Security and Compliance Flashcards
What are AWS’ Responsibilities in the shared security model?
AWS’ responsibility - Security of the Cloud - AWS is responsible for protecting and securing their infrastructure
AWS Global Infrastructure - AWS is responsible for its global infrastructure elements: Regions, edge locations, and Availability Zones
Building Security - AWS controls access to its data centers where your data resides
Networking Components - AWS maintains networking components: generators, uninterruptible power supply (UPS) systems, computer room air conditioning (CRAC) units, fire suppression systems, and more.
Software - AWS is responsible for any managed service like RDS, S3, ECS, or Lambda, patching of host operating systems, and data access endpoints.
What are AWSs’ Responsibilities in the shared security model?
Your responsibility - Security in the Cloud - You are responsible for how the services are implemented and managing your application data
Application Data - You are responsible for managing your application data, which includes encryption options.
Security Configuration - You are responsible for securing your account and API calls, rotating credentials, restricting internet access from your VPCs, and more.
Patching - You are responsible for the guest operating system (OS), which includes updates and security patches.
Identity and Access - You are responsible for application security and identity and access management.
Network Traffic - You are responsible for network traffic protection, which includes security group firewall configuration.
Installed Software - You are responsible for your application code, installed software, and more. You should frequently scan for and patch vulnerabilities in your code.
EC2 Shared Responsibility Model. You vs AWS?
You
Installed applications
Patching the guest operating system
Security controls
AWS
EC2 service
Patching the host operating system
Security of the physical server
Lambda Shared Responsibility Model. You vs AWS?
You
Security of code
Storage of sensitive data
IAM for permissions
AWS
Lambda service
Upgrading Lambda languages
Lambda endpoints
Operating system
Underlying infrastructure
Software dependencies
What responsibilities are shared in the Shared Security Responsibilities model?
Patch Management
AWS is responsible for patching infrastructure
You are responsible for patching guest OS and applications
Configuration Management
AWS is responsible for configuring infrastructure devices
You are responsible for configuring databases and applications
Awareness and Training
AWS is responsible for training their employees
You are responsible for training your employees
Where do you report abuse of services to?
AWS Trust and Safety Team
abuse@amazonaws.com
What are the 6 pillars of the Well-Architected Framework?
Operational Excellence
Security
Reliability
Performance Efficiency
Cost Optimization
Sustainability
What does the Operational Excellence pillar of the Well-Architected Framework focus on?
This pillar focuses on creating applications that effectively support production workloads.
a. Plan for and anticipate failure
b. Script operations as code
c. Deploy smaller, reversible changes
d. Learn from failure and refine
What does the Security pillar of the Well-Architected Framework focus on?
This pillar focuses on putting mechanisms in place that help protect your systems and data.
a. Automate security tasks
b. Assign only the least privileges required
c. Encrypt data in transit and at rest
d. Track who did what and when
e. Ensure security at all application layers
What does the Reliability pillar of the Well-Architected Framework focus on?
This pillar focuses on designing systems that work consistently and recover quickly.
a. Recover from failure automatically
b. Stop guessing capacity
c. Scale horizontally for resilience
d. Manage change through automation
e. Test recovery procedures
What does the Performance Efficiency pillar of the Well-Architected Framework focus on?
This pillar focuses on the effective use of computing resources to meet system and business requirements while removing bottlenecks.
a. Use serverless architectures first
b. Delegate tasks to a cloud vendor
c. Use multi-region deployments
d. Experiment with virtual resources
What does the Cost Optimization pillar of the Well-Architected Framework focus on?
This pillar focuses on delivering optimum and resilient solutions at the least cost to the user
a. Utilize consumption-based pricing
b. Measure overall efficiency
c. Implement Cloud Financial Management
d. Pay only for resources your application requires
What does the Sustainability pillar of the Well-Architected Framework focus on?
This pillar focuses on environmental impacts, especially energy consumption and efficiency.
a. Understand your impact
b. Maximize utilization Establish sustainability goals
c. Use managed services
d. Reduce downstream impact
What does Identity and Access Management (IAM) provide?
Allows you to control access to your AWS services and resources
Helps you secure your cloud resources
You define who has access
You define what they can do
A free global service
What are identities in AWS?
Identities are who can access your resources
Root user
Individual users
Groups
Roles
