Securing AWS Account
What are some best practices for securing an AWS account?
- Enable Multi-Factor Authentication (MFA): Add an extra layer of security for root and IAM users.
- Use Strong Password Policies: Enforce complexity and rotation for IAM users.
- Least Privilege Principle: Grant only the permissions required for a task.
- Regularly Review IAM Policies: Audit permissions and remove unused accounts or keys.
- Monitor Account Activity: Enable AWS CloudTrail for logging and AWS Config for compliance checks.
- Enable GuardDuty: For continuous threat detection and anomaly monitoring.
- Use Organizations and Service Control Policies (SCPs): For centralized account governance.
What is AWS IAM Access Analyzer and how can it help in securing an AWS account?
IAM Access Analyzer helps identify resources (like S3 buckets, IAM roles, KMS keys) that are shared externally. It analyzes resource policies and generates findings so you can:
- Detect unintended public access.
- Validate compliance with security standards.
- Reduce risk of data exposure.
Securing Load Balancers
What are some security considerations for AWS Elastic Load Balancers (ELBs)?
- Use Security Groups: Restrict inbound traffic to only required ports (e.g., 80/443).
- Enable SSL/TLS: Encrypt traffic between clients and the load balancer.
- Access Logs: Enable logging to S3 for auditing and troubleshooting.
- Protect with WAF: Mitigate common web attacks like SQL injection and XSS.
- Restrict IP Access: Use NACLs or WAF rules for IP whitelisting/blacklisting.
How can you restrict access to an AWS Application Load Balancer (ALB) based on IP address?
- Configure Security Groups to allow only specific IP ranges.
- Use Network ACLs for subnet-level filtering.
- Apply AWS WAF IP match conditions for granular control.
What is the purpose of SSL termination on a load balancer?
SSL termination offloads the decryption process from backend servers to the load balancer, improving performance and reducing CPU load on application servers.
What are some best practices for securing applications hosted on AWS?
- Regularly patch OS and application software.
- Implement AWS WAF for web attack protection.
- Use Security Groups and NACLs for network isolation.
- Enable CloudWatch Logs and GuardDuty for monitoring.
- Encrypt data in transit (TLS) and at rest (KMS).
AWS WAF and Web ACL
What is AWS WAF and how does it help in securing web applications?
AWS WAF is a web application firewall that protects against common exploits like SQL injection and XSS. It allows you to:
- Filter HTTP/HTTPS traffic.
- Block malicious requests.
- Integrate with ALB, API Gateway, and CloudFront.
What is a Web ACL in AWS WAF?
A Web ACL is a collection of rules that define conditions for allowing, blocking, or counting requests. It can include IP match, string match, and managed rule sets.
What is the benefit of using AWS Managed Rules with AWS WAF?
AWS Managed Rules provide pre-built protections against common threats, reducing the need for manual rule creation and ensuring up-to-date security.
AWS Shield
What is AWS Shield and how does it help protect against DDoS attacks?
AWS Shield is a managed DDoS protection service:
- Shield Standard: Automatic protection against common network and transport layer attacks.
- Shield Advanced: Enhanced protection with 24/7 DDoS Response Team and cost protection.
How does AWS Shield protect against network and transport layer DDoS attacks?
It uses:
- Always-on traffic monitoring.
- Real-time anomaly detection.
- Automated mitigation techniques.
Difference between Shield Standard and Shield Advanced:
- Standard: Free, basic protection.
- Advanced: Paid, includes advanced detection, response team, and SLA guarantees.
Amazon CloudFront
How can you use Amazon CloudFront to enhance security?
- Distribute content securely via HTTPS.
- Enable Geo-restriction to block regions.
- Integrate with AWS WAF for attack mitigation.
- Use Origin Access Identity (OAI) for private S3 content.
What is Origin Access Identity (OAI)?
A virtual identity that allows CloudFront to access private S3 buckets without exposing them publicly.
How to prevent hotlinking of content?
Configure CloudFront to validate the Referer header and serve content only to approved domains.
Purpose of signed URLs and cookies:
Control access to premium or time-sensitive content by requiring signed requests.
AWS KMS and Data Encryption
What is AWS KMS and its purpose?
AWS Key Management Service (KMS) is a managed service for creating and controlling encryption keys used to protect data across AWS services.
How does AWS KMS secure data at rest in S3 and EBS?
KMS provides encryption keys that services use to encrypt data before storing it, ensuring confidentiality.
What is a Customer Master Key (CMK)?
A logical representation of a master key in KMS used for encryption and decryption operations.
What is envelope encryption and how does AWS KMS use it?
Envelope encryption uses a data key to encrypt data, and then encrypts the data key with a CMK. This improves performance and security.
Difference between AWS managed keys and customer managed keys:
- AWS Managed Keys: Created and managed by AWS for services.
- Customer Managed Keys: Created and controlled by you for custom use cases.
How to rotate a CMK?
Enable automatic rotation or manually create a new CMK and update applications to use it.
What are AWS KMS grants?
Grants allow temporary or delegated permissions for other AWS identities or services to use your CMK.
How does AWS KMS integrate with AWS services?
Services like S3, EBS, and RDS call KMS APIs to encrypt/decrypt data using CMKs.
What is AWS CloudHSM?
A hardware security module for secure key storage and cryptographic operations, useful for compliance-heavy workloads.
How to encrypt data in Amazon RDS?
Enable encryption at rest during instance creation or modify an existing instance. RDS uses KMS keys for encryption.
What is AWS SSM Parameter Store?
A secure storage service for configuration data and secrets, supporting encryption via KMS.
How to handle security incidents in AWS?
- Implement an incident response plan.
- Use CloudTrail and GuardDuty for detection.
- Isolate compromised resources and rotate credentials.
How to secure sensitive information like API keys and passwords?
Use AWS Secrets Manager or SSM Parameter Store for secure storage and retrieval.
No comments:
Post a Comment