Security and Compliance Flashcards
(40 cards)
Customers shared responsibility
Responsibility for the security in the cloud
* Customer data
* platform
* Applications
* IAM
* OS, Network and firewall configs
* client side data encryption and data integrity configs
* server side encryption
* networking traffic protection
AWS shared responsibility
Software
* compute
* storage
* database
* networking
Hardware/Global infrastruture
* regions
* availability zones
* edge locations
What are the aws compliance programs
- Certifications / attestations.
- Laws, regulations, and privacy.
- Alignments / frameworks.
it varies among AWS services
AWS IAM
it helps you securely control access to AWS resources
AWS Trusted Advisor
its an assitant that helps one provision your resources following AWS best practices
AWS Personal Health Dashboard
A personalized view of the health of AWS services, and alerts when your resources are impacted
- it prompts the user with alerts and notifications on AWS scheduled activities, pending issues and planned charges
List the AWS support plans
- Basic
- Developer
- Business
- Enterprise
Basic
- email support only
- for billing and acct
- 7 trusted advisor checks
- $0/month
Developer
- Tech support via email (reply ~ 24 hrs)
- No third party support
- General guidance <24hrs
- System Impaired < 12hrs
- 7 trusted advisor checks
- $29/month
Business
- Tech support via email (reply ~ 24 hrs)
- Tech support via chat, phone, anytime 24/7
- General guidance <24hrs
- System Impaired < 12hrs
- Production system impaired < 4hrs
- Production system down < 1hrs
- all trusted advisor checks
- $100/month
Enterprise
- Tech support via email (reply ~ 24 hrs)
- Tech support via chat, phone, anytime 24/7
- General guidance <24hrs
- System Impaired < 12hrs
- Production system impaired < 4hrs
- Production system down < 1hrs
- Business-critical down <15m
- personal concierge
- TAM (Technical Account Manager: someone that knows AWS in and out, he helps reduce the bill)
- all trusted advisor checks
- $15,000/month
security group
-it acts as a virtual firewall by controlling the traffic both inbound and outbound.
- it acts tn the instance level
- you can change a security group associated with an ec2 instance if the instance is in the running state
Amazon VPC
It enables you to launch AWS resources into a virtual network that you have already defined
subnet
A range of Ip addresses in your VPC
- security groups and NACL are used to protect resources in a subnet
Public Subnet
uses resources that can be connected to the internet
Private subnet
uses resources that wont be connected to the internet
Route Table
A set of rules (called routes) that are used to determine where network traffic is directed.
Internet Gateway
A gateway that you attach to your VPC to enable communication between resources in your VPC and the internet.
- you can only have 1 gateway in your VPC
Which resource does Amazon Inspector perform network accesibility checks on
Amazon EC2 instance`
IAM role
it is an IAM identity that you can create in your account that has specific permisions.
- similar to IAM users
IAM user group
a collection of IAM users
IAM User
it is an entity that u can create in AWS to represent the person or application that uses it to interact with AWS
- they have access to Access keys
– Acces key ID
– secret access key
IAM Policies
are used to manage access in AWS by attaching them to IAM identities (users, user groups, or roles) or AWS resources
Amazon Macie
it is a managed security service which can be used to detect personally identifiable information (PII) such as names, password, credit card numbers from large amounts of data stored in Amazon s3 bucket.
- it uses ml to protect sensitive data like passwords
