Security & Compliance Section Flashcards
Responsibility - EC2
• For EC2 instance, customer is responsible for management of the guest OS
(including security patches and updates), firewall & network configuration, IAM
• Encrypting application data
Responsibility - RDS
AWS responsibility:
• Manage the underlying EC2 instance, disable SSH access
• Automated DB patching
• Automated OS patching
• Audit the underlying instance and disks & guarantee it functions
Your responsibility:
• Check the ports / IP / security group inbound rules in DB’s SG
• In-database user creation and permissions
• Creating a database with or without public access
• Ensure parameter groups or DB is configured to only allow SSL connections
• Database encryption setting
Responsibility - S3
AWS responsibility:
• Guarantee you get unlimited storage
• Guarantee you get encryption
• Ensure separation of the data between different customers
• Ensure AWS employees can’t access your data
Your responsibility: • Bucket configuration • Bucket policy / public setting • IAM user and roles • Enabling encryption
AWS Shield Standard
• Free service that is activated for every AWS customer
• Provides protection from attacks such as SYN/UDP Floods, Reflection attacks
and other layer 3/layer 4 attacks
AWS Shield Advanced
• Optional DDoS mitigation service ($3,000 per month per organization)
• Protect against more sophisticated attack on Amazon EC2, Elastic Load
Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53
• 24/7 access to AWS DDoS response team (DRP)
• Protect against higher fees during usage spikes due to DDoS
AWS WAF – Web Application Firewall
- Protects your web applications from common web exploits (Layer 7)
- Layer 7 is HTTP (vs Layer 4 is TCP)
- Deploy on Application Load Balancer, API Gateway, CloudFront
WAF can define Web ACL (Web Access Control List)
- Rules can include IP addresses, HTTP headers, HTTP body, or URI strings
- Protects from common attack - SQL injection and Cross-Site Scripting (XSS)
- Size constraints, geo-match (block countries)
- Rate-based rules (to count occurrences of events) – for DDoS protection
Penetration testing without approval (8 services)
- Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
- Amazon RDS
- Amazon CloudFront
- Amazon Aurora
- Amazon API Gateways
- AWS Lambda and Lambda Edge functions
- Amazon Lightsail resources
- Amazon Elastic Beanstalk environments
AWS KMS
• KMS = AWS manages the encryption keys for us
Encryption Opt-in: • EBS volumes: encrypt volumes • S3 buckets: Server-side encryption of objects • Redshift database: encryption of data • RDS database: encryption of data • EFS drives: encryption of data
Encryption Automatically enabled:
• CloudTrail Logs
• S3 Glacier
• Storage Gateway
CloudHSM
- Dedicated Hardware (HSM = Hardware Security Module)
* You manage your own encryption keys entirely (not AWS)
Types of CMK (Customer Master Keys)
Customer Managed CMK:
• Create, manage and used by the customer, can enable or disable
• Possibility of rotation policy (new key generated every year, old key preserved)
• Possibility to bring-your-own-key
AWS managed CMK:
• Created, managed and used on the customer’s behalf by AWS
• Used by AWS services (aws/s3, aws/ebs, aws/redshift)
AWS owned CMK:
• Collection of CMKs that an AWS service owns and manages to use in multiple accounts
• AWS can use those to protect resources in your account (but you can’t view the keys)
CloudHSM Keys (custom keystore):
• Keys generated from your own CloudHSM hardware device
• Cryptographic operations are performed within the CloudHSM cluster
AWS Certificate Manager (ACM)
- Lets you easily provision, manage, and deploy SSL/TLS Certificates
- Used to provide in-flight encryption for websites (HTTPS)
- Integrations with (load TLS certificates on): Elastic Load Balancers, CloudFront Distributions, APIs on API Gateway
AWS Secrets Manager
- Automate generation of secrets on rotation (uses Lambda)
- Integration with Amazon RDS (MySQL, PostgreSQL, Aurora)
- Secrets are encrypted using KMS
AWS Artifact
- Portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements
- Artifact reports and agreements
Amazon GuardDuty
- Intelligent Threat discovery to Protect AWS Account
- Uses Machine Learning algorithms, anomaly detection, 3rd party data
- One click to enable (30 days trial), no need to install software
Input data includes:
• CloudTrail Logs: unusual API calls, unauthorized deployments
• VPC Flow Logs: unusual internal traffic, unusual IP address
• DNS Logs: compromised EC2 instances sending encoded data within DNS queries
