AWS - Securing Your AWS Resources - Chapter#5

AWS - Securing Your AWS Resources - Chapter#5

1. Domain 2: Security and Compliance

   • 2.2 Understand AWS Cloud security, governance, and compliance concepts
   • 2.3 Identify AWS access management capabilities

2. Protecting the Root User

   • the root user has the permissions necessary to perform any task on your account
   • The problem is that actively using the root user over the long term with only minimal protections presents a significant security risk
   • to protect the root user by creating a complex password and implementing multifactor authentication, and for most administration activities, use IAM users instead

3. Authentication

   • Access Keys
     • Whenever you do decide to create a key, you'll click Create Access Key. You'll be given the opportunity to download the new key to your computer as a text file or showing the actual Access Key ID and Secret Access Key values in the dialog box where you can copy and paste them somewhere safe. Just make sure you choose one of those options, because you'll never be shown the secret access key itself again. You should also remember that it's never a good idea to expose the Secret Access Key in plaintext—as part of an email, for example.
     • you'll never be shown the secret access key itself again
   • Secure Shell Key Pairs
     • The SSH protocol manages the encryption and decryption steps in the process as long as compatible keys are present at both ends of the connection.

4. IAM Users, Groups, and Roles

   • you shouldn't be using the root user for regular administration duties
   • Instead, as you've seen, you're better off creating users to whom you can assign only the permissions needed for a specific set of tasks (thus adhering to the principle of least privilege) and then having your team authenticate with those user identities
   • IAM Roles
     • When creating a role, you begin by defining a trusted entity—the entity (or beneficiary) that will be trusted to use the role
       • That entity could be an AWS service (like EC2), an identity provided by a third-party federated identify provider (like Google or Amazon Cognito—which allow a digital identity to be linked across multiple identity management systems), or a specific AWS account.
   • Credential Report
     • Reports contain important information about the state of your account security, listing all current IAM users and giving you key intelligence, such as when each of them last logged in,

5. Encryption

   • AWS by the AWS Key Management Service (KMS)
     • When you select to encrypt an AWS resource, KMS will apply encryption using a customer master key (CMK) that's been generated especially for your account.
     • What can be encrypted?
       • Just about any data managed by an AWS service, including Relational Database Service (RDS) and DynamoDB databases. Elastic Block Store (EBS) volumes that you attach to EC2 instances can also be encrypted when you create them.
         • When they're encrypted, those resources will, for all practical purposes, be unreadable without the decryption key

6. AWS Compliance

   • Amazon Inspector
     • Is a security assessment service that helps users identify security vulnerabilities and deviations from security best practices in their AWS resources. It automatically assesses applications for common security issues, generates detailed findings, and provides recommendations to address them.
   • Amazon GuardDuty
     • Is a threat detection service for continuously monitoring AWS accounts for suspicious activities and malicious behavior. It analyzes event data from various AWS sources and, using machine learning algorithms, identifies potential threats, including unauthorized access, compromised instances, or malicious activity.
   • AWS Secrets Manager
     • Is a service that helps you protect and manage secrets, such as database credentials, API keys, and other sensitive information. It enables you to securely store and rotate secrets and provides integration with other AWS services to securely access secrets in your applications.
   • Amazon Detective
     • Is a service that helps you investigate security issues and conduct post-incident analysis. It automatically collects and analyzes log data from various AWS services and provides visualizations and insights to help you understand the origin and impact of potential security threats.
   • AWS Audit Manager
     • Simplifies the process of assessing and managing compliance with industry standards and regulations. It provides prebuilt frameworks and assessment templates, automates evidence collection, and generates audit reports to help you streamline the auditing process.
   • AWS Cloud HSM (Hardware Security Module)
     • Lets you secure your sensitive data by generating and deploying cryptographic keys. It provides dedicated hardware security modules in the AWS cloud, offering secure key storage and cryptographic operations for applications and services.
   • AWS Resource Access Manager (AWS RAM)
     • Allows you to share AWS resources, such as subnets, AWS Transit Gateways, and Amazon Route 53 Resolver rules, with other AWS accounts within your organization. It simplifies resource sharing across accounts and helps you securely manage and control access and permissions more efficiently.
   • AWS Security Hub
     • Provides a comprehensive view of your security profile across all of your AWS accounts. It aggregates security findings from various AWS services and custom integrations and presents them in a single dashboard. It helps you identify and prioritize security issues and streamline the management of your security alerts and compliance checks.