AWSUGKOCHI - September 2019 Meetup Presentation An Introduction in to AWS Infrastructure Security Best Practices by Shibu Basheer, CTO - Cabot Technology Solutions

1. AWS Security Best
Practices
Shibu Basheer
CTO
Cabot Technology Solutions Pvt Ltd

2. Topics
1. IAM
2. STS
3. Organisation
4. Cloudtrail
5. Cloudwatch
6. AWS Config
7. Secret Manager
8. Others

3. Policies / Compliance
Well Architected Framework

5. IAM
● Create individual users
● MFA
● Use groups to assign to assign permissions to users.
● Grant Least Privilege
● Use AWS Managed Policies
● Do not share access keys
● Use Roles for Applications that run in EC2
● Use STS to generate temporary security credentials (apps, web applications)

7. STS
● Security Token Service
● Avoid hard coding access key IDs in code
● Use STS for temporary access to aws services
● STS service will generate temporary accessKeyID, secretAccessKey and
sessionToken
● Cognito
● OpenId connect

11. AWS Organizations
● Manage multiple aws accounts under one account
● Restrict resources
● Billing Entities
● Business Units
● Environments (dev, test, prod)

12. Cloudtrail
● Log/Record every API call.
● Used for auditing any information
● Automate remediation on incidents

13. Cloudwatch
● Logs from things - Applications, devices, services
● Alarms
● Rules
● Logs
● Dashboard

14. AWS Config
● Infrastructure keeps changing
● AWS Config keeps track of everything that changed in AWS
● Compliance Rules
○ E.g. EIP Attached
○ Cloudtrail Enabled
● Prebuilt and Custom Rules

15. Secret Manager
● Rotate RDS passwords
● Store security credentials
● Retrieve via API calls.
● No hard coding of DB passwords in code

16. Other items
● VPC Flow logs
● Security Groups
● EC2 Key Pairs

17. Other Services
● AWS Inspector
○ Security Assessment Service
○ Scan vulnerabilities
● Macie
○ Discover sensitive data stored in your infrastructure
● Guard Duty
○ Threat detection service
○ Uses data from vpc flow logs, cloudtrail logs, and dns
● KMS (Key management Service)
○ Store keys that encrypts your data

18. Thank you!
Shibu Basheer
Linkedin / Twitter / Instagram
@shibubasheer
shibu@cabotsolutions.com