AWS Summit Sydney 2014 | Understanding AWS Security

1. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc. Understanding AWS Security James Bromberger Amazon Web Services

2. Agenda •  Our Security •  Your Security –  Account Management (the keys to the kingdom) –  Service Isolation –  Visibility and Auditing •  Special Guest

3. Security is our #1 priority

4. Shared security responsibility

5. AWS •  Facilities •  Physical Security •  Physical Infrastructure •  Network Infrastructure •  Virtualization Infrastructure •  Operating System •  Application •  Security Groups •  OS Firewalls •  Network Configuration •  Account Management Customer

7. How does AWS get security? •  Physical access is recorded, videoed •  Multi-factor authentication for physical access •  Segregation of duties: staff with physical access versus staff with logical access •  And every 90 days…

8. How does AWS get security?

9. How does AWS get security?

10. Prove what AWS does! •  Certifications •  Audits & Attestations –  Independent 3rd parties –  Regularly refreshed –  Available to customers aws.amazon.com/compliance

11. Certifications & Approving Industry Bodies

12. What does AWS do for its security? November 2013 60 pages freely available aws.amazon.com/security/

14. Secure your account

15. Identity and Access Management •  Users & Groups

16. Identity and Access Management •  Users & Groups •  Unique Security Credentials

17. Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials

18. Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions

19. Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions •  Roles

20. Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions •  Roles •  Multi-factor Authentication

21. ProTip #1: Account Security

22. Identity and Access Management 1.  Secure your Master account with MFA 2.  Create an IAM Group for your Admin team 3.  Create IAM Users for your Admin staff, as members of your Admin group 4.  Turn on MFA for these users!

23. ProTip #2: No hard-coded Credentials

24. EC2 Roles for Temporary Credentials •  Remove hard-coded credentials from scripts and config files •  Create an IAM Role and assign restricted policy •  Launch instance into Role •  AWS SDKs transparently get temporary credentials { "Code" : "Success", "LastUpdated" : "2012-04-26T16:39:16Z", "Type" : "AWS-HMAC", "AccessKeyId" : "AKIAIOSFODNN7EXAMPLE", "SecretAccessKey" : "wJalrXUtnFEMI/ K7MDENG/bPxRfiCYEXAMPLEKEY", "Token" : "token", "Expiration" : "2012-04-27T22:39:16Z" } GET http://169.254.169.254/latest/meta- data/iam/security-credentials/s3access

25. ProTip #3: Least Privilege Policies

26. IAM Policies •  Group “DNS-Admins”, Policy:“Action” : { “route53:List*”, “route53:Get*”, “route53ChangeResourceRecordSets” } “Resource” : { “arn:aws:route53:::hostedzone/ZONEID” }

27. IAM Policies Use Conditions to restrict key exposure “Condition”: { "IpAddress" : { "aws:SourceIp" : ["192.0.2.0/24", "203.0.113.0/24"] } }

28. ProTip #4: Test Your Policies

29. Identity and Access Management Test your policies in the Policy Simulator!

30. Secure your data in flight

31. Secure your data in flight Credentials for talking to AWS APIs via REST: •  ACCESS KEY –  An identifier •  SECRET KEY –  Used to sign requests –  Shouldn’t traverse the network again •  Not retrievable from AWS again – you lose it, generate a new pair

32. Secure your data in flight Use SSL / TLS for all your traffic, just like you do for your API access ProTip: Validate the SSL Certificate!

33. Secure your data in flight SSL offload to the Elastic Load Balancing Service

34. Secure your data in flight •  RDS connections –  MySQL –  PostgreSQL –  Oracle •  Get Public Key from AWS: https://rds.amazonaws.com/doc/rds-ssl-ca-cert.pem https://rds.amazonaws.com/doc/mysql-ssl-ca-cert.pem

35. Secure your data at rest

36. Secure your data at rest •  Use encrypted file systems on EBS and StorageGateway –  dm-crypt/LUKS –  Windows BitLocker –  Windows EFS (file level) •  In your database –  RDS Oracle & SQL Server – Transparent Data Encryption •  Object Level into S3

37. Secure your data at rest Redshift •  By Default: –  Full disk encryption by default –  Uses SSL to talk to S3 •  Optionally you can: –  Set S3 backups to be encrypted –  Limit S3 bucket access –  Connect using SSL –  Run within VPC –  Use CloudHSM key store –  Backup access logs to S3 •  Redshift retains 1 week

38. Secure your data at rest CloudHSM: Hardware Security Modules in the cloud •  Single Tenancy •  Private key material never leaves the HSM •  AWS provisioned, customer managed

39. Isolate your services

40. Isolate your services Virtual Private Cloud •  Security Groups –  Don’t use 0.0.0.0/0 •  Subnet separation of instances with: –  Network ACLs, and IAM policy to prevent changes –  Routing tables, and IAM policy to prevent changes –  No Internet Gateway, and IAM policy to prevent changes

41. Isolate your services One application per instance •  Simplify forensics •  Simplify Security Groups •  Swim-lane capacity overloads •  Limit blast radius

42. VPC Peering

43. VPC Peering •  Connect two VPCs in the same Region –  No IP address conflicts •  Bridged by routing table entries (both sides of peering relationship) •  Offer & Accept model Customer B receives request from ACustomer A initiates peer to B

44. Log (& review) your API calls

45. CloudTrail Your staff or scripts make calls… on AWS API endpoints… CloudTrail logs this to an S3 bucket… so you can review this log

46. CloudTrail •  Who made the API call? •  When was the API call made? •  What was the API call? •  What were the resources that were acted up on in the API call? •  Where was the API call made from?

47. CloudTrail Partners

48. Support: Trusted Advisor

49. Customer story: Luke Chadwick

50. Billing Alerts

51. Luke’s Summary •  Turn on MFA for root and IAM user accounts •  Look at IAM Roles for EC2 Instances •  Create a few Billing Alerts! •  Visit aws.amazon.com/security •  Talk to the AWS Solution Architecture Team about security and compliance

52. Bonus Australian Information

53. Australian Privacy Considerations Whitepaper

54. https://aws.amazon.com/whitepapers/ Auditing Logging Risk Compliance Security

55. Visit the Solution Architecture Team today, Please fill in feedback forms! Questions on security: talk to AWS James Bromberger jameseb@amazon.com @JamesBromberger