Governance & Security Flashcards
1
Q
AWS Global Infrastructure
A
Edge locations and Regional Edge Cache
Local Zones
Availability Zones
Regions
2
Q
AWS Regions
A
- A region is a geographical area
- Each region consists of 2 or more availability zones
- Isolated from other AWS Regions
3
Q
Availability Zones
A
- Availability Zones are physically separate and isolated from each
other - AZs span one or more data centers
- Each AZ is designed as an independent failure zone
4
Q
Local Zones
A
- AWS Local Zones place compute, storage, database, and other select
AWS services closer to end-users - Extension of an AWS Region where you can run your latency sensitive
applications
5
Q
Edge Locations and Regional Edge Caches
A
- Edge locations are Content Delivery Network (CDN) endpoints for
CloudFront - There are many more edge locations than regions
- Regional Edge Caches sit between your CloudFront Origin servers and
the Edge Locations - A Regional Edge Cache has a larger cache-width than each of the
individual Edge Locations
6
Q
Advantages of cloud?
A
- Trade capital expense for variable expense
- Benefit from massive economies of scale
- Stop guessing about capacity
- Increase speed and agility
- Stop spending money running and maintaining data centres
- Go global in minutes
7
Q
IAM Best Practices - General
A
- Create individual IAM users
- Use groups to assign permissions to IAM users
- Grant least privilege
- Use access levels to review IAM permissions
- Monitor activity in your AWS account
8
Q
IAM Best Practices - Roles
A
*Use roles for applications that run on Amazon EC2 instances
* Use roles to delegate permissions
9
Q
IAM Best Practices - Policies
A
- Get started using permissions with AWS managed policies
- Use customer managed policies instead of inline policies
- Use policy conditions for extra security
10
Q
IAM Best Practices - Credential Management
A
- Lock away your AWS account root user access keys
- Configure a strong password policy for your users
- Enable MFA
- Do not share access keys
- Rotate credentials regularly
- Remove unnecessary credentials
11
Q
Amazon EC2 Metadata and User Data
A
- User data is data that is supplied by the user at instance
launch in the form of a script - Instance metadata is data about your instance that you can use to configure or manage the running instance
- User data and metadata are not encrypted
- Instance metadata is available at
http://169.254.169.254/latest/meta-data
12
Q
Access keys
A
- Access keys can be used on EC2 instances to gain permissions
to other AWS services - Access keys are stored in plaintext so this is not secure
- Better to use IAM roles whenever possible and avoid access
keys
13
Q
AWS Organizations
A
- Allows you to consolidate multiple AWS accounts into an
organization that you create and centrally manage - Available in two feature sets:
- Consolidated Billing
- All features
- Includes root accounts and organizational units
- Policies are applied to root accounts or OUs
14
Q
AWS Organization Consolidated billing includes?
A
- Paying Account – independent and cannot access resources of other
accounts - Linked Accounts – all linked accounts are independent
15
Q
AWS Control Tower
A
- Simplifies the process of creating multi-account environments
- Sets up governance, compliance, and security guardrails for
you - Integrates with other services and features to setup the
environment for you including: - AWS Organizations, SCPs, OUs, AWS Config, AWS CloudTrail,
Amazon S3, Amazon SNS, AWS CloudFormation, AWS Service
Catalog, AWS Single Sign-On (SSO)
16
Q
AWS Systems Manager
A
- Manages many AWS resources including Amazon EC2, Amazon
S3, Amazon RDS etc. - Systems Manager Components:
- Automation – uses documents to run automations
- Run Command – run commands on EC2 instances
- Inventory – gather inventory information
- Patch Manager – manage patching schedules and installation
- Session Manager – connect securely without SSH or RDP
- Parameter Store – store secrets and configuration data securely
17
Q
AWS Service Catalog
A
- Allows organizations to create and manage catalogs of IT
services that are approved for use on AWS - Allows you to centrally manage commonly deployed IT
services - IT services can include virtual machine images, servers,
software, and databases and multi-tier application
architectures - Enables users to quickly deploy only the approved IT services
they need
18
Q
AWS Config
A
- Fully-managed service for compliance management
- Helps with compliance auditing, security analysis, resource
change tracking and troubleshooting
19
Q
Trusted Advisor
A
- Online resource that helps to reduce cost, increase
performance and improve security by optimizing your AWS
environment - Provides real time guidance to help you provision your
resources following best practices - Advises you on Cost Optimization, Performance, Security,
and Fault Tolerance
20
Q
AWS Personal Health Dashboard
A
- Provides alerts and remediation guidance when AWS is
experiencing events that may impact you - Gives you a personalized view into the performance and
availability of the AWS services underlying your AWS
resources - Also provides proactive notification to help you plan for
scheduled activities
21
Q
Service Health Dashboard
A
- Shows you current status of AWS services
- Not personalized
22
Q
AWS Directory Services
A
AWS Directory Service
for Microsoft Active
Directory
AD Connector
Simple AD
23
Q
AWS Directory Service for Microsoft Active Directory - description, use case
A
Service Description
AWS-managed full Microsoft AD running on Windows Server 2012 R2
Use Case
Enterprises that want hosted Microsoft Active Directory
24
Q
AD Connector - description, use case
A
AD Connector Allows on-premises users to log into AWS services with their existing AD credentials
Use Case
Single sign-on for on-premises employees
25
Q
Simple AD - description, use case
A
Low scale, low cost, AD implementation based on Samba
Use case: Simple user directory, or you need LDAP compatibility
26
Q
AWS Systems Manager Parameter Store
A
- Provides secure, hierarchical storage for configuration data
management and secrets management - You can store data such as passwords, database strings, and
license codes as parameter values - You can store values as plaintext (unencrypted data) or
ciphertext (encrypted data) - You can then reference values by using the unique name that
you specified when you created the parameter
27
Q
AWS Secrets Manager
A
- Similar to Parameter Store
- Allows native and automatic rotation of keys
- Fine-grained permissions
- Central auditing for secret rotation
28
Q
AWS Certificate Manager (ACM)
A
- Create, store and renew SSL/TLS X.509 certificates
- Single domains, multiple domain names and wildcards
- Integrates with several AWS services including:
- Elastic Load Balancing
- Amazon CloudFront
- AWS Elastic Beanstalk
- AWS Nitro Enclaves
- AWS CloudFormation
29
Q
AWS Key Management Service (KMS)
A
- Used for creating and managing encryption keys
- Gives you centralized control over the encryption keys used
to protect your data - KMS is integrated with most other AWS services
- Easy to encrypt the data you store in these services with
encryption keys you control
30
Q
AWS CloudHSM
A
- Cloud-based hardware security module (HSM)
- Generate and use your own encryption keys on the AWS Cloud
- Manage your own encryption keys using FIPS 140-2 Level 3 validated
HSMs - CloudHSM runs in your VPC
31
Q
AWS CloudTrail
A
- CloudTrail logs API activity for auditing
- By default, management events are logged and retained for
90 days - A CloudTrail Trail logs any events to S3 for indefinite
retention - Trail can be within Region or all Regions
- CloudWatch Events can be triggered based on API calls in
CloudTrail - Events can be streamed to CloudWatch Logs
32
Q
VPC Flow Logs
A
- Flow Logs capture information about the IP traffic going to
and from network interfaces in a VPC - Flow log data is stored using Amazon CloudWatch Logs
- Flow logs can be created at the following levels:
- VPC
- Subnet
- Network interface
33
Q
Elastic Load Balancing Access Logs
A
- Capture detailed information about requests sent to the load
balancer - Use to analyze traffic patterns and troubleshoot issues
- Can identify requester, IP, request type etc.
- Can be optionally stored and retained in S3
34
Q
S3 Access Logs
A
- Provides detailed records for the requests that are made to a
bucket - Details include the requester, bucket name, request time, request
action, response status, and error code (if applicable) - Disabled by default
35
Q
Amazon Detective
A
- Analyze, investigate, and quickly identify the root cause of
potential security issues or suspicious activities - Automatically collects data from AWS resources
- Uses machine learning, statistical analysis, and graph theory
- Data sources include VPC Flow Logs, CloudTrail, and
GuardDuty
36
Q
AWS GuardDuty
A
- Intelligent threat detection service
- Detects account compromise, instance compromise,
malicious reconnaissance, and bucket compromise - Continuous monitoring for events across:
- AWS CloudTrail Management Events
- AWS CloudTrail S3 Data Events
- Amazon VPC Flow Logs
- DNS Logs
37
Q
Amazon Macie
A
- Macie is a fully managed data security and data privacy
service - Uses machine learning and pattern matching to discover,
monitor, and help you protect your sensitive data on Amazon
S3 - Macie enables security compliance and preventive security
38
Q
AWS WAF
A
AWS WAF
* AWS WAF is a web application firewall
* Create rules that block common web exploits like SQL
injection and cross site scripting
* The rules are known as Web ACLs
39
Q
AWS Shield
A
AWS Shield
* AWS Shield is a managed Distributed Denial of Service
(DDoS) protection service
* Safeguards web application running on AWS with always-on
detection and automatic inline mitigations
40
Q
AWS Artifact
A
- AWS Artifact provides on-demand access to AWS’ security
and compliance reports and select online agreements - Reports available in AWS Artifact include:
- Service Organization Control (SOC) reports
- Payment Card Industry (PCI) reports
41
Q
AWS Security Hub
A
- Provides a comprehensive view of security alerts and
security posture across AWS accounts - Aggregates, organizes, and prioritizes security alerts, or
findings, from multiple AWS services
42
Q
AWS Security Bulletins
A
- Security and privacy events affecting AWS services are
published (also has an RSS feed)
43
Q
AWS Trust & Safety Team
A
- Contact the AWS Trust & Safety team if AWS resources are
being used for: - Spam
- Port scanning
- Denial-of-service attacks
- Intrusion attempts
- Hosting of objectionable or copyrighted content
- Distributing malware
44
Q
Penetration Testing
A
- Penetration testing is the practice of testing one’s own
application’s security for vulnerabilities by simulating an
attack - AWS allows penetration testing without prior approval for 8
AWS services
