AWS Organizations Flashcards
Master Account
one account controls group policies and single consolidated billing
AWS Control Tower
Setup and manage multi-account environments
- provision to conform to governance and policies
AWS Support Models
- Basic
- Dev
- Business
- Enterprise
Business and Enterprise Support Models
- AWS Shield Advanced: 24/7 support
- AWS IEM: architecture and scaling guidance
- AWS Support API: support calls to access support checks
- Concierge Support
- 15 Trusted Advisor Checks and recommendations
Trusted Advisor
real time guidance for provisioning resources w/ AWS best practices
implement checks: optimize the things
Identity and Access Management
Secure Control of Resources:
- Authentication and Authorization
- Root User
- PW Policies
- IAM Policies
- IAM Roles
Root User
single standalone sign-in identity with total access
PW Policies
8-28 chars
pw must be diff to aws account name/email
apply to all users except root
Accessing IAM
Maagement console, command line tools, SDKs, HTTPS API
IAM Managed Policies
permission set created and administered by AWS
Amazon Resource Name
how standalone policies are named
ex: arn:aws:iam::aws:policy/IAMReadOnlyAccess
IAM Roles
user, app, or service with assigned permission
temp creds for session lifetime
give outsiders access
AWS STS Temp Creds
web service for creating temp creds for validity period
How do you create temporary credentials?
w/ CLI or create from your code
Access Key
digital signatures performed to give apps outside of AWS access
AWS Cognito
AWS SSO
Network Access Control (NACLs)
allows for stateless traffic filtering to all traffic on VPC subnet
Security Groups
“allow only” firewalls, no explicit deny rules
Default Security Group Settings
- comm. b/t all resources w/i SG and all outbound traffic
- return traffic allowed s/ Shield Standard Inspection
- all rules in SG are evaluated
Web App Firewall
control and monitor HTTP/HTTPS requests forwarded to CloudFront (CDN), Application Elastic Load balancer, or API Gateway
Permissive
allow all requests except ones you designate
restrictive
block all requests except ones you designate
Matching condition sets
- country of request origin
- originating IPv4 and 6 addressses
- values in HTP request headers
- lengths o URIs, args, fields, field cts
- literal or regex string patterns
- SQL injection code presence
- Cross site scripting code presence
- cross site request forgery code
AWS Shield
- DDOS protection
- DoS floods and exploits
- layered defense -NACLs, SG, WAF
Amazon Inspector
automated security assessment to enhance security and compliance
Guard duty
fully managed threat detection
- looks for anomolies and unauthorized actions
- monitors for zero-day activities
- machine learning and AI algorithms
Client Side Encryption
app data encrypted before going to other AWS services
Server Side Encryption
data encrypted by service that receives ti
AWS KMS
customer master keys - encrypt and decrypt data and generate data keysused outside of AWS
