Decoding the Cloud
AWS Cloud Security, Module 4 of the AWS Academy course, builds on that idea and walks through how security is shared, managed and proven.
Securing the Cloud: A Closer Look at AWS Cloud Security
1. The Shared Responsibility Model
AWS splits security into two halves.
Security of the cloud (AWS): AWS protects the infrastructure that runs its services. That covers the data centers, hardware, networking and the software that runs the services.
Security in the cloud (the customer): You protect what you put there, including your data, user access, operating system patches on EC2 instances, firewall settings and encryption choices.
AWS splits security into two halves.
Security of the cloud (AWS): AWS protects the infrastructure that runs its services. That covers the data centers, hardware, networking and the software that runs the services.
Security in the cloud (the customer): You protect what you put there, including your data, user access, operating system patches on EC2 instances, firewall settings and encryption choices.
2. AWS Identity and Access Management (IAM)
IAM controls who can do what in your AWS account. Its main building blocks are:
Users: individual people or applications.
Groups: collections of users that share the same permissions.
Roles: temporary permissions that a user, service or application can assume.
Policies: JSON documents that define what is allowed or denied.
IAM works on the principle of least privilege: give people only the access they need to do their job. A developer who only needs to read from an S3 bucket shouldn't be able to delete it. IAM also supports multi-factor authentication (MFA), which asks for a second proof of identity, such as a code from your phone, on top of your password.
IAM controls who can do what in your AWS account. Its main building blocks are:
Users: individual people or applications.
Groups: collections of users that share the same permissions.
Roles: temporary permissions that a user, service or application can assume.
Policies: JSON documents that define what is allowed or denied.
IAM works on the principle of least privilege: give people only the access they need to do their job. A developer who only needs to read from an S3 bucket shouldn't be able to delete it. IAM also supports multi-factor authentication (MFA), which asks for a second proof of identity, such as a code from your phone, on top of your password.
3. Securing a New AWS Account
When you create an account, you start with the root user, which has unrestricted access to everything. Because of that power, the best practices are:
Enable MFA on the root user.
Don't use the root user for daily tasks. Create IAM users or roles instead.
Never share or hard-code root credentials.
Use strong passwords and turn on activity logging with AWS CloudTrail, so every action is recorded.
When you create an account, you start with the root user, which has unrestricted access to everything. Because of that power, the best practices are:
Enable MFA on the root user.
Don't use the root user for daily tasks. Create IAM users or roles instead.
Never share or hard-code root credentials.
Use strong passwords and turn on activity logging with AWS CloudTrail, so every action is recorded.
4. Securing Accounts at Scale
Organizations often run many AWS accounts, for example one each for development, testing and production. AWS Organizations lets you manage them centrally. Its key features are:
Grouping accounts into organizational units (OUs).
Consolidated billing.
Service control policies (SCPs), which set the maximum permissions that accounts in the organization can have.
An SCP acts as a guardrail. Even if someone in an account is granted broad permissions, the SCP can still block actions that the organization doesn't allow.
Organizations often run many AWS accounts, for example one each for development, testing and production. AWS Organizations lets you manage them centrally. Its key features are:
Grouping accounts into organizational units (OUs).
Consolidated billing.
Service control policies (SCPs), which set the maximum permissions that accounts in the organization can have.
An SCP acts as a guardrail. Even if someone in an account is granted broad permissions, the SCP can still block actions that the organization doesn't allow.
5. Securing Data
Data is usually what an attacker is after, so AWS gives you protection in two forms:
Encryption at rest: data is encrypted while stored, in S3, EBS volumes, RDS databases and more. AWS Key Management Service (KMS) helps you create and control the encryption keys.
Encryption in transit: data is protected while it moves, using protocols like TLS/HTTPS.
Beyond encryption, services like Amazon S3 let you control access with bucket policies and block public access, which helps prevent accidental exposure.
Data is usually what an attacker is after, so AWS gives you protection in two forms:
Encryption at rest: data is encrypted while stored, in S3, EBS volumes, RDS databases and more. AWS Key Management Service (KMS) helps you create and control the encryption keys.
Encryption in transit: data is protected while it moves, using protocols like TLS/HTTPS.
Beyond encryption, services like Amazon S3 let you control access with bucket policies and block public access, which helps prevent accidental exposure.
6. Working to Ensure Compliance
Many industries, such as healthcare, finance and government, have strict rules about how data is handled. AWS helps customers meet them in three ways:
AWS security compliance programs: these provide information about the policies, processes and controls that AWS establishes and operates.
AWS Config: this assesses, audits and evaluates the configurations of your AWS resources. It can tell you when something drifts from your required settings, such as an unencrypted storage volume.
AWS Artifact: this gives you on-demand access to AWS security and compliance reports. You can also use it to review, accept and track agreements with AWS, such as the Business Associate Agreement (BAA). Companies subject to HIPAA typically need one to make sure protected health information is properly safeguarded.
Many industries, such as healthcare, finance and government, have strict rules about how data is handled. AWS helps customers meet them in three ways:
AWS security compliance programs: these provide information about the policies, processes and controls that AWS establishes and operates.
AWS Config: this assesses, audits and evaluates the configurations of your AWS resources. It can tell you when something drifts from your required settings, such as an unencrypted storage volume.
AWS Artifact: this gives you on-demand access to AWS security and compliance reports. You can also use it to review, accept and track agreements with AWS, such as the Business Associate Agreement (BAA). Companies subject to HIPAA typically need one to make sure protected health information is properly safeguarded.
Key Takeaways
Security is shared. AWS secures the cloud, and you secure what you put in it.
IAM, least privilege and MFA are your first line of defense.
The root user should be locked down and used rarely.
AWS Organizations and SCPs help you govern many accounts safely.
Encrypt data both at rest and in transit.
AWS Config and AWS Artifact help you stay compliant and prove it.
IAM, least privilege and MFA are your first line of defense.
The root user should be locked down and used rarely.
AWS Organizations and SCPs help you govern many accounts safely.
Encrypt data both at rest and in transit.
AWS Config and AWS Artifact help you stay compliant and prove it.
Conclusion
AWS provides a very secure foundation, but a secure foundation doesn't guarantee a secure application. The strongest cloud setups come from people who understand their share of the responsibility and use the tools available: IAM for access, encryption for data, and Config and Artifact for compliance.
AWS provides a very secure foundation, but a secure foundation doesn't guarantee a secure application. The strongest cloud setups come from people who understand their share of the responsibility and use the tools available: IAM for access, encryption for data, and Config and Artifact for compliance.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article