AWS Security Flashcards
What is the Shared Responsibility Model?
In the public cloud, there is a shared security responsibility between you and AWS.
- AWS’s responsibility: Security of the Cloud
- Your Responsibility: Security in the Cloud
What is AWS’s responsibility “Security Of The Cloud”?
AWS is responsible for protecting and securing their infrastructure.
- AWS Global Infrastructure: AWS is responsible for its global infrastructure elements: Regions, edge locations, and Availability Zones.
- Building Security: AWS controls access to its data centers where your data resides.
- Networking Components:AWS maintains networking components: generators, uninterruptible power supply (UPS) systems, computer room air conditioning (CRAC) units, fire suppression systems, and more.
- Software: AWS is responsible for any managed service like RDS, S3, ECS, or Lambda, patching of host operating systems, and data access endpoints.
What is Your responsibility “Security In The Cloud”?
You are responsible for how the services are implemented and managing your application data.
- Application Data: You are responsible for managing your application data, which includes encryption options.
- Security Configuration: You are responsible for securing your account and API calls, rotating credentials, restricting internet access from your VPCs, and more.
- Patching: You are responsible for the guest operating system (OS), which includes updates and security patches.
- Identity and Access Management:You are responsible for application security and identity and access management.
- Network Traffic: You are responsible for network traffic protection, which includes security group firewall configuration.
- Installed Software: You are responsible for your application code, installed software, and more. You should frequently scan for and patch vulnerabilities in your code.
What is EC2 Shared Responsibility Model?
AWS:
- EC2 service
- Patching the host operating system
- Security of the physical server
ME/YOU:
- Installed applications
- Patching the guest operating system
- Security controls
What is Lambda Shared Responsibility Model?
AWS:
- Lambda service
- Upgrading Lambda languages
- Lambda endpoints
- Operating system
- Underlying infrastructure
- Software dependencies
ME/YOU:
- Security of code
- Stogare of sensitive data
- IAM for permissions
What is the Well-Architected Framework?
The 5 pillars of the Well-Architected Framework describe design principles and best practices for running workloads in the cloud.
- Operational Excellence
- Security
- Reliability
- Perfomance Efficiency
- Cost Optimization
What does the Operation Excellence entail(Well-Architected Framework)?
This pillar focus on creating application that effectively support production workloads.
- Plan for and anticipate failure
- Deploy smaller, reversible changes
- Script operations as code
- Learn from failure and refine
What does the Security entail(Well-Architected Framework)?
This pillar focuses on putting mechanism in place that help protect your systems and data.
- Automate security tasks
- Encrypt data in transit and at rest
- Assign only the least privileges required
- Track who did what and when
- Ensure security at all application layers
What does the Reliability entail(Well-Architected Framework)?
This pillar focuses on designing systems that work consistently and recover quickly.
- Recover from failure automatically
- Scale horizontally for resilience
- Reduce idle resources
- Manage change through automation
- Test recovery procedures
What does the Performance Efficiency entail(Well-Architected Framework)?
This pillar focuses on the effective use of computing resources to meet system and business requirements while removing bottlenecks.
- Use serverless architectures first
- Use Multi-region deployments
- Delegate tasks to a cloud vendor
- Experiment with virtual resources
What does the Cost Optimization entail(Well-Architected Framework)?
This pillar focuses on delivering optimum and resilient solutions at the least cost to the user.
- Utilize consumption based pricing
- Measure overall efficiency
- Implement Cloud Financial management
- Pay only for resources your application requires
What is Operation Excellence real world usecase?
You can use AWS CodeCommit for version control to enable tracking of code changes and to version-control CloudFormation templates of your infrastructure.
What is Security real world usecase?
You can configure central logging of all actions performed in your account using CloudTrail.
What is Reliability real world usecase?
You can use Multi-AZ deployments for enhanced availability and reliability of RDS databases.
What is “Performance Efficiency” real world usecase?
You can use AWS Lambda to run code with zero administration.
What is “Cost Optimization” real world usecase?
You can use S3 Intelligent-Tiering to automatically move your data between access tiers based on your usage patterns.
What is Amazon IAM?
IAM allows you to control access to your AWS services and resources.
- Helps you secure your cloud resources
- You define who has access
- You define what they can do
- A free global service
Identities vs. Access ?
Identities: Who can access your resources
- Root user
- Individual users
- Groups
- Roles
Access: What resources they can access
- Policies
- AWS managed policies
- Customer managed policies
- Permissions boundaries
Authentication (“Who”) vs. Authorization (“What”)
- Authentication is where you present your identity (username) and provide verification (password).
- Authorization determines which services and resources the authenticated identity has access to.
Types of Users?
-
Root User: The root user is created when you first open your AWS account.
- Close your account settings, includes (email address, account name etc..)
- Modify your support plan
- Cancel your AWS Support plan
- Restore IAM user permissions
- View certain tax invoices.
- Register as a seller in the Reserved Instance Marketplace.
- Configure an Amazon S3 bucket to enable MFA (multi-factor authentication) Delete.
-
Users: Individual users are created in IAM and are used for everyday tasks.
- Perform administrative tasks
- Launch EC2 Instances
- Access application code
- Configure databases
- Applications:You’ll create a user in IAM so you can generate access keys for an application running on-premises that needs access to your cloud resources.
What is the principle of least privilege?
The principle of least privilege involves giving a user the minimum access required to get the job done.
- Developer: Developers are responsible for building applications
- Project Manager: Project managers are responsible for managing the budget
What is an IAM real world usecase?
The AWS Command Line Interface (CLI) allows you to access resources in your AWS account through a terminal or command window. Access keys are needed when using the CLI and can be generated using IAM.
Create access keys for an IAM user that needs access to the AWS CLI.
What is an IAM Group?
A group is a collection of IAM users that helps you apply common access controls to all group members.
- Administrators: administrators perform administrative task susch as creating new users.
- Developers: developers use compute and database services to build applications.
- Analysts: analysts run budget and usage reports.
NB: Do not confuse security groups for EC2 with IAM groups. EC2 security groups act as firewalls, while IAM groups are collections of users.
What is an IAM Role?
Roles define access permissions and are temporarily assumed by an IAM user or service.
- You assume a role to perform a task in a single session
- Assumed by any user or service that needs it.
- Access is assigned using policies
- You grant users in one AWS account access to resources in another AWS account.
