Security

Securing Your AWS Environment with Virtual Private Clouds (VPC)

This blog post provides a comprehensive guide on securing AWS environments using Virtual Private Clouds (VPCs). It covers the importance of network segmentation, access control using NACLs and Security Groups, host-based tooling, logging with VPC Flow Logs, and additional security measures like AWS WAF and Network Firewall. The post emphasizes the significance of encryption and regular review of security configurations to maintain a robust security posture in the cloud.

Improve the security of your AWS account

As more organizations migrate their infrastructure to the cloud, security in the cloud has become a top priority. One of the most common security issues in AWS is misconfiguration, which can leave organizations vulnerable to attacks and data breaches.

In this article, we will discuss the most common security misconfigurations we find in AWS accounts. Understanding and addressing these misconfigurations can help ensure that your AWS environment is secure and protected from potential threats.

AWS Security services - the 'must-have' list

AWS CloudTrail

While not directly a ‘security’ service, AWS CloudTrail should be running in every one of your AWS accounts in every region.
Essentially, CloudTrail records all API calls within your AWS account. All activities in your account are API calls, whether you’re using the AWS Management Console, the CLI, or one of the AWS SDKs, so I hope you see the importance of the CloudTrail service.

CloudTrail is enabled in all new AWS accounts by default, but you should finish the configuration by centralizing all the logs into a single AWS account. If you’re running a multi-account deployment, CloudTrail supports AWS Organizations, which will help streamline your setup.

Identity and Access Management (IAM) - Practice Least Privilege

IAM is the main source of access for your AWS account and ensuring that everything is secure is an important part of maintaining your environment.

Let’s say a new contractor is going to start working with your team and you’ve been tasked with creating a new user for them that allows them to perform specific EC2 and RDS actions within the four AWS accounts you use; Identity (where IAM users exist), Prod, Test, and Sandbox.

Securing your AWS account and its root credentials

“Your AWS account may be compromised” – not the subject line you want to see in an email from AWS Technical support.

Fortunately, the AWS account mentioned in the email did not have Root keys – regardless of what the email said, and the API key referenced in the email notification had been disabled long, long ago.

That email got me thinking about best practices around securing both your AWS account and its API keys. Below, are my top four recommendations on how to protect the API keys associated with your AWS account.

Checking AWS root accounts for MFA

Last week we needed to develop a quick and easy way to check that Multi-Factor Authentication (MFA) was enabled for the root account for a bunch of AWS accounts.

Being a proponent of project-based learning, I decided that this would be an excellent opportunity to further my understanding of Boto3 and serverless computing in Amazon Web Services.

Here’s the list of requirements that I came up with:

1. There were to be no servers (EC2 instances) in the solution
2. It had to be inexpensive
3. It had to be able to check numerous AWS accounts that were not related
4. It had to notify a few people if it discovered an AWS account that did not have MFA enabled on its root account

Here’s a diagram of the solution.