Security & Compliance Flashcards
AWS Shield Standard
Default DDOS protection
AWS Shield Advanced
24/7 premium DDOS protection
AWS WAF
Rules based filtering
Layer 7 protection (HTTP)
Deploy on ALB, API, CloudFront
CloudFront and Route53
Protection at the edge
AWS Shield
Protects against common attacks (syn floods, reflection attacks, etc.)
AWS Shield Advanced
Protects against more sophisticated attacks on major AWS services
24/7 Response Team
$3,000/month/organization
Web ACL
WAF feature
Rules for IP, HTTP headers, HTTP body, URI
SQL Injection, XSS
geo-block
Best way to protect entire VPC?
AWS Network Firewall
Pentesting on AWS Cloud
Don’t need auth for 8 core services
Pentesting restrictions
No DOS
No network flooding
No Request flooding
No DNS zone walking
AWS KMS
AWS manages encryption keys
Services needing encryption opt-in (5)
EBS volumes
S3
Redshift
RDS
EFS
Services with default encryption (3)
Cloudtrail logs
S3 Glacier
Storage gateway
CloudHSM
AWS provisioned encryption HW
CloudHSM
Manage your own keys
Customer managed CMK
Customer managed keys, BYOK, rotation policy
AWS managed CMK
AWS manages keys
AWS owned CMK
Collection of CMK’s to use in multiple accounts
AWS Certificate Manager (ACM)
Create TLS certs
Certificate Manager cost
Free
AWS Secrets Manager
Store secrets
Capable of rotation
Secrets Manager integrated with which service?
RDS
AWS Artifact
Compliance and agreements portal
Guard Duty
Looks at logs and events to find threats and unusual traffic
Which service is good for finding cryptocurrency attacks?
GuardDuty
Amazon Inspector
Automated vulnerability inspections
Which service performs vulnerability scanning on EC2, container images, and Lambda?
Amazon inspector
AWS Config
Records configurations and changes
Ensures settings compliance
Stored in S3
Amazon Macie
Fully managed service to discover and protect sensitive data (PII) in AWS
AWS Security Hub
Centralized security dashboard
Aggregates alerts
Requires AWS Config
Costs $
Amazon Detective
Root cause analysis for security issues or suspicious activity
AWS Abuse
Report suspicious AWS services to AWS
Root user is who?
Account owner
Root user unique permissions
Change account settings
Close account
Change/Cancel support plan
Register as a reseller for reserved instances
More
IAM Access Analyzer
Find services shared externally
Zone of trust
AWS Account or org. Anything outside of the zone may be an finding.
