Security, Deployment, and Operations Flashcards
(10 cards)
How is Secrets Manager different from Parameter Store?
Designed specifically for secrets (passwords, API keys, etc) and provides specific features such as rotation via Lambda, tooling/SDK integration, and directly integrates with some additional AWS products such as RDS.
What is AWS Shield?
DDoS prevention, specifically Layer 3 and Layer 4 attacks.
What are the AWS Shield tiers?
Standard - free with Route53 and CloudFront.
Advanced - includes EC2, ELB, Global Accelerator, as well as a 24/7/365 response team and financial insurance.
What is the Web Application Firewall (WAF)?
A Layer 7 (HTTP/S) Firewall that knows about things like SQL Injection and XSS.
Integrates with edge-of-network services such as CloudFront, API Gateway, and ALBs.
What is CloudHSM?
Similar to KMS but provides true, single-tenant HSMs (Hardware Security Modules) and is fully FIPS 140-2 Level 3 compliant.
What is AWS Config?
Audit/changelog of configuration changes to resources.
Regional services but can be configured for cross-region.
What is AWS Macie?
A data security and privacy service that can discover, monitor, and protect sensitive data stored within S3 including PII, PHI, financial information, security credentials, or anything custom definable by a regular expression.
What is AWS Inspector?
A tool for scanning EC2 instances, their OSes, and network components for any deviations from best practice.
What can an agent-driven AWS Inspector job find?
CVEs, CIS benchmarks, and other security best practices defined by AWS.
What can an agent-less AWS Inspector job find?
Network and port reachability for well-known ports and warnings for unrecognized ports.
