Lab: Intro to Security, Identity, and Compliance

Security, identity, and compliance

AWS Artifact

Online portal that give access to AWS security and compliance documentation. You can read documentation about security and how to make your application government compliance.

AWS Certificate Manager

Issues SSL certificates for HTTPS, it is integrated into Route 53. It is completely free.

Amazon cloud directory

Cloud-based directory service, hierarchy of data in multiple dimensions.

Amazon directory service

Fully managed Microsoft active directory service in AWS cloud. Used for controlling users, admins, groups and manage their access to resources.

CloudHSM

Dedicated hardware security module in AWS. Achieve corporate and government compliance, rather than using your own HSM.

Cognito

Sign-in and sign up capability for your applications. Can integrate external OAuth like Google and Facebook provider as well.

IAM (Identity and access management)

Allow you to manage user access to your AWS services and resources in your account.

Users and groups have their own permission whether they are allowed or not to access the resources you specified.

AWS Organizations

Policy based management for multiple AWS accounts.

AWS Inspector

Automated seucrity assessment service. Help identify vulnerability or areas of improvement in your AWS account

Key managmenet service

Create and control encryption keys. Also use hardware security module for protecting your keys

Incorporated into S3, redshift and EBS

AWS Shield

Help protect against DDos.

Automatically into all AWS accounts

Web Application Firewall

Provide additional protection in front of your web applications, such as SQL inejction attacks.

Lab about IAM

Up until now the account we are using to play with the AWS services are our email and password, that is the root user. And most of the time you don't want to login to the root account since it has access to everything, deleting, creating, any instances. Finances, credit card informations, can lock other people out.

To protect your root user: Have a long and complicated password and use MFA

IAM user is better login as when your are interacting with the console because it will just have enough permission to do what it needs to do, those permission are granted by the root user.

The user you create for IAM can have both management console access and programmatic access (meaning they get their respective access key ID and secret access key in order to use them to use the CLI and SDK)

After you create the user you can then attach permission policy to specify what they can and cannot do with our resources.