AWS Security Best Practices

Identity & Access Management (IAM)

• IAM roles are preferable
• Apply least privilege by only giving necessary permissions
• Multi-Factor Authentication (MFA) should be enabled
• Access keys need to be rotated regularly
• To access IAM Roles/Users/Policies: AWS Console -> IAM -> Roles/Users/Policies
• To enable MFA: Users -> Security Credentials

S3 Security

• Public access should be blocked by default
• Bucket policies and IAM should be used for permissions
• Encryption should be enabled (SSE-S3, SSE-KMS)
• Monitor with CloudTrail and AWS Config
• Configure and setup Block Public Access through: AWS Console -> S3 -> Select bucket -> Permissions
• Encryption is enabled under Properties

EC2 Basics

• Security Groups should be used to restrict port access
• Public IPs should not be assigned to instances
• IAM roles should be attached to EC2 for service access
• The CloudWatch Agent should be enabled for monitoring
• Security Groups are configured under Networking: AWS Console -> EC2 -> Instances
• Public IPs should not be enabled in Launch Wizard
• IAM roles can be attached: Actions -> Security -> Modify IAM Role

VPC & Network

• Public subnets should be connected to an Internet Gateway
• Private subnets should have no direct internet access
• Security Groups (stateful) and NACLS (stateless) should be used
• VPC Flow Logs should be enabled
• Subnets, Internet Gateways and Route Tables are checked via the VPC Dashboard: AWS Console -> VPC Dashboard
• Security Groups and NACLs should be configured
• VPC Flow Logs are enabled: Your VPC -> Flow Logs

Logs & Monitoring

• CloudTrail should be enabled in all regions
• CloudWatch Logs should be used for application logging
• CloudWatch Alarms should be set up for alerts
• To create CloudTrail: Search -> CloudTrail -> Create trail -> Enable in all regions
• CloudWatch Logs can be accessed: CloudWatch -> Logs
• Alarms are configured: CloudWatch -> Alarms

Encryption & Secrets

• AWS KMS should be used for encryption
• S3, EBS, RDS, and logs should be encrypted
• Secrets should be stored in Secrets Manager or SSM Parameter Store
• Manage encryption keys with KMS
• Secrets can be configured via Secrets Manager or SSM Parameter Store

Security Tools

• Security Hub provides a security findings dashboard
• GuardDuty is for threat detection
• AWS Config is for configuration tracking
• Inspector is for EC2 vulnerability scanning
• Use Security Hub, GuardDuty, Inspector, and AWS Config for security services

Quick Wins

• Public access to S3 buckets should be blocked
• Security groups should be tightened by limiting ports

IAM Policy Example

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

Essential AWS Services

• Essential services include: IAM, S3, EC2, VPC, CloudTrail, CloudWatch, GuardDuty, AWS Config