SlideShare a Scribd company logo
1 of 12
Download to read offline
Improve Governance Over Configuration
Changes
Liron Dor, Technical Account Manager
Governance Requirements
• Allow our organization to move fast
• Visibility over used resources
• Define Best Practices and enforce them
• Meet Compliance and Regulations
• Validate compliance continuously
• Alerting and Auto-healing
• Automatic control over Manual control
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Governance Challenges
• Dynamic environments
• High complexity
• Different requirements for different environments
• Multiple Accounts
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Tools We Offer
• Tracking
• AWS Config
• AWS CloudTrail
• VPC Flow Logs
• Amazon Inspector
• Track / Log
• Amazon CloudWatch Logs
• Amazon DynamoDB
• Amazon ElasticSearch
• Alert
• AWS Config Rules
• Amazon Simple Notification Service (SNS)
• AWS Trusted Advisor
• Amazon CloudWatch Events
• And More…
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Config
• Records configuration changes continuously
• Capturing the state of your AWS resources
• “Configuration Item” contains all attributes for a resource
• Capturing the relationship between resources
• Discover resources that exists or deleted
• Receive notifications on configuration changes
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Config Rules
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Config Rules
• Validate configuration record
• Enforce Best Practices and procedures
• Result is either “compliant” or “non-compliant”
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Config Rules Demo
• “Center of Internet Security” (CIS) is a Non Profit organization dedicated to
enhancing the cybersecurity readiness and response among public and
private sector entities.
• Published “CIS AWS Foundations” Security Best Practices document
• AWS Config Rules Repository
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Demo
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Summary
• Allow our organization to move fast
• Know your account, wanted and unwanted changes
• Automate your best practices / compliance metrics
• Use Logs for forensic, Alerts for immediate actions
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
lirondor@amazon.com

More Related Content

Viewers also liked

GOWAR - Virtual Wars Real Places. AWS Case Study
GOWAR - Virtual Wars Real Places. AWS Case StudyGOWAR - Virtual Wars Real Places. AWS Case Study
GOWAR - Virtual Wars Real Places. AWS Case Study
Amazon Web Services
 
Security in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve RileySecurity in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve Riley
Amazon Web Services
 

Viewers also liked (20)

AWS Summit Bogotá Track Avanzado: Virtual Private Cloud
AWS Summit Bogotá Track Avanzado: Virtual Private Cloud AWS Summit Bogotá Track Avanzado: Virtual Private Cloud
AWS Summit Bogotá Track Avanzado: Virtual Private Cloud
 
AWS Customer Presentation - Cruxy.com
AWS Customer Presentation - Cruxy.com AWS Customer Presentation - Cruxy.com
AWS Customer Presentation - Cruxy.com
 
From Development to Production
From Development to ProductionFrom Development to Production
From Development to Production
 
Masterclass Live: Amazon EC2
Masterclass Live: Amazon EC2 Masterclass Live: Amazon EC2
Masterclass Live: Amazon EC2
 
SVC105 AWS Messaging - AWS re: Invent 2012
SVC105 AWS Messaging - AWS re: Invent 2012SVC105 AWS Messaging - AWS re: Invent 2012
SVC105 AWS Messaging - AWS re: Invent 2012
 
GOWAR - Virtual Wars Real Places. AWS Case Study
GOWAR - Virtual Wars Real Places. AWS Case StudyGOWAR - Virtual Wars Real Places. AWS Case Study
GOWAR - Virtual Wars Real Places. AWS Case Study
 
Scaling the Platform for Your Startup
Scaling the Platform for Your StartupScaling the Platform for Your Startup
Scaling the Platform for Your Startup
 
Security Day - Intro
Security Day - IntroSecurity Day - Intro
Security Day - Intro
 
Security in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve RileySecurity in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve Riley
 
AWS Webcast - Library Storage Webinar
AWS Webcast - Library Storage WebinarAWS Webcast - Library Storage Webinar
AWS Webcast - Library Storage Webinar
 
AWS Summit Sydney 2014 | Running Complex Enterprise Workloads on AWS - Sessio...
AWS Summit Sydney 2014 | Running Complex Enterprise Workloads on AWS - Sessio...AWS Summit Sydney 2014 | Running Complex Enterprise Workloads on AWS - Sessio...
AWS Summit Sydney 2014 | Running Complex Enterprise Workloads on AWS - Sessio...
 
More Nines for Your Dimes: Improving Availability and Lowering Costs using Au...
More Nines for Your Dimes: Improving Availability and Lowering Costs using Au...More Nines for Your Dimes: Improving Availability and Lowering Costs using Au...
More Nines for Your Dimes: Improving Availability and Lowering Costs using Au...
 
Everything You Need to Develop Apps Faster and Scale to Millions of Users
Everything You Need to Develop Apps Faster and Scale to Millions of UsersEverything You Need to Develop Apps Faster and Scale to Millions of Users
Everything You Need to Develop Apps Faster and Scale to Millions of Users
 
Globus Genomics: How Science-as-a-Service is Accelerating Discovery (BDT310) ...
Globus Genomics: How Science-as-a-Service is Accelerating Discovery (BDT310) ...Globus Genomics: How Science-as-a-Service is Accelerating Discovery (BDT310) ...
Globus Genomics: How Science-as-a-Service is Accelerating Discovery (BDT310) ...
 
Workshop part3 – IOT
Workshop part3 – IOTWorkshop part3 – IOT
Workshop part3 – IOT
 
(DVO205) Monitoring Evolution: Flying Blind to Flying by Instrument
(DVO205) Monitoring Evolution: Flying Blind to Flying by Instrument(DVO205) Monitoring Evolution: Flying Blind to Flying by Instrument
(DVO205) Monitoring Evolution: Flying Blind to Flying by Instrument
 
Automating Backup & Archiving with AWS and CommVault
Automating Backup & Archiving with AWS and CommVaultAutomating Backup & Archiving with AWS and CommVault
Automating Backup & Archiving with AWS and CommVault
 
Protecting Your Data in AWS
Protecting Your Data in AWSProtecting Your Data in AWS
Protecting Your Data in AWS
 
Dole Food's Global Collaboration Platform and Web Presence on AWS (ENT209) | ...
Dole Food's Global Collaboration Platform and Web Presence on AWS (ENT209) | ...Dole Food's Global Collaboration Platform and Web Presence on AWS (ENT209) | ...
Dole Food's Global Collaboration Platform and Web Presence on AWS (ENT209) | ...
 
The 2014 AWS Enterprise Summit Keynote
The 2014 AWS Enterprise Summit Keynote The 2014 AWS Enterprise Summit Keynote
The 2014 AWS Enterprise Summit Keynote
 

More from Amazon Web Services

Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Recently uploaded

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Recently uploaded (20)

Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Evaluating the top large language models.pdf
Evaluating the top large language models.pdfEvaluating the top large language models.pdf
Evaluating the top large language models.pdf
 

Improve Governance over Configuration Changes

  • 1. Improve Governance Over Configuration Changes Liron Dor, Technical Account Manager
  • 2. Governance Requirements • Allow our organization to move fast • Visibility over used resources • Define Best Practices and enforce them • Meet Compliance and Regulations • Validate compliance continuously • Alerting and Auto-healing • Automatic control over Manual control © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 3. Governance Challenges • Dynamic environments • High complexity • Different requirements for different environments • Multiple Accounts © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 4. Tools We Offer • Tracking • AWS Config • AWS CloudTrail • VPC Flow Logs • Amazon Inspector • Track / Log • Amazon CloudWatch Logs • Amazon DynamoDB • Amazon ElasticSearch • Alert • AWS Config Rules • Amazon Simple Notification Service (SNS) • AWS Trusted Advisor • Amazon CloudWatch Events • And More… © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 5. AWS Config • Records configuration changes continuously • Capturing the state of your AWS resources • “Configuration Item” contains all attributes for a resource • Capturing the relationship between resources • Discover resources that exists or deleted • Receive notifications on configuration changes © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 6. AWS Config Rules © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 7. AWS Config Rules • Validate configuration record • Enforce Best Practices and procedures • Result is either “compliant” or “non-compliant” © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 8. AWS Config Rules Demo • “Center of Internet Security” (CIS) is a Non Profit organization dedicated to enhancing the cybersecurity readiness and response among public and private sector entities. • Published “CIS AWS Foundations” Security Best Practices document • AWS Config Rules Repository © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 9. Demo © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 10. Summary • Allow our organization to move fast • Know your account, wanted and unwanted changes • Automate your best practices / compliance metrics • Use Logs for forensic, Alerts for immediate actions © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
  • 11.

Editor's Notes

  1. Available in all regions except Beijing Price Currently: Config: $0.003 per Configuration Item recorded Config Rules: $2 per active rule per month & $0.10 per thousand evaluations (Beyond 20K Evaluations that are free)
  2. Current Existing Regions: Virginia, Oregon, Ireland, Frankfurt, Tokyo, Missing: Seoul, California, Singapore, Sydney, Sao Paulo Put Evaluation (The Evaluation Result structure) [ { "ComplianceResourceType": "string", "ComplianceResourceId": "string", "ComplianceType": "COMPLIANT"|"NON_COMPLIANT"|"NOT_APPLICABLE"|"INSUFFICIENT_DATA", "Annotation": "string", "OrderingTimestamp": timestamp } ... ]
  3. Current Existing Regions: Virginia, Oregon, Ireland, Frankfurt, Tokyo, Missing: Seoul, California, Singapore, Sydney, Sao Paulo Put Evaluation (The Evaluation Result structure) [ { "ComplianceResourceType": "string", "ComplianceResourceId": "string", "ComplianceType": "COMPLIANT"|"NON_COMPLIANT"|"NOT_APPLICABLE"|"INSUFFICIENT_DATA", "Annotation": "string", "OrderingTimestamp": timestamp } ... ]
  4. https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf https://github.com/awslabs/aws-config-rules