HSBC and AWS Day - Security Identity and Access Management

1
06 July 2017
Michael Braendle, AWS Professional Services Hong
Kong, Taiwan and Macau
Security, Identity, and Access
Management
HSBC Training Day

2
AWS Shared Responsibility Model
AWS Founda+on Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Loca?ons
Client-side Data
Encryp+on
Server-side Data
Encryp+on
Network Traﬃc
Protec+on
PlaDorm, Applica+ons, Iden+ty, and Access Management
Opera+ng System, Network, and Firewall Conﬁgura+on
Customer Applica+ons & Content Customers
Customers are
responsible for
security IN the cloud
AWS is responsible
for the security OF
the cloud
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

3
Physical Security
•  24/7 trained security staff
•  AWS data centers in nondescript and
undisclosed facilities
•  Two-factor authentication for
authorized staff
•  Authorization for data center access

4
Hardware, Software, and Network
•  Automated change-control
process
•  Bastion servers that record all
access attempts
•  Firewall and other boundary
devices
•  AWS monitoring tools

5
Certifications and Accreditations
ISO 9001, ISO 27001, ISO 27017, ISO 27018, IRAP (Australia), MLPS Level 3 (China),
MTCS Tier 3 Certification (Singapore) and more …

6
SSL Endpoints
VPC
Secure Transmission
Use secure endpoints
to establish secure
communication
sessions (HTTPS).
Instance Firewalls
Use security groups
to configure firewall
rules for instances.
SSL Endpoints Security Groups
Network Control
Use public and
private subnets,
NAT, and VPN
support in your
virtual private cloud
to create low-level
networking
constraints for
resource access.
SSL Endpoints

7
Security Groups
SSL Endpoints Security Groups
Instance Firewalls
Use security groups
VPC
Secure Transmission
to establish secure
communication
sessions (HTTPS).
Network Control
Use public and
private subnets,
NAT, and VPN
support in your
to create low-level
networking
constraints for
resource access.

8
AWS Multi-Tier Security Groups
www server
www server
www server
app server
app server
app server
Database Tier
security group
Application Tier
security group
Web Tier
security group
db server
db server
db server
Internet
Corporate
Admin Network
ssh/rdp
api api
(all other ports are blocked)

9
Amazon Virtual Private Cloud (VPC)
VPCSSL Endpoints Security Groups
Network Control
Use public and
private subnets,
NAT, and VPN
support in your
to create low-level
networking
constraints for
resource access.
Instance Firewalls
Use security groups
Secure Transmission
to establish secure
communication
sessions (HTTPS).

10
AWS Identity and Access Management (IAM)
AWS IAM
3
Manage federated users
and their permissions
2
Manage AWS IAM roles
and their permissions
1
Manage AWS IAM users
and their access

11
AWS IAM Authentication
•  Authentication
•  AWS Management Console
•  User Name and Password
IAM User

12
AWS IAM Authentication
•  Authentication
•  AWS CLI or SDK API
•  Access Key and Secret Key
Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Java
Python
.NET
AWS SDK & APIAWS CLI
IAM User

13
AWS IAM User Management - Groups
User D
DevOps Group
User C
AWS Account
TestDev Group
User B
User A

14
AWS IAM Authorization
Authorization
•  Policies:
•  Are JSON documents to describe
permissions.
•  Are assigned to users, groups or
roles.
IAM User
IAM Group
IAM Roles

15
AWS IAM Policy Elements
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1453690971587",
"Action": [
"ec2:Describe*",
"ec2:StartInstances",
"ec2:StopInstances”
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "54.64.34.65/32”
}
}
},
{
"Sid": "Stmt1453690998327",
"Action": [
"s3:GetObject*”
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::example_bucket/*”
}
]
}
IAM Policy

16
AWS IAM Policy Assignment
IAM User
IAM Group
Assigned
Assigned
IAM Policy

17
IAM User
IAM Group
IAM Roles
Assigned
Assigned
Assigned
IAM Policy

18
AWS IAM Roles
•  An IAM role uses a policy.
•  An IAM role has no associated credentials.
•  IAM users, applications, and services may assume IAM
roles.
IAM Roles

19
IAM User
IAM Group
IAM Roles
Assigned
Assigned
Assigned
IAM Policy
IAM User
Assumed
Assumed
AWS Resources

20
Example: Application Access to AWS
Resources
•  Python application hosted on an Amazon EC2 Instance
needs to interact with Amazon S3.
•  AWS credentials are required:
•  Option 1: Store AWS Credentials on the Amazon EC2 instance.
•  Option 2: Securely distribute AWS credentials to AWS Services
and Applications.
IAM Roles

21
AWS IAM Roles - Instance Profiles
Amazon EC2
App &
EC2 MetaData Service
http://169.254.169.254/latest/meta-data/iam/security-credentials/rolename
Amazon S3
1
2
3
4
Create Instance
SelectIAMRole
ApplicationinteractswithS3

22
AWS IAM Roles – Assume Role
IAM Restricted Policy
IAM User A-1
AWS Account A
IAM Admin Role
IAM Admin Policy
Assigned
Assume
Assigned
1
2
IAM User B-1
AWS Account B
Amazon S3
Assume
4
Access
53
Access
1

23
Temporary Security Credentials (AWS STS)
Use Cases
•  Cross account access
•  Federation
•  Mobile Users
•  Key rotation for Amazon EC2-based apps
Session
Access Key ID
Secret Access Key
Session Token
Expiration
Temporary Security Credentials
15 minutes to 36 hours

24
Application Authentication
AWS IAM
Application
No Support
No Support
OS

25
AWS IAM Authentication and Authorization
Authentication
•  AWS Management Console
•  User Name and Password
•  AWS CLI or SDK API
•  Access Key and Secret Key
Authorization
•  Policies
IAM User
IAM Group
IAM Roles

26
AWS IAM Best Practices
•  Delete AWS account (root) access keys.
•  Create individual IAM users.
•  Use groups to assign permissions to IAM users.
•  Grant least privilege.
•  Configure a strong password policy.
•  Enable MFA for privileged users.

27
AWS IAM Best Practices (cont.)
•  Use roles for applications that run on Amazon EC2
instances.
•  Delegate by using roles instead of by sharing
credentials.
•  Rotate credentials regularly.
•  Remove unnecessary users and credentials.
•  Use policy conditions for extra security.
•  Monitor activity in your AWS account.

28
AWS CloudTrail
•  Records AWS API calls for accounts.
•  Delivers log files with information to an Amazon S3
bucket.
•  Makes calls using the AWS Management Console, AWS
SDKs, AWS CLI and higher-level AWS services.
AWS CloudTrail
Amazon S3 Bucket
Logs

29
Knowledge Check
Q: Your web application needs to read/write an Amazon DynamoDB
table and an Amazon S3 bucket. This operation requires AWS
credentials and authorization to use AWS services. What IAM entity
should be used?
User
Group
Role
Policy

HSBC and AWS Day - Security Identity and Access Management

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to HSBC and AWS Day - Security Identity and Access Management

Similar to HSBC and AWS Day - Security Identity and Access Management (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Recently uploaded

Recently uploaded (20)

HSBC and AWS Day - Security Identity and Access Management