Best Practices for Application Security, Identity, and Compliance

In the past, a common refrain from companies was that they were hesitant to move to the cloud because they believed the cloud was not secure. A big part of this pushback was that companies didn’t understand the cloud or its capabilities. It is possible to have security vulnerabilities even if you use cloud infrastructure. However, as we will see in this chapter, AWS provides a comprehensive catalog of services enabling you to create highly secure sites and applications.

When creating applications and implementing workflows, it is imperative to consider security from the start of your design and not as an afterthought. First, you will understand why security is essential in any system – not just in the cloud. Next, you will learn how AWS, in general, and IAM, in particular, can help us design and build robust and secure cloud applications. Also, as you will see in this chapter, AWS provides a veritable...

Understanding the importance of security, identity, and compliance in AWS

Many organizations face challenges in maintaining and managing the security of their on-premises infrastructure. In an on-premises environment, it can be challenging to know what resources and data are out there at any given time, where they are moving, and who is utilizing/accessing them. Accurate, real-time asset inventory requires expensive and complex tooling, making it inaccessible for most organizations. This lack of visibility in their on-premises environment hinders their ability to ensure adequate security and compliance of infrastructure and data. With AWS, you can see all your infrastructure and application resources in one place and maintain servers, storage, and database inventory records and access patterns.

AWS enhances your capacity to adhere to key security and compliance standards, such as data locality, protection, and confidentiality, through its extensive services and features. Boasting...

Join our book community on Discord

https://packt.link/AWS4SAs

Building applications is all about data collection and management. If you design an e-commerce application, you want to show available inventory catalog data to customers and collect purchase data as they make a transaction. Similarly, if it is an autonomous vehicle application, you want to analyze surrounding traffic data and provide the right prediction to data to cars. As of now, you learned about networking, storage, and compute in previous chapters. In this chapter, you will learn the choices of database services available in AWS to complete the core architecture tech stack.

With so many choices at your disposal, it is easy to get analysis paralysis. So, in this chapter, we will first lay a foundation of how the databases and their use cases can be classified and then use these classifications to help us pick the right service for our particular use case and our circumstances. In this chapter, you will navigate the...

A brief history of databases

Relational databases have been around for over 50 years. Edgar F. Codd created the first database in 1970. The main feature of a relational database is that data is arranged in rows and columns, and rows in tables are associated with other rows in other tables by using the column values in each row as relationship keys. Another important feature of relational databases is that they normally use Structured Query Language (SQL) to access, insert, update, and delete records. SQL was created by IBM researchers Raymond Boyce and Donald Chamberlin in the 1970s. Relational databases and SQL have served us well for decades.

With the internet's popularity increased in the 1990s, we started hitting scalability limits with relational databases. Additionally, a wider variety of data types started cropping up. RDBMSes were simply not enough anymore. This led to the development of new designs, and we got the term NoSQL databases. As confusing as the term is, it does...

Data-Driven Innovation trends

Since high-speed internet has been available in the last decade, more and more data is getting generated. Before we can talk about how to take advantage of data, let's first talk about three major trends that impact how you think about data.

The explosion of data: There is an explosion of data being generated. You have to track a lot of data from your business applications. However, the growth comes from data generated by network-connected smart devices that drive the variety and volume of data. Every "smart" device produces real-time data, such as mobile phones, connected cars, smart homes, wearable technologies, home appliances, security systems, industrial equipment, machinery, and electronics. Most new cars have built-in cellular connections, which account for one-third of mobile sign-ups on cell phone networks. Applications also generate real-time data such as purchase data from e-commerce sites, user behavior from mobile apps, and tweets...

Database consistency model

Transaction data consistency in the context of databases refers to the requirement that any database transaction can change data only in allowed ways. Data written to the database will be validated against a set of rules and constraints, and all these checks must always be passed before the data is made available to other users. Currently, there are two popular data consistency models. We'll discuss these models in the following subsections.

ACID data consistency model

When database sizes were measured in megabytes, we could have stringent requirements that enforced strict consistency. Since storage has become exponentially cheaper, databases can be much bigger, often measured in terabytes and even petabytes. For this reason, making databases ACID-compliant for storage reasons is much less prevalent. The ACID model guarantees the following:

• Atomicity: For an operation to be considered atomic, it should ensure that transactions within the operation either...

Database usages model

Two operations can be performed with a database first, ingest data (or write data into the database) and second, retrieve data (or read data from the database). These two operations will always be present.

On the ingestion side, the data will be ingested in two different ways. It will either be data update or brand new data (such as an insert operation). To retrieve data, you will analyze the change data capture (CDC) set, which is changes in existing data or accessing brand new data. But what drives your choice of database is not the fact that these two operations are present but rather the following:

• How often will the data be retrieved?
• How fast should it be accessed?
• Will the data be updated often, or will it be primarily new?
• How often will the data be ingested?
• How fast does ingestion need to be?
• Will the ingested data be sent in batches or in real-time?
• How many users will be consuming the data?
• How many simultaneous processes will there be for ingestion...

AWS database services

AWS offers a broad range of database services that are purpose-built for every major use case. These fully managed services allow you to build applications that scale quickly. All these services are battle-tested and provide deep functionality, so you get the high availability, performance, reliability, and security required by production workloads.

AWS fully managed database services include relational databases for transactional applications (Amazon RDS and Amazon Aurora), non-relational databases for internet-scale applications (Amazon DynamoDB), an in-memory data store for caching and real-time workloads (Amazon ElastiCache), and a graph database for building applications with highly connected data (Amazon Neptune). If you want to migrate your existing databases to AWS, the AWS Database Migration Service makes it easy and cost-effective. Each of these database services is so vast that going into details warrants a book for each of these services itself. This...

Amazon Keyspaces (for Apache Cassandra)

Amazon Keyspaces is a highly scalable, highly available, and managed Apache Cassandra–a compatible database service. With Amazon Keyspaces, you can run your Cassandra workloads on AWS using the same Cassandra application code and developer tools you use today. Servers are automatically spun up or brought down, and, as such, users are only charged for the servers, Cassandra is using at any one time. Since AWS manages it, users of the service never have to provision, patch, or manage servers, and they don't have to install, configure, or tune software. Cassandra in AWS can be configured to support thousands of user requests per second.

You can build applications that serve thousands of requests per second with virtually unlimited throughput and storage. Data is encrypted by default, and Amazon Keyspaces enables you to back up your table data continuously using point-in-time recovery. Amazon Keyspaces provides the performance, elasticity...

Benefits of AWS database services

In the new world of cloud-born applications, a one-size-fits-all database model no longer works. Modern organizations will not only use multiple types of databases for multiple applications, but many will use multiple types of databases in a single application. To get more value from data, you can choose the following three options available in AWS based on your workload.