Security & Compliance

AWS Shared Responsibility Model

Security and compliance is a shared responsibility between AWS and the customer.

• AWS Responsibility — "Security OF the Cloud": Protecting the infrastructure that runs all AWS services (hardware, software, networking, facilities, managed services).
• Customer Responsibility — "Security IN the Cloud": Determined by the AWS services you select. Includes configuration, data management, IAM, encryption.

Shared Controls

• Patch Management — AWS patches infrastructure; customer patches guest OS & applications.
• Configuration Management — AWS configures infrastructure; customer configures their own databases, applications.
• Awareness & Training — Both AWS and customer must train their respective employees.

DDoS Protection

AWS Shield Standard

• Free and automatically enabled for all AWS customers.
• Provides protection against common DDoS attacks (SYN/UDP floods, reflection attacks) at Layer 3 and Layer 4.

AWS Shield Advanced

• $3,000/month per organization — premium DDoS protection.
• Protects against more sophisticated attacks on EC2, ELB, CloudFront, Global Accelerator, Route 53.
• 24/7 access to AWS DDoS Response Team (DRT).
• DDoS cost protection — fee waiver for scaling charges due to DDoS attacks.
• Automatic application layer (L7) DDoS mitigation via WAF.

AWS WAF (Web Application Firewall)

• Protects web applications from common web exploits at Layer 7 (HTTP).
• Deployed on ALB, API Gateway, CloudFront, AppSync GraphQL, Cognito User Pool.
• Define Web ACL (Access Control List) rules:

Rule Types

• IP Set Rules — Allow/block up to 10,000 IP addresses.
• Rate-based Rules — Count requests per IP, block if exceeds threshold (good for DDoS, brute force).
• SQL Injection Protection — Block SQL injection attempts.
• Cross-Site Scripting (XSS) Protection — Block XSS attacks.
• Geo-match — Block requests from specific countries.
• Size constraints — Filter requests by size.
• Managed Rules — Pre-configured rules by AWS and AWS Marketplace sellers.

AWS Network Firewall

• Managed firewall to protect your entire VPC (Layer 3 to Layer 7).
• Uses AWS Gateway Load Balancer internally.
• Supports thousands of custom rules: IP & port filtering, protocol filtering, stateful domain list / regex pattern matching.
• Active flow inspection to protect against network threats.
• Send logs to S3, CloudWatch Logs, Kinesis Data Firehose.

Encryption Services

AWS KMS (Key Management Service)

• Create and manage encryption keys used to encrypt your data.
• Fully integrated with most AWS services (EBS, S3, RDS, Redshift, etc.).
• AWS Managed Keys — Free, created automatically, naming format: aws/service-name.
• Customer Managed Keys (CMK) — $1/month, you create/manage/control rotation.
• Customer Managed Keys imported — $1/month, you generate & import your own key material.
• Pay for API calls to KMS ($0.03 per 10,000 calls).
• Automatic key rotation: 1 year for CMK (must enable); automatic for AWS managed keys.

AWS CloudHSM

• AWS provisions dedicated Hardware Security Module (HSM) hardware.
• You manage your own encryption keys entirely (AWS has no access).
• HSM device is tamper-resistant, FIPS 140-2 Level 3 compliance.
• Supports both symmetric and asymmetric encryption.
• Good for: SSO, HTTPS/SSL acceleration, TLS acceleration.

AWS Certificate Manager (ACM)

• Provision, manage, and deploy TLS/SSL certificates.
• Free of charge for public TLS certificates.
• Automatic TLS certificate renewal.
• Integrates with: ELB, CloudFront, API Gateway.

AWS Artifact

• Portal for on-demand access to AWS compliance documentation and AWS agreements.
• Artifact Reports — Download AWS security and compliance documents (SOC reports, PCI, ISO certifications, etc.).
• Artifact Agreements — Review, accept, and track AWS agreements (BAA, HIPAA, etc.) for individual account or organization.
• Can be used to support internal audit or compliance.

Threat Detection & Security Services

Amazon GuardDuty

• Intelligent threat detection using ML, anomaly detection, and 3rd-party threat intelligence.
• Analyzes: CloudTrail Event Logs, VPC Flow Logs, DNS Logs, EKS Audit Logs.
• Can detect: cryptocurrency mining attacks, unauthorized deployments, compromised EC2/IAM credentials.
• Can trigger EventBridge notifications for automated remediation (Lambda, SNS).
• One-click enable, 30-day free trial, no software to install.

Amazon Inspector

• Automated security assessments for:
• EC2 instances — Uses AWS Systems Manager (SSM) agent, checks OS vulnerabilities, unintended network exposure.
• ECR container images — Checks for vulnerabilities when images are pushed.
• Lambda functions — Checks for software vulnerabilities in code and dependencies.
• Sends findings to AWS Security Hub and EventBridge.
• Provides a risk score associated with each vulnerability.

AWS Config

• Record and audit configuration changes to your AWS resources over time.
• Define compliance rules (e.g., all EBS volumes must be encrypted, all security groups must not allow SSH from 0.0.0.0/0).
• Receive alerts via SNS for configuration changes.
• Per-region service (must be enabled in each region).
• Data can be aggregated across regions and accounts.
• Can use with AWS Config Rules for automatic compliance checking.

Amazon Macie

• Fully managed data security and privacy service using machine learning.
• Discovers, classifies, and protects sensitive data in S3 (PII: names, addresses, credit card numbers, etc.).
• Alerts you to unencrypted buckets, publicly accessible buckets, and buckets shared with external accounts.

Amazon Detective

• Analyzes, investigates, and identifies root cause of security findings.
• Uses ML and graphs on data from VPC Flow Logs, CloudTrail, GuardDuty.
• Automatically collects and processes events; produces visualizations.
• Use when GuardDuty finds something suspicious and you need to deep-dive into the cause.

AWS Security Hub

• Central security dashboard to manage security across multiple AWS accounts.
• Aggregates findings from: GuardDuty, Inspector, Macie, IAM Access Analyzer, Systems Manager, Firewall Manager, partner tools.
• Automatically runs continuous compliance checks against AWS best practices and standards (CIS, PCI DSS).
• Must first enable AWS Config for Security Hub to work.

AWS Abuse & Penetration Testing

AWS Abuse

• Report suspected abusive or illegal use of AWS resources.
• Examples: spam, port scanning, DDoS from AWS IPs, hosting malware, distributing illegal content.
• Contact the AWS Trust & Safety team via the abuse form or abuse@amazonaws.com.

Penetration Testing

• You can perform penetration testing on the following 8 services without prior approval: