DVA-C02 Preparation Material 3 - Security & Logging & Monitoring

IAM

• Trust Policy is the only resource-based policy in IAM.
• "Effect": "Allow"
• Cross-Account Access
• Ability to allow resources in one account in AWS to be accessed by users or services in another account.
• IAM roles and resource-based policies delegate access to accounts within a single partition.
• It is desirable to set up roles with access to resources (S3, etc.) so that access can be delegated only to trusted entities.
• IAM Access Analyzer
• Simplifies checking for unused access and guides you to least privileges
• Helps identify resources in your organization and account that are shared with external entities, such as S3 buckets or IAM roles.
• Access Advisor in IAM console
• does not provide information about non-IAM entities;
• IAM reports a last used timestamp, which indicates the last time the role was used to make an AWS request.
• Access to Billing and Cost Management can be set
• Supports web services that can request temporary and limited authority credentials using STS (Security Token Service)
• Distribution of SSL/TLS certificates
• Use IAM as a certificate manager only when you need to support HTTPS connections in regions not supported by ACM.
• By configuring IAM Policy Variables, you can determine which users can use which resources.
• ${aws:username}

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::amzn-s3-demo-bucket"],
"Condition": {"StringLike": {"s3:prefix": ["${aws:username}/*"]}}
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": ["arn:aws:s3:::amzn-s3-demo-bucket/${aws:username}/*"]
}
]
}

###ACM

• Distribution of SSL/TLS certificates

Amazon Inspector

• Services that focus on individual security assessment and vulnerability analysis

AWS Security Hub

• A service that integrates multiple security alerts to monitor security status at a glance

AWS Trusted Advisor

• A tool that provides guidance for overall resource optimization and cost reduction, helping to configure resources in accordance with AWS best practices.

CloudWatch

• CloudWatch custom metric settings determine the amount of failures during request API calls and process SNS alarms when the amount exceeds a certain level.
• High resolution 1sec
• If you want to track the CPU utilization of your EC2 instance every 10 seconds.
• Standard resolution 1min
• Searchable in units of 1sec, 5sec, 10sec, 30sec, 60sec
• Detailed Monitoring is a specialized function for some resources and services
• EC2 Detailed Monitoring provided at 1min intervals
• External payment processing API calls cannot be measured
• Specify CloudWatch event or Cron expression for Lambda trigger
• Choose to push statistics to a user-defined metric rather than extracting statistics from the metric.
• Cron job on instances to push EC2 RAM statistics to CloudWatch as custom metrics
• Download CloudWatch agent to your on-premises server using IAM user credentials with permissions for CloudWatch.
• Installing the AWS SDK on an on-premises server requires manual configuration and is not suitable.

AWS Glue

A fully managed extract, transform, and load (ETL) service that makes it easy for customers to prepare and load data for analysis.

Server-Side Encryption (SSE)

• Server-side encryption only encrypts object data, not object metadata. -SSE-C
• S3 rejects all requests made over HTTP when using SSE-C
• For security purposes, AWS recommends that you consider any key incorrectly sent using HTTP to be considered compromised. -SSE-KMS
• buildspec.yml > configure
• Store the CMK and receive data from the client, encrypt it and send it back
• 'x-amz-server-side-encryption': 'aws:kms'
• Pass large-sized data to Lambda using envelope encryption
• Lambda API has a 4KB payload upper limit
• A way to convey something more than that
• The IAM user's policy must be modified to allow the kms:GenerateDataKey operation.
• An API call that returns an encrypted copy of the plaintext key and data key for object encryption.
• Encrypt data using plaintext keys
• full control to create, rotate and remove the encryption keys
• CloudWatch Logs requires permission to the CMK each time encrypted data is requested.
• Use the AWS CLI associate-kms-key command and specify the KMS key ARN.
• aws logs associate-kms-key --log-group-name my-log-group --kms-key-id "key-arn" -SSE-S3
• Master key rotation possible
• Amazon S3 server-side encryption encrypts your data using 256-bit Advanced Encryption Standard (AES-256), one of the strongest block ciphers available.
• "s3:x-amz-server-side-encryption": "AES256"

env:
variables:
S3_BUCKET_NAME: "your-bucket-name"
KMS_KEY_ID: "arn:aws:kms:region:account-id:key/key-id"

{
"Version": "2012-10-17",
"Id": "PutObjectPolicy",
"Statement": [
{
"Sid": "DenyIncorrectEncryptionHeader",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
},
{
"Sid": "DenyUnencryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
"Condition": {
"Null": {
"s3:x-amz-server-side-encryption": "true"
}
}
}
]
}

• Using StringNotEquals will reject the request if the value of s3:x-amz-server-side-encryption is not aws:kms.

{
"Version":"2012-10-17",
"Id":"PutObjectPolicy",
"Statement":[{
"Sid":"DenyUnEncryptedObjectUploads",
"Effect":"Deny",
"Principal":"*",
"Action":"s3:PutObject",
"Resource":"arn:aws:s3:::examplebucket/*",
"Condition":{
"StringNotEquals":{
"s3:x-amz-server-side-encryption":"aws:kms"
}
}
}
]
}

Cognito

• Integrating a third-party authentication provider requires OIDC or SAML settings, which creates additional complexity.
• What is Amazon Cognito?
• User pool
• Implement identity, access, and refresh tokens as defined by the OpenID Connect (OIDC) open standard
• JWT return authentication mechanism
• Web or app login
• Identity pool
• Grant users temporary credentials to access other AWS services
• Cannot manage users or create IAM users using identity pools
• Provides temporary access credentials to access services such as S3 or DynamoDB
• Sync feature synchronizes user profile data across mobile devices and the web without the need for your own backend

Step Function

• Because the status of each step is tracked, it is possible to track all processes desired by the company.
• long-running, durable, and auditable workflows
• human approval steps
• Manage and automate orchestration of data flows
• Provide visualization data
• Use Express Workflows for workloads with high event rates and short durations.
• Supports a rate of over 100,000 events per second
• Single work unit of Statemachine - Task

"HelloWorld": {
"Type": "Task",
"Resource": "arn:aws:lambda:us-east-1:123456789012:function:HelloFunction",
"Next": "AfterHelloWorldState",
"Comment": "Run the HelloWorld Lambda function"
}

AWS Secrets Manager

• Database credentials can be automatically renewed periodically (Auto Rotation)
• Secrets Manager handles this through Lambda functions, so no manual intervention is required.
• Import and use API credentials at runtime with SDK
• Any solution to store and retrieve credentials with minimal management overhead

AWS Systems Manager

• Provides visibility and control over infrastructure
• SSM Parameter Store
• Use with CloudTail to encrypt all secret strings used in your application, preventing values from being exposed as plaintext and auditing decryption events.
• You can create SecureString parameters, which are parameters with a plain text parameter name and an encrypted parameter value.
• Access tokens can be stored in encrypted form and made accessible from other AWS accounts.
• More cost-effective than AWS Secrets Manager

CloudTail & X-ray

• CloudTrail provides event history of AWS account activity
• Who made the API call to modify this resource?
• Use X-ray to debug and track data across accounts
• End-to-end transaction tracking
• Provide visualization data
• Requires IAM read permission
• Enable X-ray sampling to record the first request every second
• Install and run the X-Ray daemon on your on-premises server to capture and forward data to the X-Ray service.
• Manually instrument X-Ray SDK in application code
• How to securely handle PII on EC2 instances and prevent PII from being included in X-Ray trace messages