Part 13. Learn about AWS - Security, ETC at once

· Tech· Cloud
CloudCertification

AWS Managed Microsoft Active Director (AD)

AWS Managed Microsoft AD is a fully managed Microsoft Active Directory service provided by AWS. Simply put, it is a service that allows you to use Microsoft Active Directory (AD) in the AWS Cloud without managing it. This makes it easier to link and manage on-premise Active Directory (in your own data center) and Active Directory in the cloud.

Encryption

In HTTPS communication, security is maintained through encryption and decryption using TLS. TLS helps prevent man in the middle attack (MITM) problems.

Key Management Service, KMS

We use AWS KMS, which manages keys for encryption. You can encrypt documents with a KMS key by making an API call using SDK or CLI. There are two types of KMS Key: Symmetric (AES-256 keys) and Asymmetric (RSA & ECC key pairs). Automatically provides key rotation function (90~2560 days). Keys managed by AWS are rotated every year, and import keys must be rotated manually. You can create an EBS volume by moving EBS encrypted with a key to another region using a snapshot.

  • By default, KMS policies are accessible from all AWS accounts.
aws kms encrypt \
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
--plaintext fileb://ExamplePlaintextFile \
--output text \
--query CiphertextBlob | base64 \
--decode > ExampleEncryptedFile
aws kms decrypt \
--ciphertext-blob fileb://ExampleEncryptedFile \
--output text \
--query Plaintext | base64 --decode > ExampleDecryptedFile

Envelope Encryption

KMS Encrypt API calls have a 4KB limit, but if larger encryption is required, Envelope Encryption is used. Envelope Encryption uses two keys: DEK and KEK. This DEK itself is not stored, but is stored using an encrypted KEK. Generate a DEK using the GenerateDataKey API.

Encryption/decryption using Lambda

Since it is not good to put scret in the lambda function code, you can put it as an OS environment variable and encrypt/decrypt it using KMS.

ENCRYPTED = os.environ['DB_PASSWORD']
DECRYPTED = boto3.client('kms').decrypt(
CipertextBlob=b62decode(ENCRYPTED),
EncryptionContext={'LambdaFunctionName':os.environ['AWS_LAMBDA_FUNCTION_NAME']}
)['Plaintext'].decode('utf-8')

S3 Bucket Key

The S3 Bucket Key is created and used using KMS, and by using this S3 Bucket Key, there is no need to call the KMS API for data encryption every time. In other words, you can reduce KMS-related CloudTrail events by using S3 Bucket Key.

CloudHSM

This is a Hardware Security Module (HSM) service. This is a managed service that handles cryptographic operations on its own physical device and provides high security. The difference with KMS is that customers manage CloudHSM directly and provides greater security and flexibility. However, the cost may be relatively higher. AWS KMS performs encryption and decryption operations using keys stored in CloudHSM.

SSM Parameter Store

A service in AWS Systems Manager that securely stores and manages important settings in applications and infrastructure. Parameters stored as SecureString are encrypted with a KMS key. AWS Secrets Manager can automatically encrypt and manage sensitive information such as passwords and is relatively expensive than SSM Parameter Store. AWS Secrets Manager is recommended for secret management and rotation, and SSM Parameter Store is recommended for general configuration values ​​or non-secure information.

  • boto3 makes it easy to manage and work with AWS resources from Python code.
aws ssm get-parameters --names "/my/app/password" --with-decryption --region us-west-2

Secret Manager

You can copy secrets to another region using Secrets Manager.

  • For example, Secrets Manager manages secrets, such as database credentials, and encrypts this information when stored using KMS (mandatory).
  • SSM Parameter Store does not provide rotation, but rotation is possible using EventBridge. KMS enforcement is optional and cheaper than Secrets Manager.

Encryption with other services

  • Can be applied when creating CloudFormation as a template with Secrets Manager and SSM Parameter Store data.
  • In CloudWatch Log, it is possible to encrypt logs corresponding to a log group by setting a KMS key ID in the log group.
  • Rather than just creating environment variables in CodeBuild, you can apply them using AWS Systems Manager or Secrets Manager. (Prevent possible leakage when using Plaintext)
  • You can manage highly sensitive data using Nitro Enclaves. It is an isolated virtual machine and is used for data processing.

Comparison of AWS Security Services

service Description Key Use Cases Key Features
AWS KMS (Key Management Service) Services that generate and manage encryption keys and encrypt and decrypt data - Encrypt and decrypt data
- Integrate with other AWS services to manage security
- Manage key rotation		 - Supports symmetric keys (AES-256) and asymmetric keys (RSA, ECC)
- Key rotation (auto/manual)
- CloudTrail integration
AWS Secrets Manager Securely stores and manages confidential information (passwords, API keys, etc.) and supports automatic rotation - Database credentials
- API keys
- Store and manage sensitive information such as passwords
- Auto-rotate when necessary		 - Encryption with KMS
- Support automatic secret rotation
- Copy secrets between multiple regions
- High cost
SSM Parameter Store A service that stores and manages application settings and infrastructure configuration information - Storage of environment variables, application settings values
- Non-sensitive information management
- Automated infrastructure management		 - Supports SecureString encrypted with KMS
- Manually manages password rotation
- Low cost
CloudHSM Use Hardware Security Modules (HSMs) to manage encryption keys and provide high security - High-security encryption key management
- Corporate environments with high security requirements		 - Manage keys on physical devices
- Integrate with KMS to perform encryption and decryption
- Cost is relatively high

Other AWS Services

Simple Email Service, SES

It is a service for sending emails and can be used with S3, SNS, and Lambda.

OpenSearch Service

OpenSearch is a successor service to Elastic Search. After Elastic N.V. changed the license, it forked Elastic Search and provides OpenSearch service. It provides partial match functionality and also allows for analytical queries.

Athena

This serverless service helps analyze data in S3. It is used to query and analyze S3 data and is affordable at a fixed price of $5.00/TB. It is primarily used in connection with the QuickSights service.

Federated Query

You can access S3 data using Federated Query in Lambda.

import boto3
import time
athena_client = boto3.client('athena')
s3_client = boto3.client('s3')
def lambda_handler(event, context):
database = 'database_name'
query = '''
SELECT * FROM "table_name" LIMIT 10;
'''
query_execution_context = {
'Database': database
}
response = athena_client.start_query_execution(
QueryString=query,
QueryExecutionContext=query_execution_context,
ResultConfiguration={
'OutputLocation': 's3://results-bucket/',
}
)
query_execution_id = response['QueryExecutionId']
status = 'RUNNING'
while status in ['RUNNING', 'QUEUED']:
result = athena_client.get_query_execution(QueryExecutionId=query_execution_id)
status = result['QueryExecution']['Status']['State']
print(f"Query status: {status}")
time.sleep(2)
if status == 'SUCCEEDED':
result = athena_client.get_query_results(QueryExecutionId=query_execution_id)
print("Query Results:")
for row in result['ResultSet']['Rows']:
print(row)
else:
print(f"Query failed with status: {status}")

Managed Streaming for Apache Kafka, MKS

Apache Kafka is used as an alternative to AWS Kinesis and can be managed using MSK. The topic sent to the producer is replicated to several brokers in the MSK Cluster, and the broker delivers it to the consumer so that it can be used in AWS services (EMR, S3, etc.).

  • Kinesis Data Stream is a data stream with a 1MB size limit and shards. Suitable for small-scale, real-time analysis.
  • On the other hand, MSK is a distributed streaming platform that can have a size larger than 1MB and is composed of Kafka Topic and partitions.

###Certificate

AWS Certificate Manager, ACM

Used to manage SSL/TLS certificates. When a user makes a request to an ALB over HTTPS, the required certificate is managed by ACM and allows you to use the required AWS resources. ACM-provided public certificates are free.

Private CA

A managed private certificate authority provided by AWS. This service is used to issue and manage private SSL/TLS certificates for secure connections within internal networks, applications, or cloud environments.

Macie

Scans data stored in your S3 buckets to automatically identify sensitive information (e.g. name, address, email, credit card number, etc.). In particular, it plays an important role in monitoring and protecting sensitive data such as Personally Identifiable Information (PII). ###AppConfig As one of the features of AWS Systems Manager, it is used to dynamically set the configuration for the app and update it in real time.

Comments

No comments yet. Be the first!

    164 posts in 테크

    1–5 / 164