Domain 2 - Security and Compliance Flashcards
2.1 What is the AWS Shared Responsibility Model?
The Shared Responsibility Model defines how customer operational burdens can be relieved by sharing Security & Compliance duties with AWS.
It defines which components of the customer’s infrastructure AWS is responsible for, which components the Customer is responsible for, and where responsibility overlaps.
Basically, AWS is responsible for “Security of the Cloud” and the Customer is responsible for “Security in the Cloud.”
2.1.1 What are the 6 main areas of Customer responsibility in the AWS Shared Responsibility Model?
- Customer Data
- Platform, Apps, Identity, & Access Management
- OS, Network & Firewall Config
- Client-side data encryption & data integrity authentication
- Server-side encryption
- Networking traffic protection
2.1.1 What are the 7 main areas of AWS responsibility in the AWS Shared Responsibility Model?
Software:
1. Cloud Compute
2. Cloud Storage
3. Cloud Managed DBs
4. Cloud Networking
Hardware/AWS Global Infrastructure:
5. Regions
6. Availability Zones
7. Edge Locations
2.1.2 How does the customer’s responsibility shift depending on the AWS service they use?
Different AWS products offer different levels of service, requiring more or less customer configuration work.
e.g. Infrastructure as a Service (IaaS) services like EC2 are simply infrastructure offerings and as such the customer is responsible for all security configuration and management of whatever they put on that infrastructure. However, abstracted services like Amazon S3 & DynamoDB involve Amazon taking responsibility for the infrastructure management with customers only needing to be responsible for their data, permissions, etc on those services.
2.2.1 Where can you find AWS Compliance Information with lists of recognized available compliance controls?
aws.amazon.com/compliance
or
AWS Audit Manager
2.2.2.1 - How can customers achieve compliance on AWS?
Compliance and its evidence can be setup in AWS Audit Manager where an admin can setup Assessment Frameworks
2.2.2.2 - What are the different encryption options on AWS
In Transit
At Rest
2.2.4.2.1 - What is Amazon CloudWatch
Collects & visualizes real-time logs, metrics, & event data monitoring your cloud resources & applications
2.2.4.2.2 - What is AWS Config
Continually assesses, audits, & evaluates the configurations and relationships of your resources. When config changes happen on your AWS resources, it records & normalizes those changes to evaluate them against your configured compliance policies.
2.2.4.2.3 - What is AWS CloudTrail
Monitors & records account/user activity in your AWS account, giving you monitoring & auditing capabilities to improve your security and allow you to prove compliance with regulations such as SOC/HIPAA/etc,
2.2.5 - What is the concept of least privileged access?
When you set permissions with IAM policies, you should grant only the minimum permissions required to perform a task. Do this by defining the actions that can be taken on specific resources under specific conditions.
2.3.1 - User & Identity Management - What is the purpose of access keys and password policies (rotation, complexity)
Access keys should be rotated often, to keep credentials temporary and avoid long-term credentials which are more likely to be compromised or misused. Passowrd policies are of course important to ensure that credentials to critical infrastructure are not easily compromised.
2.3.1 - User & Identity Management - What is the purpose of Multi-Factor Authentication (MFA)
MFA is critical, especially for root users in your account whose credentials are not temporary. This provides an additional layer of confirmation via an authenticated challenge on another device owned by a user to better ensure that credentials are only used by their authorized users.
2.3.1 - User & Identity Management - What is the purpose of AWS IAM groups/users
IAM users are entities you create AWS that allow specific people/services to interact with your AWS account.
When you create an IAM user, you grant them permissions which will allow them specific access to your AWS resources.
These permissions can be assigned directly to the user, but this is not recommended.
The recommended approach is to create a user group, which can have permissions assigned to it relevant to that group’s required functions, and then an admin can simply assign a user to various groups to grant them the permissions they need as part of those groups.
2.3.1 - User & Identity Management - What are the purpose of IAM Roles?
IAM Roles are granted specific permissions to access your AWS resources. These roles can then be given to machine identities so that they can access AWS within a role session. Essentially, an IAM Role is like an IAM user, except that it is not assigned to a specific person, and its access is not permanent and is limited to a “role session.”
