AWSome Day Online Conference 2019 - Module 3 AWS Security

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 3:
Security Overview

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Topics
• Introduction to AWS Security
• The AWS Shared Responsibility Model
• AWS Access Control and Management
• AWS Security Resources and Features

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introduction to AWS Security
Security is of the utmost importance to AWS.
• Approach to security
• AWS environment controls
• AWS offerings and features

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Keep Your Data Safe
• Resilient infrastructure
• High security
• Strong safeguards

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Continual Improvement
• Rapid innovation
• Constantly evolving security services

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Pay For What You Need
• Advanced security services
• Address real-time emerging risks
• Meeting needs at a lower operational cost

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Meet Compliance Requirements
Governance-enabled features
• Additional oversight
• Security control
• Central automation

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security Products and Features
Tools
• Access from AWS and partners
• Use for monitoring and logging

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Network Security
• Built-in firewalls
• Encryption in transit
• Private/dedicated connections
• Distributed denial of service (DDoS)
mitigation

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Inventory and Configuration
Management
• Deployment tools
• Inventory and configuration tools
• Template definition and management tools

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data Encryption
• Encryption capabilities
• Key management options
• AWS Key Management Service
• Hardware-based cryptographic key
storage options
• AWS CloudHSM

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Access Control and Management
• AWS Identity and Access Management (IAM)
• AWS Multi-factor authentication (MFA)
• Integration and federation with corporate
directories
• Amazon Cognito
• AWS SSO

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring and Logging
Tools and features to reduce your risk profile:
• Deep visibility into API calls
• Log aggregation and options
• Alert notifications

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Marketplace
• Qualified partners to market/sell software
to AWS customers
• Online software store that can run on AWS

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shared Responsibility Model

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security of the Cloud
Protection of the AWS global infrastructure is top priority
Availability of third-party reports

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security of the Cloud
• Amazon EC2
• Amazon EBS
AWS Foundation Services
Unmanaged services Managed Services
• Amazon DynamoDB
• Amazon RDS
• Amazon Redshift
• Amazon EMR
• Amazon WorkSpaces

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security in the Cloud
• What to store
• Which AWS services
• In what location
• In what content format and structure
• Who has access

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security in the Cloud
• Customers retain control
• Changes to model depend on services

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM
Control access to AWS resources
• Authentication
• Authorization
Controls access to services such as:
• Compute
• Storage
• Database
• Application services

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM
Create users and groups
Grant permissions
User Group Permissions Role

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM
Functionality
Manage
• Users and their access
• Roles and their permissions
• Federate users and their permissions
IAM Corp

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Account Root User
Account root user has complete
access to all AWS Services.

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Account Root User
Recommendations
1. Delete root user access keys.
2. Create an IAM user.
3. Grant administrator access.
4. Use IAM credentials to
interact with AWS.
IAM

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM: Authentication
Programmatic access
• Enables access key ID and secret access key
Management console access
• Uses AWS account name and password
• MFA prompts for code

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM: Authorization
Access AWS services
• Grant authorization
Assign permissions
• Create an AWS IAM policy

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM: Policy Assignment
IAM User
IAM Policy
IAM Group IAM Roles

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s take a look at the AWS IAM DEMO

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IAM DEMO

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM Best Practices
• Delete AWS root account access keys
• Activate multi-factor authentication (MFA)
• Give IAM users only the permissions they must have
• Use IAM groups
• Apply an IAM password policy

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM Best Practices
• Roles
• Use roles for applications
• Use roles instead of sharing credentials
• Credentials
• Rotate credentials regularly
• Remove unnecessary users and credentials
• Use policy conditions for extra security
• Monitor activity in your AWS account

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.