AWS KMS and Data Security Quiz

AWS Global Infrastructure

• AWS is deployed globally.
• Infrastructure is built around AWS Regions.
• Each region has multiple availability zones (AZs).
• Data centers are in the availability zones.
• Global infrastructure reduces latency.
• Each region is isolated from others.
• Instances and data are placed in multiple regions and AZs.
• AZs are physically separated and in low-risk flood plains.
• Availability Zones (AZs) are independent of each other in network and power resources.
• A region is made up of two or more availability zones.
• Many availability zones belong to a region.
• Users should choose a region closest to the end-users.
• Prices and SLAs aren't the same across all regions.

Content Delivery Network (CDN)

• Data is distributed across the globe and stored near consumers.
• This leads to quicker access speeds.

AWS CloudFront

• A global CDN (Content Delivery Network).
• Routes traffic to the closest cached location for swift loading.
• Delivery is based on user location, website origin, and content server location.
• Integrates with many AWS services for performance and security.
• Uses edge locations worldwide to cache resources for quick retrieval.
• Makes websites/apps load faster for end-users by using edge locations to cache files and resources.

Security

• Compliance requirements determine the region to use.
• High availability is achieved by duplicating resources in multiple AZs or regions.
• Resiliency is the ability to keep working during natural disasters; it's part of Disaster Recovery (DR).
• Redundancy is having multiple copies of data in different data centers.
• Security is a pillar in AWS well-architected framework.

AWS Well-Architected Framework: Security

• Includes Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

Security Pillar Design Principles

• Implement a strong identity foundation.
• Enable traceability.
• Apply security at all layers.
• Automate security best practices.
• Protect data in transit and at rest.
• Keep people away from data.
• Prepare for security events.

The Shared Responsibility Model & Security

• Cloud Service Providers (CSPs) are responsible for data center security, data isolation between businesses, and network security within the data center.
• Cloud consumers are responsible for security within the cloud, including direct user access to data (permissions), backup, and restoration of data.

AWS Security & Compliance

• AWS manages cloud security, but users are responsible for their own content, applications, and security.
• AWS provides tools and features for network security, configuration management, access control, and data encryption.
• AWS environments are continuously audited.

AWS Shared Responsibility Model (Diagram)

• Shows the divisions of responsibility between AWS and the customer.
• Customer is responsible for customer data, platform, applications, identity and access management, operating systems, network and firewall configuration, client-side data encryption, data integrity, and authentication.
• AWS is responsible for hardware, AWS global infrastructure (regions, availability zones, edge locations), server-side encryption, network, and traffic protections.

Cloud Service Models

• Diagram depicts the different levels of cloud services.
• Traditional IT, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a service (SaaS).

AWS Responsibility: Security of the Cloud

• AWS manages physical security of data centers, controlled access, hardware and software infrastructure, storage decommissioning, OS access logging, auditing, network infrastructure, intrusion detection, and virtualization infrastructure; instance isolation.
• Customer Responsibility encompasses client-side data encryption and data integrity.

Customer Responsibility: Security in the Cloud

• Customer responsible for instance operating systems, security group configurations, OS or host-based firewalls, network configurations, including intrusion detection or prevention, account management, logins, and permissions. 

Service characteristics and security responsibility

• Illustrates examples of services managed by the customer and AWS (IaaS, PaaS, SaaS).

Access Management

• Authentication uses credentials to establish identity.
• Authorization takes place after authentication and determines the access level to resources.
• Common methods, such as attribute-based access control (ABAC), and role-based access control (RBAC) are used.
• The principle of least privilege should be applied; only necessary permissions should be granted.

AWS CloudWatch Monitoring

• Monitors the state and utilization of most AWS resources.
• CloudWatch Agent collects metrics, including metrics of Amazon EC2 instances and on-premises servers.
• CloudWatch provides alarms, insights into events and rules, and monitoring from a dashboard. 

AWS Identity and Access Management (IAM)

• Enables secure sharing and access control for AWS resources for individuals and groups.
• Integrates with most AWS services.
• Supports federated identity management.
• Supports granular permissions and multi-factor authentication (MFA). 
• Provides identity information for information assurance and compliance audits. 

Data Security: Data at rest and in transit

• Data at rest is any data that persists in nonvolatile storage.
• Data in transit is data being sent between systems.
• Protections for data at rest and data in transit include encryption, key management, access controls, and auditing. 

AWS Key Management Service (AWS KMS)

• Allows users to create and manage cryptographic keys.
• Uses hardware security modules (HSMs) for key protection.
• Integrates with other AWS services.
• Enables usage policies to control key use by users.

Logging and monitoring

• Logging is collecting and recording activities and events.
• Monitoring continuously verifies security and performance of resources, applications, and data.
• Common log elements include date, time, event origin, and resource identities.

CloudWatch Dashboard

• Surfaces data about your running AWS ecosystem.
• Can be leveraged by existing monitoring tools.
• Displays metrics from multiple AWS services on a single dashboard.

AWS CloudTrail

• The primary AWS logging solution.
• Enables governance, compliance, operational and risk auditing of your AWS account.
• Records actions taken by users, roles, and services.
• Allows viewing, searching, downloading, archiving, analyzing, and responding to account activity across your AWS infrastructure.
• Logs API calls for most AWS services, including AWS Management Console and AWS CLI activity.
• Automatically pushes logs to Amazon S3.
• Does not track events within an Amazon EC2 instance.

Amazon CloudWatch

• A unified monitoring and observability service.
• Provides operational health of AWS resources, applications, services.
• Collects metrics in the AWS cloud and on premises.
• Allows for monitoring and troubleshooting of infrastructure.
• Provides customizability for logs and events.

CloudWatch Monitoring (Diagram)

• Shows how CloudWatch collects metrics, issues alarms, and sends notifications through Amazon SNS.
• Data flows from EC2 instances and the hypervisor to CloudWatch, which uses alarms to notify personnel of relevant issues.

Test your knowledge of AWS Key Management Service (KMS) and data security practices with this informative quiz. It covers key concepts related to protecting data at rest and in transit, as well as logging and monitoring differences. Perfect for those looking to strengthen their understanding of cloud security.