Hi guys and welcome to the exam cram for security in the cloud.
Let's start with managed Microsoft AD. This is a fully managed AWS service.
It's the best choice if you have more than 500
users and or you need a trust relationship set up,
you can perform schema extensions.
You can set up trust relationships as well with on-premises
active directories on premise users and groups
can access resources in either domain using SSO
once you have that trust relationship, it does require a VPN or DX connection.
Managed Microsoft Ad can be used as a stand-alone active directory in the
AWS cloud AD connector redirects directory requests to your on premises AD.
It's the best choice when you want to use an existing active directory with AWS
services AD connector comes in two sizes small for organization
up to 500 users and large for up to 5000 users. Also requires a VPN or DX connection.
You can join EC2 instances to your on premises a
through a connector and you can log into the
management console using your on premises active directory,
domain controllers for authentication.
Simple AD is an inexpensive AD compatible service with common directory features.
It's a stand alone fully managed directory on the AWS cloud.
It's generally the least expensive option.
The best choice for less than 500 users if you don't need
those advanced ad features. Features include managing user accounts and groups,
applying group policies
kerberos
based SSO also supports joining Linux oWindows-baseded EC2 instances
for identity providers and federation with an IDP
you can manage user identities outside of
AWS and give these identities permissions to use resources in your account.
For example,
your organization already has its own identity
system such as a corporate user directory.
You're creating a mobile app or web application that requires access to
AWS resources with an IAM identity provider
There's no need to create custom signing code or manage your own identities. The IDP
will do that for you.
External users sign in for a well known IDP such as login with Facebook,
Amazon or Google,
I AM supports IDPs that are compatible with open ID connect as well O
IC or SMl 2.0.
IAM Identity center used to be called
AWS SSO. And it's basically the same thing.
You can essentially manage access to multiple
AWS accounts and business applications
and you can easily manage SSO access and user permissions to all your accounts
in organizations centrally,
IAM Identity Center also includes built in integrations to
many business applications like Salesforce, Box and office 365.
You can create and manage user identities in IAM Identity Center as
well or you can connect to existing identity stores such as Ad or
Azure with Amazon Cognito
You can add user sign up and sign in and access control to your web and mobile apps.
A user
pool is a directory for managing sign in
and sign up and users can be stored in a user pool or can sign in using social IDPs.
It supports SAML and OIDC
compatible IDPs.
Cognito acts as an identity broker between the IDP and
AWS.
Identity pools are used to obtain temporary limited privilege credentials for
AWS
services using the STS service.
And IAM role is assumed providing access to those services.
Next up, we've got KMS fully manage
service that enables you to create and manage cryptographic keys.
You can control your key usage across services and in applications.
It allows you to centrally manage and securely store your
KMS keys and it supports symmetric and asymmetric encryption.
KMS keys are the primary resources in KMS.
They used to be known as customer master keys or CMKs.
So you might see that terminology,
the KMS keys contain the key material used to encrypt and decrypt data.
KMS keys are created in
AWS KMS symmetric KMS keys and the private
keys of asymmetric KMS keys will never leave
AWS KMS unencrypted by default KMS creates the key material for KMS
key. You can also import your own key material KSS
keys can only encrypt data up to four kilobytes in size.
But KMS keys can generate encrypt and decrypt data encryption keys, data
encryption keys can then be used for encrypting
large quantities of data. Now
AWS managed KMS keys are created managed and used on
your behalf by a service that is integrated with KMS.
You can't manage these keys, you can't rotate them or change their key policies.
You also cannot use AWS
managed KMS keys, encrypt graphic operations directly.
The service uses them on your behalf,
data keys or encryption keys that you can use to encrypt data,
including large amounts of data
and other data encryption keys.
You can use KMS keys to generate encrypt and decrypt your data keys.
KMS doesn't store manage or track your data keys or perform the operations with
those data keys you must use and manage the data keys outside of KMS.
So here's a table showing you the
differences between the customer managed KMS keys,
AWS
managed KMS keys and
AWS own keys which you don't really see at all.
So the top two are the ones that you really want to concentrate on
and understand the automatic rotation
in here.
Next up, we've got cloudhsm which is a cloud based hardware security module here
You can generate and use your own encryption keys on the
AWS cloud. It runs in your VPC
uses FIPS 140-2 level three validated HSMs.
It's a managed service and automatically scales here
You retain control over your encryption keys
and you control access with no visibility for
AWS.
Use cases are to offload
SSL/TLS
processing from web servers, protect private keys from issuing CA
store the master key for oracle DB transparent data encryption
and a custom key store for KMS.
So you can retain control of the HSM that protects the master keys.
And here's a table to help you understand the differences between HSM and KMS. So
slightly different security here.
And of course, the control with cloud HSM is higher and it's a single tenant HSM.
Next, we've got
AWS certificate manager.
This is a service for creating storing and renewing
SSL/TLS X 509 certificates that supports single domains,
multiple domain names and wild cards and
integrates with several services like elbs,
cloudfront, Elastic beanstalk, Nitro enclaves and AWS
cloud formation. Public certificates are signed by the AWS public CA.
You can also create a private CA
with ACM, then you can issue private certificates.
You can also import certificates from third party issuers as well.
Next up, we've got the AWS web application firewall.
This service lets you create rules to filter web
traffic based on conditions such as IP addresses,
http headers and body or custom URIs.
It makes it easy to create rules that block common
web exploits like sequel injection and cross site scripting.
You have web ACLS, these are used to protect a set of resources and then rules.
These are the rules that define the inspection criteria and actions to take if
a web request meets your defined criteria and then you have rule groups.
So you can use rules individually or in reusable rule groups.
An IP set provides a collection of IP addresses
and IP address ranges that you want to use together
in a rule statement.
You also have a regeX pattern set which provides
a collection of regular expressions you want to use together
in a rule statement. A rule action tells WAS what to do with a web request
When it matches the criteria defined in the rule, you might want to count,
you might want to allow or you might want to block the request.
A match statement compares the web request or its origin
against conditions that you provide. And here's a few examples.
We've got geographic, we've got IP sets regex size constraints,
sequel injection attacks, string, match and cross site scripting attacks.
So these are various different ways of identifying
traffic that could be malicious in nature.
We then have AWS
shield. This is a managed distributed denial of service protection service.
It safeguards web applications running on AWS with
always on detection and automatic in line mitigations.
It helps to minimize application downtime and latency.
There are two tiers,
the standard which is no cost at all and then advance
which comes for a monthly fee and a one year commitment.
The standard is integrated with cloudfront by default.