AWS Summit Auckland 2014 | Understanding AWS Security

© 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc. Understanding AWS Security James Bromberger Solutions Architect, Amazon Web Services

Agenda •  Our Security •  Your Security –  Account Management (the keys to the kingdom) –  Service Isolation –  Visibility and Auditing

Security is our #1 priority

Shared security responsibility

AWS •  Facili'es •  Physical Security •  Physical Infrastructure •  Network Infrastructure •  Virtualiza'on Infrastructure •  Operating System •  Application •  Security Groups •  OS Firewalls •  Network Configuration •  Account Management Customer

How does AWS get security? •  Physical access is recorded, videoed •  Multi-factor authentication for physical access •  Segregation of duties: staff with physical access versus staff with logical access •  And every 90 days…

How does AWS get security?

Prove what AWS does! •  Certifications •  Audits & Attestations –  Independent 3rd parties –  Regularly refreshed –  Available to customers aws.amazon.com/compliance

Certifications & Accreditations for Workloads That Matter

What does AWS do for its security? November 2013 60 pages freely available aws.amazon.com/security/

AWS •  Facili'es •  Physical Security •  Physical Infrastructure •  Network Infrastructure •  Virtualiza'on Infrastructure •  Operating System •  Application •  Security Groups •  OS Firewalls •  Network Configuration •  Account Management Customer

Secure your account

Identity and Access Management •  Users & Groups

Identity and Access Management •  Users & Groups •  Unique Security Credentials

Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials

Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions

Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions •  Roles

Identity and Access Management •  Users & Groups •  Unique Security Credentials •  Temporary Security Credentials •  Policies & Permissions •  Roles •  Multi-factor Authentication

ProTip #1: Account Security

Identity and Access Management 1.  Secure your Master account with MFA 2.  Create an IAM Group for your Admin team 3.  Create IAM Users for your Admin staff, as members of your Admin group 4.  Turn on MFA for these users!

ProTip #2: No hard-coded Credentials

EC2 Roles for Temporary Credentials •  Remove hard-coded credentials from scripts and config files •  Create an IAM Role and assign restricted policy •  Launch instance into Role •  AWS SDKs transparently get temporary credentials GET http://169.254.169.254/latest/ meta-data/iam/security-credentials/ s3access { "Code" : "Success", "LastUpdated" : "2012-04-26T16:39:16Z", "Type" : "AWS-HMAC", "AccessKeyId" : "AKIAIOSFODNN7EXAMPLE", "SecretAccessKey" : "wJalrXUtnFEMI/ K7MDENG/bPxRfiCYEXAMPLEKEY", "Token" : "token", "Expiration" : "2012-04-27T22:39:16Z" }

ProTip #3: Least Privilege Policies

IAM Policies “Action” : { “route53:List*”, “route53:Get*”, “route53ChangeResourceRecordSets” } “Resource” : { “arn:aws:route53:::hostedzone/ZONEID” }

IAM Policies Use Conditions to restrict key exposure “Condition”: { "IpAddress" : { "aws:SourceIp" : ["192.0.2.0/24", "203.0.113.0/24"] } }

ProTip #4: Test Your Policies

Identity and Access Management •  Test your policies in the Policy Simulator!

Secure your data in flight

Secure your data in flight Credentials for talking to AWS APIs via REST: •  ACCESS KEY –  An identifier •  SECRET KEY –  Used to sign requests –  Shouldn’t traverse the network again •  Not retrievable from AWS again – you lose it, generate a new pair

Secure your data in flight Use SSL / TLS for all your traffic, just like you do for your API access ProTip #5: Validate the SSL Certificate!

Secure your data in flight SSL offload to the Elastic Load Balancing Service

Secure your data in flight •  RDS connections can be encrypted –  Get Public Key from AWS: https://rds.amazonaws.com/doc/rds-ssl-ca-cert.pem https://rds.amazonaws.com/doc/mysql-ssl-ca- cert.pem

Secure your data at rest

Secure your data at rest •  Use encrypted file systems on EBS and Storage Gateway –  dm-crypt/LUKS –  Windows BitLocker –  Windows EFS (file level) –  Products from Partners: Trend, Safenet, etc •  In your database –  RDS Oracle & SQL Server – Transparent Data Encryption •  Object Level into S3

Secure your data at rest Redshift •  By Default: –  Full disk encryption –  Uses SSL to talk to S3 •  Optionally you can: –  Set S3 backups to be encrypted –  Limit S3 bucket access –  Connect using SSL –  Run within VPC –  Use CloudHSM key store –  Backup access logs to S3 •  Redshift retains 1 week

Secure your data at rest CloudHSM: Hardware Security Modules in the cloud •  Single Tenancy •  Private key material never leaves the HSM •  AWS provisioned, customer managed

Isolate your services

Isolate your services Virtual Private Cloud •  Security Groups –  Don’t use 0.0.0.0/0 •  Subnet separation of instances with: –  Network ACLs, and IAM policy to prevent changes –  Routing tables, and IAM policy to prevent changes –  No Internet Gateway, and IAM policy to prevent changes

Isolate your services One application per instance •  Simplify forensics •  Simplify Security Groups •  Swim-lane capacity overloads •  Limit blast radius

VPC Peering

VPC Peering •  Connect two VPCs in the same Region –  No IP address conflicts •  Bridged by routing table entries (both sides of peering relationship) •  Offer & Accept model Customer B receives request from ACustomer A initiates peer to B

Log (& review) your API calls

CloudTrail Your staff or scripts make calls… on AWS API endpoints… CloudTrail logs this to an S3 bucket… so you can review this log

CloudTrail •  Who made the API call? •  When was the API call made? •  What was the API call? •  What were the resources that were acted up on in the API call? •  Where was the API call made from?

CloudTrail Partners

CloudTrail •  AWS Services are supporting logging API calls to CloudTrail: Kinesis, Elastic LoadBalancing, AWS CloudFormation, Amazon Eleastic MapReduce, AWS Beanstalk, AWS DirectConnect •  CloudTrail support for API calls in AP- Southeast-2 – Sydney – announced for this month (May 2014).

Support: Trusted Advisor

AWS Premium Support: make Amazon’s security team a part of your security team.

HeartBleed timeline. •  Disclosed: April 7. •  1st AWS Security Bulletin: April 7 –  Acknowledgement •  2nd AWS Security Bulletin: April 8 –  RDS instances being patched •  3rd AWS Security Bulletin: April 8 –  ELB updating, CloudFront updated; advice to customers •  4th AWS Security Bulletin: April 8 –  All AWS managed environments updated (or were already OK)

AWS Security Bulletins •  Visit the web site: https://aws.amazon.com/security/security-bulletins/ •  Subscribe to the RSS feed: http://aws.amazon.com/rss/security.rss

Monitor your AWS spend

Billing Alerts

Deep dive on more security…

https://aws.amazon.com/whitepapers/ Auditing Logging Risk Compliance Security

James’ Summary 1.  Turn on MFA for root and IAM user accounts 2.  Look at IAM Roles for EC2 Instances 3.  Use IP address conditions on Policies 4.  Create a few Billing Alerts 5.  Visit aws.amazon.com/security 6.  Talk to the AWS Solution Architecture Team about security and compliance

Developers… Please do not check your API credentials into revision control… …and please don’t check credentials in to public revision control (github, bitbucket, etc)

Visit the Solution Architecture Team today. Questions on security: talk to AWS James Bromberger [email protected] @JamesBromberger

AWS Summit Auckland 2014 | Understanding AWS Security

by Amazon Web Services

on May 14, 2014

Statistics

Views

Actions

0 Embeds 0

Accessibility

Categories

Upload Details

Usage Rights

Report content

AWS Summit Auckland 2014 | Understanding AWS Security Presentation Transcript