An Overview of Security and Compliance Services

Understanding what each of the AWS security services does as a function is essential if you want to be able to be able to protect your infrastructure and applications as set out by the requirements within your security strategy.

Security is AWS's number one priority, and so, as a result, each security service has been designed and crafted with a specific objective. This chapter will look at a number of different services that focus on security and compliance at a high level, to enable you to select and architect the appropriate solution.

The services that will be discussed within this chapter include the following:

• AWS CloudTrail
• Amazon Inspector
• AWS Trusted Advisor
• AWS Systems Manager
• AWS Config

There are a number of other security-focused services, and detailed information on these can be found within the following chapters...

Technical requirements

To gain the most from this chapter, you should have an understanding of the following AWS services:

• EC2, including AMI configuration
• Simple Notification Service (SNS)
• An awareness of AWS Lambda

AWS CloudTrail

AWS CloudTrail is a service that is used heavily when it comes to compliance and auditing. This is because its core function is to track and record application programming interface (API) calls made within your AWS account. These API requests can be initiated from users within the management console, when using an SDK or via the AWS CLI, to those initiated by other AWS services that may be responding to events, for example, an alert being sent by SNS when a CloudWatch metric threshold has been met.

CloudTrail is a global service covering all regions and most AWS services: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html.

With so much coverage, not only does this make an effective compliance tool, it also makes a great security analysis tool. This is because the information captured during an API call also contains...

Amazon Inspector

Amazon Inspector is a security service designed to help secure your EC2 instances against known vulnerabilities and threats. It is used to identify and notify you if any of these vulnerabilities exist within your EC2 fleet, in addition to identifying those that could also affect your applications running on your EC2 instances. Like Amazon CloudTrail, Inspector is also a managed service that only operates through an Amazon Inspector agent that is installed locally on the instances that you want to protect.

Once the agent is installed, it is possible to automatically run scheduled assessments that look for security weaknesses and flaws, using a series of predefined rules packages. These rules packages can consist of one or more of the following four categories:

• Center for Internet Security (CIS) Benchmarks: These are global standards that are used across the industry...

AWS Trusted Advisor

The AWS Trusted Advisor service is extremely useful and can help you optimize your AWS infrastructure within your environment based on best practices. It provides recommendations based on the following five core categories:

• Cost Optimization: This category will provide suggestion and improvements on how you could reduce your costs based on your current AWS environment and resources
• Performance: Trusted Advisor will scan and assess your resources to see whether there are changes that could be made to rectify any performance concerns
• Security: This will analyze your environment to look for security vulnerabilities and threats, based on best practice
• Fault Tolerance: This category will provide suggestions and improvements that could enhance your resilience within your deployed resources
• Service Limits: This will show you how close you are to particular service...

AWS Systems Manager

The AWS Systems Manager (known as SSM) service has been derived from previous services that you may have heard of that are no longer in service, these being AWS EC2 Systems Manager and Amazon Simple Systems Manager.

The service itself is designed to help you manage and give visibility to your infrastructure, particularly when it comes to your EC2 fleet. It also has the ability to configure and manage your virtual compute resources on-premises, as well as within your AWS environment, ensuring they meet specific compliance needs. Using AWS SDKs, the AWS CLI, AWS Toolkit for Windows PowerShell, or even the AWS the Management Console, you are able to centrally manage, review, and automate tasks for your resources. This makes it a great tool for helping you view your infrastructure through a single pane of glass, making it highly scalable.

Much like Amazon Inspector...

AWS Config

AWS Config is another key service when it comes to compliance, and it has a close relationship with AWS CloudTrail.

The service focuses on the importance of resource management within your organization. In a typical on-premises environment, you are often required to have a full understanding of your assets within the data centers, as well as knowing their configuration status and the current version of the software. Much of this is required for audits that are normally reviewed a number of times a year. This would often include the requirement to have an awareness of resource dependencies and communication paths. Trying to operate your own manual method of gaining this data within your AWS account, with its continuous fluctuation and scaling of resources, could prove both time consuming and a never-ending task, and this is why AWS Config was introduced. AWS Config...

Summary

AWS offers a wide range of security and compliance services available to us as customers, and it's down to us to use them within our own environments to help safeguard and protect our resources and data. It's very easy to implement and add data and services within AWS, but understanding how to protect them effectively is a different matter.

You need to understand what data you have within your environment, become aware of how to monitor that data, and whether any changes are happening to not only the data, but the resources that are behind that data as well.

Maintaining compliance within a cloud environment can be a tricky task to implement effectively; due to the fluidity of the cloud, resources are changing all of the time, but you need to know when a change is a standard operational change, or a restricted unauthorized change. The services covered within this...

Further reading

More information regarding some of the topics covered in this chapter can be found here:

• Trusted Advisor Blogs: https://aws.amazon.com/blogs/aws/category/aws-trusted-advisor/
• AWS Config Best Practices: https://aws.amazon.com/blogs/mt/aws-config-best-practices/
• AWS Webinar: Automated Compliance and Governance: AWS Config and AWS CloudTrail – 2017 AWS Online Tech Talks: https://www.youtube.com/watch?v=9g0u_05WBig