AWS Cloud Security Flashcards
Federation w/ IAM
Federation w/ IAM
Federation can use something other than an ‘individual’ identity sources for AWS IAM access
Example:
Active Directory (like we do at State Farm) --->Connects to AWS IAM via SAML 2.0
Social Providers (gmail, facebook, etc) --->Connects to AWS IAM via OpenID Connect (OIDC)
AWS Single Sign-On (SSO)
AWS Single Sign-On (SSO)
Centralized permissions management
—>Provides access to MULTIPLE AWS Accounts and Organizations w/out having to re-authenticate for each one
Identify Sources
- –>Active Directory (self-managed) or cloud directory(Asure AD)
- –>Business applications
Active Directory (self-managed) identity source connects to SSO via AWS Directory Service
Used for Mobile and Web Apps to obtain temporary, limited-privilege credentials for AWS services via AWS STS (Security Token Service):
AD Connector
AWS Single Sign-On (SSO)
AWS Cognito
AWS Directory Services
AWS Cognito
Used for Mobile and Web Apps
Cognito Identity pools are used to obtain temporary, limited-privilege credentials for AWS services
Identities can come from:
- –>Cognito User Pool - stores actual identities are stored
- –>Identity Provider - external source - social IdPs
Cognito Identity pool uses AWS STS (Security Token Service) to obtain the ‘temporary’ credentials to AWS
—>STS provides access via an IAM role
AWS managed Microsoft Active Directory providing fully managed AWS services on AWS infrastructure. Good option for enterprises that want a hosted Microsoft Active Directory:
AD Connector
AWS Single Sign-On (SSO)
AWS Cognito
AWS Directory Services
AWS Directory Services:
AWS Managed Microsoft Active Directory
Fully managed AWS services on AWS infrastructure
Best choice if you have more than 5,000 users and/or need a trust relationship set up
You can setup trust relationships to extend authentication from on-premises Active Directories into the AWS cloud
On-premises users and groups can access resources in either domain using SSO
Can be uses as a standalone AD in the AWS cloud
Use Case: Enterprises that want hosted Microsoft Active Directory
Self-managed Microsoft Active Directory in your own datacenter that connects your existing on-premise Active Directory to AWS:
AD Connector
AWS Single Sign-On (SSO)
AWS Cognito
AWS Directory Services
AD Connector
Self-managed Microsoft AD in your own datacenter
All Identities are in one place - on premises
A gateway for redirecting directory requests to your on-premise Active Directory
Eliminates need for directory synchronization and the cost of complexity of hosting a federation infrastructure
Connects your existing on-premise AD to AWS
Use Case: Single sign-on for on-premises employees
Compatible w/ Active Directory but very simple, low scale, low cost, Active Directory (AD) implementation based on Samba:
AD Connector
AWS Single Sign-On (SSO)
Simple AD
AWS Directory Services
Simple AD
Compatible w/ Active Directory but very simple
Low scale, low cost, AD implementation based on Samba
Use Case: Simple user directory, or you need LDAP compatibility
AWS Systems Manager Parameter Store
AWS Systems Manager Parameter Store
Stores information in one place but NOT stored in your code
Provides secure, hierarchical storage for configuration data management and secrets management
Highly scalable, available and durable
You can store data such as passwords, database strings, and license codes as parameter values
You can store values as plaintext (unencrypted data) or ciphertext (encrypted data)
You can then reference values by using the unique name that you specified when you created the parameter
AWS Secrets Manager
AWS Secrets Manager
Similar to Parameter Store
Store info (database strings, passwords,etc) in a secure, encrypted place
Can be pulled out using API call
Allows native and automatic rotation of keys
Fine grained permissions
Central auditing for secret rotation
Encryption in Transit VS Encryption at Rest
Encryption in Transit
—When user sends data via HTTPSS it is protected by SSL/TLS (certificate attached to load balancer) in transit.
— Data may not have been encrypted on users machine and may not be encrypted once it gets to AWS, HOWEVER, it IS encrypted while it is in transit thanks to the SSL/TLS certificate.
Encryption at Rest
—Data is encrypted when it is stored
—Amazon S3 encrypts the object as it is written to the bucket using a data encryption key
What is SSL/TLS?
SSL/TLS = Secure Sockets Layer/Transport Layer Security
public and private CERTIFICATES Used to connect your internal connected resources with AWS
Encrypts data while it is IN TRANSIT
Asymmetric Encryption
Asymmetric Encryption
Also known as public key cryptography
Data is passed through encryption process and it becomes encrypted via a Public Key THEN you pass that encrypted data through decryption process via a Private Key and data becomes decrypted
Messages encrypted with the public key can only be decrypted with the Private Key
Messages encrypted with the private key can be decrypted with the public key
Examples include SSL/TLS certificates used to secure websites and SSH (secure shell)
Which AWS service creates, stores and renews SSL/TLS X.509 certificates?
AWS Key Management Service (KMS)
AWS Secrets Manager
AWS CloudHSM
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM)
Create, store and renew SSL/TLS X.509 certificates
Single domains, multiple domain names and wildcards
Integrates w/ several AWS services:
- -Elastic Load Balancing
- -Amazon CloudFront
- -AWS Elastic Beanstalk
- -AWS Nitro Enclaves
- -AWS CloudFormation
Symmetric Encryption
Symmetric Encryption
Data is passed through encryption process and it becomes encrypted via a Data encryption key
To decrypt the data you need the SAME Data encryption key for encryption and decryption
What Multi-tenant AWS service is used to create and manage encryption keys, has AWS managed root of trust and provides broad AWS service support?
AWS Key Management Service (KMS)
AWS Secrets Manager
AWS CloudHSM
AWS Certificate Manager (ACM)
AWS Key Management Service (KMS)
Used for creating and managing encryption keys
Gives you centralized control over the encryption keys used to protect your data
KMS is integrated with most other AWS services
Easy to encrypt the data you store in these services with encryption keys you control
KMS is:
- -MULTI-TENANT AWS Service
- —>Muti-tenant = a single instance of the software and its supporting infrastructure serves multiple customers
- -Highly available and durable key storage and management
- -AWS managed root of trust
- Broad AWS service support
What Single-tenant AWS service is used to create and manage encryption keys in your VPC, has customer managed root of trust and broad 3rd Party support?
AWS Key Management Service (KMS)
AWS Secrets Manager
AWS CloudHSM
AWS Certificate Manager (ACM)
AWS CloudHSM
Similar to KMS but has a higher level of security due to its physical separation and single tenancy
Can be used to created and managed symmetric and asymmetric encryption keys
Cloud-based hardware security module (HSM)
Generate and use your own encryption keys on the AWS Cloud
Manage your own encryption keys using FIPS 140-2 level 3 validated HSM’s
CloudHSM runs in your VPC
CloudHSM is:
- -SINGLE-TENANT Hardware Security Model(HSM)
- —>Single-tenant - a single instance of the software and supporting infrastructure serve a single customer on customer own independent database
Customer-managed durability and availability
Customer managed root of trust
Broad 3rd Party Support
