Module 6 - Security Flashcards
Shared Responsibility Model
AWS is responsible for some parts of your environment and the customer is responsible for other parts.
Customer responsibilities
“security in the cloud”.
Customers responsible for security of everything they create and put in AWS Cloud.
Customer maintains complete control over their content when using AWS services.
Responsible for managing security requirements for your content.
- Which content you choose to store on AWS.
- Which AWS services you use.
- Who has access to that content.
- How access rights are granted, managed and revoked.
Customer security steps factors
- Services that you use.
- Complexity of your systems.
- Company’s specific operational and security needs.
Customer security steps include:
- Selecting, configuring and patching operating systems that will run on Amazon EC2 instances.
- Configuring security groups.
- Managing user accounts.
AWS responsibilities
“security of the cloud”.
AWS responsible for security of the cloud.
AWS operates, manages, and controls components at all layers of infrastructure.
• Host operating system.
• Virtualisation layer.
• Physical security of data centres from which services operate.
AWS responsible for protecting global infrastructure that runs all of services offered in AWS Cloud.
• AWS Regions.
• Availability Zones.
• Edge locations.
AWS manages security of cloud specifically physical infrastructure that hosts your resources. • Physical security of data centres. • Hardware and software infrastructure. • Network infrastructure. • Virtualisation infrastructure.
AWS provides several reports from third-party auditors.
• Auditors verified compliance with variety of computer security standards and regulations.
AWS Identity and Access Management (IAM)
- Enables you to manage access to AWS services and resources securely.
- Gives you flexibility to configure access based on your company’s specific operational and security needs.
IAM features
IAM users, groups, roles.
IAM policies.
Multi-factor authentication.
AWS Account Root User
• Root user – first create an AWS account and begin identity.
o Accessed by signing in with email address and password that you used to create your AWS account.
o Complete access to all AWS services and resources in account.
AWS Account Root User Best Practice
o Do not use root user for everyday tasks.
o Use root user to create first IAM user and assign it permissions to create other users.
o Continue to create IAM users and access those identities for performing regular tasks throughout AWS.
o Only use root user when need perform limited number of tasks only available to root user.
o E.g. changing root user email address, changing AWS support plan.
IAM Users
- Identity you create in AWS.
- Represents person or application that interacts with AWS services and resources.
- Consists of name and credentials.
- Default – when you create new IAM user in AWS, has no permissions associated with it.
- Allow IAM user to perform specific actions in AWS – must grant IAM user necessary permissions.
IAM Users Best Practice
o Create individual IAM users for each person who needs access AWS.
o Provides additional security by allowing each IAM user to have unique set of security credentials.
IAM Policies
- Document that allows/denies permissions to AWS services and resources.
- Enable you to customise users’ levels of access to resources
IAM Policies Best Practice
o Follow security principle of least privilege when granting permissions.
o Help prevent users/roles from having more permissions than needed to perform tasks.
IAM Groups
- Collection of IAM users.
- Assign IAM policy to group – all users in group granted permissions specified by policy.
• Assigning IAM policies at group level makes it easier to adjust permissions when employee transfers to different job.
o Ensures employees have only permissions that are required for their current role.
IAM Roles
- Identity that you can assume to gain temporary access to permissions.
- Before IAM user, application, or service can assume IAM role – must be granted permissions to switch to role.
- Someone assumes IAM role – abandon all previous permissions they had under previous role and assume permissions of new role.
