Securely Connecting to Your AWS Environment

As you continue to work on securing your AWS environment so that your data is effectively protected both in transit and at rest, you need to ensure that the initial points of contact that your users have with your applications are also secure. As the primary users of the network, your corporate users are the ones most likely to interact with the AWS environment most frequently, especially for transactions that require elevated access.

This chapter explores various connectivity options and their associated security measures to establish and maintain secure connections between your personal or corporate environment and your AWS environment. You will examine the configuration of security features such as routing, security groups, and the permissions required to connect to your AWS environment through AWS Virtual Private Network (VPN) and/or AWS DirectConnect. By delving into these topics, you will gain insights into establishing robust and...

Technical Requirements

You need to have a basic understanding of AWS services and networking concepts for this chapter. You will also need access to an active AWS account with a user with the appropriate permissions to create and edit items with AWS VPC. You will also need to have an AWS VPC stood up.

Understanding Your Connection

If you are part of an organization developing solutions on AWS, accessing your resources and services over the internet is straightforward. Many users accomplish this through the AWS Management Console, which you might have already interacted with while completing the exercises in this book. Using the AWS Management Console, you can easily deploy and configure the infrastructure and services you have designed for your environment.

From a logical standpoint, connecting to your AWS environment from your on-premises setup via the internet can be visualized as follows:

Figure 18.1: Connecting an on-premises network to AWS VPC

As shown in Figure 18.1, just using a basic setup where the servers and users connect to the instance in your AWS account directly via the internet leaves you open to bad actors sniffing the traffic during the different server hops that it takes before it reaches its final destination. You want to provide...

Understanding AWS VPN

AWS VPN is a service that enables secure and encrypted communication between your corporate network and your AWS resources. It establishes a VPN connection over the internet, allowing you to securely access your AWS infrastructure as if it were an extension of your corporate network. With AWS VPN, you can maintain the confidentiality and integrity of your data while seamlessly connecting to and managing your resources in the cloud.

A Quick Overview of VPNs

A VPN is a secure connection that allows users to access a private network, such as AWS, over the internet by using an encrypted connection from a user’s device and that private network. It creates a private network tunnel within the public network, allowing users to securely transmit data between their devices and a remote network or resource. VPNs provide confidentiality, integrity, and privacy by encrypting data and ensuring that it remains protected from unauthorized access. They enable users...

Understanding the Purpose of AWS CloudHub

AWS VPN CloudHub is a managed service that allows you to connect multiple AWS Site-to-Site VPN connections securely. This enables your sites to communicate with each other and not just with resources in your VPC. You can see from the following image that CloudHub allows connectivity from multiple remote locations (just like the Direct Connect gateway) but does so using VPN connections instead of Direct Connect circuits.

Figure 18.11: The hub-and-spoke model of AWS CloudHub

AWS VPN CloudHub operates on a simple hub-and-spoke model, as shown in Figure 18.11, that you can use with or without a VPC. In this approach, the VPN connection is the hub, and the remote offices act as the spokes. In the hub-and-spoke design of CloudHub, the AWS account is the hub and the remote offices are the spokes. It is more cost-effective than multiple Direct Connect connections and is extremely useful in cases where you need a redundant...

Summary

In this chapter, you looked at the different ways you can secure the connections you and your company make into your AWS environment. You started by reviewing the default connection from an on-premises network to AWS that is simply a connection over the internet, which is an insecure manner of operation. You were then introduced to the two main services that can help you protect your data in transit: AWS VPN and AWS Direct Connect.

In the final section of this chapter, you looked at AWS VPN CloudHub and how it can connect multiple remote sites to a VPN connection using a hub-and-spoke model, thereby simplifying your networking and security tasks for connectivity for remote offices.

In the next chapter, we will look at how to further protect data in transit by using and creating certificates using the AWS Certificate Manager service.

Further Reading

For additional information on the AWS Shared Responsibility Model and the underlying foundation of AWS security, please look at the following resources:

• AWS VPN FAQs: https://packt.link/s0Whv
• AWS Direct Connect FAQs: https://packt.link/KOUcO
• AWS VPN CloudHub Documentation: https://packt.link/hKLUh
• Connect your VPC to remote networks using AWS VPN: https://packt.link/IciRm

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH18

   Alternatively, you can scan the following QR code (Figure 18.12):

Figure 18.12: QR code that opens Chapter Review...