Securing EC2 Instances

AWS Elastic Compute Cloud (EC2) is one of the most commonly used compute services in AWS. With a wide variety of operating systems and the flexibility of processing and memory options available, along with an array of performance variations to meet various workloads, the EC2 service makes it extremely easy to get up and running in the cloud. Furthermore, if you have long-running or predictable workloads, with the EC2 service, you can take advantage of cost savings in Reserved Instances or Savings Plans. Even for short-term instances, EC2 offers its extra capacity as Spot Instances at significant discounts.

Unfortunately, there will always be malicious actors with the sole aim of harming and hindering your infrastructure. As a result, you need to learn the techniques that not only keep your perimeter secure, as discussed in Chapter 10, but also maintain the security of the EC2 instances running your application code inside your AWS environment. These security...

Technical Requirements

To complete some of the exercises in this chapter, you will need an AWS account with an EC2 Linux instance running and permission to access the instance. You will also need permission to run and configure Amazon Inspector and AWS Systems Manager.

Securing Key Pairs for EC2 Instances

The more customizable your service or platform, the more responsibilities you hold as the customer. With the EC2 service, you can create a set of encryption keys that will allow secure access to your EC2 instances.

Creating and Securing EC2 Key Pairs

As part of the process for creating an EC2 instance, you are asked to create a new key pair or select an existing one. This section will discuss the importance of these key pairs and how you can manage them.

Key pairs allow you to connect to your instance, whether it’s Linux-based or Windows-based. The methods for connecting to each of these operating systems with key pairs differ, and you will review the different techniques shortly.

Each key pair uses public key cryptography using 2,048-bit SSH-2 RSA keys and is used to encrypt and decrypt administrative logs on credentials for that instance. It is worth noting, however, that key pairs, once created, are not tied down to a specific...

Building a Hardened Bastion Server

In Chapter 10, Configuring Infrastructure Security, you were introduced to the concept of a bastion server. This server is installed in one of the public subnets and acts as a jump box to access the other systems on your AWS network, especially in cases where you need to get in from an external IP address.

Figure 11.10: A bastion server in a public subnet

Figure 11.10 depicts a user outside the network where the AWS VPC resides entering the VPC from the internet gateway with access to the public subnet. Suppose the user’s external IP address has been granted access to the bastion server in the bastion’s security group. In that case, that user can authorize themselves and gain access to the bastion. Once on the bastion server, the user is on the network and can either directly go to the EC2 instance or create an SSH tunnel to one of the resources in the private subnet, such as the EC2 instance or the RDS...

Isolating EC2 Instances for Forensic Inspection

If you are going to perform forensic inspection or forensic analysis, you need to have created the required infrastructure beforehand. The optimal way to do this is with AWS Organizations and the creation of a specialized forensic account. Some companies skip creating the forensic account and instead use their security account inside the AWS organization structure. This practice can be dangerous. For example, if you have moved an instance or function over to the quarantine in the forensic account because it had malicious software that could spread to other parts of the account and perform destructive actions such as deleting files, you don’t want the same happening in your specialized security account. Figure 11.21 presents a graphical representation of the isolated placement of forensic accounts in an AWS Organizations structure.

Figure 11.21: Forensic account placement in AWS organizational structure...

Using Systems Manager to Configure Instances

Earlier in the chapter, you saw how one of the components of the Systems Manager service, Session Manager, could be used in lieu of a bastion server to connect to remote EC2 instances. Systems Manager has many other uses when it comes to managing your AWS environment, especially for a security engineer.

AWS Systems Manager is a powerful tool that allows you to easily and quickly administer and perform operational actions against your instances (both Windows- and Linux-based) at scale for both on-premises resources and within AWS without having to SSH or RDP to those instances. From a security standpoint, being able to remove these protocols from security groups reduces the attack surface of your instances even further. A single dashboard providing this administration also allows you greater infrastructure visibility. You will, for example, be able to see system configurations, the patching levels of your instances, and other software...

Performing a Vulnerability Scan Using Amazon Inspector

Amazon Inspector is a security assessment service provided by AWS. It helps you identify potential vulnerabilities and security issues in your AWS resources and applications. Amazon Inspector is designed to automate the assessment of security vulnerabilities and deviations from security best practices, enabling you to analyze the security posture of your AWS environment quickly and efficiently.

The service uses a combination of network-based and host-based assessments to gather information about your resources. It analyzes this data to generate findings that highlight security issues such as common software vulnerabilities, insecure configurations, and inadequate access controls. These findings are presented in a comprehensive report with detailed information about the identified vulnerabilities and recommended remediation steps.

Amazon Inspector offers pre-built assessment templates based on best practices and industry standards...

Summary

In this chapter, you learned how to create key pairs for your EC2 instances so that you could securely access your instances over either the SSH or RDP protocols. Then, you examined how to securely access your private AWS infrastructure using a hardened bastion server or the AWS Session Manager service.

You also saw how to take your previously configured EC2 instance and then install the Amazon Inspector agent on it so that the latter can inform you if it finds any vulnerabilities.

In Chapter 12, Managing Key Infrastructure, you will examine the Amazon-managed encryption service KMS. You will go through steps to create your customer-managed keys and learn how different permissions can be set so that users from various groups in your organization can access data using those keys. You will also see how keys can be either rotated automatically or manually based on the needs of your organization.

Further Reading

For additional information on the AWS shared responsibility model and more comprehensive understanding of AWS security, please look at the following resources:

• Tips for securing your EC2 instances: https://packt.link/cWtCg
• Amazon Inspector FAQs: https://packt.link/FSfts
• AWS Systems Manager FAQs: https://packt.link/gbQKd
• Amazon Detective FAQs: https://packt.link/eqhB9

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH11

   Alternatively, you can scan the following QR code (Figure 11.35):

Figure 11.35: QR code that opens Chapter Review...