Security Flashcards
Security of the cloud:
Amazon’s Responsibility
Protecting and securing infrastructure
Building security
Networking components – generators, uninterruptible power supplies, computer room air conditioning, fire suppression systems
Software – Managed services (RDS, S3, ECS, Lambda)
Security In the cloud:
My responsibility
App data and encryption options
Security config – API calls, account, rotating credentials, restricting internet
Patching – Guest operating system
Identity and Access Management – Security and identity
Network Traffic – Firewall configuration
Installed Software
Shared responsibilities
Patch management
AWS: patching infrastructure
Me: patching guest OS and apps
Config management
AWS: Configuring infrastructure devices
Me: Configuring databases and apps
Awareness and training
AWS: their employees
Me: my employees
5 Pillars
Operational Excellence
Security
Reliability
Performance Efficiency
Cost Optimization
Operational Excellence -
Creating apps that effectively support production workloads
Plan for and anticipate failure
Deploy smaller, reversible changes
Script operations as code
Learn from failure and refine
In the real world:
CodeCommit – Version control to enable tracking of changes in code
Security –
Putting mechanisms in place to protect systems and data
Automate security tasks
Encrypt data in transit and at rest
Assign only the least privileges required
Track who did what when
Ensure security at all app layers
In the real world:
CloudTrail – Logging of all actions
Reliability –
Design systems that work consistently and recover quickly
Recover from failure automatically
Scale horizontally for resilience
Reduce idle resources
Manage change through automation
Test recovery procedures
In the real world:
RDS – Use multi AZ deployments for enhanced availability and reliability
Performance Efficiency –
The effective use of computing resources to meet system and business requirements while removing bottlenecks
Use serverless architecture first
Use multi-region deployments
Delegate tasks to a cloud vendor
Experiment with virtual resources
In the real world:
Lambda – Severless, run with zero administration
Cost Optimization –
Delivering optimum and resilient solutions at the lowest cost to the user
Using consumption-based pricing
Measure overall efficiency
Implement Cloud Financial Management
Pay only for resources your app requires
In the real world:
S3 – Intelligent tiering to automatically move data between tiers
IAM –
Controls access to AWS services and resources
Secure cloud resources
You define who has access
You define what they can do
Free global service
Identities –
Who can access your resources
Root user
Individual user
Groups
Collection of users
Administrators
Creating new users
Developers
Use compute and db services to build apps
Analysts
Run budgets and use reports
Roles
Access –
What resources they can access
Policies
AWS managed policies
Customer managed policies
Permissions boundaries
Authentication –
Who
Present identity through username and password
Authorization –
What
Which services the authenticated identity has access to
Users –
Entities you create in IAM to represent the person or app needing access to AWS resources
Root user – not meant for day to day tasks.
Individual users – used for every day tasks
Applications can be users – For instance, you’ll generate access keys for an app running on-premises that needs access to the cloud
