Network Security Flashcards
AWS Organizations - Service Control Policy (SCP).
The SCP allows the designated master account to define policies that restrict, at the account level, what services and actions member-account users, groups, and roles can take, including the account root user.
AWS Organizations - Programmatic Account Creation
When you use AWS Organizations to create a new account within an organization, the new account is created with an administrative role, typically called OrganizationAccountAccessRole, which you assume to access the new account.
AWS CloudFormation
Cloud formation stacks extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Using an administrator account, you define and manage an AWS CloudFormation template and use the template as the basis for provisioning stacks into selected target accounts across specified regions.
AWS Service Catalog
Create a curated portfolio of products
Used combination IAM roles termed launch constraints and CFT to deliver fined grained control of access and configuration during the provisioning process.
AWS Service Catalog executes a template to generate the new AWS account, create the VPC enclave, build the VPN, and apply the restrictive SCP. With this approach, creation and configuration of a new account is completely automated. Moreover, the process is standardized, repeatable, and auditable.
Edge Locations
Tool to prevent DDOS attacks
Infra is monitored for anomalies
First all traffic is scored across a set of dimensions to prioritize the flow of legitimate traffic.
Second, the global scale of the edge infrastructure allows AWS to absorb attacks by diffusing the incoming traffic flows across multiple edge locations.
Third, many services running in an edge location have the ability to apply geographic isolation and restriction; that is, both automated and manual whitelisting and blacklisting of source traffic is possible.
Route 53 - Shuffle Sharding
Shuffle sharding is a technique designed to minimize correlated failures by simultaneously leveraging the traditional benefits of sharding (such as fault isolation and performance scaling) and the effects of randomized, or shuffled, assignment.
Route 53 - Anycast Striping
Anycast striping is another availability mechanism built into Amazon Route 53. Anycast is the notion that multiple systems respond to the same IP address. In practical terms, anycast means that when your DNS resolver initiates a connection to an Amazon Route 53 DNS server, the actual responder to which you connect could be in any of several locations across the globe advertising the same anycast address.
example: If a TLD (Top Level Domain) - R53 provides multiple anywise servers to a request
Route 53 - Packet Filters
Amazon Route 53 also provides mechanisms to block invalid or unwanted requests. As part of the edge infrastructure, packet filters are applied that drop invalid DNS requests. If you wish to block requests further, Amazon Route 53 provides geolocation routing policies that give you control over the responses provided to DNS resolvers based on their source IP addresses.
Amazon Cloudfront - OAI
Origin Access Identity - Special cloud front user you can associate with a distro
You grant permission to OAI
Require access to the CDN using the OAI you preclude bypassing network security that you grant (or revoke) from the OAI
Cloudfront - Custom HTTP headers
Can manipulate headers being passed to the origin. You can restrict access to distros you designate
Example: Add customer headers so that the origin can authenticate incoming traffic from the CDN. If not there then you can deny it.
Cloudfront - TLS enforcement/signed URLs,cookies
Can encrypt using TLS, can required signed URLs or cookies
You are responsible for generating the tokens. Can also restrict valid dates/times
Cn also use Zcloudfronts field level encryptions to encrypt sensitized data (e.g. cc numbers).
Cloudfront - AWS Lambda@Edge
Can execute lambdas inside of a CDN
Can be used to populate custom headers
A similar use case involves validation of consumer-provided authorization tokens. You can use AWS Lambda@Edge to inspect headers and authorization tokens. For example, if you experienced an application layer attack (Layer 7), you could leverage AWS Lambda@Edge to validate the format and validity of the asserted session or authorization tokens to distinguish between accepting valid traffic and dropping malicious traffic. As
AWS Certificate Manager
Create TLS certs for Cloudfront, ELBs, Elastic Beanstalk
Can use ACM generated or uploaded certs
Provides SHA-256 cert valid for 13 months
must use fully qualified domain name (FQDN), can also use wildcards
These are regional
Free, you cannot download the private key, the key is encrypted at rest with the KMS service
For cloud front these tasks are in the N Virginia region
AWS WAF - ACLs
With AWS WAF, you implement Web Access Control Lists (ACLs) to control your HTTP and HTTPS traffic. Web ACLs are composed of rules, and rules are composed of conditions.
Filters are OR-ed. If one meets then it is enforced
AWS WAF Conditions - Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS), enables you to match web requests containing scripts that might exploit vulnerabilities in your applications. This condition allows you to search for XSS in common parts of the request data, including the HTTP method, header, query string, Uniform Resource Identifier (URI), or body.
