Security Flashcards
CLI Access
Security
Access AWS services by command line
Security
Use (3)
Security CLI Access
- Automation
- Running scripts
- Direct resource access
Security CLI Access
Access keys
Security
Key ID and Secret key pair created for CLI Access
Security
SDK
Security
Language specific APIs for application access
Security
Systems supported (3)
Security SDK
- Programming languages (like JS, Python, .Net)
- Mobile SDKs
- IoT SDKs
Security SDK
CloudShell
Security
Browser based shell that includes preloaded tools
Security
File management
CloudShell
can upload, edit, and download files
CloudShell
Default region
CloudShell
The current region you are browsing
CloudShell
Shared Responsibility Model
Security
Both AWS and Customer have security and compliance responsibilities
Security
Employees
AWS Responsibility
Access and training for Amazon employees
AWS Responsibility
Physical
AWS Responsibility
data centers, hardware, and network
AWS Responsibility
Updates
AWS Responsibility
patching of cloud infrastructure and services
AWS Responsibility
Users (2)
Customer responsibility
- Training
- Least privilege access
Customer responsibility
Data
Customer responsibility
security and encryption of data and code
Customer responsibility
Configuration
Customer responsibility
OS, network, and firewall
Customer responsibility
Updates
Customer responsibility
patching guest OS and custom applications
Customer responsibility
Artifact
Compliance
self-service access to AWS agreements and compliance reports
Compliance
GuardDuty
Compliance
Monitors accounts and workloads for malicious activity
Compliance
Cognito
Security
provides user sign-up, sign-in, and access control for custom applications
Security
Federation
Security
can federate with social and enterprise identity providers
Security
Network ACL
Security
Security controls at the subnet level in a VPC
Security
Traffic control
Network ACL
May allow or deny traffic based on conditions
Network ACL
Default ACL
Network ACL
Allow all traffic
Network ACL
VPN
Security
Encrypted tunnel over Internet into VPC
Security
Endpoint options (2)
VPN
- Datacenter
- individual clients
VPN
Service types
VPN
Site-to-site or client
VPN
Shield
Security
Managed detection and mitigation of DDoS attacks
Security
Macie
Security
Data leakage protection powered by ML
Security
Data protected
Macie
personal information and intellectual property
Macie
Anomaly detection
Macie
detects unusual activity
Macie
Inspector
Security
Scans EC2 Instances for security vulnerabilities
Security
Secrets Manager
Security
secure way to store credentials, API keys, tokens
Security
Services integrated (3)
Secrets Manager
- RDS
- DynamoDB
- Redshift
Secrets Manager
credential management feature
Secrets Manager
can auto-rotate credentials
Secrets Manager
authorization
Secrets Manager
provides fine-grained access controls to secrets
Secrets Manager
Access AWS services by command line
Security
CLI Access
Security
- Automation
- Running scripts
- Direct resource access
Security CLI Access
Use (3)
Security CLI Access
Key ID and Secret key pair created for CLI Access
Security
Access keys
Security
Language specific APIs for application access
Security
SDK
Security
- Programming languages (like JS, Python, .Net)
- Mobile SDKs
- IoT SDKs
Security SDK
Systems supported (3)
Security SDK
Browser based shell that includes preloaded tools
Security
CloudShell
Security
can upload, edit, and download files
CloudShell
File management
CloudShell
The current region you are browsing
CloudShell
Default region
CloudShell
Both AWS and Customer have security and compliance responsibilities
Security
Shared Responsibility Model
Security
Access and training for Amazon employees
AWS Responsibility
Employees
AWS Responsibility
data centers, hardware, and network
AWS Responsibility
Physical
AWS Responsibility
patching of cloud infrastructure and services
AWS Responsibility
Updates
AWS Responsibility
- Training
- Least privilege access
Customer responsibility
Users (2)
Customer responsibility
security and encryption of data and code
Customer responsibility
Data
Customer responsibility
OS, network, and firewall
Customer responsibility
Configuration
Customer responsibility
patching guest OS and custom applications
Customer responsibility
Updates
Customer responsibility
self-service access to AWS agreements and compliance reports
Compliance
Artifact
Compliance
Monitors accounts and workloads for malicious activity
Compliance
GuardDuty
Compliance
provides user sign-up, sign-in, and access control for custom applications
Security
Cognito
Security
can federate with social and enterprise identity providers
Security
Federation
Security
Security controls at the subnet level in a VPC
Security
Network ACL
Security
May allow or deny traffic based on conditions
Network ACL
Traffic control
Network ACL
Allow all traffic
Network ACL
Default ACL
Network ACL
Encrypted tunnel over Internet into VPC
Security
VPN
Security
- Datacenter
- individual clients
VPN
Endpoint options (2)
VPN
- Site-to-site
- client
VPN
Service types (2)
VPN
Managed detection and mitigation of DDoS attacks
Security
Shield
Security
Data leakage protection powered by ML
Security
Macie
Security
personal information and intellectual property
Macie
Data protected
Macie
detects unusual activity
Macie
Anomaly detection
Macie
Scans EC2 Instances for security vulnerabilities
Security
Inspector
Security
secure way to store credentials, API keys, tokens
Security
Secrets Manager
Security
- RDS
- DynamoDB
- Redshift
Secrets Manager
Services integrated (3)
Secrets Manager
can auto-rotate credentials
Secrets Manager
credential management feature
Secrets Manager
provides fine-grained access controls to secrets
Secrets Manager
authorization
Secrets Manager
