# AWS Security & Encryption

### <mark style="color:orange;">Why encryption? Encryption in flight (SSL)</mark>&#x20;

**•&#x20;**<mark style="color:red;">**Data is encrypted before sending**</mark>**&#x20;and&#x20;**<mark style="color:green;">**decrypted after receiving**</mark>&#x20;

**• SSL certificates help with encryption (HTTPS)**&#x20;

<mark style="color:green;">**• Encryption in flight ensures**</mark>**&#x20;**<mark style="color:red;">**no**</mark>**&#x20;**<mark style="color:green;">**MITM (man in the middle attack) can happen**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FYrUDl38I6xkKUoodRx6G%2Fimage.png?alt=media&#x26;token=b71a3482-443b-43ea-a8bb-e70e35e85394" alt=""><figcaption></figcaption></figure>

## Why encryption? Server side encryption at rest&#x20;

<mark style="color:red;">**• Data is encrypted after being received by the server**</mark>&#x20;

<mark style="color:green;">**• Data is decrypted before being sent**</mark>&#x20;

**• It is stored in an encrypted form thanks to a key (usually a data key)**&#x20;

<mark style="color:green;">**• The encryption / decryption keys must be managed somewhere and the server must have access to it**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FxvcMQblpzNhApt1haZPk%2Fimage.png?alt=media&#x26;token=a6f8e642-4010-456d-a733-9f0d4d348daf" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">Why encryption? Client side encryption</mark>&#x20;

<mark style="color:red;">**• Data is encrypted by the client**</mark>**&#x20;and&#x20;**<mark style="color:green;">**never decrypted by the server**</mark>

&#x20;**• Data will be decrypted by a receiving client**&#x20;

**•&#x20;**<mark style="color:red;">**The server should not be able to decrypt the data**</mark>&#x20;

**• Could leverage&#x20;**<mark style="color:blue;">**Envelope Encryption**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FW40Qxv0HxYjh4gL5qM8g%2Fimage.png?alt=media&#x26;token=61ae7cfa-1765-4c1c-966a-bc435708f70b" alt=""><figcaption></figcaption></figure>

## <mark style="color:orange;">AWS KMS (Key Management Service)</mark>&#x20;

**• Anytime you hear “encryption” for an AWS service,&#x20;**<mark style="color:red;">**it’s most likely KMS**</mark>&#x20;

**• Easy way to control access to your data,&#x20;**<mark style="color:green;">**AWS manages keys for us**</mark>&#x20;

<mark style="color:green;">**• Fully integrated with IAM for authorization**</mark>&#x20;

<mark style="color:blue;">**• Seamlessly integrated into:**</mark>&#x20;

&#x20;  <mark style="color:red;">**• Amazon EBS:**</mark>**&#x20;encrypt volumes**&#x20;

&#x20;  <mark style="color:red;">**• Amazon S3:**</mark>**&#x20;Server side encryption of objects**&#x20;

&#x20;  <mark style="color:red;">**• Amazon Redshift:**</mark>**&#x20;encryption of data**&#x20;

&#x20;  <mark style="color:red;">**• Amazon RDS:**</mark>**&#x20;encryption of data**&#x20;

&#x20;   <mark style="color:red;">**• Amazon SSM:**</mark>**&#x20;Parameter store**&#x20;

**• Etc…**&#x20;

<mark style="color:red;">**• But you can also use the CLI / SDK**</mark>

## <mark style="color:blue;">KMS – Customer Master Key (CMK) Types</mark>&#x20;

### <mark style="color:red;">• Symmetric (AES-256 keys)</mark>&#x20;

<mark style="color:green;">**• First offering of KMS, single encryption key that is used to Encrypt and Decryp**</mark>**t**&#x20;

**• AWS services that are integrated with KMS use Symmetric CMKs**&#x20;

<mark style="color:green;">**• Necessary for**</mark> <mark style="color:red;">**envelope encryption**</mark>&#x20;

<mark style="color:green;">**• You never get access to the Key unencrypted**</mark>**&#x20;(**<mark style="color:red;">**must call KMS API to use**</mark>**)**&#x20;

### <mark style="color:red;">**• Asymmetric (RSA & ECC key pairs)**</mark>&#x20;

<mark style="color:green;">**• Public (Encrypt) and Private Key (Decrypt) pair**</mark>&#x20;

**• Used for&#x20;**<mark style="color:red;">**Encrypt/Decrypt**</mark>**, or&#x20;**<mark style="color:red;">**Sign/Verify**</mark>**&#x20;operations**&#x20;

**• The&#x20;**<mark style="color:green;">**public key is downloadable**</mark>**, but you&#x20;**<mark style="color:green;">**can’t access the Private Key unencrypted**</mark>&#x20;

**• Use case:&#x20;**<mark style="color:red;">**encryption outside of AWS by users who can’t call the KMS API**</mark>

## <mark style="color:blue;">AWS KMS (Key Management Service)</mark>&#x20;

<mark style="color:blue;">**• Able to fully manage the keys & policies:**</mark>&#x20;

&#x20;   <mark style="color:green;">**• Create**</mark>&#x20;

&#x20;  <mark style="color:green;">**• Rotation policies**</mark>&#x20;

&#x20;   <mark style="color:green;">**• Disable**</mark>&#x20;

&#x20;  <mark style="color:green;">**• Enable**</mark>&#x20;

<mark style="color:red;">**• Able to audit key usage (using CloudTrail)**</mark>&#x20;

### <mark style="color:blue;">**• Three types of Customer Master Keys (CMK):**</mark>&#x20;

&#x20;   &#x20;**&#x20;**<mark style="color:red;">**• AWS Managed Service Default CMK**</mark><mark style="color:green;">**: free**</mark>&#x20;

&#x20;     <mark style="color:red;">**• User Keys created in KMS:**</mark>**&#x20;**<mark style="color:green;">**$1 / month**</mark>&#x20;

&#x20;     <mark style="color:red;">**• User Keys imported**</mark>**&#x20;**<mark style="color:green;">**(must be 256-bit symmetric key): $1 / month**</mark>&#x20;

<mark style="color:blue;">**• + pay for API call to KMS ($0.03 / 10000 calls)**</mark>

## <mark style="color:blue;">AWS KMS 101</mark>&#x20;

<mark style="color:red;">**• Anytime you need to share sensitive information… use KMS**</mark>&#x20;

&#x20;   <mark style="color:blue;">**• Database passwords**</mark>&#x20;

&#x20;  <mark style="color:blue;">**• Credentials to external service**</mark>&#x20;

&#x20;  <mark style="color:blue;">**• Private Key of SSL certificates**</mark>&#x20;

<mark style="color:red;">**•**</mark>**&#x20;**<mark style="color:green;">**The value in KMS is that**</mark>**&#x20;**<mark style="color:red;">**the CMK used to encrypt data can never be retrieved by the user, and the CMK can be rotated for extra security**</mark>

## AWS KMS 101&#x20;

<mark style="color:green;">**• Never ever store your secrets in plaintext, especially in your code!**</mark>&#x20;

<mark style="color:orange;">**• Encrypted secrets can be stored in the code / environment variables**</mark>&#x20;

<mark style="color:red;">**• KMS can only help in encrypting up to 4KB of data per cal**</mark>**l**&#x20;

**•&#x20;**<mark style="color:green;">**If data > 4 KB**</mark>**,&#x20;**<mark style="color:red;">**use envelope encryption**</mark>&#x20;

<mark style="color:blue;">**• To give access to KMS to someone:**</mark>&#x20;

&#x20;   **• Make sure the&#x20;**<mark style="color:green;">**Key Policy allows the user**</mark>&#x20;

&#x20;  **• Make sure the&#x20;**<mark style="color:green;">**IAM Policy allows the API call**</mark>**s**

**birinci öz keyinle sifrele sonra gönderdikden sonra yeniden sifrelenir ve stapthot gönderilir**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fkq7vaE52o40nEyFmv1Cl%2Fimage.png?alt=media&#x26;token=79bf664e-2ffe-48f9-ae05-94ff77313d43" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">KMS Key Policies</mark>&#x20;

<mark style="color:orange;">**• Control access to KMS keys, “similar” to S3 bucket policies**</mark>&#x20;

<mark style="color:green;">**• Difference:**</mark> <mark style="color:red;">**you cannot control access without them**</mark>&#x20;

### **•&#x20;**<mark style="color:orange;">**Default KMS Key Policy:**</mark>&#x20;

&#x20;**&#x20;  &#x20;**<mark style="color:green;">**• Created if you don’t provide a**</mark> <mark style="color:red;">**specific KMS Key Policy**</mark>&#x20;

&#x20;    **•&#x20;**<mark style="color:red;">**Complete access to the key to the root user**</mark>**&#x20;=&#x20;**<mark style="color:green;">**entire AWS account**</mark>&#x20;

&#x20;     <mark style="color:green;">**• Gives access to the IAM policies to the KMS key**</mark>&#x20;

### <mark style="color:orange;">**• Custom KMS Key Policy:**</mark>&#x20;

<mark style="color:purple;">**• Define users, roles that can access the KMS key**</mark>&#x20;

<mark style="color:green;">**• Define who can administer the key**</mark>&#x20;

<mark style="color:red;">**• Useful for cross-account access of your KMS key**</mark>

**1Create a Snapshot, encrypted with your own CMK**

&#x20;**2. Attach a KMS Key Policy to authorize cross-account access**&#x20;

**3. Share the encrypted snapshot**

&#x20;**4. (in target) Create a copy of the Snapshot, encrypt it with a KMS Key in your account**&#x20;

**5. Create a volume from the snapshot**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FFuh4EYW9Vu62WBZRN5RX%2Fimage.png?alt=media&#x26;token=3b6fbba9-9884-4555-b482-008b43a2f6f6" alt=""><figcaption></figcaption></figure>

## <mark style="color:orange;">KMS Automatic Key Rotation</mark>&#x20;

**•&#x20;**<mark style="color:green;">**For Customer-managed CMK**</mark>**&#x20;(**<mark style="color:red;">**not AWS managed CMK**</mark>**)**&#x20;

**• If enabled:&#x20;**<mark style="color:red;">**automatic key rotation happens every 1 year**</mark>&#x20;

<mark style="color:green;">**• Previous key is kept active so you can decrypt old data**</mark>&#x20;

**• New Key has the&#x20;**<mark style="color:red;">**same CMK ID**</mark>**&#x20;(**<mark style="color:green;">**only the backing key is changed**</mark>**)**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FCyqgfqnMe82bfb3RIvee%2Fimage.png?alt=media&#x26;token=efe95be1-44d8-455c-849b-8703a3b6e52e" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">KMS Manual Key Rotation</mark>&#x20;

<mark style="color:green;">**• When you want to rotate key every**</mark> <mark style="color:red;">**90 days, 180 days, etc**</mark>**…**&#x20;

<mark style="color:red;">**• New Key has a different CMK ID**</mark>&#x20;

<mark style="color:green;">**• Keep the previous key active so you can decrypt old data**</mark>&#x20;

<mark style="color:blue;">**• Better to use**</mark>**&#x20;**<mark style="color:red;">**aliases**</mark>**&#x20;**<mark style="color:blue;">**in this case (to hide the change of key for the application)**</mark>&#x20;

**• Good solution to rotate CMK that are not eligible&#x20;**<mark style="color:red;">**for automatic rotation**</mark>**&#x20;(like asymmetric CMK)**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FXSVnAfNrxQJDu6SizSfu%2Fimage.png?alt=media&#x26;token=a180b529-b54d-4019-b67c-6d7d874c2a0f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FWuWvR6JOuZf31FXVkR2v%2Fimage.png?alt=media&#x26;token=c95d98af-7eb4-41da-8d28-e6aca0e2b874" alt=""><figcaption><p> </p></figcaption></figure>

## <mark style="color:red;">KMS Multi -Region Keys</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FqBMYN303NYjjRCH6KV23%2Fimage.png?alt=media&#x26;token=1484b3a4-3794-40c5-b644-e61b9e59084f" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">KMS Multi-Region Keys</mark>&#x20;

<mark style="color:green;">**• Identical KMS keys in different AWS Regions that can be used interchangeably**</mark>&#x20;

**• Multi-Region keys have&#x20;**<mark style="color:red;">**the same key ID, key material, automatic rotation**</mark>**…**&#x20;

**• Encrypt in one Region and decrypt in other Regions**&#x20;

<mark style="color:green;">**• No need to re-encrypt or making cross-Region API calls**</mark>&#x20;

**• KMS Multi-Region are&#x20;**<mark style="color:red;">**NOT global (Primary + Replicas)**</mark>

<mark style="color:green;">**• Each Multi-Region key is managed independently**</mark>

&#x20;**• Use cases:&#x20;**<mark style="color:red;">**global client-side encryption, encryption on Global DynamoDB, Global Aurora**</mark>

## <mark style="color:blue;">DynamoDB Global Tables and KMS MultiRegion Keys Client-Side encryption</mark>&#x20;

**• We can encrypt specific attributes client-side in our DynamoDB table using the Amazon DynamoDB Encryption Client**&#x20;

**• Combined with Global Tables, the client-side encrypted data is replicated to other regions**&#x20;

**• If we use a multi-region key, replicated in the same region as the DynamoDB Global table, then clients in these regions can use lowlatency API calls to KMS in their region to decrypt the data client-side**&#x20;

**• Using client-side encryption we can protect specific fields and guarantee only decryption if the client has access to an API key**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FM7MgbjgubR4tqMmjo8JT%2Fimage.png?alt=media&#x26;token=57220956-4726-4691-a3f7-7e3ae3fee907" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">Global Aurora and KMS Multi-Region Keys Client-Side encryption</mark>&#x20;

**• We can encrypt specific attributes client-side in our Aurora table using the&#x20;**<mark style="color:red;">**AWS Encryption SDK**</mark>

&#x20;**• Combined with Aurora Global Tables, the client-side encrypted data is replicated to other regions**&#x20;

**•&#x20;**<mark style="color:green;">**If we use a multi-region key, replicated in the same region as the Global Aurora DB, then clients in these regions can use low-latency API calls to KMS in their region to decrypt the data client-side**</mark>&#x20;

**• Using client-side encryption we can protect specific fields and guarantee only decryption if the client has access to an API key,&#x20;**<mark style="color:red;">**we can protect specific fields even from database admins**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FmRKKtzwdPGdkUVWF5gaH%2Fimage.png?alt=media&#x26;token=f8004c77-2575-435d-a2b5-2a0994783e72" alt=""><figcaption></figcaption></figure>

## <mark style="color:orange;">S3 Replication Encryption Considerations</mark>&#x20;

**• Unencrypted objects and objects encrypted with&#x20;**<mark style="color:red;">**SSE-S3 are replicated by default**</mark>&#x20;

**• Objects encrypted with&#x20;**<mark style="color:red;">**SSE-C (customer provided key) are never replicated**</mark>&#x20;

**• For objects encrypted with&#x20;**<mark style="color:red;">**SSE-KMS, you need to enable the option**</mark>&#x20;

&#x20;    <mark style="color:green;">**• Specify which KMS Key to encrypt the objects within the target bucket**</mark>&#x20;

&#x20;&#x20;**&#x20; &#x20;**<mark style="color:green;">**• Adapt the KMS Key Policy for the target key**</mark>&#x20;

&#x20; &#x20;**&#x20;**<mark style="color:green;">**• An IAM Role with kms:Decrypt for the source KMS Key and kms:Encrypt for the target KMS Key**</mark>

&#x20;**• You might get KMS throttling errors, in which case you can ask for a&#x20;**<mark style="color:red;">**Service Quotas increase**</mark>

&#x20;**•&#x20;**<mark style="color:red;">**You can use multi-region AWS KMS Keys**</mark>**, but they are currently treated as independent keys by&#x20;**<mark style="color:blue;">**Amazon S3 (the object will still be decrypted and then encrypted)**</mark>

## <mark style="color:orange;">AMI Sharing Process Encrypted via KMS</mark>

1. <mark style="color:green;">**AMI in Source Account is encrypted with KMS Key from Source Account**</mark>
2. **Must modify the image attribute to add a Launch Permission which corresponds to the specified target AWS account**
3. **Must share the KMS Keys used to encrypted the snapshot the AMI references with the target account / IAM Role**
4. <mark style="color:red;">**The IAM Role/User in the target account must have the permissions to DescribeKey, ReEncrypted, CreateGrant, Decrypt**</mark>
5. **When launching an EC2 instance from the AMI, optionally the target account can specify a new KMS key in its own account to re-encrypt the volumes**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FJP9s4h83BaFGxVZRaX2L%2Fimage.png?alt=media\&token=f6900a3e-82a5-4194-8a79-0cdd1cc81518)

##

## <mark style="color:orange;">SSM Parameter Store</mark>&#x20;

<mark style="color:green;">**• Secure storage for configuration and secrets**</mark>&#x20;

<mark style="color:green;">**• Optional Seamless Encryption using KMS**</mark>&#x20;

<mark style="color:red;">**• Serverless, scalable, durable, easy SDK**</mark>&#x20;

<mark style="color:green;">**• Version tracking of configurations / secrets**</mark>&#x20;

<mark style="color:green;">**• Configuration management using path & IAM**</mark>&#x20;

<mark style="color:green;">**• Notifications with**</mark>**&#x20;**<mark style="color:red;">**CloudWatch Events**</mark>&#x20;

<mark style="color:green;">**• Integration with**</mark>**&#x20;**<mark style="color:red;">**CloudFormation**</mark>

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fxusz7cJ2l6p4KVupbDhw%2Fimage.png?alt=media\&token=c1c2b3a1-3984-408f-9c4f-3a7e603cc84e)

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FV1RxkP6cvlbSnssieIZs%2Fimage.png?alt=media&#x26;token=e852dbef-a70c-42a6-86ea-6e90814730c8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Foz9fYddWWD2i7mnYzGlK%2Fimage.png?alt=media&#x26;token=c2a13445-18d5-4460-a1d6-ba3828e00ed9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FJC12qBWiPejZIlrtc07o%2Fimage.png?alt=media&#x26;token=50bf818e-108a-4519-b684-ec1e05761a02" alt=""><figcaption></figcaption></figure>

{% embed url="<https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html>" %}

## <mark style="color:red;">AWS Secrets Manager</mark>&#x20;

**• Newer service, meant for&#x20;**<mark style="color:red;">**storing secrets**</mark>

**• Capability to force&#x20;**<mark style="color:red;">**rotation of secrets every**</mark>**&#x20;X days**&#x20;

**• Automate generation of secrets on rotation (uses Lambda)**&#x20;

<mark style="color:red;">**• Integration with**</mark> <mark style="color:red;">**Amazon RDS**</mark> <mark style="color:green;">**(MySQL, PostgreSQL, Aurora)**</mark>&#x20;

<mark style="color:green;">**• Secrets are encrypted using KMS**</mark>&#x20;

<mark style="color:red;">**• Mostly meant for RDS integration**</mark>

## <mark style="color:purple;">AWS Certificate Manager (ACM)</mark>&#x20;

<mark style="color:green;">**• Easily provision, manage, and deploy TLS Certificates**</mark>&#x20;

**• Provide in-flight encryption for websites (HTTPS)**&#x20;

<mark style="color:green;">**• Supports both public and private TLS certificates**</mark>&#x20;

**• Free of charge for public TLS certificates**&#x20;

**• Automatic TLS certificate renewal**

&#x20;<mark style="color:blue;">**• Integrations with (load TLS certificates on)**</mark>&#x20;

&#x20;    **• Elastic Load Balancers (CLB, ALB, NLB)**&#x20;

&#x20;    **• CloudFront Distributions**&#x20;

&#x20;    **• APIs on API Gateway**&#x20;

<mark style="color:red;">**• Cannot use ACM with EC2 (can’t be extracted)**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FTxVSzne11tcFYmGmzYsU%2Fimage.png?alt=media&#x26;token=a0c303d5-3f88-4d8a-a16d-aed2550aefb9" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">ACM – Requesting Public Certificates</mark>

1. <mark style="color:red;">**List domain names to be included in the certificate**</mark>&#x20;

&#x20;    <mark style="color:green;">**• Fully Qualified Domain Name (FQDN): corp.example.com**</mark>&#x20;

&#x20;    <mark style="color:green;">**• Wildcard Domain: \*.example.com**</mark>

1. <mark style="color:green;">**Select Validation Method:**</mark> <mark style="color:red;">**DNS Validation or Email validation**</mark>&#x20;

&#x20;     <mark style="color:orange;">**• DNS Validation is preferred for automation purposes**</mark>

&#x20;     **•&#x20;**<mark style="color:orange;">**Email validation will send emails to contact addresses in the WHOIS database**</mark>&#x20;

&#x20;      <mark style="color:purple;">**• DNS Validation will leverage a CNAME record to DNS config (ex: Route 53**</mark>**)**

1. **It will take a few hours to get verified**
2. <mark style="color:red;">**The Public Certificate will be enrolled for automatic renewal**</mark>&#x20;

&#x20;     <mark style="color:green;">**• ACM automatically renews ACM-generated certificates 60 days before expiry**</mark>

## <mark style="color:orange;">ACM – Importing Public Certificates</mark>&#x20;

**• Option to generate the certificate outside of ACM and then import it**&#x20;

<mark style="color:red;">**• No automatic renewal,**</mark>**&#x20;must import a new certificate before expiry**&#x20;

<mark style="color:red;">**• ACM sends daily expiration events starting 45 days prior to expiration**</mark>&#x20;

**• The # of days can be configured**&#x20;

<mark style="color:blue;">**• Events are appearing in EventBridge**</mark>&#x20;

<mark style="color:orange;">**• AWS Config has a managed rule named acm-certificate-expiration-check to check for expiring certificates (configurable number of days)**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FenbuqQFAUVHJ2bWXNXs1%2Fimage.png?alt=media&#x26;token=5cbc9125-56a1-4407-a399-252166c6cf05" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FNrdFnpt9s9XGytFwB5OI%2Fimage.png?alt=media&#x26;token=4a2cea62-5d94-46d3-adae-4c8259a4f163" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">API Gateway - Endpoint Types</mark>&#x20;

### <mark style="color:blue;">• Edge-Optimized (default): For global clients</mark>&#x20;

&#x20;   **• Requests are routed through the CloudFront Edge locations (improves latency)**&#x20;

&#x20;   <mark style="color:red;">**• The API Gateway still lives in only one region**</mark>&#x20;

### **• Regional:**

&#x20;      <mark style="color:green;">**• For clients within the same region**</mark>

&#x20;       <mark style="color:green;">**• Could manually combine with CloudFront (more control over the caching strategies and the distribution)**</mark>&#x20;

### **• Private:**&#x20;

<mark style="color:purple;">**• Can only be accessed from your VPC using an interface VPC endpoint (ENI)**</mark>

&#x20;<mark style="color:red;">**• Use a resource policy to define access**</mark>

## <mark style="color:red;">ACM – Integration with API Gateway</mark>&#x20;

<mark style="color:green;">**• Create a Custom Domain Name in API Gateway**</mark>&#x20;

### <mark style="color:blue;">• Edge-Optimized (default): For global clients</mark>&#x20;

**• Requests are routed through the CloudFront Edge locations (improves latency)**&#x20;

**• The API Gateway&#x20;**<mark style="color:red;">**still lives in only one region**</mark>&#x20;

<mark style="color:red;">**• The TLS Certificate must be in the same region as CloudFront,**</mark><mark style="color:red;">**&#x20;**</mark><mark style="color:green;"><mark style="color:red;">**in us-east-**<mark style="color:red;"></mark><mark style="color:green;">**1**</mark>&#x20;

**• Then setup CNAME or (better) A-Alias record in Route 53**&#x20;

### <mark style="color:blue;">**• Regional:**</mark>&#x20;

&#x20;   **• For clients within the same region**&#x20;

<mark style="color:green;">**• The TLS Certificate must be imported on API Gateway, in the same region as the API Stage**</mark>

&#x20;**• Then setup CNAME or (better) A-Alias record in Route 53**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FFSv6Ueg9kqxM1tYiI233%2Fimage.png?alt=media&#x26;token=6f40f1a9-0326-4100-8940-de0b2f29cb8b" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">AWS WAF – Web Application Firewall</mark>&#x20;

<mark style="color:red;">**• Protects your web applications from common web exploits (Layer 7)**</mark>&#x20;

<mark style="color:green;">**• Layer 7 is HTTP (vs Layer 4 is TCP/UDP)**</mark>&#x20;

### <mark style="color:blue;">**• Deploy on**</mark>&#x20;

&#x20;   <mark style="color:red;">**• Application Load Balancer**</mark>

&#x20;   <mark style="color:red;">**• API Gateway**</mark>&#x20;

&#x20;   <mark style="color:red;">**• CloudFront**</mark>&#x20;

&#x20;    <mark style="color:red;">**• AppSync GraphQL API**</mark>&#x20;

&#x20;    <mark style="color:red;">**• Cognito User Pool**</mark>

<mark style="color:green;">**WAF does not support the**</mark>**&#x20;**<mark style="color:red;">**Network Load Balancer (Layer 4)**</mark>&#x20;

**• We can use&#x20;**<mark style="color:red;">**Global Accelerator for fixed IP**</mark>**&#x20;and WAF on the ALB**

## <mark style="color:blue;">AWS WAF – Web Application Firewall</mark>&#x20;

<mark style="color:orange;">**• Define Web ACL (Web Access Control List) Rules:**</mark>&#x20;

&#x20;     <mark style="color:green;">**• IP Set: up to 10,000 IP addresses**</mark>**&#x20;–&#x20;**<mark style="color:red;">**use multiple Rules for more IPs**</mark>&#x20;

&#x20;**&#x20;  &#x20;**<mark style="color:red;">**• HTTP headers, HTTP body, or URI strings Protects from common attacks**</mark>**&#x20;-&#x20;**<mark style="color:green;">**SQL injection and Cross-Site Scripting (XSS)**</mark>&#x20;

&#x20;   **• Size constraints**<mark style="color:red;">**, geo-match (block countries)**</mark>&#x20;

&#x20;  <mark style="color:red;">**• Rate-based rules**</mark>**&#x20;(to count occurrences of events) –&#x20;**<mark style="color:green;">**for DDoS protection**</mark>&#x20;

<mark style="color:green;">**• Web ACL are Regional except for CloudFront**</mark>&#x20;

<mark style="color:purple;">**• A rule group is a reusable set of rules that you can add to a web ACL**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FK9Fq3O7It5oqDjPZd1Gl%2Fimage.png?alt=media&#x26;token=10fedc0f-52ed-433b-817d-dbc5587b2f3d" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">AWS Shield:</mark> <mark style="color:orange;">protect from DDoS attack</mark>&#x20;

<mark style="color:red;">**• DDoS:**</mark>**&#x20;**<mark style="color:green;">**Distributed Denial of Service – many requests at the same time**</mark>&#x20;

### <mark style="color:blue;">**• AWS Shield Standard:**</mark>&#x20;

**•&#x20;**<mark style="color:red;">**Free service that is activated for every AWS customer**</mark>&#x20;

**• Provides protection from attacks such as&#x20;**<mark style="color:red;">**SYN/UDP Floods**</mark>**,&#x20;**<mark style="color:red;">**Reflection attacks**</mark>**&#x20;and other layer&#x20;**<mark style="color:red;">**3/layer 4 attacks**</mark>&#x20;

### <mark style="color:blue;">**• AWS Shield Advanced:**</mark>&#x20;

**• Optional DDoS mitigation service&#x20;**<mark style="color:green;">**($3,000 per month per organization)**</mark>&#x20;

**• Protect against more sophisticated attack on&#x20;**<mark style="color:green;">**Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53**</mark>&#x20;

<mark style="color:blue;">**• 24/7 access to AWS DDoS response team (DRP)**</mark>&#x20;

<mark style="color:orange;">**• Protect against higher fees during usage spikes due to DDoS**</mark>&#x20;

<mark style="color:orange;">**• Shield Advanced automatic application layer DDoS mitigation automatically creates, evaluates and deploys AWS WAF rules to mitigate layer 7 attacks**</mark>

## <mark style="color:blue;">AWS Firewall Manager</mark>&#x20;

<mark style="color:red;">**• Manage rules in all accounts of an AWS Organization**</mark>&#x20;

### **• Security policy: common set of security rules**&#x20;

&#x20;    <mark style="color:green;">**• WAF rules (Application Load Balancer, API Gateways, CloudFront)**</mark>&#x20;

&#x20;    <mark style="color:green;">**• AWS Shield Advanced (ALB, CLB, NLB, Elastic IP, CloudFront)**</mark>&#x20;

&#x20;     <mark style="color:green;">**• Security Groups for EC2, Application Load BAlancer and ENI resources in VPC**</mark>&#x20;

&#x20;    <mark style="color:green;">**• AWS Network Firewall (VPC Level)**</mark>&#x20;

&#x20;     <mark style="color:green;">**• Amazon Route 53 Resolver DNS Firewall**</mark>&#x20;

&#x20;    <mark style="color:red;">**• Policies are created at the region level**</mark>&#x20;

**• Rules are applied to new resources as they are created (good for compliance) across all and future accounts in your Organization**

## <mark style="color:red;">WAF</mark> <mark style="color:blue;">vs. Firewall Manager vs.</mark> <mark style="color:green;">Shield</mark>

<mark style="color:green;">**• WAF, Shield and Firewall Manager are used together for comprehensive protection**</mark>&#x20;

<mark style="color:blue;">**• Define your Web ACL rules**</mark> <mark style="color:red;">**in WAF**</mark>&#x20;

**•&#x20;**<mark style="color:red;">**For granular protection**</mark>**&#x20;of your resources,&#x20;**<mark style="color:red;">**WAF alone is the correct choice**</mark>&#x20;

**• If you want to&#x20;**<mark style="color:green;">**use AWS WAF across accounts,**</mark>**&#x20;**<mark style="color:red;">**accelerate WAF configuration**</mark>**,&#x20;**<mark style="color:blue;">**automate the protection of new resources,**</mark>**&#x20;**<mark style="color:red;">**use Firewall Manager with AWS WAF**</mark>&#x20;

**•&#x20;**<mark style="color:red;">**Shield Advanced**</mark>**&#x20;adds additional features on top of AWS WAF, such as dedicated support from the Shield Response Team (SRT) and advanced reporting.**&#x20;

**• If you’re&#x20;**<mark style="color:red;">**prone to frequent DDoS attacks,**</mark>**&#x20;consider purchasing&#x20;**<mark style="color:red;">**Shield Advanced**</mark>

## <mark style="color:red;">AWS Best Practices for DDoS Resiliency</mark> <mark style="color:blue;">Edge Location Mitigation (BP1, BP3)</mark>&#x20;

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FACpQJPzlTtVqYjh9RbMN%2Fimage.png?alt=media&#x26;token=19b588d6-06d8-44ee-bc5e-8336e2aa411a" alt=""><figcaption></figcaption></figure>

### <mark style="color:blue;">• BP1 – CloudFront</mark>&#x20;

&#x20;   <mark style="color:green;">**• Web Application delivery at the edge**</mark>&#x20;

&#x20; &#x20;**&#x20;**<mark style="color:red;">**• Protect from DDoS Common Attacks (SYN floods, UDP reflection…)**</mark>&#x20;

### <mark style="color:blue;">• BP1 – Global Accelerator</mark>&#x20;

&#x20;    <mark style="color:green;">**• Access your application from the edge**</mark>&#x20;

&#x20;   <mark style="color:red;">**• Integration with Shield for DDoS protection**</mark>&#x20;

&#x20; &#x20;**&#x20;**<mark style="color:green;">**• Helpful if your backend is not compatible with CloudFront**</mark>&#x20;

### <mark style="color:blue;">• BP3 – Route 53</mark>&#x20;

&#x20;   <mark style="color:green;">**• Domain Name Resolution at the edge**</mark>&#x20;

&#x20;&#x20;**&#x20;&#x20;**<mark style="color:red;">**• DDoS Protection mechanism**</mark>

## <mark style="color:red;">AWS Best Practices for DDoS Resiliency</mark> <mark style="color:green;">Best pratices for DDoS mitigation</mark>&#x20;

### <mark style="color:blue;">• Infrastructure layer defense (BP1, BP3, BP6)</mark>&#x20;

&#x20;     <mark style="color:green;">**• Protect Amazon EC2 against high traffic**</mark>&#x20;

&#x20;     **• That includes using&#x20;**<mark style="color:red;">**Global Accelerator, Route 53, CloudFront, Elastic Load Balancing**</mark>&#x20;

### <mark style="color:blue;">• Amazon EC2 with Auto Scaling (BP7)</mark>&#x20;

&#x20;    &#x20;**&#x20;**<mark style="color:red;">**• Helps scale in case of sudden traffic surges including a flash crowd or a DDoS attack**</mark>&#x20;

### <mark style="color:blue;">• Elastic Load Balancing (BP6)</mark>&#x20;

&#x20;      <mark style="color:red;">**• Elastic Load Balancing scales with the traffic increases and will distribute the traffic to many EC2 instances**</mark>

## <mark style="color:green;">AWS Best Practices for DDoS Resiliency</mark> <mark style="color:red;">Application Layer Defense</mark>&#x20;

### <mark style="color:blue;">• Detect and filter malicious web requests (BP1, BP2)</mark>&#x20;

&#x20;   **•&#x20;**<mark style="color:red;">**CloudFront cache static content**</mark>**&#x20;and serve it from&#x20;**<mark style="color:red;">**edge locations, protecting your backend**</mark>&#x20;

&#x20;  **•&#x20;**<mark style="color:red;">**AWS WAF is used on top of CloudFront and Application Load Balancer**</mark>**&#x20;to&#x20;**<mark style="color:green;">**filter and block requests based on request signatures**</mark>&#x20;

&#x20;   **•&#x20;**<mark style="color:green;">**WAF rate-based rules can automatically block the IPs of bad actors**</mark>&#x20;

&#x20;   **• Use managed rules on&#x20;**<mark style="color:red;">**WAF to block**</mark>**&#x20;attacks based on&#x20;**<mark style="color:red;">**IP reputation, or block anonymous Ips**</mark>&#x20;

&#x20;    **•&#x20;**<mark style="color:green;">**CloudFront**</mark>**&#x20;can block specific** <mark style="color:red;">**geographies**</mark>&#x20;

### <mark style="color:blue;">**• Shield Advanced (BP1, BP2, BP6)**</mark>&#x20;

&#x20;  **•&#x20;**<mark style="color:red;">**Shield Advanced**</mark>**&#x20;automatic&#x20;**<mark style="color:blue;">**application layer DDoS mitigation automatically creates, evaluates and deploys**</mark>**&#x20;A**<mark style="color:green;">**WS WAF rules to mitigate layer 7 attacks**</mark>

## AWS Best Practices for DDoS Resiliency <mark style="color:red;">Attack surface reduction</mark>&#x20;

### <mark style="color:blue;">• Obfuscating AWS resources (BP1, BP4, BP6)</mark>&#x20;

**•&#x20;**<mark style="color:green;">**Using CloudFront, API Gateway, Elastic Load Balancing**</mark> <mark style="color:red;">**to hide your backend resources (Lambda functions, EC2 instances**</mark><mark style="color:red;">)</mark>&#x20;

### <mark style="color:blue;">• Security groups and Network ACLs (BP5)</mark>&#x20;

**• Use&#x20;**<mark style="color:orange;">**security groups and NACLs**</mark>**&#x20;to&#x20;**<mark style="color:green;">**filter traffic based on specific IP at the subnet or ENI-level**</mark>&#x20;

**•&#x20;**<mark style="color:purple;">**Elastic IP**</mark>**&#x20;are protected&#x20;**<mark style="color:red;">**by AWS Shield Advanced**</mark>&#x20;

### <mark style="color:blue;">• Protecting API endpoints (BP4)</mark>&#x20;

**•&#x20;**<mark style="color:green;">**Hide EC2, Lambda, elsewhere**</mark>&#x20;

**• Edge-optimized mode, or CloudFront + regional mode (more control for DDoS)**&#x20;

**•&#x20;**<mark style="color:red;">**WAF + API Gateway:**</mark>**&#x20;**<mark style="color:green;">**burst limits, headers filtering, use API keys**</mark>

## <mark style="color:orange;">Amazon GuardDuty</mark>&#x20;

<mark style="color:orange;">**• Intelligent Threat discovery**</mark>**&#x20;to&#x20;**<mark style="color:green;">**Protect AWS Account**</mark>&#x20;

<mark style="color:green;">**• Uses Machine Learning algorithms, anomaly detection, 3rd party data**</mark>&#x20;

<mark style="color:orange;">**• One click to enable (30 days trial), no need to install software**</mark>&#x20;

#### <mark style="color:blue;">• Input data includes:</mark>&#x20;

<mark style="color:red;">**• CloudTrail Events Logs**</mark>**&#x20;– unusual API calls, unauthorized deployments**&#x20;

<mark style="color:red;">**• CloudTrail Management Events**</mark>**&#x20;– create VPC subnet, create trail, …**&#x20;

**•&#x20;**<mark style="color:red;">**CloudTrail S3 Data Events**</mark>**&#x20;– get object, list objects, delete object, …**&#x20;

<mark style="color:red;">**• VPC Flow Logs**</mark>**&#x20;– unusual internal traffic, unusual IP address**&#x20;

<mark style="color:red;">**• DNS Logs**</mark>**&#x20;– compromised EC2 instances sending encoded data within DNS queries**&#x20;

<mark style="color:red;">**• Kubernetes Audit Logs**</mark>**&#x20;– suspicious activities and potential EKS cluster compromises**&#x20;

<mark style="color:green;">**• Can setup CloudWatch Event rules to be notified in case of findings**</mark>&#x20;

**• CloudWatch Events rules can&#x20;**<mark style="color:purple;">**target AWS Lambda or SNS**</mark>&#x20;

**•&#x20;**<mark style="color:green;">**Can protect against**</mark>**&#x20;**<mark style="color:red;">**CryptoCurrency attacks**</mark>**&#x20;**<mark style="color:green;">**(has a dedicated “finding” for it)**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F7AvjZH3KBv9V76Kj0WcO%2Fimage.png?alt=media&#x26;token=b569a7c2-f5a1-4899-bf03-27ac06fae726" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">Amazon Inspector</mark>&#x20;

<mark style="color:green;"><mark style="color:blue;">**• Automated Security Assessments**<mark style="color:blue;"></mark>&#x20;

### <mark style="color:blue;">• For EC2 instances</mark>&#x20;

**•&#x20;**<mark style="color:green;">**Leveraging the AWS System Manager (SSM) agen**</mark>**t**&#x20;

**•&#x20;**<mark style="color:green;">**Analyze**</mark>**&#x20;**<mark style="color:red;">**against unintended network accessibility**</mark>&#x20;

**•&#x20;**<mark style="color:blue;">**Analyze**</mark>**&#x20;**<mark style="color:red;">**the running OS against known vulnerabilities**</mark>

### <mark style="color:blue;">**• For Containers push to Amazon ECR**</mark>&#x20;

<mark style="color:red;">**• Assessment of containers as they are pushed**</mark>&#x20;

<mark style="color:green;">**• Reporting & integration with**</mark>**&#x20;**<mark style="color:red;">**AWS Security Hub**</mark>&#x20;

**•&#x20;**<mark style="color:green;">**Send findings to**</mark>**&#x20;**<mark style="color:red;">**Amazon Event Bridge**</mark>

]

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F1r9QRb6MDaxAh0Q2CjxH%2Fimage.png?alt=media&#x26;token=99e6aa0f-612f-43a2-a5a6-4bd294ca3a4d" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">What does AWS Inspector evaluate?</mark>

&#x20;**• Remember:&#x20;**<mark style="color:red;">**only for EC2 instances and container infrastructure**</mark>&#x20;

<mark style="color:green;">**• Continuous scanning of the infrastructure, only when needed**</mark>&#x20;

<mark style="color:red;">**• Package vulnerabilities (EC2 & ECR) – database of CVE**</mark>&#x20;

<mark style="color:blue;">**• Network reachability (EC2)**</mark>&#x20;

**• A risk score is associated with all vulnerabilities for prioritization**

## <mark style="color:orange;">Amazon Macie</mark>&#x20;

<mark style="color:green;">**• Amazon Macie is a fully managed data security and data privacy service**</mark>**&#x20;that&#x20;**<mark style="color:purple;">**uses machine learning and pattern matching to discover and**</mark>**&#x20;**<mark style="color:red;">**protect your sensitive data in AWS.**</mark>&#x20;

**• Macie helps&#x20;**<mark style="color:red;">**identify and alert you to sensitive data, such as personally identifiable information**</mark>**&#x20;(PII)**

Amazon Macie is a fully managed data security service that uses Machine Learning to discover and protect your sensitive <mark style="color:red;">data stored in S3 buckets.</mark> It automatically provides an inventory of S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with other AWS accounts. It allows you to identify and alert you to sensitive data, such as Personally Identifiable Information (PII).

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FxPFhHNUXX8Dy8PGK9yvJ%2Fimage.png?alt=media&#x26;token=36b35565-1a24-44cb-b7ac-41745074250c" alt=""><figcaption></figcaption></figure>

## <mark style="color:orange;">CloudHSM</mark>&#x20;

**•&#x20;**<mark style="color:blue;">**KMS =**</mark>**>&#x20;**<mark style="color:green;">**AWS manages the software for encryption**</mark>&#x20;

**•&#x20;**<mark style="color:blue;">**CloudHSM**</mark>**&#x20;=>&#x20;**<mark style="color:green;">**AWS provisions encryption hardware**</mark>&#x20;

**• Dedicated Hardware (**<mark style="color:blue;">**HSM = Hardware Security Module**</mark>**)**&#x20;

<mark style="color:red;">**• You manage your own encryption keys entirely (not AWS)**</mark>&#x20;

<mark style="color:purple;">**• HSM device is tamper resistant, FIPS 140-2 Level 3 compliance**</mark>&#x20;

**• Supports both symmetric and asymmetric encryption (SSL/TLS keys)**&#x20;

**•&#x20;**<mark style="color:red;">**No free tier available**</mark>&#x20;

**• Must use the CloudHSM Client Software**&#x20;

**•&#x20;**<mark style="color:green;">**Redshift supports CloudHSM for database encryption and key management**</mark>&#x20;

<mark style="color:red;">**• Good option to use with SSE-C encryption**</mark>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FOQKCf4wLtgHlTUYc7bB2%2Fimage.png?alt=media&#x26;token=56fc92e6-d584-4e15-97d6-0a7f35b1aa9a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F61TkWkacLgueT8CTBokW%2Fimage.png?alt=media&#x26;token=6030ad39-f0b5-46df-887b-2738d380187b" alt=""><figcaption></figcaption></figure>

## CloudHSM vs. KMS

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FNOX55HjZDURQ3gAW60rP%2Fimage.png?alt=media&#x26;token=e8305b90-0c28-4d59-a9b1-3dd0066da7f4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fo4EnGwMbvD7dkajHeYI3%2Fimage.png?alt=media&#x26;token=8edc964f-e07a-4506-8c49-8e592033be27" alt=""><figcaption></figcaption></figure>

## <mark style="color:blue;">AWS Shared Responsibility Model</mark>&#x20;

<mark style="color:red;">**• AWS responsibility - Security of the Cloud**</mark>&#x20;

&#x20;   **• Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services**&#x20;

&#x20;  **• Managed services like S3, DynamoDB, RDS, etc.**&#x20;

&#x20;  <mark style="color:red;">**• Customer responsibility - Security in the Cloud**</mark>&#x20;

**• For EC2 instance, customer is responsible for management of the guest OS (including security patches and updates), firewall & network configuration, IAM**&#x20;

**• Encrypting application data**&#x20;

<mark style="color:red;">**• Shared controls:**</mark>&#x20;

&#x20;   **• Patch Management, Configuration Management, Awareness & Training**

## <mark style="color:orange;">Example, for RDS</mark>&#x20;

### <mark style="color:orange;">• AWS responsibility:</mark>&#x20;

**• Manage the underlying EC2 instance, disable SSH access**&#x20;

**• Automated DB patching**&#x20;

**• Automated OS patching**&#x20;

**• Audit the underlying instance and disks & guarantee it functions**&#x20;

### <mark style="color:orange;">**• Your responsibility**</mark>**:**&#x20;

**• Check the ports / IP / security group inbound rules in DB’s SG**

&#x20;**• In-database user creation and permissions**

**• Creating a database with or without public access**&#x20;

**• Ensure parameter groups or DB is configured to only allow SSL connections**

&#x20;**• Database encryption setting**

## <mark style="color:orange;">Example, for S3</mark>&#x20;

### <mark style="color:red;">• AWS responsibility:</mark>&#x20;

**• Guarantee you get unlimited storage**

&#x20;**• Guarantee you get encryption**&#x20;

**• Ensure separation of the data between different customers**&#x20;

**• Ensure AWS employees can’t access your data**&#x20;

### <mark style="color:red;">**• Your responsibility:**</mark>&#x20;

**• Bucket configuration**&#x20;

**• Bucket policy / public setting**&#x20;

**• IAM user and roles**&#x20;

**• Enabling encryption**

<figure><img src="https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F6QUgW0FmRbd9Dl4eRifB%2Fimage.png?alt=media&#x26;token=d87baf31-bf8c-4683-b205-8a6c8240cf0f" alt=""><figcaption></figcaption></figure>
