AWS Security Links and Resources

AWS Security Links and Resources to understand Security complexity

 

Security

 

AWS Cloud Adoption Framework Security Perspective https://d1.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf

AWS Security Documentation https://docs.aws.amazon.com/security/

 

Amazon Web Services: Overview of Security Processes

https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf–

• AWS Well-Architected Security Labs https://wellarchitectedlabs.com/Security/README.html
• Security Centre https://aws.amazon.com/security/
• Security Best Practices White Papers https://aws.amazon.com/whitepapers/aws-security-best-practices/
• AWS and the CLOUD Act https://aws.amazon.com/blogs/security/aws-and-the-cloud-act/
• Compliance Programs https://aws.amazon.com/compliance/programs/

 

Security Standards and Benchmarking

• Atlas – Compliance Centre https://atlas.aws
• Centre for Internet Security https://www.cisecurity.org/cis-benchmarks/ CIS Benchmarks: 100+ configuration guidelines for various technology groups to safeguard systems against cyber threats.
• SCAP Security Guide https://www.open-scap.org/security-policies/scap-security-guide/
• A SOC 1 Report (System and Organization Controls Report) https://www.ssae-16.com/soc-1/ is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting.

 

Secure Account Management

• AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html
• AWS Services That Work with IAM https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html AWS services grouped by their AWS product categories and include information about what IAM features they support.
• How IAM evaluates policies https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
• Policy Summaries https://aws.amazon.com/blogs/security/move-over-json-policy-summaries-make-understanding-iam-policies-easier/ Make Understanding IAM Policies Easier.
• Configuring MFA-Protected API Access https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html provides the additional security of requiring users to be authenticated with AWS multi-factor authentication (MFA) before you allow them to perform particularly sensitive actions.
• AWS Process Credential Providers https://github.com/awslabs/awsprocesscreds process-based credential providers to be used with the AWS CLI and related tools. Includes examples for okta and adfs.
• AWS Security Hub https://aws.amazon.com/security-hub/ gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts.
• AWS Control Tower https://aws.amazon.com/controltower/ automates the set-up of a baseline environment, or landing zone, that is a secure, well-architected multi-account AWS environment.
• AWS Data-safe Cloud https://pages.awscloud.com/AWS-Data-safe-Cloud-S.html
• AWS License Manager – Manage Software Licenses and Enforce Licensing Rules https://aws.amazon.com/blogs/aws/new-aws-license-manager-manage-software-licenses-and-enforce-licensing-rules/ You can define your licensing rules, taking in to account any enterprise agreements and other terms that govern your use of the licensed software.

 

Encryption and Security Keys

• AWS Key Management Service Cryptographic Details https://d1.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf white paper.
• Signing AWS Requests with Signature Version 4 https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html how to create a signature and add it to an HTTP request to AWS.
• TLS 1.3: better for individuals – harder for enterprises https://www.ncsc.gov.uk/blog-post/tls-13-better-individuals-harder-enterprises – blog post from the National Cyber Security Centre.
• How to quickly launch encrypted EBS-backed EC2 instances from unencrypted AMIs https://aws.amazon.com/blogs/security/how-to-quickly-launch-encrypted-ebs-backed-ec2-instances-from-unencrypted-amis/
• Sharing an AMI with Specific AWS Accounts https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html

 

Firewalls and packet inspection

• Gateway Load Balancer https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer one gateway for distributing traffic across multiple virtual appliances
• Deployment models for AWS Network Firewall https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

 

Security Monitoring, Logging and Auditing

• Trusted Advisor https://aws.amazon.com/premiumsupport/technology/trusted-advisor/ Reduce Costs, Increase Performance, and Improve Security
• Viewing Events with CloudTrail Event History https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html
• CloudTrail Supported Services and Integrations https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html
• Validating CloudTrail Log File Integrity https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
• AWS Service Limits https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html
• Cloud Custodian https://github.com/cloud-custodian/cloud-custodian is a rules engine for managing public cloud accounts and resources
• AWS Security Incident Response Guide https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf
• VPC Traffic Mirroring https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/ Capture & Inspect Network Traffic
• AWS Config Conformance Pack Sample Templates https://docs.aws.amazon.com/config/latest/developerguide/conformancepack-sample-templates.html

 

Cross-Region Replication and Failover

• S3 Cross-Region Replication https://docs.aws.amazon.com/AmazonS3/latest/dev/crr-what-is-isnot-replicated.html – what Amazon S3 does/does not replicate after you add a replication configuration on a bucket.
• Replicating Objects Created with Server-Side Encryption (SSE) Using AWS KMS-Managed Encryption Keys https://docs.aws.amazon.com/AmazonS3/latest/dev/crr-replication-config-for-kms-objects.html

 

Web Application Security

• AWS Acceptable Use Policy https://aws.amazon.com/aup/
• Guidelines for Shared Linux AMIs https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/building-shared-amis.html to reduce the attack surface and improve the reliability of the AMIs you create.
• Amazon Inspector FAQs https://aws.amazon.com/inspector/faqs/
• Amazon Inspector Agents https://docs.aws.amazon.com/inspector/latest/userguide/inspector_agents.html
• Amazon Inspector Rules Packages for Supported Operating Systems https://docs.aws.amazon.com/inspector/latest/userguide/inspector_rule-packages_across_os.html
• AWS Systems Manager Features https://aws.amazon.com/systems-manager/features/ and Use Cases and Best Practices https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-best-practices.html
• Recommended NACL rules for VPCs https://docs.aws.amazon.com/vpc/latest/userguide/vpc-recommended-nacl-rules.html
• Security Group Rules Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html

 

Data Security

• Security features of Amazon DocumentDB https://docs.aws.amazon.com/documentdb/latest/developerguide/security.html
• AWS Resource Access Manager https://docs.aws.amazon.com/ram/latest/userguide/what-is.html (AWS RAM) enables you to share your resources with any AWS account or through AWS Organizations.

 

Hybrid Environment Security

• The OWASP Foundation https://www.owasp.org/index.php/Main_Page
• Trend Micro Managed Rules for AWS WAF – Content Management System (CMS) https://aws.amazon.com/marketplace/pp/B0779N3B6Q
• How To Protect SSH With Fail2Ban on CentOS 7 https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7
• AWS Marketplace: CloudLink Data Encryption https://aws.amazon.com/marketplace/pp/CloudLink-CloudLink-Data-Encryption/B00BJB0RW0
• How to Implement Federated API and CLI Access Using SAML 2.0 and AD FS https://aws.amazon.com/blogs/security/how-to-implement-federated-api-and-cli-access-using-saml-2-0-and-ad-fs/
• Amazon Route 53 Resolver for Hybrid Clouds https://aws.amazon.com/blogs/aws/new-amazon-route-53-resolver-for-hybrid-clouds/

 

Serverless Security

• Security Overview of AWS Lambda https://d1.awsstatic.com/whitepapers/Overview-AWS-Lambda-Security.pdf