2 Security and Compliance

Security begins with configuration

AWS security depends on controlling identities and resources, protecting data, monitoring for threats, and gathering evidence that controls are working. Using AWS services does not automatically make a workload secure or compliant: customers must configure their services and meet the requirements that apply to their data and business.

Identity and access management

AWS Identity and Access Management (IAM) controls who or what can access AWS resources and which actions they can perform. A principal, such as a user, role, or AWS service, makes a request; IAM evaluates applicable permissions before allowing or denying it.

• Users represent identities with credentials. Groups organize IAM users and can receive policies.

• Roles provide permissions through temporary credentials. People, applications, and AWS services can assume roles when authorized.

• Policies are JSON documents that specify allowed or denied actions and resources, and can include conditions. An explicit deny overrides an allow.

• IAM Identity Center helps centrally manage workforce access to multiple AWS accounts and applications.

Follow least privilege by granting only the permissions needed for a task. Prefer federation and temporary credentials for people, and roles with temporary credentials for workloads, rather than long-lived access keys. Protect the account root user, enable multi-factor authentication (MFA), and avoid using root for routine work.

For example, an application running on an EC2 instance should use an attached IAM role to access a specific S3 bucket, rather than credentials stored in its code.

The shared responsibility model

The shared responsibility model divides security responsibilities between AWS and its customers, but the tasks are not shared equally.

• Security of the cloud: AWS protects the underlying global infrastructure, including data centers, hardware, networking, and the virtualization layer.

• Security in the cloud: Customers protect their data, manage identities and permissions, and configure the services they use.

The customer’s responsibilities depend on the service. With Amazon EC2, customers manage the guest operating system, patches, applications, and instance network access. With a more managed service such as Amazon S3, AWS operates more of the underlying infrastructure, but customers still control their data, permissions, and relevant security settings. Check the responsibilities for the particular service and workload.

Protecting data and secrets

Protect data throughout its lifecycle: identify and classify it, limit who can access it, and use encryption where appropriate.

Encryption at rest protects stored data. AWS Key Management Service (AWS KMS) lets customers create and control cryptographic keys and integrates with many AWS services for encryption. Access to keys must be controlled, because a user or service generally needs appropriate permissions to use them.

Encryption in transit protects data as it moves between clients and services. TLS is commonly used for secure connections, and AWS Certificate Manager (ACM) helps provision and manage TLS certificates for supported AWS services.

AWS Secrets Manager stores and manages secrets such as database credentials, so applications can retrieve them without embedding passwords in source code. Amazon Macie can help discover and protect sensitive data stored in Amazon S3.

Encryption is one safeguard; it does not replace access control, careful configuration, or sound data-handling practices.

Compliance and evidence

Compliance involves meeting applicable laws, regulations, contracts, and organizational requirements. AWS operates compliance programs and makes supporting information available, but customers remain responsible for determining and meeting the requirements that apply to their workloads. An AWS certification or attestation does not, by itself, certify a customer’s application or business.

AWS Artifact provides access to AWS security and compliance documents, such as audit reports and certifications. These documents can help customers assess AWS controls and support their own compliance work. Customers must still configure their environments appropriately and maintain their own evidence and processes.

Monitoring and security services

AWS security services support monitoring and security management, but they have different roles and do not automatically fix every issue or replace customer review and response.

• AWS CloudTrail records account activity and API calls, helping answer who did what, when, and from where.

• AWS Config records resource configurations and changes and can evaluate resources against rules.

• Amazon GuardDuty detects potential threats by analyzing supported AWS data sources and activity.

• Amazon Inspector identifies software vulnerabilities and certain unintended network exposures in supported workloads.

• AWS Security Hub provides a centralized view of security findings and security posture across supported AWS accounts and services.

• AWS WAF helps protect web applications by inspecting and filtering HTTP(S) requests.

• AWS Shield helps protect supported resources against distributed denial-of-service (DDoS) attacks.

• Security groups and network ACLs control network traffic. Security groups are associated with resources such as EC2 instances; network ACLs apply at the subnet level.

CloudTrail records activity, GuardDuty detects suspicious activity, and Security Hub helps bring findings together. These services support security operations, while customers remain responsible for reviewing and responding to issues.

Putting the controls together

Secure AWS use combines least-privilege access, MFA, and temporary credentials where possible with protection of data and careful service configuration. AWS protects the underlying cloud infrastructure; customers protect their data and configure the services they use. Encryption, careful secret handling, and compliance evidence contribute to protecting and governing workloads, while services such as CloudTrail, Config, GuardDuty, and Security Hub support monitoring and security management.