Billing & Monitoring Flashcards
Cloudwatch intro
Enables you to setup billing alarms.
Will email you if you hit a threshold.
Uses SNS.
Cloudwatch detail
Monitoring services to monitor AWS resources and applications that run on AWS. • Compute ○ EC2 instance ○ CPU ○ Network ○ Disk ○ Status check ○ Monitors every 5 minutes but can be 1 minute with detailed monitoring ○ Autoscaling groups ○ ELB ○ Route53 health checks • Storage and content delivery ○ EBS volume ○ Storage gateways ○ CloudFront Alarm can be set to monitor spending on AWS account All about performance.
Config
Provides detailed view of the configuration of AWS resources in your AWS account.
Includes how resources are related to one another and how they were configured in the past.
Can see how relationships have changed over time.
All about resource configuration.
Macie
Security Server that uses ML and NLP to discover, classify, and protect sensitive S3 data.
• Uses AI to recognize which S3 data contains PII
• Dashboards, reporting, alerts
• Works with data in S3
• Can analyze CloudTrail logs
• Great for PCI-DSS (payment on website) and preventing ID theft
IAM Identity Access Management
- Centralized control of AWS
- Shares access to AWS
- Granular Permissions
- Identity Federations (include FB/Linkedin)
- MFA
- Temporary access for users/devices/services
- Password rotation policy
- Integrates with other AWS services
- PCI DSS compliance framework
- Global account/service (only need to create user/policy once as it is global and not per region.
- Root account as full perms/complete admin access
IAM Key terminology
• User: End users like people/orgs. New users have no perms when made.
• Groups: Collection of users who inherit perms of group.
• Policies: Made of policy documents in JSON format that give perms for user/group/role. Different policies suited for different job functions
• Roles: Create roles to assign to AWS resources. One service use another service.
○ Perms to IAM user in another account
○ Application on EC2 that needs actions on another AWS resource
○ AWS service that needs to act on resources in your account
○ Attach policy
○ Unique role name.
○ More secure; allow you to access instances through roles without sharing secret keys/ID’s.
○ Easier to manage.
○ Roles are universal.
IAM initial setup
• Delete root access keys • Activate MFA on root • Create individual IAM users ○ Has username; access type (console/programmatic); password/password type ○ Add user to group ○ Username, pw, access key id, secret access key, console login link. Send to user • Use groups to assign perms ○ Add policy to group
IAM Policies
• JSON doc that defines permissions
• Identity policy: attached to user group or role. Specifies what an identity can do (permissions)
• Resource policy: attached to resource (like S3 bucket or sqsq) to specify who has access to said resource and what they can do.
• Must attach policy to identity or resource
○ Each statement matches an AWS API request (any action you can perform against AWS)
○ Sid: human readable id of what statement does
○ Effect: allow or deny
○ Action: What they can do (dynamodb:Query or dynamodb:PutItem)
○ Resource: which resource it applies to (arn:aws:dynamodb:::table/myTable)
IAM Permission Boundaries
• Delegate administration to other users
• Advanced feature for using a managed policy to set max perms that an identity based policy grant to an IAM entity
• Used to prevent privilege escalation or unnecessarily broad permission
• Use cases:
○ Devs creating roles for lambda functions
○ App owners creating roles for EC2 instances
○ Admins creating ad hoc users
○ Even if we give someone admin access we can restrict using permission boundaries.
Resources Access Manage (RAM)
• Allows resource sharing between accounts
Can share: app mesh, aurora, codebuild, ec2, ec2 image builder, license manager, resource groups, route53
• Can share a resource without giving access to your subnet so that they can clone it
Signed Sign-on (SSO)
Service that helps centrally manage access to AWS accounts and business applications
• Can be 3rd party apps like dropbox, github, office 365, salesforce
○ Or any SAML 2.0 enabled
Security Assertion Markup Language
• Centrally manage accounts
• Use existing corporate identities
• Manage user permissions
Granular account level permissions
• Grant security team admin access to AWS accounts running security tools AND auditor level perms to other accounts
IAM AWS Directory Service
- Family of managed services.
- Connect AWS resources with on-premise AD
- Standalone directory in the cloud
- Use preexisting corporate credentials
- Single sign on to any domain-joined EC2 instance and not per instance
IAM AWS Active Directory
- On premise directory services
- Hierarchical DB of users, groups, computers, trees, forests
- Apply Group policies to managed users and devices
- LDAP (lightweight directory access protocol and DNS)
- Supports kerberos, LDAP, NTLM authentication
- Highly available
Cognito
IS the federated thing
Brokers between app and FB to give temp credentials allowing IAM role access.
Provides Cognito with web-identity federation
• Sign up/sign in to apps
• Access for guest users
• Acts as identity broker between your app and Web ID providers
Recommended approach is User authenticates with FB who gives them auth token to Cognito who responds and grants access to AWS environment. Cognito uses Push Sync to push updates and sync user data across multiple devices. Uses SNS to send notifications.
• User pools used to manage sign-up/sign-in function for mobile/apps. Users can sign in directly using user pool or using FB etc.
○ Cognito acts as identity broker between identity provider and AWS.
○ Successful authentication generates JSON web tokens.
• Identity pools provide credentials to AWS resources like S3 or DynamoDB
Organizations
central location to manage AWS accounts. As company grows there should be separation of duties.
• Centralized management of all accounts using SCP (Service Control Policies to give maximum permissions applied to OU or individual account).
• Apply policy to an Organizational Unit (OU).
• Consolidated billing for all member accounts through primary account. Bulk discounts. Hierarchical grouping of accounts.
• Create multiple accounts through AWS Organizations. Invite another email.
With AWS Organizations, you can use either the consolidated billing features or all the offered features. If you create an organization with consolidated billing features only, you can later enable all features.
