Security & Compliance (25%) Flashcards
What is AWS responsible for in terms of security? (4)
o AWS global infrastructure – includes regions, edge locations, and availability zones.
o Building security – AWS controls access to its data centers where your data resides
o Maintains networking components (generators, etc)
o Responsible for any managed software service like RDS, S3, ECS, lambda, patching of host operating systems, and data access endpoints.
What is the customer responsible for in terms of security? (6)
o Application data (includes encryption options – scrambling data so only authorized people can read it)
o Security configuration – responsible for securing your account & API calls, rotating credentials, restricting internet access from your VPCs)
o Patching – guest operating system, which includes updates and security patches
o Identity & access mgmt. – application security and identity, and access management
o Network traffic protection – which includes security group firewall configuration
o Installed Software – your application code, you should frequently scan for path vulnerabilities in your code.
What is the EC2 shared responsibility model? (AWS vs. the customer)
- AWS is responsible for patching the host operating system, and the security of the physical server.
- The customer is responsible for installed applications, patching the guest operating system, and security controls
What is the Lambda shared responsibility model? (AWS vs. the customer)
- AWS is responsible for Lambda service, upgrading Lambda languages, Lambda endpoints, operating system, underlying infrastructure, and software dependencies.
- The customer is responsible for security of code, storage of sensitive data, IAM for permissions
What are the shared responsibilities between AWS and the customer?
- Patch management: AWS patches infrastructure, you patch guest operation system & applications
- Configuration management: AWS configures infrastructure devices, and you configure databases & applications
- Awareness & Training: AWS responsible for training their employees, you are responsible for training your employees.
What is the Well-architected framework? (6 Pillars) 1 - 3 2 - 5 3 - 5 4 - 4 5 - 4 6 - 6
1) Operational Excellence – creating applications that effectively support production workloads
a. Deploy smaller, reversible changes
b. Script operations as code
c. Learn from failure & refine
2) Security – put mechanisms in place that help protect your systems & data
a. Automate security tasks
b. Encrypt data in transit & at rest
c. Assign only the least privileges required
d. Track who did what & when
e. Ensure security at all application layers
3) Reliability – designing systems that work consistently & recover quickly
a. Recover from failure automatically
b. Scale horizontally for resilience
c. Reduce idle resources
d. Manage change through automation
e. Test recovery procedures
4) Performance Efficiency – effective use of computing resources to meet system & business requirements while removing bottlenecks
a. Use serverless architectures first
b. Use multi-region deployments
c. Delegate tasks to a cloud vendor
d. Experiment with virtual resources
5) Cost Optimization – focuses on delivering optimum & resilient solutions at the least cost to the user
a. Utilize consumption-based pricing
b. Implement cloud financial management
c. Measure overall efficiency
d. Pay only for resources your application requires
6) Sustainability - dresses the long-term environmental, economic, and societal impact of your business activities.
a. Understand your impact
b. Establish sustainability goals
c. Maximize utilization
d. Anticipate and adopt new, more efficient hardware and software offerings
e. Use managed services
f. Reduce the downstream impact of your cloud workloads
How to apply 6 pillars in the real-world?
1) Operational Excellence – use AWS CodeCommit for version control to enable tracking code changes to version-control CloudFormation templates of your infrastructure.
2) Security – Use CloudTrail to configure central logging of all actions performed in your account.
3) Reliability – use multi AZ deployments for enhanced availability & reliability of RDS databases.
4) Performance Efficiency – use Lambda to run code with zero administration.
5) Cost Optimization – use S3 intelligent tiering to automatically move your data between access tiers based on your usage patterns.
6) Sustainability - Use automation to manage the lifecycle of your development and test environments, and use managed device farms for testing.
What allows you to control access to your AWS services & resources?
Benefits (2)
IAM Users: (Identity & Access Management)
- A free global service that helps you secure your cloud resources.
- You define who has access & what they can do.
What are entities you create in IAM to represent the person or application needing to access your AWS resources?
Users (applications can also be users)
Identities vs. Access?
Identities – who can access your resources (root user, individual users, groups, roles)
Access – what resources they can access (policies, AWS managed policies, customer managed policies, permissions boundaries)
Authentication (who) vs. Authorization (what)?
Authentication – where you present you identity (username) & provide verification (password)
Authorization – determines what services & resources the authenticated identity has access to
What can only the root user do?
Close your account, change email address, modify support plan
What can individual users do?
Perform administrative tasks, launch EC2 instances, access application code, configure databases
What is the principle of least privilege?
involves giving a use the minimum access required to get the job done.
What is a collection of IAM users that helps you apply common access controls to all group members?
Groups
