Security

  • Key Management Service
    • Regional secure key management and encryption and decryption
    • Manages customer master keys (CMKs)
    • Encrypt and decrypt data up to 4 KB in size
    • Audit capability using CloudTrail – logs delivered to S3
    • FIPS 140-2 Level 2 service
    • Level 3 is CloudHSM
  • Types of CMK
    • AWS Managed CMK – Free; used by default if you pick encryption in most AWS services. Only that service can use them directly.
    • Customer Managed CMK – Allows key rotation; controlled via key policies and can be enabled/disabled.
    • AWS Owned CMK – Used by AWS on a shared basis across many accounts; you typically won’t see these.
  • Symmetric vs Asymmetric CMKs
    • Symmetric – Same key used for encryption and decryption and based on the AES-256 standard. Also, may be used to import your own key material.
    • Asymmetric – Mathematically related public/private key pair based on the RSA and elliptic-curve cryptography (ECC) algorithms.
  • CloudHSM – Provides a tamper resistant environment for managing keys
    • Dedicated HSM
    • FIPS 140-2 Level 3
    • Manage your own keys (single tenant, multi-AZ cluster, within a VPC)
    • No access to the AWS-managed component
    • Industry-standard APIs – no AWS APIs
    • Keep your keys safe – irretrievable if lost
  • Systems Manager Parameter Store – Securely managing configuration and secrets within AWS. It’s an essential tool for caching and distributing secrets securely to AWS resources.
    • Secure serverless storage for configuration and secrets
    • Values can be stored encrypted (KMS) or plain text
    • Separate data from source control
    • Store parameters in hierarchies
    • Track versions
  • Secrets Manager – A service that helps you rotate, manage, and retrieve various kinds of secrets such as database credentials, API keys, etc. Using secrets manager you can secure, audit, and manage secrets to access resources in AWS, on third party services, and on-premise.
    • The ability to automatically rotate secrets
    • Generate random secrets
  • AWS Shield
    • AWS Shield Standard
      • Automatically enabled for all customers at no cost
      • Protect against common layer 3 and 4 attacks
        • SYN/UDP flood
        • Reflection attacks
    • AWS Shield Advanced
      • $3,000/month, per orgranization
      • Enhanced protection for EC2, ELB, CloudFront, Global Accelerator, and Route 53
      • 24/7 access to DDoS Response Team (DRT)
  • Web Application Firewall (WAF) – A web application firewall that lets you monitor HTTP(S) requests to CloudFront, ALB, or API Gateway
    • Control access to content
      • Configure filtering rules to allow/deny traffic
    • Allow all requests, except the ones you specify
    • Block all requests, expect the ones you specify
    • Count the requests that match the properties you specify
  • AWS Firewall Manager – Allows you to centrally configure and manage firewall rules across an AWS Organization