AWS Security Best Practices (March 2017)
23 likes5,046 views
The document outlines best practices for AWS security including understanding the shared security model, encrypting data, managing users and permissions, logging activities, and automating security checks. Some key recommendations are to encrypt everything using services like KMS, apply least privilege and rotate credentials for IAM users, enable CloudTrail logging across all regions, and use tools like Inspector and Config to automate security checks.
![create-volume [--dry-run | --no-dry-run] [--size <value>]
[--snapshot-id <value>] --availability-zone <value>
[--volume-type <value>] [--iops <value>]
[--encrypted | --no-encrypted] [--kms-key-id <value>]
[--cli-input-json <value>] [--generate-cli-skeleton]
Server-side encryption"
Amazon EBS](https://image.slidesharecdn.com/07security-170324134647/85/AWS-Security-Best-Practices-March-2017-10-320.jpg)
![Server-side encryption"
Amazon RDS
aws rds create-db-instance --region us-west-2
--db-instance-identifier myrdsinstance
--allocated-storage 20 --storage-encrypted
[ --kms-key-id xxxxxxxxxxxxxxxxxx ]
--db-instance-class db.m4.large --engine mysql
--master-username myawsuser --master-user-password myawsuser
http://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html](https://image.slidesharecdn.com/07security-170324134647/85/AWS-Security-Best-Practices-March-2017-11-320.jpg)
AWS Security Best Practices (March 2017)
- 1. Best practices for AWS security Julien Simon" Principal Technical Evangelist julsimon@amazon.fr @julsimon
- 2. Agenda • Understand the Shared Security Model • Encrypt everything • Manage users and permissions • Log everything • Automate security checks
- 4. AWS Shared Responsibility Model AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Client-side Data Encryption Server-side Data Encryption Network Traffic Protection Platform, Applications, Identity, and Access Management Operating System, Network, and Firewall Configuration Customer Applications & Content Customers Customers are responsible for security IN the cloud AWS is responsible for the security OF the cloud
- 5. Such as Amazon EC2, Amazon EBS, and Amazon VPC Shared Security Model: Infrastructure Services
- 6. Such as Amazon RDS and Amazon EMR Shared Security Model: Platform Services
- 7. Such as Amazon S3 and Amazon DynamoDB Shared Security Model: Managed Services
- 9. Encryption options Native server-side encryption for most services § S3, EBS, RDS, Redshift, etc. Flexible key management § AWS Key Management Service § AWS CloudHSM 3rd-party encryption § Trend Micro, SafeNet, Vormetric, Hytrust, Sophos etc. § AWS Marketplace : https://aws.amazon.com/marketplace/ Client-side encryption § Tricky business, please be careful!
- 10. create-volume [--dry-run | --no-dry-run] [--size <value>] [--snapshot-id <value>] --availability-zone <value> [--volume-type <value>] [--iops <value>] [--encrypted | --no-encrypted] [--kms-key-id <value>] [--cli-input-json <value>] [--generate-cli-skeleton] Server-side encryption" Amazon EBS
- 11. Server-side encryption" Amazon RDS aws rds create-db-instance --region us-west-2 --db-instance-identifier myrdsinstance --allocated-storage 20 --storage-encrypted [ --kms-key-id xxxxxxxxxxxxxxxxxx ] --db-instance-class db.m4.large --engine mysql --master-username myawsuser --master-user-password myawsuser http://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html
- 13. Server-side encryption on S3 (SSE-S3)
- 14. SSE-S3 with the AWS SDK for Java File file = new File(uploadFileName); PutObjectRequest putRequest = new PutObjectRequest(bucketName, keyName, file); // Request server-side encryption. ObjectMetadata objectMetadata = new ObjectMetadata(); objectMetadata.setSSEAlgorithm(ObjectMetadata.AES_256_SERVER_SIDE_ENCRYPTION); putRequest.setMetadata(objectMetadata); PutObjectResult response = s3client.putObject(putRequest); System.out.println("Uploaded object encryption status is " + response.getSSEAlgorithm());
- 15. AWS KMS Two-tiered key hierarchy using envelope encryption: • Unique data key encrypts customer data • AWS KMS master keys encrypt data keys Benefits: • Limits risk of compromised data key • Better performance for encrypting large data • Easier to manage small number of master keys than millions of data keys • Centralized access and audit of key activity Data key 1 Amazon S3 object Amazon EBS volume Data key 2 Data key 3 Data key 4 Custom" application Customer master" key(s) Amazon RDS instance https://aws.amazon.com/kms/
- 16. Your RDS instance + Data key Encrypted data key Encrypted" data Master key(s) in " customer’s account AWS KMS 1. Service requests encryption key to use to encrypt data, passes reference to master key in account 2. Client request authenticated based on permissions set on both the user and the key 3. A unique data encryption key is created and encrypted under the KMS master key 4. Plaintext and encrypted data key returned to the client 5. Plaintext data key used to encrypt data and then deleted when practical 6. Encrypted data key is stored; it’s sent back to KMS when needed for data decryption How keys are used to protect your data https://aws.amazon.com/kms/
- 17. Encryption SDKs • Different from the AWS SDKs • Java https://aws.amazon.com/blogs/security/how-to-use-the-new-aws- encryption-sdk-to-simplify-data-encryption-and-improve-application- availability/ • Python (released yesterday!) https://aws.amazon.com/blogs/security/new-aws-encryption-sdk-for- python-simplifies-multiple-master-key-encryption/
- 19. Identity and Access Management (IAM) 1. Create users Advantages § Unique credentials § Easier to rotate § Easier to track
- 20. Identity and Access Management (IAM) 1. Create users 2. Apply the principle of least privilege Advantages § Reduce the risk of human error § Finer control § Easier to add permissions than to remove them § Access Advisor tells you what permissions are actually used
- 21. Identity and Access Management (IAM) 1. Create users 2. Apply the principle of least privilege 3. Factorize permissions with groups Advantages § Simplest way to manage permissions for similar users
- 22. Identity and Access Management (IAM) 1. Create users 2. Apply the principle of least privilege 3. Factorize permissions with groups 4. Use conditional permissions for privileged accounts (time, IP adress, etc). Advantages § Extra security! § Possible for all APIs
- 23. Identity and Access Management (IAM) 1. Create users 2. Apply the principle of least privilege 3. Factorize permissions with groups 4. Use conditional permissions for privileged accounts (time, IP adress, etc). 5. Enable Cloudtrail to log all API calls Advantages § Keep a log of ALL activity inside your AWS account § Useful for debugging § Vital for forensics
- 24. Identity and Access Management (IAM) 6. Use a strong password policy Advantages § Do I really have to explain?
- 25. Identity and Access Management (IAM) 6. Use a strong password policy 7. Rotate security credentials regularly Advantages § Just in case one of your credentials leaked… https://aws.amazon.com/fr/blogs/security/how-to-rotate-access-keys-for-iam-users/
- 26. Identity and Access Management (IAM) 6. Use a strong password policy 7. Rotate security credentials regularly 8. Enable MFA for privileged users Advantages § Vital for protection against phishing attacks https://aws.amazon.com/fr/blogs/security/how-to-enable-mfa-protection-on-your-aws-api-calls/
- 27. Identity and Access Management (IAM) 9. Use IAM roles to delegate permissions Advantages § No need to store or share security credentials § Use cases § Cross-account access § Federation
- 28. Identity and Access Management (IAM) 9. Use IAM roles to delegate permissions 10. Use IAM roles for EC2 instances Avantages § No need to store, share or rotate security credentials § Application is granted least- privilege § Integration with the AWS SDK and the AWS CLI
- 29. Identity and Access Management (IAM) 9. Use IAM roles to delegate permissions 10. Use IAM roles for EC2 instances 11. Delete credentials for the root account Avantages § C’mon, don’t use ‘root’
- 30. 11 IAM Best Practices 1. Create users! 2. Apply the principle of least privilege 3. Factorize permissions in groups 4. Use conditional permissions for privileged accounts (time, IP adress, etc). 5. Enable Cloudtrail to log all API calls 6. Use a strong password policy 7. Rotate security credentials regularly 8. Enable MFA for privileged users 9. Use IAM roles to delegate permissions 10. Use IAM roles for EC2 instances 11. Delete credentials for the root account
- 31. AWS account: one or many ? Use a single AWS account when: § You only need simple controls on who does what § You don’t need to isolate projects or teams § You don’t need to track costs separately Use multiple accounts when: § You need total isolation between projects or teams § You need total isolation for some of your data (such as Cloudtrail logs) § You want to keep track of costs separately (you can still get a single bill with Consolidated Billing)
- 32. Log Everything
- 33. Logs? Sure, we got logs! Infrastructure Logs § AWS CloudTrail § VPC Flow Logs Service Logs § Amazon S3 § AWS Elastic Load Balancing § Amazon CloudFront § AWS Lambda § AWS Elastic Beanstalk § … Instance Logs § UNIX / Windows logs § NGINX/Apache/IIS § Your own logs § …
- 34. CloudTrail 1. Enable Cloudtrail in all regions Advantages § This takes 10 seconds § It works for all regions, even if you don’t use them yet.
- 35. CloudTrail 1. Enable Cloudtrail in all regions 2. Enable log validation Advantages § Guarantees log integrity § Vital for audits and forensics § Based on SHA-256 and RSA signature
- 36. CloudTrail 1. Enable Cloudtrail in all regions 2. Enable log validation 3. Encrypt logs Advantages § SSE-S3 by default § KMS is supported too
- 37. CloudTrail 1. Enable Cloudtrail in all regions 2. Enable log validation 3. Encrypt logs 4. Export logs to Cloudwatch Logs Advantages § Easier to search § Trigger alerts on specific events
- 38. CloudTrail 1. Enable Cloudtrail in all regions 2. Enable log validation 3. Encrypt logs 4. Export logs to Cloudwatch Logs 5. Centralize logs in a single place Avantages § Single bucket § Could be in a dedicated account
- 40. VPC Flow Logs § Store all network traffic in Cloudwatch Logs § They can be enable by VPC, by subnet our by network interface § It’s going to be a lot of data: what do you really need? • Everything, Allow, Deny • For debugging or for security monitoring?
- 41. AWS Service Logs Many services let you export their logs to CloudWatch Logs, CloudTrail ou S3. § Elastic Beanstalk à CloudWatch Logs " https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html https://aws.amazon.com/fr/about-aws/whats-new/2016/12/aws-elastic-beanstalk-supports-application-version-lifecycle-management-and- cloudwatch-logs-streaming/ § ECS (instances & containers) à CloudWatch Logs http://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html § Lambda à CloudWatch Logs " http://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions-logs.html § S3 à CloudTrail (S3 data events) § CloudFront à S3 " http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html § ELB / ALB à S3 " http://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
- 42. EC2 Logs § You can export them to Cloudwatch Logs with the Cloudwatch Agent. § Storage costs are pretty low, so it’s probably worth it § Available for Linux and Windows § Logs can be exported to S3 and ElasticSearch § Metrics and alarms allow you to keep track of suspicious events
- 44. You can automate on multiple levels • Infrastructure / application automation - AWS CloudFormation - AWS OpsWorks • DIY automation - AWS CloudTrail à CloudWatch Logs à CloudWatch alerts - API calls à Amazon CloudWatch Events à SNS / SQS / Kinesis / Lambda • Compliance automation - AWS Inspector - AWS Config Rules
- 45. Configuring CloudWatch alarms for CloudTrail • CloudFormation template with 10 predefined alarms • Create, modify or delete Security Groups • Modify IAM policies • Failed connections to the console • Failed API calls caused by permission issues • Set them up in less than 5 minutes! • Get e-mail notifications when these events occur in your AWS account http://docs.aws.amazon.com/fr_fr/awscloudtrail/latest/userguide/use-cloudformation-template-to-create-cloudwatch-alarms.html https://s3-us-west-2.amazonaws.com/awscloudtrail/cloudwatch-alarms-for-cloudtrail-api-activity/CloudWatch_Alarms_for_CloudTrail_API_Activity.json
- 46. AWS Config Rules • Config Rules checks that AWS resources are compliant • You can use: • Pre-defined rules: MFA on, CloudTrail on, EBS encryption, etc. • Your own rules • Checks can be: • Periodic (1, 3, 6, 12 or 24 hours) • Triggered by configuration changes • Notifications are sent to SNS… • ... Which means that you can process them with Lambda functions • Non-compliant instance? Kill it!
- 47. Amazon Inspector • This service allows you to check the configuration and the behavior of EC2 instances. • Agent-based • Can run from 15 minutes to 24 hours • Reports and advice on how to fix issues • Can be automated with the AWS API • Built-in rule packages
- 48. Amazon Inspector – Rule packages • Common Vulnerabilities and Exposures • http://cve.mitre.org • https://s3-us-west-2.amazonaws.com/rules-engine/CVEList.txt (47,050) • CIS Operating System Security Configuration Benchmarks • Center for Internet Security http://cisecurity.org • http://benchmarks.cisecurity.org • Security Best Practices • SSH, passwords, etc. (Linux uniquement) • https://docs.aws.amazon.com/fr_fr/inspector/latest/userguide/inspector_security-best- practices.html • Runtime Behavior Analysis • How instances behave during testing (networking, protocols, etc.) • https://docs.aws.amazon.com/fr_fr/inspector/latest/userguide/inspector_runtime-behavior- analysis.html
- 50. Please promise me this • Never share credentials across users / applications • Never store credentials in source code (they’ll end up on Github) • Never store credentials on EC2 instances • (Almost) never work with the root account • One account per user / one role per app with least privilege • Use MFA for privileged accounts • Enable CloudTrail in all regions • Encrypt everything • Automate security checks and alarms “It’s not because you’re paranoid that they’re not after you”
- 51. Additional resources Whitepapers https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf http://d0.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf AWS re:Invent 2016: Security Services State of the Union (SEC312) - Steve Schmidt, CISO, Amazon Web Services https://www.youtube.com/watch?v=8ZljcKn8FPA AWS re:Invent 2016: Automating Security Event Response, from Idea to Code to Execution (SEC313) https://www.youtube.com/watch?v=x4GkAGe65vE AWS re:Invent 2016: Automated Governance of Your AWS Resources (DEV302) https://www.youtube.com/watch?v=2P2I7HlrFtA AWS re:Invent 2016: Scaling Security Operations and Automating Governance (SAC315) https://www.youtube.com/watch?v=_yfeCvqHdNg
- 52. Julien Simon julsimon@amazon.fr @julsimon Your feedback is important to us!