Introduction to AWS: Security in The Cloud
Tags: aws, cloud, beginners
Published: 2021-07-15 00:00:00

---
title: "Introduction to AWS: Security in The Cloud"
date: "2021-07-15"
categories: 
  - "aws"
tags:
  - "aws"
  - "cloud"
  - "beginners"
series: [Introduction to AWS]
---

### “If you spend more on coffee than on IT security, you will be hacked. What’s more, you deserve to be hacked” ― Richard Clarke

![cupofcode_blog_main_picture](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_main-768x432.png)

Welcome back! This is the third blog post in the series and you might be feeling a bit unmotivated. I get it, every blog post is long and we still have more to go.

Because I was sick of studying as well, I tried taking a practice test and completely failed the security part! So we are back here. It’s tricky to remember what does what, but do not worry — I’ll emphasize the differences between them!

#### What will we talk about today?

1. Compliance in AWS & AWS Artifact
2. The Shared Responsibility Model
3. AWS WAF & AWS Shield
4. AWS Inspector & AWS Trusted Advisor
5. AWS CloudTrail & AWS Config
6. Penetration Testing in AWS
7. AWS KMS and AWS CloudHSM
8. AWS Secrets Manager vs AWS System Manager ->Parameter Store
9. Amazon GuardDuty vs AWS control tower
10. Resolving Compromised IAM Credentials
11. Amazon Athena vs Amazon Macie
12. AWS Security Hub

![cupofcode_blog_toomuch_meme](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_learn_meme.jpg)

* * *

### Compliance in AWS

The term **compliance** describes the ability to act according to an order, set of rules, or request. Cloud compliance ensures that cloud computing services meet compliance requirements.

An example of compliance requirement is _PCI DSS_, which is an acronym for “Payment Card Industry Data Security Standard”. That means that if you want to receive payments in your business, you need to meet the compliance requirements. 

Compliance mandates require that you have implemented essential security controls to protect sensitive data in your environment. Auditors will want to see proof that you know:

- Which assets contain sensitive data
- Who can access these data (and that they are authorized)
- How assets are configured and whether there are any known vulnerabilities present
- What threats exist and how to respond to them.

You need to ensure you can handle such sensitive data, like payment cards, in order to store them. AWS supports security standards and compliance certifications.

### AWS Artifact

![cupofcode_blog_aws_security_artifact](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_artifact-1024x576.png)

No cost, self-service portal for on-demand access to AWS’ compliance reports. You can access AWS Artifact directly from the AWS Management Console.

* * *

### The Shared Responsibility Model

Security and Compliance are a shared responsibility between AWS and the customer.   
This shared model can help relieve the customer’s operational burden. AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.   
The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment.

As shown in the chart below, this differentiation of responsibility is commonly referred to as Security **_of_** the Cloud versus Security **_in_** the Cloud.

|![cupofcode_blog_Shared_Responsibility_Model](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_Shared_Responsibility_Model-1024x561.jpg)|
|--|
|[https://aws.amazon.com/compliance/shared-responsibility-model/](https://aws.amazon.com/compliance/shared-responsibility-model/)|

Do you know what this shared responsibility model reminds me of? 

![cupofcode_blog_clothes_shop](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_clothes_shop-1024x512.jpg)

When I used to work at a clothing shop in the mall, it was my responsibility to put the money in the safe and lock the shop doors, while it was the mall’s responsibility to have a security guy 24/7 and prevent entrance to the mall at closing hours.

Here is a trick to remember who is responsible: **Can you do this in the AWS console or in EC2 by yourself?**

- If yes, you are likely responsible: SGs, IAM users, Patching EC2 operating systems, patching DBs running on EC2, etc.
- If not, AWS is likely responsible for: Management of Data Centers, security cameras, cabling, patching RDS Operating Systems, etc.
- Encryption is a shared responsibility.

You can read more about the shared responsibility model [here](https://aws.amazon.com/compliance/shared-responsibility-model/).

* * *

### AWS WAF & AWS Shield

![cupofcode_blog_aws_security_WAF_Sield](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_WAF_Sield-1024x576.png)

**_AWS WAF_** is a **W**eb **A**pplication **F**irewall that helps protect your web applications or APIs against _common web exploits_ and bots that may affect availability, compromise security, or consume excessive resources.

**_AWS Shield_** is a managed _Distributed Denial of Service (DDoS)_ protection service that safeguards applications running on AWS. 

Here is a nice explanation I found for DDoS attack:

> _From a high level, a DDoS attack is like an unexpected traffic jam clogging up the highway, preventing regular traffic from arriving at its destination._

|![DDoS attack](https://cdn-images-1.medium.com/max/1000/0*rWKFv0wHnnm24xgX.png)|
|--|
|—[https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/)|

There are two tiers of AWS Shield — Standard and Advanced. The standard shield is turned on by default, but the advanced protection is an additional cost.

**So they both protect from attacks, what is the difference?**  
**_AWS WAF_** is a Web Application Firewall, designed to stop hackers.  
**_AWS Shield_** is a DDOS mitigation service designed to stop DDOS attacks.

* * *

### AWS Inspector & AWS Trusted Advisor

![cupofcode_blog_aws_security_inspector](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_inspector-1024x576.png)

Some people may confuse AWS Inspector and AWS Trusted Advisor.

**_AWS Inspector_** is used for inspecting EC2 instances for vulnerabilities. Remember that it’s **inspecting** EC2 instances.

**_AWS Trusted Advisor_** inspects your AWS account as a whole (not just EC2). It does more than just security checks: Cost optimization, performance, and fault tolerance.   
Remember it’s **advising** you on how to improve your AWS usage.

![cupofcode_blog_security_screenshot](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_security_screenshot.png)

Trust Advisor has a tiered service based on the AWS support plans. We will talk about it more when we reach **the billing & pricing blog post**, but for now know that there are four support plans: Basic, developer, business, and enterprise.  
_AWS Basic Support_ and _AWS Developer Support_ customers can access core security checks and all checks for service quotas. _AWS Business Support_ and _AWS Enterprise Support_ customers can access all checks.

* * *

### AWS CloudTrail and AWS Config

![cupofcode_blog_aws_security_cloudtrail](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_cloudtrail-1024x576.png)

#### AWS CloudTrail

**_AWS CloudTrail_** is recording AWS management console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.  
Remember it’s like a **paper trail** — it documents everything.

#### AWS Config

**_AWS Config_** provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.

Some people mix up Amazon CloudWatch and AWS Config. CloudWatch is used for monitoring AWS resources and applications on AWS and on-premises and is not part of the security section. I have [a blog post about CloudWatch alarms](https://cupofcode.blog/aws-in-between-alarms/) if you wanna check it out.

Do you see why it’s tricky? _CloudWatch_ is used for **monitoring performance** and _AWS Config_ is used to **monitor configurations** of your AWS resources.

* * *

### Penetration Testing in AWS

A penetration test (pentest) is a simulated cyberattack against your computer system to check for exploitable vulnerabilities.

If we go back to the days I worked in the mall, it’s similar to when your management brings an undercover supervisor as a client, to check your customer service qualities.

#### Pen-test without prior approval

When I learned about cybersecurity at university, I was curious to ‘test’ random websites on the internet. I just wanted to check what information I could find. Cool idea, but it’s illegal. You can’t decide to try hacking Facebook just for funnies — you can only do it with prior approval.

That’s the same with AWS. You can carry out pentests against your AWS infrastructure without prior approval for eight services only (Some of them you know, and some of them we will meet in a future blog post):

1. EC2 instances, NAT Gateways, and ELBs (These are 3 services but all under the EC2 service).
2. RDS
3. CloudFront
4. Aurora
5. API Gateway
6. Lambda & Lambda Edge functions
7. Lightsail resources.
8. Elastic beanstalk envs.

* * *

### AWS KMS and AWS CloudHSM

![cupofcode_blog_aws_security_KMS](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_KMS-1024x576.png)

TLAs…TLAs everywhere… TLAs are Three Letters Acronyms, and here we have a bunch.

![cupofcode_blog_aws_security_TLAs](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_TLAs-768x432.png)

**_KMS = Key Management Service._** This service creates and manages cryptographic keys and controls their use across a wide range of AWS services and in your applications.

A few facts about it:

1. AWS KMS encrypt and decrypt data, up to 4 kb in size.
2. AWS KMS manages customer master keys (CMKs). A _customer master key_ (CMK) is the primary resource in AWS KMS.
3. AWS KMS is integrated with most AWS services and is ideal for s3 objects, DB passwords, and API keys stored in the _systems manager parameter store_.
4. AWS KMS is a _regional_ service and is on shared hardware => This is where AWS CloudHSM enters the picture.

#### AWS CloudHSM

AWS **CloudHSM** is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.

CloudHSM is a dedicated hardware security module (HSM), single-tenant, multi-AZ cluster, _FIPS 140–2 Level 3_. 

Now, I’ll give you the definition for that _FIPS_ thingy, not because I think it’s necessary, but for those of you who are curious: **_FIPS 140–2 Level 3_** allows for a cryptographic module to be executed on a general-purpose PC as long as its operating system meets the minimum requirements.

You can read more about it [here](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html). 

* * *

### AWS Systems Manager Parameter Store vs AWS Secrets Manager

![cupofcode_blog_aws_security_secrets_manager](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_secrets_manager-1024x576.png)

**_Parameter Store_**, a capability of AWS Systems Manager, is secure serverless storage for configuration and secrets: passwords and DB connection strings. It is a component of AWS.

Important to mention: Systems Manager was formerly known as “Amazon Simple Systems Manager (SSM)” and the original abbreviated name of the service, “SSM”, is **still** reflected in various AWS resources. That means You’ll see **_SSM_** in the AWS console and it means **_Secrets Manager_**.

Values can be stored encrypted (KMS) or in plaintext. In order to store them encrypted, we use the **_AWS KMS_**.

**This service is free of cost,** but there is a limit of 10,000 per account. If you need more — then _Secrets manager_ is your choice.

**_AWS Secrets Manager_** is similar to Systems Manager Parameter Store. It automatically rotates secrets, applies the new key/password in RDS for you, and generates random secrets.

For this service, you are charged per secret stored and per 10,000 API calls.

* * *

### Amazon GuardDuty vs AWS Control Tower

![cupofcode_blog_aws_security_GuardDuty_Control_tower](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_GuardDuty_Control_tower-1024x576.png)

These two services are sitting together because they both manage to secure your AWS environment, so it’s easy to mix between them.

**_Amazon GuardDuty_** is a threat detection service that uses _machine learning_ and continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. GuardDuty is enabled only to watch over **one account**.

**_AWS Control Tower_** is defined as the easiest way to set up and govern a secure **multi-account** AWS environment. This service is for large enterprises.

* * *

### Resolving Compromised IAM Credentials

We’ve talked about IAM in [the previous AWS blog post](https://cupofcode.blog/aws-iam-cloudfront-s3/).

To be honest, as a non-native English speaker, I thought the word _compromise_ only describe a situation like deciding from which place to order dinner, but apparently, here in the title, it means _“we do the best we can to secure but not preparing for the oopsie is not wise”_, which makes sense when we are on the topic of security in AWS.

So, what do you do to resolve compromised IAM credentials?

1. Determine what resources those credentials have access to.
2. Invalidate the credentials so they can no longer be used to access your account.
3. Consider invalidating any temporary security credentials that might have been issued using the credentials.
4. Restore appropriate access.
5. Review access to your AWS account.

![cupofcode_blog_aws_security_password_meme](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_password_meme-768x432.png)

* * *

### Amazon Athena Vs Amazon Macie

![cupofcode_blog_aws_security_macie](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_macie-1024x576.png)

I’ll tell you about the services that sound like first names, and you decide who is Athena and who is Macie!

![cupofcode_blog_aws_security_athena_macie](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_athena_macie-201x300.png)

#### What is Athena?

An interactive query service that enables you to analyze and query data located in S3 using standard SQL. Athena helps you analyze unstructured, semi-structured, and structured data stored in Amazon S3.

- Serverless, nothing to provision, pay per query/per TB scanned.
- No need to set up complex Extract/Transform/Load (ETL) processes
- Works directly with data stored in S3

What can Athena be used for?

- Can be used to query log files stored in S3, e.g. ELB logs, S3 access logs, etc
- Generate business reports on data stored in S3
- Analyze _AWS Cost and Usage_ reports (we will talk about this service in the future).
- Run queries on click-stream data.

The only connection of Athena to security that I see is integration with IAM. Maybe it’s here because people confuse it with Macie. What do you think?

#### What is Macie?

First of all, let’s learn about _PII (Personally identifiable information)_. It’s personal data used to establish an individual’s identity, such as home address, email address, or credit card number.

This data could be exploited by criminals, used in identity theft and financial fraud.

What does this have to do with Macie? **_Amazon Macie_** is a security service that uses Machine Learning and NLP ([Natural language processing](https://en.wikipedia.org/wiki/Natural_language_processing)**)** to discover, classify and protect sensitive data stored in S3. It’s great for PCI-DSS and preventing ID theft.

Macie uses AI to recognize if your S3 objects contain sensitive data such as PII, and can also analyze CloudTrail logs.

So, Macie helps recognize objects in S3 that contain sensitive data.

* * *

### AWS Security Hub

![cupofcode_blog_aws_security_security_hub](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_aws_security_security_hub-1024x576.png)

Well, AWS Security Hub does pretty much what you’d expect by the name: Provides a single place that aggregates, organizes, and prioritizes your security alerts and findings from **multiple AWS services** — such as GuardDuty, Amazon Inspector, Amazon Macie, IAM Access Analyzer and AWS firewall manager — across **multiple AWS accounts**.

Notice that we have the word “multiple” twice — multiple services and multiple accounts.

* * *

That’s it! Wow, we learned a lot today! We learned about concepts such as **Compliance in AWS, The Shared Responsibility Model, Penetration Testing in AWS** and **Resolving Compromised IAM Credentials.**

We also got familiar with a bunch of AWS services: **AWS Artifact, AWS WAF & AWS Shield, AWS Trusted Advisor, AWS Config, AWS KMS and AWS CloudHSM, AWS Secrets Manager vs Parameter Store, GuardDuty and AWS Control Tower, Amazon Athena Vs Amazon Macie and AWS SecurityHub.**

![cupofcode_blog_toomuch_meme](https://cupofcode.blog/wp-content/uploads/2021/07/cupofcode_blog_toomuch_meme.jpg)

Before we go, I couldn’t help but wonder why some services were called “AWS XXX” and the others “Amazon XXX” and apparently I wasn’t the only one. So according to [StackOverflow](https://stackoverflow.com/questions/33125790/why-some-services-are-called-aws-xxx-and-the-others-amazon-xxx), 

> _The pattern is that **utility services** are prefixed with “AWS”, while **standalone services** are prefixed by “Amazon”._

You are welcome.

* * *

If you read this, you’ve reached the end of the blog post, and I would love to hear your thoughts! Was I helpful? Do you also use AWS at work? Here are the ways to contact me:  
Facebook: [https://www.facebook.com/cupofcode.blog/](https://www.facebook.com/cupofcode.blog/)  
Instagram: [https://www.instagram.com/cupofcode.blog/](https://www.instagram.com/cupofcode.blog/)  
Email: cupofcode.blog@gmail.com
![[https://cupofcode.blog/](https://cupofcode.blog/)](https://cdn-images-1.medium.com/max/3170/0*vLdjjgtBfeBxj_f8.png)