Discuss How to Secure Your Virtual Data Center in the Cloud (NET210-R1) - AWS re:Invent 2018

© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Securing Your Virtual Data Center
in the Cloud
Alan Halachmi
Senior Manager, Solutions Architecture
AWS Worldwide Public Sector
N E T 2 1 0
Becky Weiss
Senior Principal Engineer
AWS Identity

Agenda
Master the fundamentals of AWS security:
• Learn how Identity and Access Management (IAM)
enforces your authorization rules
• Learn how Virtual Private Cloud (VPC) lets you apply the
principle of least privilege to your network connectivity
This is an interactive session: We want to be interrupted!
Ask questions, talk about your workloads.

Our example workload
Application Load
Balancer
Backend EC2 instances
RDS database
Amazon S3
Amazon CloudWatch
Logs

Thank you!
Alan Halachmi & Becky Weiss
AWS

Lock down traffic patterns with security groups
Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
Port 8443 (HTTPS)
Port 3306 (MySQL)
Port 443 (HTTPS)

Lock down traffic patterns with security groups
Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
Port 8443 (HTTPS)
Port 3306 (MySQL)
Port 443 (HTTPS)
Security Group
sg-08eec15c2101526a1
Security Group
sg-0bbef9ea1db9d2ddf
Security Group
sg-0b0a4f8118aa5d450

Controlling traffic into and out of your VPC
Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs

Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
subnet Route table
Internet Gateway
Route for 0.0.0.0/0

Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
subnet Route table
Internet Gateway
subnet Route table
Route for 0.0.0.0/0

Authorizing access to AWS resources from EC2
Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
subnet Route table
subnet Route table
Route for 0.0.0.0/0

Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs
subnet Route table

Application Load
Balancer
RDS database
Amazon S3
Amazon CloudWatch
Logs

The ABCs of IAM
• I: Identity. IAM lets you create Principals in your AWS account who can
make authenticated requests to AWS
• AM: Access Management. IAM is your tool for defining who has
permissions to do what to which resources in IAM.
• IAM is the AWS-wide permissions control system. So you need to
know it.
IAM

I is for Identity: Humans  IAM Users
IAM
IAM user
long-term
security
credential
IAM user
long-term
security
credential
Human user
Human user

I is for Identity: Humans with external identities 
IAM roles
Corporate
identities
(analysts)
IAM Role:
Developers
Corporate
identities
(developers)
IAM Role:
Analysts
IAM
Corporate
Identification
Provider

AM is for Authorization IAM

I is for Identity: Robots  IAM roles
IAM
EC2 instance
Lambda
function
IAM Role
IAM Role

Where does IAM Policy matter?
Everywhere in AWS.
For an authenticated call to succeed:
• The request must have a valid signature for an IAM principal
• IAM policy must specifically authorize the call

IAM Administrator Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
IAM
In English: Whoever has this
policy can do everything*

Writing granular IAM Policies
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [ "s3:GetObject" ],
"Resource": "arn:aws:s3:::my-example-workload-bucket/config.txt"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": [
"arn:aws:logs:us-east-2:111122223333:log-group:MyLogGroup",
"arn:aws:logs:us-east-2:111122223333:log-group:MyLogGroup:*"
]
}
]
}
IAM
In English: Allowed to read
one particular object from
Amazon S3 and write to
one particular CloudWatch
Logs Group

Identity-based policies

Resource-based policies

Application Load
Balancer
RDS database
Amazon S3
subnet Route table

Role policy
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::my-example-workload-bucket/*“
}
]
}
IAM
and write objects to a
specific S3 bucket

Step 1 Result
Corporate OfficeSecure VPC
Some Other VPC

VPC endpoint policy
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::my-example-workload-bucket/*",
"Principal": "*"
}
]
}
IAM
and write objects to a
specific S3 bucket through
this VPC Endpoint

Step 2 Result
Some Other VPC

S3 bucket policy
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": “Deny",
"Resource": "arn:aws:s3:::my-example-workload-bucket/*",
"Condition": {
“StringNotEquals": {
"aws:SourceVpce": "vpce-0123456789abcdefg"
}
},
"Principal": "*"
}
]
}
IAM
In English: Deny read and
write for the specific
bucket, unless the specific
VPC Endpoint is used

Step 3 Result
Some Other VPC

Permissions policies

Permissions boundary

Some final, and interesting uses of IAM

Example: SSH access to EC2 instances
• VPC security controls used:
• Security groups
• Routing for least privilege
Availability Zone
EC2 instances
SSH bastion instance
Port 22 (SSH)
Port 22 (SSH)
$ echo "hello world"

Example: IAM-controlled SSH access to EC2 instances
• Makes use of SSM
Session Manager
• IAM controls used:
• Permissions for users to
SSH to specific instances or
groups
• VPC security controls
used:
• Security groups
• VPC endpoints to SSMAvailability Zone
EC2 instances
Amazon EC2
Systems Manager
$ echo "hello world"

Example: Securing serverless workloads
Amazon API
Gateway
Lambda functions
Amazon
DynamoDB
Amazon DynamoDB
Accelerator
Serverless workload with in-VPC
components
IAM controls used:
Least-privilege access on IAM Roles for
Lambda function and DAX cluster
Lambda functions allow invocation by API
Gateway
VPC endpoint Policies for DynamoDB
VPC security controls used:
Security groups
VPC endpoint for DAXDynamoDB
Port 8111

Discuss How to Secure Your Virtual Data Center in the Cloud (NET210-R1) - AWS re:Invent 2018

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Discuss How to Secure Your Virtual Data Center in the Cloud (NET210-R1) - AWS re:Invent 2018

Similar to Discuss How to Secure Your Virtual Data Center in the Cloud (NET210-R1) - AWS re:Invent 2018 (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Discuss How to Secure Your Virtual Data Center in the Cloud (NET210-R1) - AWS re:Invent 2018