Security and Compliance Flashcards
Customers shared responsibility
Responsibility for the security in the cloud
* Customer data
* platform
* Applications
* IAM
* OS, Network and firewall configs
* client side data encryption and data integrity configs
* server side encryption
* networking traffic protection
AWS shared responsibility
Software
* compute
* storage
* database
* networking
Hardware/Global infrastruture
* regions
* availability zones
* edge locations
What are the aws compliance programs
- Certifications / attestations.
- Laws, regulations, and privacy.
- Alignments / frameworks.
it varies among AWS services
AWS IAM
it helps you securely control access to AWS resources
AWS Trusted Advisor
its an assitant that helps one provision your resources following AWS best practices
AWS Personal Health Dashboard
A personalized view of the health of AWS services, and alerts when your resources are impacted
- it prompts the user with alerts and notifications on AWS scheduled activities, pending issues and planned charges
List the AWS support plans
- Basic
- Developer
- Business
- Enterprise
Basic
- email support only
- for billing and acct
- 7 trusted advisor checks
- $0/month
Developer
- Tech support via email (reply ~ 24 hrs)
- No third party support
- General guidance <24hrs
- System Impaired < 12hrs
- 7 trusted advisor checks
- $29/month
Business
- Tech support via email (reply ~ 24 hrs)
- Tech support via chat, phone, anytime 24/7
- General guidance <24hrs
- System Impaired < 12hrs
- Production system impaired < 4hrs
- Production system down < 1hrs
- all trusted advisor checks
- $100/month
Enterprise
- Tech support via email (reply ~ 24 hrs)
- Tech support via chat, phone, anytime 24/7
- General guidance <24hrs
- System Impaired < 12hrs
- Production system impaired < 4hrs
- Production system down < 1hrs
- Business-critical down <15m
- personal concierge
- TAM (Technical Account Manager: someone that knows AWS in and out, he helps reduce the bill)
- all trusted advisor checks
- $15,000/month
security group
-it acts as a virtual firewall by controlling the traffic both inbound and outbound.
- it acts tn the instance level
- you can change a security group associated with an ec2 instance if the instance is in the running state
Amazon VPC
It enables you to launch AWS resources into a virtual network that you have already defined
subnet
A range of Ip addresses in your VPC
- security groups and NACL are used to protect resources in a subnet
Public Subnet
uses resources that can be connected to the internet
Private subnet
uses resources that wont be connected to the internet
Route Table
A set of rules (called routes) that are used to determine where network traffic is directed.
Internet Gateway
A gateway that you attach to your VPC to enable communication between resources in your VPC and the internet.
- you can only have 1 gateway in your VPC
Which resource does Amazon Inspector perform network accesibility checks on
Amazon EC2 instance`
IAM role
it is an IAM identity that you can create in your account that has specific permisions.
- similar to IAM users
IAM user group
a collection of IAM users
IAM User
it is an entity that u can create in AWS to represent the person or application that uses it to interact with AWS
- they have access to Access keys
– Acces key ID
– secret access key
IAM Policies
are used to manage access in AWS by attaching them to IAM identities (users, user groups, or roles) or AWS resources
Amazon Macie
it is a managed security service which can be used to detect personally identifiable information (PII) such as names, password, credit card numbers from large amounts of data stored in Amazon s3 bucket.
- it uses ml to protect sensitive data like passwords
AWS Shield
It is used for defecting against DDOS attacks
AWS shield advance
For higher level of protection against Attacks targets in your web applications running on Amazon EC2, elastic load balancing,, cloud front and Route 52 resources
you can subscribe to AWS shield advanced
AWS CloudTrail
It is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account
Network ACL
Network access control list is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets.
- it is a subnet level
AWS Secrets Manager
it i sused to store and manage secrets used to access database or other resources in AWS
- it is used to securely store and automatically rotate credentials for databases hosted on RDS
AWS Systems manager Parameter Store
it is used to store config data and secrets securely in a plain or encrypted format
Ama
Amazon detective
Amazon Detective automatically collects log data from your AWS resources and uses machine learning (ML), statistical analysis, and graph theory to build a linked dataset that you can use to conduct more efficient security investigations.
- it is passive protection
- makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities
Amazon Detective
is an automated security assessment service that helps you test the network accessibility of your Amazon EC2 instances and the security state of your applications running on the instances
Amazon security Hub
is a service that gives you aggregated visibility into your security and compliance status across multiple AWS accounts
AWS WAF
helps Protect your web applications from common exploits
- it is launched with
- Amazon cloud front
- Application load balancer
- Amazon API Gateway
- AWS AppSync
AWS Security
Used to download AWS security and compliance documents
Security Groups
Security groups allow specific inbound and outbound traffic at the resource level (such as an EC2 instance)
- it is resource/instance level
AWS Firewall Manager
It makes it possible to manage VPC security groups, AWS Shield Advanced and WAF rules on one platform even across multiple AWS accts.
AWS Security Hub
It is a full-view, single-look, comprehensive depiction of the security state of the customer’s AWS environment.
AWS IAM Access Analyzer
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to
AWS resource
