The AWS cloud infrastructure has been architected to be one of the most flexible and secure cloud computing environments available today. In this session, we’ll provide a practical understanding of the assurance programs that AWS provides; such as HIPAA, FedRAMP(SM), PCI DSS Level 1, MPAA, and many others. We’ll also address the types of business solutions that these certifications enable you to deploy on the AWS Cloud, as well as the tools and services AWS makes available to customers to secure and manage their resources.

1. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
Understanding AWS Security
James Bromberger
Solutions Architect, Amazon Web Services

2. Agenda
• Our Security
• Your Security
– Account Management (the keys to the kingdom)
– Service Isolation
– Visibility and Auditing

3. Security is our #1 priority

4. Shared security responsibility

5. AWS
• Facili'es
• Physical
Security
• Physical
Infrastructure
• Network
Infrastructure
• Virtualiza'on
Infrastructure
• Operating System
• Application
• Security Groups
• OS Firewalls
• Network
Configuration
• Account Management
Customer

6. AWS
• Facili'es
• Physical
Security
• Physical
Infrastructure
• Network
Infrastructure
• Virtualiza'on
Infrastructure
• Operating System
• Application
• Security Groups
• OS Firewalls
• Network
Configuration
• Account Management
Customer

7. How does AWS get security?
• Physical access is
recorded, videoed
• Multi-factor authentication
for physical access
• Segregation of duties:
staff with physical access
versus staff with logical
access
• And every 90 days…

8. How does AWS get security?

9. How does AWS get security?

10. Prove what AWS does!
• Certifications
• Audits & Attestations
– Independent 3rd
parties
– Regularly refreshed
– Available to customers
aws.amazon.com/compliance

11. Certifications & Accreditations for Workloads That Matter

12. What does AWS do for its security?
November 2013
60 pages
freely available
aws.amazon.com/security/

13. AWS
• Facili'es
• Physical
Security
• Physical
Infrastructure
• Network
Infrastructure
• Virtualiza'on
Infrastructure
• Operating System
• Application
• Security Groups
• OS Firewalls
• Network
Configuration
• Account Management
Customer

14. Secure your account

15. Identity and Access Management
• Users & Groups

16. Identity and Access Management
• Users & Groups
• Unique Security Credentials

17. Identity and Access Management
• Users & Groups
• Unique Security Credentials
• Temporary Security Credentials

18. Identity and Access Management
• Users & Groups
• Unique Security Credentials
• Temporary Security Credentials
• Policies & Permissions

19. Identity and Access Management
• Users & Groups
• Unique Security Credentials
• Temporary Security Credentials
• Policies & Permissions
• Roles

20. Identity and Access Management
• Users & Groups
• Unique Security Credentials
• Temporary Security Credentials
• Policies & Permissions
• Roles
• Multi-factor Authentication

21. ProTip #1: Account Security

22. Identity and Access Management
1. Secure your Master account with MFA
2. Create an IAM Group for your Admin team
3. Create IAM Users for your Admin staff, as
members of your Admin group
4. Turn on MFA for these users!

23. ProTip #2:
No hard-coded Credentials

24. EC2 Roles for Temporary Credentials
• Remove hard-coded
credentials from scripts
and config files
• Create an IAM Role and
assign restricted policy
• Launch instance into Role
• AWS SDKs transparently
get temporary credentials
GET http://169.254.169.254/latest/
meta-data/iam/security-credentials/
s3access
{
"Code" : "Success",
"LastUpdated" : "2012-04-26T16:39:16Z",
"Type" : "AWS-HMAC",
"AccessKeyId" :
"AKIAIOSFODNN7EXAMPLE",
"SecretAccessKey" : "wJalrXUtnFEMI/
K7MDENG/bPxRfiCYEXAMPLEKEY",
"Token" : "token",
"Expiration" : "2012-04-27T22:39:16Z"
}

25. ProTip #3: Least Privilege Policies

26. IAM Policies
“Action” : {
“route53:List*”,
“route53:Get*”,
“route53ChangeResourceRecordSets”
}
“Resource” : {
“arn:aws:route53:::hostedzone/ZONEID”
}

27. IAM Policies
Use Conditions to restrict key exposure
“Condition”: {
"IpAddress" : {
"aws:SourceIp" : ["192.0.2.0/24", "203.0.113.0/24"]
}
}

28. ProTip #4: Test Your Policies

29. Identity and Access Management
• Test your policies in
the Policy Simulator!

30. Secure your data in flight

31. Secure your data in flight
Credentials for talking to AWS APIs via REST:
• ACCESS KEY
– An identifier
• SECRET KEY
– Used to sign requests
– Shouldn’t traverse the network again
• Not retrievable from AWS again – you lose it,
generate a new pair

32. Secure your data in flight
Use SSL / TLS for all your traffic,
just like you do for your API access
ProTip #5: Validate the SSL Certificate!

33. Secure your data in flight
SSL offload to the Elastic
Load Balancing Service

34. Secure your data in flight
• RDS connections can be
encrypted
– Get Public Key from AWS:
https://rds.amazonaws.com/doc/rds-ssl-ca-cert.pem
https://rds.amazonaws.com/doc/mysql-ssl-ca-
cert.pem

35. Secure your data at rest

36. Secure your data at rest
• Use encrypted file systems on EBS and Storage
Gateway
– dm-crypt/LUKS
– Windows BitLocker
– Windows EFS (file level)
– Products from Partners: Trend, Safenet, etc
• In your database
– RDS Oracle & SQL Server – Transparent Data Encryption
• Object Level into S3

37. Secure your data at rest
Redshift
• By Default:
– Full disk encryption
– Uses SSL to talk to S3
• Optionally you can:
– Set S3 backups to be encrypted
– Limit S3 bucket access
– Connect using SSL
– Run within VPC
– Use CloudHSM key store
– Backup access logs to S3
• Redshift retains 1 week

38. Secure your data at rest
CloudHSM: Hardware Security
Modules in the cloud
• Single Tenancy
• Private key material never
leaves the HSM
• AWS provisioned, customer
managed

40. Isolate your services

41. Isolate your services
Virtual Private Cloud
• Security Groups
– Don’t use 0.0.0.0/0
• Subnet separation of instances with:
– Network ACLs, and IAM policy to prevent changes
– Routing tables, and IAM policy to prevent changes
– No Internet Gateway, and IAM policy to prevent changes

42. Isolate your services
One application per instance
• Simplify forensics
• Simplify Security Groups
• Swim-lane capacity overloads
• Limit blast radius

43. VPC Peering

44. VPC Peering
• Connect two VPCs in the
same Region
– No IP address conflicts
• Bridged by routing table
entries (both sides of
peering relationship)
• Offer & Accept model
Customer B receives request from ACustomer A initiates peer to B

45. Log (& review) your API calls

46. CloudTrail
Your staff or scripts
make calls…
on AWS API
endpoints…
CloudTrail logs this
to an S3 bucket…
so you can
review this log

47. CloudTrail
• Who made the API call?
• When was the API call made?
• What was the API call?
• What were the resources that were acted up on in the API call?
• Where was the API call made from?

48. CloudTrail Partners

49. CloudTrail
• AWS Services are supporting logging API calls
to CloudTrail:
Kinesis, Elastic LoadBalancing, AWS CloudFormation, Amazon
Eleastic MapReduce, AWS Beanstalk, AWS DirectConnect
• CloudTrail support for API calls in AP-
Southeast-2 – Sydney – announced for this
month (May 2014).

50. Support: Trusted Advisor

52. AWS Premium Support: make
Amazon’s security team a part
of your security team.

54. HeartBleed timeline.
• Disclosed: April 7.
• 1st AWS Security Bulletin: April 7
– Acknowledgement
• 2nd AWS Security Bulletin: April 8
– RDS instances being patched
• 3rd AWS Security Bulletin: April 8
– ELB updating, CloudFront updated; advice to customers
• 4th AWS Security Bulletin: April 8
– All AWS managed environments updated (or were already OK)

55. AWS Security Bulletins
• Visit the web site:
https://aws.amazon.com/security/security-bulletins/
• Subscribe to the RSS feed:
http://aws.amazon.com/rss/security.rss

56. Monitor your AWS spend

57. Billing Alerts

58. Deep dive on more security…

59. https://aws.amazon.com/whitepapers/
Auditing
Logging
Risk
Compliance
Security

60. James’ Summary
1. Turn on MFA for root and IAM user accounts
2. Look at IAM Roles for EC2 Instances
3. Use IP address conditions on Policies
4. Create a few Billing Alerts
5. Visit aws.amazon.com/security
6. Talk to the AWS Solution Architecture Team
about security and compliance

61. Developers…
Please do not check your API credentials into
revision control…
…and please don’t check credentials in to public
revision control (github, bitbucket, etc)

62. Visit the Solution Architecture Team today.
Questions on security: talk to AWS
James Bromberger
jameseb@amazon.com
@JamesBromberger