AWS Security Best Practices

To help you configure, secure, and protect your AWS environment against both internal and external threats, there are a number of security best practices that you can adhere to that will help you maintain a high level of control across your environment. This chapter will focus on some of those best practices and how you can use them in your daily operations when running workloads across AWS.

I have always said that it is very easy to deploy resources within AWS, often with just a few simple clicks within the AWS Management Console, or a few commands run at the AWS CLI level. Either way, deploying the resources is the easy part, architecting and maintaining a strict level of access control, data protection, and availability is a different matter. Any data, service, or application running in AWS needs to be protected and secured if you want to minimize...

Technical requirements

To gain the most from this chapter, you should have an understanding of the following services:

• Amazon Simple Storage Service (S3)
• Amazon Virtual Private Cloud (VPC)
• Amazon Elastic Compute Cloud (EC2)
• AWS Identity and Access Management (IAM)
• AWS Key Management Service (KMS)

You would have already come across some of these point already in this book; however, in this chapter, I want to focus on the key best practices and why you should be implementing them. This chapter will not focus on how to configure those services, it will explain the reasoning behind the importance of maintaining the best practice.

Shared responsibility model

Understanding the AWS shared responsibility model is absolutely fundamental when it comes to using and deploying infrastructure within AWS. You need to be fully aware of where your responsibility starts and ends from a security perspective. How can you possibly architect your environment if you do not know where you boundary of responsibility ends? The simple answer is you can't. If you presume that another party, in this case, AWS, is maintaining a certain level of security of your infrastructure, you will almost inevitably leave a vulnerability within your infrastructure allowing a malicious user to take advantage of the weakness and gain unauthorized entry into your environment.

Many users of AWS are only aware of one shared responsibility model, which looks as follows and covers the infrastructure elements of AWS, such as EC2:

Shared responsibility...

Data protection

From a data protection perspective, there are a number of elements to consider when looking at best practices.

Using encryption at rest for sensitive data

Encryption is such an important part of protecting your data from being seen and read by anyone that it is not intended for. AWS offers a range of services and methods for encryption, and here are some of the key points to be made aware of in preparation for your certification.

Encryption should be used for data when both at rest and in transit, especially for sensitive data. All too often, we have seen in the media vast amounts of data that have been mistakenly exposed and customer data leaked because it was all stored in plaintext.

KMS can be used to control...

Virtual Private Cloud

The Virtual Private Cloud (VPC) is your own segment of the AWS cloud where you can deploy your resources and build solutions. Through the use of different subnets, route tables, and an internet gateway, you can configure your VPC to communicate with the internet, in addition to allowing traffic from the internet to access your resources, such as a web server.

The creation of your VPCs can be very simple, but understanding how traffic and boundaries are implemented is a security must. There are a variety of methods to control traffic and access to different network segments. To isolate and control network traffic, you should adopt as many of these options as possible

Using security groups to control access at an instance level

...

Identity and Access Management

IAM is probably the most common security service of IAM, so many service integrate with IAM and the features that it provides, and so it makes perfect sense to ensure you are aware of some of the best practices from an access control perspective.

Avoid sharing identities

You should not share an IAM user identity among a shared group of users. This makes it very difficult from a security risk perspective, especially when an incident occurs as a result of an action that was carried out by that identity. It's easy to track what actions a user has carried out by analyzing the logs from CloudTrail. However, if this user is shared by multiple parties, it's not so easy to identify the individual...

EC2 security

EC2 is one the services that is covered the most within the certification, and you need to have a solid understanding of all things EC2, which includes the best practices, when it comes to securing them.

Implementing a patching strategy

As we know from the shared responsibility model, when it comes to managing the security of our instances, we, the customers, are responsible for securing the OS itself, and this includes downloading and installing the latest patches that are released by the OS vendors. New patches often have fixes for previously identified security weaknesses. Failure to install the latest patches could cause an unexpected security exposure that could be exploited.

You could leverage the capabilities...

Security services

AWS has a dedicated category for their AWS security centric services within the AWS Management Console, and I am sure over time this list will continue to grow as new demands and threats are identified within the ever-growing field of cloud computing. At the time of writing this book, the category listing looks as follows:

To help you in the ever continuing task of securing your infrastructure its best practice to use these services where required, some of these services have been covered within this book and are accessed within the certification; others do not play as much of an active part for the Solution Architect - Associate. However, I feel it's good to have an awareness of what each of these services does at a high level to help with preparation and to be aware of the purpose of each security service:

• IAM: The Identity and Access Management service...

Summary

Implementing security best practices requires an understanding of the shared responsibility model; once you understand your responsibilities, you can begin to architect and implement additional levels of security throughout your environment. Adhering to best practices from the outset will significantly help to protect your data and resources from a wide variety of threats, risks, and exposures, both internally and externally.

This chapter has focused on some of the common security best practices, some of which may be referenced within the certification. Understanding the reasoning behind the best practice helps you to protect against the threat in a structured way.

New threats are being defined and exposed all the time, and so it's important to keep revisiting your security strategy, to ensure that it is still meeting all the requirements stipulated within your Information...

Further reading

• AWS Security Best Practices Whitepaper: https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf
• How to encrypt an EBS Volume: https://cloudacademy.com/blog/how-to-encrypt-an-ebs-volume-the-new-amazon-ebs-encryption/