Account Management in AWS

Whether you wish to set up a new environment or are on the path to growing an existing set of accounts, the Account Management tools can help you perform these tasks in an automated systematic manner.

Control Tower

When you are looking for one of the easiest ways to secure and govern multiple accounts in AWS, AWS Control Tower is the best choice. With AWS Control Tower, you have the ability to implement best practices when creating new accounts using an Account Factory. Guardrails can be put in place, offering governance and security across the entire organization. Control Tower also allows for the use of blueprints that make it easy to set up a landing zone.

Control Tower itself is made up of four (4) key components:

• Landing Zone – A landing zone is a standardized framework for managing an AWS environment and ensuring compliance with AWS Best practices. Using AWS Control Tower to set up your AWS environment creates a well-architected...

Cloud Compute in AWS

Compute in AWS refers to the many services such as Amazon EC2, Elastic Load Balancing (ELB), AWS Lambda, AWS Batch, Elastic Container Service (ECS), and Elastic Kubernetes Service (EKS) along with AWS Fargate. The Fargate managed service allows you to run your containers with minimal overhead. AWS Compute even includes Lightsail, one of the quickest ways for customers to get their cloud up and running without needing to configure software or networking.

Figure 2.3: Compute services in AWS

You can see, as is shown on Figure 2.3, the different myriad of services that fall under the classification of Compute services in Amazon Web Services. These are not only the virtual instances of the Elastic Compute Cloud (EC2) service but also Lambda which is the function as a service offering and even Elastic Load Balancing, the service that helps spread requests to multiple instances.

Although there are quite a few services that fall under the...

Route 53

The global DNS service that AWS provides is Route 53. This is one of the few services in AWS that is not tied to any specific region. The Route 53 service also has one of the most substantial commitments, stating that it will use commercially reasonable efforts to make Amazon Route 53 100% Available

The following three components of Route 53 are of foundational importance:

• Registration (and management) of domain names
• The DNS service
• Health checks (and subsequentially traffic routing) for your web application based on the fact that it’s functional, available, and reachable

This section will cover some of the basic information about the Route 53 service and especially any topics that would be relevant to know for the Security Specialty Exam.

Knowing the difference between a domain and a hosted zone

One of the first things to understand between a domain and a hosted zone is that a domain is an internet construct of domain name servers that...

Cloud Databases

Looking at the following model (shown in figure 2.5. you may wonder why there are so many databases. This comes from the evolution of application architecture over the past few decades, where specialization, speed, and scale have become keys to success in this industry.

Figure 2.5: Database types and services in AWS

Going through each and every type of database that AWS offers is beyond the scope of this chapter. However, this section will cover some of the databases and their basic features, including security, as part of the foundational overview.

Note on data security

Data security will be covered in depth in Chapter 17: Protecting Data in Flight and at Rest.

Relational databases

The word database usually brings to mind relational databases and star schemas with rows and columns. Schemas, rows, and columns are associated with Relational Databases or RDBMS systems. Relational databases in AWS give you the ability to choose...

Message and Queueing systems

As you start to build out cloud-scale applications, you need ways to decouple different tiers of the application so that it can scale independently. This is for several reasons, including making your application more resilient and allowing each available tier to scale independently of the other tiers. You might only need to have a single EC2 instance running at any point in time. Encapsulating this instance in an autoscaling group and connecting it to a managed queue allows the queue to take the requests and ensure that they get processed by the EC2 instance, even if it happens to stop and terminate for some reason. In another scenario, if there is a burst of traffic for any amount of time and it is too much for the single instance to handle, then having the request flow first in a queue allows an auto-scaling group to scale up more instances based on the number of requests coming in at a certain point of time. This is easy to think of in an order processing...

API Gateway

When trying to build RESTful and WebSocket APIs, AWS creates a fully managed service that is built around a simple interface. API Gateway can act as the entryway to other AWS services such as data stored on RDS, or compute calls made by the EC2 or Lambda services as just an example. API Gateway supports a number of protocols including HTTP, HTTPS, and WebSocket.

One of the most compelling features about API Gateway is that since AWS is managing all of the underlying infrastructure, you and your development team can concentrate on building the data being served by the API and hence reduce the cost of building and maintain the API.

Security Considerations for API Gateway

With data and authorizations happening in the course of API events, understanding the security features that can and should be implemented when using the API Gateway service will help keep your data and applications fronted by API Gateway more secure.

• Enable Logging - When using API Gateway...

Trusted Advisor

As the number of resources grows in your AWS account, it can sometimes take work to keep track of them all. Challenges start to arise in the account, such as security groups that have access to anyone across the internet from a security perspective or unused Elastic IP addresses, which costing money despite being idle.

Every AWS customer and account has the ability to access the seven core security checks provided by the service. These include the following:

• Multifactor (MFA) on the Root Account
• S3 Bucket permissions
• EBS Snapshots available for Public access
• RDS Snapshots available for Public access
• Open access (0.0.0.0.0/0) on Security Groups
• That IAM users are being used (as opposed to the root user)
• Service Limits (these are on the service limits section, not the security section)

If you are on the Basic support plan, then you can view these checks easily within the AWS Management Console by doing the following:

1. Select...

Summary

In this chapter, you reviewed many of the major services used in AWS architecture. These make up the majority of the services that will be both part of your day-to-day responsibilities as AWS Cloud security engineers and the services which will be referenced in the questions on the exam.

Having the baseline knowledge of these services will allow us to dive deep into the most relevant exam material rather than revisiting the basics.

The next chapter will wrap up Section I by examining the different types of attacks that you need to look for in your AWS environments as a security engineer. It will discuss the relevant mitigation strategies to keep these attacks at bay as you examine each attack type, and you will also explore one of the most prevalent types of attacks, Distributed Denial of Service, or DDoS attacks in detail.

Further Reading

For additional information on the AWS shared responsibility model and an underlying foundation to AWS security, please look at the following resources:

• AWS Control Tower Controls Reference Guide

  https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

• AWS EC2 Frequently Asked Questions:

  https://aws.amazon.com/ec2/faqs/

• Amazon RDS FAQs

  https://aws.amazon.com/rds/faqs/

• Amazon DynamoDB FAQs

  https://aws.amazon.com/dynamodb/faqs/

• Amazon Route 53 FAQs

  https://aws.amazon.com/route53/faqs/

• AWS SQS FAQs

  https://aws.amazon.com/sqs/faqs/

• Security overview of AWS Lambda

  https://aws.amazon.com/lambda/security-overview-of-aws-lambda/

Summary

In this chapter, you reviewed many of the main services used in AWS architecture. These make up the majority of the services that will be part of your day-to-day responsibilities as AWS cloud security engineers and the services that will be referenced in the questions in the exam.

Having a baseline knowledge of these services will allow us to dive deep into the most relevant exam material rather than revisiting the basics.

Chapter 3, Understanding Attacks on Cloud Environments, will wrap up Section I by examining the different types of attacks that you need to look for in your AWS environments as a security engineer. It will discuss the relevant mitigation strategies to keep these attacks at bay as you examine each attack type, and you will also explore one of the most prevalent types of attacks, Distributed Denial of Service (DDoS) attacks, in detail.

Further Reading

For additional information on the AWS shared responsibility model and to gain a more comprehensive understanding of AWS security, please look at the following resources:

• AWS Control Tower Controls Reference Guide: https://packt.link/XHYWT
• AWS EC2 Frequently Asked Questions: https://packt.link/q8OxD
• Amazon RDS FAQs: https://packt.link/VgKnY
• Amazon DynamoDB FAQs: https://packt.link/gUa6j
• Amazon Route 53 FAQs: https://packt.link/LmMKz
• AWS SQS FAQs: https://packt.link/zTe0n
• Security overview of AWS Lambda: https://packt.link/gz2Tr

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH02.

   Alternatively, you can scan the following QR code (Figure 2.13):

Figure 2.13: QR code that opens Chapter Review...