discuss the lifecycle of creating an instance, hardening, and then creating a reusable AMI again. Stress the importance of AMI management and bootstrapping.
- #58 Your security posture is determined by the “whole” of the mechanisms you employ. This slide should serve as a review, but be sure to address any questions here.
- #60 The main point of this slide is to introduce the fact that AWS takes security very seriously. We dedicate an entire section of our website to the Security and Compliance Center to communicate with our customers providing things like: Security and Compliance whitepapers Security best practice whitepapers Security bulletins Requests for customer penetration testing This presentation is a brief overview of the information on this site, please be aware of it and check out the site for more details and information.