AWS Security Responsibilities Quiz

AWS Global Infrastructure

• AWS infrastructure is globally deployed
• The infrastructure is structured around AWS regions
• Each region contains multiple availability zones (AZs)
• Data centers are situated within these AZs
• A global infrastructure architecture enhances latency (speed of action and response)
• Each region is separated from the others.
• Instances and data can be dispersed across multiple regions and AZs.
• AWS Availability Zones (AZs) are physically distinct.
• AZs are located in low-risk flood plains.
• Pricing and Service Level Agreements (SLAs) differ across regions.

AWS Global Infrastructure - Availability Zones (AZs)

• AZs are independent in network and power sources, enabling fault tolerance.
• Each region is formed by two or more AZs.
• Various AZs connect to a single region.

AWS Global Infrastructure - Content Delivery Network (CDN)

• Data is distributed geographically near consumers for quick access
• Hosting servers and network nodes are strategically positioned for optimal performance, based on the geographical locations of end-users.
• Content Delivery Network (CDN) improves the speed at which content loads for users geographically closer to the server.

AWS CloudFront

• CloudFront is a global content delivery network (CDN).
• It identifies user location, routes data requests to the nearest cached location.
• Content and resource delivery depends on the customer's location, the source of the content, and the content delivery server.
• It integrates with many AWS services for seamless performance and security.
• CloudFront utilizes edge locations globally to store resources and improve retrieval speed by end-users.
• Edge locations and caching mechanisms boost website/application loading speeds for end-users.

AWS Well-Architected Framework: Security

• Security framework includes pillars like operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Security Pillar Design Principles

• Implementing a robust identity foundation
• Ensuring traceability of actions and requests
• Applying security measures throughout all levels of the system
• Automating security best practices
• Protecting data while in transit and at rest
• Maintaining safe access for authorized personnel

The Shared Responsibility Model & Security

• Cloud Service Providers (CSPs) are responsible for security within the cloud, specifically the data center, data isolation between businesses, and network security within the data center.
• Customers maintain responsibility for security aspects, including direct user access to data, and data backup/restoration, within the cloud.

AWS Security & Compliance

• AWS employs a shared responsibility model, managing cloud security while customers handle data security in the cloud.
• AWS provides security-specific tools across network security, configuration, access control, and data encryption.
• AWS environments are consistently audited.
• Certification data comes from accreditation bodies.

AWS Shared Responsibility Model

• Different elements between Customer and AWS responsibility.
• Customer's responsibility in managing customer data, applications, platform resources, and configurations.
• AWS's responsibility in providing infrastructure hardware/software, regions, availability zones, and edge locations, along with other key functionality to support the customer's usage.

Cloud Service Models

• Different models for managing various aspects of IT infrastructure
• Traditional IT: Customers manage everything from applications to the physical servers and networks
• Infrastructure as a Service (IaaS): Customers handle applications, data, and runtime environment. AWS manages the infrastructure
• Platform as a Service (PaaS): Customers manage applications, data, runtime, and middleware. AWS manages the infrastructure and operating system
• Software as a Service (SaaS): Customers manage applications data runtime in a software operating in the cloud. AWS handles all the infrastructure and other layers.

AWS Responsibilities: Security of the cloud

• Physical security of data centers
• Managing access control to the data center
• Managing and configuring operating systems
• Handling hardware, software, and storage infrastructures
• Auditing and decommissioning infrastructure components
• Maintaining internal network infrastructure
• Managing virtual infrastructure and instance isolation

Customer Responsibilities: Security in the cloud

• Managing customer data and applications
• Implementing firewall configurations and security groups
• Managing operating systems
• Implementing security infrastructure, such as firewalls
• Handling server-side encryption
• Using the provided security configuration tools provided by AWS

Service Characteristics and Security Responsibility

• Various AWS services are categorized into groups that customers manage, and those that AWS manages.

Access Management

• Authentication verifies users' identities. Different authentication methods include usernames, passwords, multi-factor authentication (MFA).
• Authorization determines the level of access an authenticated user/entity has to resources. Common methods include attribute-based access control (ABAC) and role-based access control (RBAC).
• The Principle of Least Privilege principle dictates that users should only have the permissions necessary for their specific tasks.

AWS CloudWatch Monitoring

• Monitors resources' state and usage
• Provides tools to collect system-level metrics from Amazon EC2 instances and on-premises servers,
• Allows real-time monitoring
• Customizable logging and event viewing
• Includes alarms that notify users about issues
• AWS CloudWatch dashboards provide a unified view of operational health
• Enables leveraging of existing monitoring tools

AWS Identity and Access Management (IAM)

• IAM helps in securely managing and controlling access to various AWS resources by individuals and groups.
• Supports integrations with other AWS services.
• Supports federated identity management for flexible access control.
• Supports granular permissions for fine-grained access control.
• Supports multi-factor authentication (MFA) for extra security
• Provides identity information for audits.

Data Security

• Data at rest protection includes secure key management, enforcing encryption, enforcing access controls, and using audit mechanisms to monitor encryption and access activity to data.
• Data in transit protection includes implementing secure key management, enforcing data encryption, authenticating network communications, preventing unintended data access, and securing data transfer between VPC and on-premises locations.

AWS Key Management Service (AWS KMS)

• AWS KMS allows users to create and manage cryptographic keys.
• It leverages hardware security modules (HSMs) for key protection.
• KMS integrates with other AWS services for seamless usage.
• It enables policies to govern access by different users to specific keys.

Logging and Monitoring

• Logging (in AWS) is the process of recording and gathering operational data about activities and events within an AWS system.
• Data is collected based on the specific service used.
• Logs include date, time, events' origin, and the identities of the resources accessed.
• Monitoring involves continuously verifying the security and performance of resources, applications, and data within AWS.
• AWS provides services for monitoring and identifying issues before they affect operations.

CloudWatch Dashboard

• AWS CloudWatch dashboards visualize data about running AWS systems
• These dashboards can be utilized by existing monitoring tools.

AWS CloudTrail

• AWS CloudTrail logs and tracks account activity, API calls, and AWS Management Console/CLI actions.
• CloudTrail records events from various AWS services and pushes log data to Amazon S3.
• CloudTrail is vital for auditing, security, identifying errors, and resolving issues with access and operation related events.

Amazon CloudWatch

• A unified monitoring and observability service for AWS resources, applications, and services.
• Aggregates data from multiple AWS services.
• Collects metrics from AWS Cloud and on-premises resources.
• Allows for customizing logs and events.

CloudWatch Monitoring

• CloudWatch collects metrics and data from various sources, such as EC2, third-party tools.
• These metrics are combined with alarm and alert thresholds to ensure system stability and quick identification of issues.

Test your knowledge of AWS's roles and responsibilities regarding security in the cloud. This quiz covers the AWS Shared Responsibility Model, instance isolation, and various security measures that both AWS and customers must undertake. Challenge yourself with questions about AWS Key Management Service and data protection strategies.