Security Engineering on AWS, Version 3.2

--- title: Security Engineering on AWS, Version 3.2 tags: Resources, Talk description: Resources to support the Security Engineering on AWS course from AWS Training and Certification --- # Security Engineering on AWS, Version 3.2 ![](https://i.imgur.com/dwKhVi6.jpg) Instructor: Scott Jones Email: scojoe@amazon.com Path to this page: https://bit.ly/tip-sheet-seceng --- Have a look at these resources related to our course. --- ## :books: Essential Resources :::info - AWS Cloud Security: https://aws.amazon.com/security/ - AWS Security Documentation: https://docs.aws.amazon.com/security/ - AWS Security Resources: http://aws.amazon.com/security/security-resources/ - AWS Compliance Programs: https://aws.amazon.com/compliance/programs/ - AWS Security Blog: https://aws.amazon.com/blogs/security/ - AWS Cloud Security Quickstarts: https://aws.amazon.com/quickstart/?solutions-all.filter-tech-category=tech-category%23security-identity-compliance&awsf.filter-content-type=*all&awsf.filter-tech-category=tech-category%23security-identity-compliance - Security-related AWS Workshops: https://workshops.aws/card/security ::: --- ## <img src="https://i.imgur.com/AoghaZ0.png" alt="drawing" width="48"/> Modules 0 & 1: Course Introduction / Security on AWS ### Documents/Articles - Well-Architected Security Pillar: https://wa.aws.amazon.com/wat.pillar.security.en.html - Security Design Principles from the Well-Architected Framework: https://docs.aws.amazon.com/wellarchitected/latest/framework/sec-design.html - AWS Cloud Adoption Framework - Security Perspective: https://aws.amazon.com/professional-services/CAF/ - Introduction to AWS Security: https://d1.awsstatic.com/whitepapers/Security/Intro_to_AWS_Security.pdf?did=wp_card&trk=wp_card - STRIDE (security) - Wikipedia: https://en.wikipedia.org/wiki/STRIDE_(security) - AWS Security Maturity Roadmap: https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit_Route.pdf - 300+ Terrifying Cybercrime & Cybersecurity Statistics [2020 EDITION]: https://www.comparitech.com/vpn/cybersecurity-cyber-crime-statistics-facts-trends/ - AWS Security Vulnerabilities and Configurations: https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilities-perspective/ - AWS Essentials: Top 5 Tests for Penetration Testing AWS: https://rhinosecuritylabs.com/aws/aws-essentials-top-5-tests-penetration-testing-aws/ ### Videos - AWS Foundations: Securing Your AWS Cloud: https://www.aws.training/Details/Video?id=49712https://www.aws.training/Details/Video?id=16491 - MITRE Attack Matrix for Enterprise : https://attack.mitre.org/matrices/enterprise/cloud/aws/ ### Digital Training Courses - AWS Security Fundamentals (2nd Edition): https://www.aws.training/Details/eLearning?id=34259AWS Security Fundamentals (2nd Edition): https://www.aws.training/Details/eLearning?id=34259 --- ## <img src="https://i.imgur.com/VBfKoUL.png" alt="drawing" width="48"/> Module 2: Identifying Entry Points on AWS ### Documents/Articles - IAM Policies and Bucket Policies and ACLs: https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/ - Example Policies for Administering AWS Resources - AWS Identity and Access Management: http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html - AWS IP address ranges: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html ### Videos - Access control confidence: Right access to the right things: https://www.youtube.com/watch?v=XO4CALyzbVM&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=16&t=0s - Dive Deep into IAM Access Analyzer: https://www.youtube.com/watch?v=i5apYXya2m0&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=27&t=0s - Introduction to AWS Security Token Services (STS): https://www.aws.training/Details/Video?id=15877 ### Digital Training Courses - AWS Identity and Access Management - Basics: https://www.aws.training/Details/eLearning?id=54606 - AWS Identity and Access Management - Architecture and Terminology: https://www.aws.training/Details/eLearning?id=55148 - Introduction to Identity AWS Access and Management: https://www.aws.training/Details/eLearning?id=16448 - Deep Dive with Security: AWS Identity and Access Management (IAM): https://www.aws.training/Details/eLearning?id=53780 - Compliance Resources - Amazon Web Services (AWS): https://aws.amazon.com/compliance/resources/ --- ## <img src="https://i.imgur.com/iSLyyCv.png" alt="drawing" width="55"/> Module 3: Security Considerations: Web Application Environments ### Documents/Articles - Amazon Web Services: Overview of Security Processes: https://d0.awsstatic.com/whitepapers/Security/AWS%20Security%20Whitepaper.pdf - AWS Cloud Compliance: http://aws.amazon.com/compliance/ - AWS Security Blog: How to approach threat modeling: https://aws.amazon.com/blogs/security/how-to-approach-threat-modeling/ --- ## <img src="https://i.imgur.com/iSLyyCv.png" alt="drawing" width="55"/> Module 4: Application Security ### Documents/Articles - Securing Amazon EC2 instances: https://aws.amazon.com/answers/security/aws-securing-ec2-instances/ - Security in EC2 Image Builder: https://docs.aws.amazon.com/imagebuilder/latest/userguide/image-builder-security.html ### Videos - Build Security into Your Golden AMI Pipeline: https://www.youtube.com/watch?v=3jCVnSLmaiM&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=15&t=0sekxAq0wMJpslV562SP&index=27&t=0s --- ## <img src="https://i.imgur.com/XEhlxBV.png" alt="drawing" width="58"/> Module 5: Data Security ### Documents/Articles - Securing Data at Rest with Encryption: https://d0.awsstatic.com/whitepapers/aws-securing-data-at-rest-with-encryption.pdf - Applying best practices for securing sensitive data in Amazon RDS: https://aws.amazon.com/blogs/database/applying-best-practices-for-securing-sensitive-data-in-amazon-rds/ - Applying best practices for securing sensitive data in Amazon DynamoDB: https://aws.amazon.com/blogs/database/applying-best-practices-for-securing-sensitive-data-in-amazon-dynamodb/ - Best practices for securing sensitive data in AWS data stores: https://aws.amazon.com/blogs/database/best-practices-for-securing-sensitive-data-in-aws-data-stores/ - How to Prevent Uploads of Unencrypted Objects to Amazon S3: https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/ - Amazon S3 Access Policy Guidelines: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-alternatives-guidelines.html --- ## <img src="https://i.imgur.com/y9i3MzG.png" alt="drawing" width="45"/> Module 6: Securing Network Communications ### Documents/Articles - Security in Amazon VPC: https://docs.aws.amazon.com/vpc/latest/userguide//vpc-ug.pdf#security - VPC Security Capabilities: https://aws.amazon.com/answers/networking/vpc-security-capabilities/ - VPC Traffic Mirroring – Capture & Inspect Network Traffic: https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/ - Making Private Connectivity the New Norm via AWS PrivateLink - AWS Online Tech Talks: https://www.slideshare.net/AmazonWebServices/making-private-connectivity-the-new-norm-via-aws-privatelink-aws-online-tech-talks - How to Configure a Private Network Environment for Amazon DynamoDB Using VPC Endpoints: https://aws.amazon.com/blogs/database/how-to-configure-a-private-network-environment-for-amazon-dynamodb-using-vpc-endpoints/ - What is AWS Network Firewall?: https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html ### Videos - Root CA Hierarchies for AWS Certificate Manager (ACM) Private CA: https://www.youtube.com/watch?v=zXoXavMNimo&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=12&t=2814s ### Digital Training Courses - Introduction to AWS Certificate Manager: https://www.aws.training/Details/eLearning?id=15890 --- ## <img src="https://i.imgur.com/8VDfjY8.png" alt="drawing" width="48"/> Module 7: Monitoring and Collecting Logs on AWS ### Documents/Articles - Example Scenarios for AWS Config Continuous Monitoring of Amazon S3 Bucket Access Controls: https://aws.amazon.com/blogs/mt/example-scenarios-for-aws-config-continuous-monitoring-of-amazon-s3-bucket-access-controls/ - Native AWS Security-Logging Capabilities: https://aws.amazon.com/answers/logging/aws-native-security-logging-capabilities/ - How to Enable Logging on Every AWS Service in Existence (Circa 2021): https://matthewdf10.medium.com/how-to-enable-logging-on-every-aws-service-in-existence-circa-2021-5b9105b87c9 - awslabs/aws-config-rules: https://github.com/awslabs/aws-config-rules - awslabs/aws-config-rdk: https://github.com/awslabs/aws-config-rdk - Centralized Logging on AWS: https://aws.amazon.com/solutions/implementations/centralized-logging ### Videos - Network Visibility into the Traffic Traversing Your AWS Infrastructure: https://www.youtube.com/watch?v=60nFZ3rz3Ec&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=81&t=290s ### Digital Training Courses - Introduction to AWS Certificate Manager: https://www.aws.training/Details/eLearning?id=15890 --- ## <img src="https://i.imgur.com/8VDfjY8.png" alt="drawing" width="48"/> Module 8: Processing Logs on AWS ### Documents/Articles - Analyzing VPC Flow Logs with Amazon Kinesis Firehose, Amazon Athena, and Amazon QuickSight: https://aws.amazon.com/blogs/big-data/analyzing-vpc-flow-logs-with-amazon-kinesis-firehose-amazon-athena-and-amazon-quicksight/ - Trimming AWS WAF logs with Amazon Kinesis Firehose transformations: https://aws.amazon.com/blogs/security/trimming-aws-waf-logs-with-amazon-kinesis-firehose-transformations/ - How do I analyze my Amazon S3 server access logs using Athena?: https://aws.amazon.com/premiumsupport/knowledge-center/analyze-logs-athena/ - Analyze and visualize your VPC network traffic using Amazon Kinesis and Amazon Athena: https://aws.amazon.com/blogs/big-data/analyze-and-visualize-your-vpc-network-traffic-using-amazon-kinesis-and-amazon-athena/ - AWS Labs GitHub repo of custom AWS Config Rules: https://github.com/awslabs/aws-config-rules - AWS Config Rule Developer Kit: https://github.com/awslabs/aws-config-rdk --- ## <img src="https://i.imgur.com/wsDSFk1.png" alt="drawing" width="48"/> Module 9: Security Considerations: Hybrid Environments ### Documents/Articles - Client Authentication and Authorization: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/authentication-authorization.html - Introducing AWS Client VPN to Securely Access AWS and On-Premises Resources: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-client-vpn-to-securely-access-aws-and-on-premises-resources/ - AWS Direct Connect Resiliency Recommendations: https://aws.amazon.com/directconnect/resiliency-recommendation/ ### Videos - Transit Gateway and Transit VPCs: https://www.youtube.com/watch?v=ar6sLmJ45xs&feature=youtu.be --- ## <img src="https://i.imgur.com/puQ7IuJ.png" alt="drawing" width="48"/> Module 10: Out of Region Protection ### Documents/Articles - Secure Content Delivery with Amazon CloudFront: https://d1.awsstatic.com/whitepapers/Security/Secure_content_delivery_with_CloudFront_whitepaper.pdf - AWS Best Practices for DDoS Resiliency: https://d1.awsstatic.com/whitepapers/Security/DDoS_White_Paper.pdf - Use AWS WAF to Mitigate OWASP’s Top 10 Web Application Vulnerabilities: https://d0.awsstatic.com/whitepapers/Security/aws-waf-owasp.pdf ### Videos - A defense-in-depth approach to building web applications: https://www.youtube.com/watch?v=3AJ68A0plfw&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=26&t=0s - DDoS Attack Detection at Scale: https://www.youtube.com/watch?v=2lAcE3NA2UU&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=76&t=0s ### Digital Training Courses - Introduction to AWS Web Application Firewall (WAF): https://www.aws.training/Details/eLearning?id=16024 - Protect Your Web-facing Workloads with AWS Security Services: https://www.aws.training/Details/eLearning?id=27496 --- ## <img src="https://i.imgur.com/ubda82Q.png" alt="drawing" width="55"/> Module 12: Security Considerations in Serverless Environments ### Documents/Articles - Security Overview of AWS Lambda: https://d1.awsstatic.com/whitepapers/Overview-AWS-Lambda-Security.pdf?did=wp_card&trk=wp_card - Introducing custom authorizers in Amazon API Gateway: https://aws.amazon.com/blogs/compute/introducing-custom-authorizers-in-amazon-api-gateway/ ### Videos - Identity and Access Control for Custom Enterprise Applications: https://www.youtube.com/watch?v=VZzx15IEj7Y&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=26&t=2747s ### Digital Training Courses - Introduction to Amazon Cognito: https://www.aws.training/Details/eLearning?id=16501 --- ## <img src="https://i.imgur.com/WxTzNzT.png" alt="drawing" width="48"/> Module 13: Secrets Management on AWS ### What's New - KMS Multi-Region Keys: https://aws.amazon.com/about-aws/whats-new/2021/06/kms-multi-region-keys/ ### Documents/Articles - AWS Key Management Service Best Practices: https://d1.awsstatic.com/whitepapers/aws-kms-best-practices.pdf?did=wp_card&trk=wp_card - Security of AWS CloudHSM Backups: https://d1.awsstatic.com/whitepapers/Security/security-of-aws-cloudhsm-backups.pdf?did=wp_card&trk=wp_card - AWS Key Management Service Cryptographic Details: https://d1.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf?did=wp_card&trk=wp_card ### Videos - Achieving security goals with AWS CloudHSM: https://www.youtube.com/watch?v=Vox-PDRHIUs&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=15&t=0s - Using AWS KMS for data protection, access control, and audit: https://www.youtube.com/watch?v=hxWvbNvj2lg&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=14&t=0s - Encrypting Everything with AWS: https://www.youtube.com/watch?v=oqHLLbOoxDg&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=3&t=2254s - How Encryption Works in AWS: https://www.youtube.com/watch?v=plv7PQZICCM&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=43&t=3252s ### Digital Training Courses - Introduction to AWS Secrets Manager: https://www.aws.training/Details/eLearning?id=19441 --- ## <img src="https://i.imgur.com/t2Biy8E.png" alt="drawing" width="48"/> Module 14: Automating Security on AWS ### Documents/Articles - AWS CloudFormation Best Practices: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html - A curated list of resources and projects for working with AWS CloudFormation: - Sample templates: https://aws.amazon.com/cloudformation/aws-cloudformation-templates/ - Template anatomy, Mappings: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html - To share information between stacks, export a stack’s output values: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.html - Control Tower Service Catalog Templaes - https://github.com/aws-samples/aws-service-catalog-reference-architectures - AWS Security Incident Response Guide: https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf - Automated Response and Remediation with AWS Security Hub: https://aws.amazon.com/blogs/security/automated-response-and-remediation-with-aws-security-hub/ - How to create custom alerts with Amazon Macie: https://aws.amazon.com/blogs/security/how-to-create-custom-alerts-with-amazon-macie/ - Nine AWS Security Hub best practices: https://aws.amazon.com/blogs/security/nine-aws-security-hub-best-practices/ - Automated Forensics Orchestrator for Amazon EC2: https://aws.amazon.com/solutions/implementations/automated-forensics-orchestrator-for-amazon-ec2. ### Videos - Prepare for & respond to security incidents in your AWS environment: https://www.youtube.com/watch?v=8uiO0Z5meCs&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=7&t=6s - Threat management in the cloud: Amazon GuardDuty & AWS Security Hub: https://www.youtube.com/watch?v=vhYsm5gq9jE&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=13&t=0s - AWS Security Hub: Manage Security Alerts & Automate Compliance: https://www.youtube.com/watch?v=HsWtPG_rTak&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=31&t=936s ### Digital Training Courses - Introduction to AWS Security Hub: https://www.aws.training/Details/eLearning?id=27168 - Introduction to Amazon GuardDuty: https://www.aws.training/Details/eLearning?id=16620 - Introduction to AWS Secrets Manager: https://www.aws.training/Details/eLearning?id=19441 --- ## <img src="https://i.imgur.com/YBPzVNP.png" alt="drawing" width="48"/> Module 15: Account Management on AWS ### Documents/Articles - What's the difference between a service control policy and an IAM policy?: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-service-control-policy/?icmpid=support_secblog ### Videos - Managing user permissions at scale with AWS SSO: https://www.youtube.com/watch?v=aEIqeFCcK7E&list=PL2yQDdvlhXf9Ub-ekxAq0wMJpslV562SP&index=19&t=0s - Enforcing Security Invariants with AWS Organizations: https://www.youtube.com/watch?v=W30sx0hpY0Y&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=48&t=661s - Using AWS Control Tower to Govern Multi-Account AWS Environments: https://www.youtube.com/watch?v=2t-VkWt0rKk&list=PLtsUi0RJikGL6GKWwnlldsnE00nN3w88d&index=53&t=21s ### Digital Training Courses - Introduction to Amazon Cloud Directory: https://www.aws.training/Details/eLearning?id=16379

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.