7.1.
Learning Objectives
7.2. Responsibility Models in AWS
7.3. Federation
7.4. AWS Security process
7.5. AWS IAM
7.6. IAM Policy
7.7. Inline Policy
7.8. Amazon Resource Naming(ARN)
7.9. AWS Service Principal
7.10. Principle
7.11. Resources
7.12. Conditional Access
7.13. Implicit Deny
7.14. Permission Boundary
7.15. IAM Roles
An IAM role is an IAM identity that you can create in your account that has specific
permissions. An IAM role is similar to an IAM user in that it is an AWS identity with
permission policies that determine what the identity can and cannot do in AWS.
7.16. Cross Account Policy
7.17. The Confused Deputy
7.18. AWS Cognito
7.19. Cloud Tower
7.20. Assisted Practice-Identity based policy, Implicit Deny, Explicit
Allow
7.21. AP- Policy Generator managed policy versions groups
7.22. AP- Resource based policy, policy generated principals
7.23. AP
7.24. AP
7.25. AP
7.26. Cloud Security
7.27. WAF
With AWS WAF, you can create security rules that control bot traffic and block common
attack patterns such as SQL injection or cross-site scripting (XSS).
Web Application Firewall, Web API Protection - AWS WAF - AWS (amazon.com)
7.28. AP-WAF
7.29. SHIELD
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that
safeguards applications running on AWS. AWS Shield provides always-on detection and
automatic inline mitigations that minimize application downtime and latency, so there is no
need to engage AWS Support to benefit from DDoS protection. (___AWS Shield_______
gives security and safeguards applications that are running on AWS.)
AWS Shield Advanced is a tailored protection program that identifies threats using exabyte-
scale detection to aggregate data across AWS.
Managed DDos Protection - AWS Shield - AWS (amazon.com)
7.30. Benefits of Shield
7.31. Secrets Manager
7.32. Secrets Manager Administrator Permissions
7.33. Secret Manager Concepts
7.34. System Manager
7.35. AWS Config
7.36. AP- AWS Config S3 Bucket Encryption compliance
7.37. AWS Inspector Trusted Advisior
7.38. AWS Insector Access
7.39. Trusted Advisor
7.40. AP-
7.41. AP- Trusted Advisor
7.42. GuardDuty
7.43. GuardDuty Managing findings from multiple accounts
7.44. Available regions
7.45. Macie:
Amazon Macie is a fully managed data security and data privacy service that uses machine
learning and pattern matching to discover and protect your sensitive data in AWS.
7.46. Other Security Services
7.47. Setting up Integration with AWS Security Hub (Sphos Cloud Optix):
7.48. Detective:
7.49. IAM Access Analyzer
7.50. Patch Manager
7.51. Key Takeaways
1. AWS Security Hub:
Purpose: Provides a comprehensive view of security alerts and
compliance status across your AWS accounts.
Key Features:
Aggregates findings from various AWS services and third-party
tools.
Normalizes and prioritizes security findings.
Provides actionable insights for remediation.
2. Amazon Macie:
Purpose: Focuses on data security and discovery, helping to
identify and protect sensitive data stored in AWS.
Key Features:
Automatically classifies and identifies sensitive data.
Provides alerts for unauthorized access or sharing of sensitive
data.
Supports compliance with data protection regulations.
3. Amazon GuardDuty:
Purpose: A threat detection service that continuously monitors for
malicious activity and unauthorized behavior in your AWS accounts.
Key Features:
Uses machine learning to identify threats.
Provides real-time threat intelligence.
Generates findings related to potential security issues.
4. AWS Trusted Advisor:
Purpose: Offers best practices and recommendations to improve
the security, performance, and reliability of your AWS environment.
Key Features:
Analyzes your AWS resources and provides personalized
recommendations.
Helps optimize costs, improve security, and enhance
performance.
5. AWS Inspector:
Purpose: An automated security assessment service that helps
improve the security and compliance of applications deployed on
AWS.
Key Features:
Assesses the security vulnerabilities and compliance of EC2
instances.
Provides detailed findings with prioritized recommendations.
6. Amazon Detective:
Purpose: Investigates security incidents by analyzing, correlating,
and visualizing data from multiple AWS sources.
Key Features:
Helps in identifying and understanding the root cause of
security incidents.
Provides visualizations and insights into security-related
events.
7. Access Analyzer for S3:
Purpose: Analyzes resource policies to help you identify and
manage access to your S3 buckets.
Key Features:
Identifies S3 buckets with potentially unintended public
access.
Provides recommendations for access policy changes.
These services collectively contribute to enhancing the security and
compliance of your AWS environment. It's important to configure and use
these services based on your specific security and compliance
requirements. Regularly reviewing findings, acting on recommendations,
and staying informed about best practices are key to maintaining a secure
AWS environment.
