Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
AWS Security Cookbook
AWS Security Cookbook

AWS Security Cookbook: Practical solutions for managing security policies, monitoring, auditing, and compliance with AWS

eBook
AU$59.99 AU$66.99
Paperback
AU$45.99 AU$61.99
Paperback
AU$82.99
Subscription
Free Trial
Renews at $19.99p/m

What do you get with Print?

Product feature icon Instant access to your digital copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Redeem a companion digital copy on all Print orders
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Product feature icon AI Assistant (beta) to help accelerate your learning
OR
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Table of content icon View table of contents Preview book icon Preview Book

AWS Security Cookbook

Access Management with IAM Policies and Roles

Secure access management is crucial for effectively managing who can access our AWS resources and what actions they can perform. This knowledge ensures that our AWS environment remains secure and compliant by allowing us to precisely control permissions and minimize the risk of unauthorized access. It empowers us to implement a robust security posture that safeguards our data and resources, while also enabling a scalable and efficient way to manage access for users and services across our AWS infrastructure. In this chapter, we will learn about secure access management within the AWS cloud using IAM policies and IAM roles.

AWS supports various policy types, such as identity-based policies, resource-based policies, session policies, permissions boundaries, service control policies (SCPs), and access control lists (ACLs). While we will learn most of these policy types with detailed recipes. ACLs are only discussed theoretically since ACLs...

Technical requirements

Before diving into the recipes of this chapter, we need to ensure we have the following requirements in place:

  • We need an active AWS account to complete most of the recipes within this chapter. We can use an account that is part of an AWS organization or a standalone account for most of the recipes within this chapter. I will be using the awsseccb-sandbox-1 AWS organization member account that we created in the Multi-account management with AWS Organizations recipe from Chapter 1. However, unless specified otherwise, I won’t be utilizing AWS Organizations features, meaning you can follow these steps with a standalone account, too. Note that certain recipes may have different AWS account requirements, which will be specified in those recipes.
  • For administrative actions, we need a user who has AdministratorAccess permission to the AWS account we are working with. This can be an IAM Identity Center user or an IAM user. I will be using the awsseccbadmin1...

Creating a customer-managed IAM policy

In this recipe, we will create a customer-managed identity-based IAM policy to manage access to an S3 bucket. We will give permission to list all S3 buckets and will further use the Condition policy element to restrict the permission based on the requester’s IP address. We will use the AWS Management Console for this recipe, but you may do it from the AWS CLI by making use of the provided JSON code following the next recipe titled Using policy variables within IAM policies from this chapter.

IAM policies can work with both IAM and IAM Identity Center. Within this recipe, we will use the IAM policies with IAM entities. In the recipe titled Creating customer-managed policies in IAM Identity Center from this chapter, we will learn how to use the same policy with IAM Identity Center entities.

Getting ready

We need the following to successfully complete this recipe:

  • A working AWS account, awsseccb-sandbox-1, and a user with...

Using policy variables within IAM policies

IAM policy variables are a set of predefined placeholders that we can use in IAM policy documents, and they get replaced with the actual values at runtime. They help in creating more dynamic and flexible policies. In this recipe, we will create an S3 bucket with folders matching the usernames of IAM users. With the help of the ${aws:username} policy variable, we will allow the IAM user to list the contents of only the folder with their names. We will use the AWS CLI for this recipe, but you may do it from the AWS Management Console by making use of the provided JSON code following the previous recipe.

Getting ready

We need the following to successfully complete this recipe:

  • A working awsseccb-sandbox-1 AWS account, a user with AdministratorAccess permission to that account, awsseccbadmin1, and a corresponding Sandbox1Admin1CLI profile, following the Technical requirements section of this chapter.
  • For testing this recipe,...

Creating customer-managed policies in IAM Identity Center

To create customer-managed policies in IAM Identity Center, we need to first create a custom permission set and then assign users or groups to one or more AWS accounts with that permission set. In the User management and SSO with IAM Identity Center recipe from Chapter 1, we created a permission set using an AWS-managed policy. In this recipe, we will create a custom permission set based on the customer-managed IAM policy we created in the Creating a customer-managed IAM policy recipe in this chapter, and then, we will assign a user to an AWS account with this permission set making use of groups.

Getting ready

We need the following to successfully complete this recipe:

  • An AWS account where an IAM Identity Center instance is setup. If we are using AWS Organizations, as we saw in Chapter 1, this will be the management account. We could also do this using a delegated administrator account in an AWS organization. We...

Setting IAM permission boundaries for IAM entities

This recipe demonstrates how to use permissions boundaries to set a maximum permission limit for an IAM entity such as an IAM user or an IAM role. Initially, we will assign a user complete access to S3. Subsequently, we’ll apply a permission boundary to confine the user’s S3 permissions exclusively to read-only access. Similar to SCPs, permission boundaries do not grant permissions; they only define constraints. In other words, without an identity-based, resource-based, or session policy in place, actions permitted within the permission boundary or SCP cannot be executed.

Getting ready

We need the following to successfully complete this recipe:

  • A working AWS account, awsseccb-sandbox-1, and a user with AdministratorAccess permission to that account, awsseccbadmin1, following the Technical requirements section of this chapter.
  • An IAM user, awsseccb_iam_user1, with AmazonS3FullAccess permission to the...

Centralizing governance in AWS Organizations with SCPs

SCPs in AWS allow us to manage permissions across an entire AWS organization, organizational units (OUs), or even individual accounts. SCPs fulfill the crucial need for centralized governance by allowing administrators to implement consistent compliance and security policies efficiently across multiple AWS accounts. By utilizing SCPs, organizations can enhance their security posture, manage risks more effectively, and ensure adherence to both internal policies and external regulatory requirements through a centralized policy management framework. In this recipe, we will use an SCP to restrict the creation of Amazon S3 buckets within a specific Region.

Getting ready

We need a working AWS account with AWS Organizations service enabled. I will be using the aws-sec-cookbook-1 account that we created in Chapter 1.

How to do it...

We can explore SCPs as follows:

  1. Log in to the AWS Management Console and navigate to...

IAM cross-account role switching and identity account architecture

Many organizations use multiple AWS accounts to distinctly manage different operational environments, such as development, testing, and production. Users with varied job roles may need diverse access privileges across these environments. However, the task of managing multiple IAM users, each having different access credentials across various AWS accounts, can be complex and time consuming.

A role in AWS IAM grants a specific set of permissions, much like a user account. Unlike users, we do not directly log in to roles; instead, we can switch to a role either in our own account or another AWS account. This replaces our original permissions with the role’s permissions. Based on how the role switch happens, two primary strategies are often utilized to streamline user access management across multiple AWS accounts, negating the need for individual IAM users and access credentials for each account.

The first...

Cross-service access via IAM roles on EC2 instances

In this recipe, we will create an IAM role that allows an EC2 instance to access S3 APIs and then attach it to an EC2 instance. IAM roles provide temporary permissions for an AWS service or user to access another AWS service. This avoids the need for hard coding credentials such as access keys and secret access keys within EC2 instances.

Getting ready

To complete the steps within this recipe, we need the following:

  • A working AWS account, awsseccb-sandbox-1, and a user with AdministratorAccess permission to that account, awsseccbadmin1, following the Technical requirements section of this chapter.
  • Working knowledge of IAM, EC2, and S3 services.

How to do it...

We can create an IAM role for an EC2 instance with access to S3 APIs as follows:

  1. Go to the IAM dashboard.
  2. Click on Roles from the left sidebar.
  3. Click on Create role.
  4. Under Trusted entity type, select AWS service, and under the Service...
Left arrow icon Right arrow icon
Download code icon Download Code

Key benefits

  • Explore useful recipes for implementing robust cloud security solutions on AWS
  • Monitor your AWS infrastructure and workloads using CloudWatch, CloudTrail, config, GuardDuty, and Macie
  • Prepare for the AWS Certified Security-Specialty exam by exploring various security models and compliance offerings

Description

As a security consultant, securing your infrastructure by implementing policies and following best practices is critical. This cookbook discusses practical solutions to the most common problems related to safeguarding infrastructure, covering services and features within AWS that can help you implement security models such as the CIA triad (confidentiality, integrity, and availability), and the AAA triad (authentication, authorization, and availability), along with non-repudiation. The book begins with IAM and S3 policies and later gets you up to speed with data security, application security, monitoring, and compliance. This includes everything from using firewalls and load balancers to secure endpoints, to leveraging Cognito for managing users and authentication. Over the course of this book, you'll learn to use AWS security services such as Config for monitoring, as well as maintain compliance with GuardDuty, Macie, and Inspector. Finally, the book covers cloud security best practices and demonstrates how you can integrate additional security services such as Glacier Vault Lock and Security Hub to further strengthen your infrastructure. By the end of this book, you'll be well versed in the techniques required for securing AWS deployments, along with having the knowledge to prepare for the AWS Certified Security – Specialty certification.

Who is this book for?

If you are an IT security professional, cloud security architect, or a cloud application developer working on security-related roles and are interested in using AWS infrastructure for secure application deployments, then this Amazon Web Services book is for you. You will also find this book useful if you’re looking to achieve AWS certification. Prior knowledge of AWS and cloud computing is required to get the most out of this book.

What you will learn

  • Create and manage users, groups, roles, and policies across accounts
  • Use AWS Managed Services for logging, monitoring, and auditing
  • Check compliance with AWS Managed Services that use machine learning
  • Provide security and availability for EC2 instances and applications
  • Secure data using symmetric and asymmetric encryption
  • Manage user pools and identity pools with federated login
Estimated delivery fee Deliver to United States

Economy delivery 10 - 13 business days

Free $6.95

Premium delivery 6 - 9 business days

$21.95
(Includes tracking information)

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Last updated date : Feb 11, 2025
Publication date : Feb 27, 2020
Length: 440 pages
Edition : 1st
Language : English
ISBN-13 : 9781838826253
Category :
Concepts :
Tools :

What do you get with Print?

Product feature icon Instant access to your digital copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Redeem a companion digital copy on all Print orders
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Product feature icon AI Assistant (beta) to help accelerate your learning
OR
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Estimated delivery fee Deliver to United States

Economy delivery 10 - 13 business days

Free $6.95

Premium delivery 6 - 9 business days

$21.95
(Includes tracking information)

Product Details

Last updated date : Feb 11, 2025
Publication date : Feb 27, 2020
Length: 440 pages
Edition : 1st
Language : English
ISBN-13 : 9781838826253
Category :
Concepts :
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts

Table of Contents

12 Chapters
Chapter 1: Setting Up AWS Accounts and Organization Chevron down icon Chevron up icon
Chapter 2: Access Management with IAM Policies and Roles Chevron down icon Chevron up icon
Chapter 3: Key Management with KMS and CloudHSM Chevron down icon Chevron up icon
Chapter 4: Securing Data on S3 with Policies and Techniques Chevron down icon Chevron up icon
Chapter 5: Network and EC2 Security with VPCs Chevron down icon Chevron up icon
Chapter 6: Web Security Using Certificates, CDNs, and Firewalls Chevron down icon Chevron up icon
Chapter 7: Monitoring with CloudWatch, CloudTrail, and Config Chevron down icon Chevron up icon
Chapter 8: Compliance with GuardDuty, Macie, Inspector, and Analyzer Chevron down icon Chevron up icon
Chapter 9: Advanced Identity and Directory Management Chevron down icon Chevron up icon
Chapter 10: Additional Services and Practices for AWS Security Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon
Other Books You May Enjoy Chevron down icon Chevron up icon

Customer reviews

Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5
(4 Ratings)
5 star 50%
4 star 50%
3 star 0%
2 star 0%
1 star 0%
Lin Zhu Oct 25, 2024
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Security is the most critical part of cloud design and it covers broad range of services and topics. Having a guide like this will help to ensure you are not forgetting any key areas. I feel it is not only a great tool for AWS but also for other clouds as well.
Amazon Verified review Amazon
Ivonne Oct 27, 2024
Full star icon Full star icon Full star icon Full star icon Full star icon 5
As a Security Engineer, I found this book invaluable in refining my AWS multi-account strategy. It combines insightful best practices with clear, step-by-step instructions that make complex security topics accessible and actionable. I highly recommend this book to both beginners and intermediate users aiming to strengthen their AWS security knowledge and apply practical solutions effectively.
Amazon Verified review Amazon
M. S Nov 13, 2024
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
I read a lot of the book. I also worked through some of the items. There is so much good detail and information on how to secure AWS. I have worked most of these items in the past. I learned a lot from the book. I do think there is one fault with the book. It assumes you are starting from a brand new scratch account. Rarely are you doing that in the security field. Most of the time, you are having to start with a mess and have to clean it up. This book is still useful and has great info. If you come into a mess of an AWS account.. my advice: take a breath and skip to the books section Trust Advisor. Also, if you are working for a company that has AWS services, talk to your rep too. Read more
Amazon Verified review Amazon
Ashish Chettri Nov 09, 2024
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
The book is structured around practical solutions for safeguarding AWS infrastructure, covering essential security models. Whether you are a security professional or a cloud architect, this Cookbook is a valuable resource that will help you build and maintain a secure AWS environment. Read more
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is the digital copy I get with my Print order? Chevron down icon Chevron up icon

When you buy any Print edition of our Books, you can redeem (for free) the eBook edition of the Print Book you’ve purchased. This gives you instant access to your book when you make an order via PDF, EPUB or our online Reader experience.

What is the delivery time and cost of print book? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
What is custom duty/charge? Chevron down icon Chevron up icon

Customs duty are charges levied on goods when they cross international borders. It is a tax that is imposed on imported goods. These duties are charged by special authorities and bodies created by local governments and are meant to protect local industries, economies, and businesses.

Do I have to pay customs charges for the print book order? Chevron down icon Chevron up icon

The orders shipped to the countries that are listed under EU27 will not bear custom charges. They are paid by Packt as part of the order.

List of EU27 countries: www.gov.uk/eu-eea:

A custom duty or localized taxes may be applicable on the shipment and would be charged by the recipient country outside of the EU27 which should be paid by the customer and these duties are not included in the shipping charges been charged on the order.

How do I know my custom duty charges? Chevron down icon Chevron up icon

The amount of duty payable varies greatly depending on the imported goods, the country of origin and several other factors like the total invoice amount or dimensions like weight, and other such criteria applicable in your country.

For example:

  • If you live in Mexico, and the declared value of your ordered items is over $ 50, for you to receive a package, you will have to pay additional import tax of 19% which will be $ 9.50 to the courier service.
  • Whereas if you live in Turkey, and the declared value of your ordered items is over € 22, for you to receive a package, you will have to pay additional import tax of 18% which will be € 3.96 to the courier service.
How can I cancel my order? Chevron down icon Chevron up icon

Cancellation Policy for Published Printed Books:

You can cancel any order within 1 hour of placing the order. Simply contact customercare@packt.com with your order details or payment transaction id. If your order has already started the shipment process, we will do our best to stop it. However, if it is already on the way to you then when you receive it, you can contact us at customercare@packt.com using the returns and refund process.

Please understand that Packt Publishing cannot provide refunds or cancel any order except for the cases described in our Return Policy (i.e. Packt Publishing agrees to replace your printed book because it arrives damaged or material defect in book), Packt Publishing will not accept returns.

What is your returns and refunds policy? Chevron down icon Chevron up icon

Return Policy:

We want you to be happy with your purchase from Packtpub.com. We will not hassle you with returning print books to us. If the print book you receive from us is incorrect, damaged, doesn't work or is unacceptably late, please contact Customer Relations Team on customercare@packt.com with the order number and issue details as explained below:

  1. If you ordered (eBook, Video or Print Book) incorrectly or accidentally, please contact Customer Relations Team on customercare@packt.com within one hour of placing the order and we will replace/refund you the item cost.
  2. Sadly, if your eBook or Video file is faulty or a fault occurs during the eBook or Video being made available to you, i.e. during download then you should contact Customer Relations Team within 14 days of purchase on customercare@packt.com who will be able to resolve this issue for you.
  3. You will have a choice of replacement or refund of the problem items.(damaged, defective or incorrect)
  4. Once Customer Care Team confirms that you will be refunded, you should receive the refund within 10 to 12 working days.
  5. If you are only requesting a refund of one book from a multiple order, then we will refund you the appropriate single item.
  6. Where the items were shipped under a free shipping offer, there will be no shipping costs to refund.

On the off chance your printed book arrives damaged, with book material defect, contact our Customer Relation Team on customercare@packt.com within 14 days of receipt of the book with appropriate evidence of damage and we will work with you to secure a replacement copy, if necessary. Please note that each printed book you order from us is individually made by Packt's professional book-printing partner which is on a print-on-demand basis.

What tax is charged? Chevron down icon Chevron up icon

Currently, no tax is charged on the purchase of any print book (subject to change based on the laws and regulations). A localized VAT fee is charged only to our European and UK customers on eBooks, Video and subscriptions that they buy. GST is charged to Indian customers for eBooks and video purchases.

What payment methods can I use? Chevron down icon Chevron up icon

You can pay with the following card types:

  1. Visa Debit
  2. Visa Credit
  3. MasterCard
  4. PayPal
What is the delivery time and cost of print books? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
Modal Close icon
Modal Close icon