Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Mastering AWS Security
  • Table Of Contents Toc
  • Feedback & Rating feedback
Mastering AWS Security

Mastering AWS Security

By : Albert Anthony
3.7 (13)
Buy this Book
close
close
Mastering AWS Security

Mastering AWS Security

3.7 (13)
By: Albert Anthony

Overview of this book

Mastering AWS Security starts with a deep dive into the fundamentals of the shared security responsibility model. This book tells you how you can enable continuous security, continuous auditing, and continuous compliance by automating your security in AWS with the tools, services, and features it provides. Moving on, you will learn about access control in AWS for all resources. You will also learn about the security of your network, servers, data and applications in the AWS cloud using native AWS security services. By the end of this book, you will understand the complete AWS Security landscape, covering all aspects of end - to -end software and hardware security along with logging, auditing, and compliance of your entire IT environment in the AWS cloud. Lastly, the book will wrap up with AWS best practices for security.
Table of Contents (10 chapters)
close
close
close
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Readers feedback
Customer support
Free Chapter
1
Overview of Security in AWS
chevron up
Overview of Security in AWS
Chapter overview
AWS shared security responsibility model
AWS Security responsibilities
Customer security responsibilities
AWS account security features
AWS Security services
AWS Security resources
Summary
2
AWS Identity and Access Management
AWS Identity and Access Management
Chapter overview
IAM features and tools
IAM Authentication
IAM Authorization
Passwords Policy
AWS credentials
IAM limitations
IAM best practices
Summary
3
AWS Virtual Private Cloud
AWS Virtual Private Cloud
Chapter overview
VPC components
VPC features and benefits
VPC use cases
VPC security
Creating VPC
VPC limits
VPC best practices
Summary
4
Data Security in AWS
Data Security in AWS
Chapter overview
Encryption and decryption fundamentals
Securing data at rest
Securing data in transit
AWS KMS
AWS CloudHSM
Amazon Macie
Summary
5
Securing Servers in AWS
Securing Servers in AWS
EC2 Security best practices
EC2 Security
Amazon Inspector
AWS Shield
Summary
6
Securing Applications in AWS
Securing Applications in AWS
AWS Web Application Firewall (WAF)
Signing AWS API requests
Amazon Cognito
Amazon API Gateway
Summary
7
Monitoring in AWS
Monitoring in AWS
AWS CloudWatch
Monitoring Amazon EC2
Summary
8
Logging and Auditing in AWS
Logging and Auditing in AWS
Logging in AWS
AWS CloudWatch Logs
AWS CloudTrail
Auditing in AWS
AWS Artifact
AWS Config
AWS Trusted Advisor
AWS Service Catalog
AWS Security Audit Checklist
Summary
9
AWS Security Best Practices
AWS Security Best Practices
Shared security responsibility model
IAM security best practices
VPC
Data security
Security of servers
Application security
Monitoring, logging, and auditing
AWS CAF
Summary

AWS Security services

Now, let us look at AWS Security services. These are AWS services that primarily provide ways to secure your resources in AWS. We'll briefly go over these services in this section as all of these services are discussed in detail in the subsequent chapters.

AWS Identity and Access Management 

AWS IAM enables customers to control access securely for their AWS resources and AWS users. In a nutshell, IAM provides authentication and authorization for accessing AWS resources. It supports accessing AWS resources through a web-based management console, CLI, or programmatically through API and SDK. It has basic features for access control such as users, groups, roles, and permissions as well as advanced features such as Identity Federation for integrating with the customer's existing user database, which could be a Microsoft Active Directory or Facebook, or Google. You can define granular permissions for all your resources as well as use temporary security credentials for providing access to external users outside of your AWS account.

AWS Virtual Private Cloud

AWS VPC is an IaaS that allows you to create your own VPN in the cloud. You can provision your resources in this logically isolated network in AWS. This network can be configured to connect to your on-premise data center securely. You can configure firewalls for all your resources in your VPC at instance level and/or subnet level to control traffic passing in and out of your VPC. VPC has a VPC flow log feature that enables you to collect information regarding IP traffic of your VPC.

AWS Key Management System (KMS)

AWS KMS is a service that helps you manage keys used for encryption. There are multiple options for KMS that include bringing your own keys and having them managed by KMS along with those generated by AWS. This is a fully managed service and integrates with other AWS Services such as AWS CloudTrail to log all activities for your KMS services. This service plays an important role in securing the data stored by your applications by encrypting them.

AWS Shield

AWS shield protects your web applications running on AWS from managed Distributed Denial of Service (DDoS) attacks. It is a fully managed service and has two variants, standard and advanced. AWS shield standard is offered to all customers free of charge and provides protection from most common attacks that target your applications or websites on AWS. AWS shield advanced gives you higher levels of protection, integration with other services such as web application firewalls, and access to the AWS DDoS response team.

AWS Web Application Firewall (WAF)

AWS WAF is a configurable firewall for your web applications, allowing you to filter traffic that you want to receive for your web applications. It is a managed service and can be configured either from the management console or through AWS WAF API, so you can have security checkpoints at various levels in your application by multiple actors such as developer, DevOps engineer, security analysts, and so on.

AWS CloudTrail

This is a logging service that logs all API requests in and out of your AWS account. It helps with compliance, auditing, and governance. It delivers a log of API calls to an S3 bucket periodically. This log can be analyzed by using log analysis tools for tracing the history of events. This service plays a very important part in Security Automation and Security Analysis.

AWS CloudWatch

This is a monitoring service that provides metrics, alarms and dashboards for all AWS Services available in your account. It integrates with other AWS services such as AutoScaling, Elastic Load Balancer, AWS SNS, and AWS Lambda for automating response for a metric crossing threshold. It can also collect and monitor logs. AWS CloudWatch can also be used to collect and monitor custom metrics for your AWS resources or applications.

AWS Config

AWS Config is a service that lets you audit and evaluates the configuration of your AWS resources. You can visit the historical configuration of your AWS resources to audit any incident. It helps you with compliance auditing, operational troubleshooting, and so on. You will use this service to make sure your AWS resources stay compliant and configured as per your baseline configuration. This service enables continuous monitoring and continuous assessment of configuration of your AWS resources.

AWS Artifact

This service gives you all compliance related documents at the click of a button. AWS Artificat is a self service, on-demand portal dedicated to compliance and audit related information along with select agreements such as business addendum and non disclosure agreement, and so on.

Penetration testing

AWS allows you to conduct penetration testing for your own EC2 and Relational Database Service (RDS) instances; however, you have to first submit a request to AWS. Once AWS approves this request, you can conduct penetration testing and vulnerability scans for EC2 and RDS instances in your AWS account. We'll take a detailed look at penetration testing in subsequent chapters.

End of Section 7
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY