Security, Deployment, and Operations Flashcards
How is Secrets Manager different from Parameter Store?
Designed specifically for secrets (passwords, API keys, etc) and provides specific features such as rotation via Lambda, tooling/SDK integration, and directly integrates with some additional AWS products such as RDS.
What is AWS Shield?
DDoS prevention, specifically Layer 3 and Layer 4 attacks.
What are the AWS Shield tiers?
Standard - free with Route53 and CloudFront.
Advanced - includes EC2, ELB, Global Accelerator, as well as a 24/7/365 response team and financial insurance.
What is the Web Application Firewall (WAF)?
A Layer 7 (HTTP/S) Firewall that knows about things like SQL Injection and XSS.
Integrates with edge-of-network services such as CloudFront, API Gateway, and ALBs.
What is CloudHSM?
Similar to KMS but provides true, single-tenant HSMs (Hardware Security Modules) and is fully FIPS 140-2 Level 3 compliant.
What is AWS Config?
Audit/changelog of configuration changes to resources.
Regional services but can be configured for cross-region.
What is AWS Macie?
A data security and privacy service that can discover, monitor, and protect sensitive data stored within S3 including PII, PHI, financial information, security credentials, or anything custom definable by a regular expression.
What is AWS Inspector?
A tool for scanning EC2 instances, their OSes, and network components for any deviations from best practice.
What can an agent-driven AWS Inspector job find?
CVEs, CIS benchmarks, and other security best practices defined by AWS.
What can an agent-less AWS Inspector job find?
Network and port reachability for well-known ports and warnings for unrecognized ports.
