Security & Compliance

1. The AWS Shared Responsibility Model

The model splits every AWS deployment in two.

AWS responsibility — Security of the Cloud:

• Protecting the infrastructure (hardware, software, facilities and networking) that runs all the AWS services.
• Managed services like S3, DynamoDB, RDS, and so on.

Customer responsibility — Security in the Cloud:

• For an EC2 instance, the customer is responsible for management of the guest OS (including security patches and updates), firewall and network configuration, and IAM.
• Encrypting application data.

Shared controls: Patch Management, Configuration Management, Awareness & Training.

Example: RDS

AWS responsibility	Your responsibility
Manage the underlying EC2 instance, disable SSH access	Check the ports / IP / security group inbound rules in the DB’s SG
Automated DB patching	In-database user creation and permissions
Automated OS patching	Creating a database with or without public access
Audit the underlying instance and disks and guarantee it functions	Ensure parameter groups or the DB are configured to allow only SSL connections; database encryption setting

Example: S3

AWS responsibility	Your responsibility
Guarantee you get unlimited storage	Bucket configuration
Guarantee you get encryption	Bucket policy / public setting
Ensure separation of the data between different customers	IAM users and roles
Ensure AWS employees can’t access your data	Enabling encryption

Exam tip

The shortcut that resolves most shared-responsibility questions: AWS handles the hardware and the managed service itself; you handle your data, your configuration and your access control. Patching the guest OS of your EC2 instance is yours; patching RDS is AWS’s.

2. DDoS protection

A DDoS (Distributed Denial-of-Service) attack, as the slide draws it, has an attacker driving masters, which drive bots, which flood the application server until it is not accessible and not responsive to normal users.

AWS’s answer combines several services:

• AWS Shield Standard — protects against DDoS attacks for your website and applications, for all customers at no additional cost.
• AWS Shield Advanced — 24/7 premium DDoS protection.
• AWS WAF — filter specific requests based on rules.
• CloudFront and Route 53 — availability protection using the global edge network; combined with AWS Shield, they provide attack mitigation at the edge.
• Be ready to scale — leverage AWS Auto Scaling.

AWS Shield in detail

Shield Standard:

• Free service that is activated for every AWS customer.
• Provides protection from attacks such as SYN/UDP floods, reflection attacks and other layer 3 / layer 4 attacks.

Shield Advanced:

• Optional DDoS mitigation service — $3,000 per month per organization.
• Protects against more sophisticated attacks on Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator and Route 53.
• 24/7 access to the AWS DDoS response team (DRP).
• Protects against higher fees during usage spikes due to DDoS.

Exam tip

Three details get tested: Shield Standard is free and automatic for everyone, Shield Advanced costs $3,000 per month, and Advanced includes 24/7 access to the DDoS response team plus cost protection against the bill spike a DDoS causes.

3. AWS WAF – Web Application Firewall

• Protects your web applications from common web exploits (Layer 7). Layer 7 is HTTP, as opposed to Layer 4 which is TCP.
• Deploy on Application Load Balancer, API Gateway, CloudFront.
• You define a Web ACL (Web Access Control List):
  • Rules can include IP addresses, HTTP headers, HTTP body or URI strings.
  • Protects from common attacks — SQL injection and Cross-Site Scripting (XSS).
  • Size constraints and geo-match (block countries).
  • Rate-based rules (to count occurrences of events) — for DDoS protection.

Real-world example

A public API behind CloudFront: a Web ACL blocks SQL injection patterns in the request body, geo-matches out countries you do not serve, and applies a rate-based rule so a single IP cannot hammer the login endpoint.

4. AWS Network Firewall

• Protects your entire Amazon VPC.
• Provides Layer 3 to Layer 7 protection.
• Can inspect traffic in any direction:
  • VPC to VPC traffic
  • Outbound to internet
  • Inbound from internet
  • To / from Direct Connect and Site-to-Site VPN

Exam tip

Keep the three firewalls apart by scope: WAF = Layer 7 web requests on ALB/API Gateway/CloudFront, Network Firewall = the whole VPC, Layer 3 to 7, and Security Groups / NACLs from Amazon VPC sit at the instance and subnet level.

5. AWS Firewall Manager

• Manage security rules in all accounts of an AWS Organization.
• A security policy is a common set of security rules covering:
  • VPC Security Groups for EC2, Application Load Balancer, and so on
  • WAF rules
  • AWS Shield Advanced
  • AWS Network Firewall
• Rules are applied to new resources as they are created — good for compliance — across all and future accounts in your Organization.

Exam tip

The giveaway for Firewall Manager is “across every account in the Organization, including accounts created later”. A WAF rule alone applies to one account.

6. Penetration testing on AWS

AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services:

1. Amazon EC2 instances, NAT Gateways and Elastic Load Balancers
2. Amazon RDS
3. Amazon CloudFront
4. Amazon Aurora
5. Amazon API Gateways
6. AWS Lambda and Lambda Edge functions
7. Amazon Lightsail resources
8. Amazon Elastic Beanstalk environments

The list can increase over time — the deck notes you will not be tested on the exact list.

Prohibited activities:

• DNS zone walking via Amazon Route 53 Hosted Zones
• Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS
• Port flooding
• Protocol flooding
• Request flooding (login request flooding, API request flooding)

For any other simulated events, contact aws-security-simulated-event@amazon.com.

Exam tip

What you need to retain is the shape, not the list: penetration testing is allowed without prior approval on a defined set of services, but anything resembling a denial-of-service or flooding attack is prohibited.

7. Encryption: data at rest and in transit

• At rest — data stored or archived on a device: on a hard disk, on an RDS instance, in S3 Glacier Deep Archive…
• In transit (in motion) — data being moved from one location to another: on-premises to AWS, EC2 to DynamoDB… that is, data transferred on the network.

We want to encrypt data in both states to protect it, and for that we leverage encryption keys.

AWS KMS (Key Management Service)

Anytime you hear “encryption” for an AWS service, it’s most likely KMS. KMS = AWS manages the encryption keys for us.

Encryption opt-in:

• EBS volumes — encrypt volumes
• S3 buckets — server-side encryption of objects (SSE-S3 enabled by default, SSE-KMS opt in)
• Redshift database — encryption of data
• RDS database — encryption of data
• EFS drives — encryption of data

Encryption automatically enabled:

• CloudTrail Logs
• S3 Glacier
• Storage Gateway

Types of KMS keys

• Customer Managed Key — created, managed and used by the customer; can be enabled or disabled; possibility of a rotation policy (a new key generated every year, the old key preserved); possibility to bring your own key.
• AWS Managed Key — created, managed and used on the customer’s behalf by AWS; used by AWS services (aws/s3, aws/ebs, aws/redshift).
• AWS Owned Key — a collection of CMKs that an AWS service owns and manages to use in multiple accounts; AWS can use them to protect resources in your account, but you can’t view the keys.
• CloudHSM Keys (custom keystore) — keys generated from your own CloudHSM hardware device; cryptographic operations are performed within the CloudHSM cluster.

CloudHSM

• KMS ⇒ AWS manages the software for encryption.
• CloudHSM ⇒ AWS provisions encryption hardware.
• Dedicated hardware (HSM = Hardware Security Module).
• You manage your own encryption keys entirely — not AWS.
• The HSM device is tamper resistant, FIPS 140-2 Level 3 compliant.

In the CloudHSM diagram, AWS manages the hardware while the user manages the keys, and the CloudHSM client talks to the cluster over an SSL connection.

Exam tip

The single line that answers most of these questions: KMS — AWS manages the keys; CloudHSM — you manage the keys, on dedicated tamper-resistant hardware. “We are required to control our own key material on FIPS 140-2 Level 3 hardware” is always CloudHSM.

8. AWS Certificate Manager (ACM)

• Lets you easily provision, manage and deploy SSL/TLS certificates.
• Used to provide in-flight encryption for websites (HTTPS).
• Supports both public and private TLS certificates.
• Free of charge for public TLS certificates.
• Automatic TLS certificate renewal.
• Integrations (loads TLS certificates onto): Elastic Load Balancers, CloudFront Distributions, APIs on API Gateway.

Real-world example

The slide’s architecture: ACM provisions and maintains the certificate on an Application Load Balancer, clients reach the ALB over HTTPS, and the ALB talks to the EC2 instances in the Auto Scaling group over plain HTTP inside the VPC.

9. AWS Secrets Manager

• A newer service, meant for storing secrets.
• Capability to force rotation of secrets every X days.
• Automates generation of secrets on rotation (uses Lambda).
• Integration with Amazon RDS (MySQL, PostgreSQL, Aurora).
• Secrets are encrypted using KMS.
• Mostly meant for RDS integration.

Exam tip

Automatic rotation is the word that identifies Secrets Manager.

10. AWS Artifact

AWS Artifact is not really a service — it is a portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements.

• Artifact Reports — download AWS security and compliance documents from third-party auditors, such as AWS ISO certifications, Payment Card Industry (PCI) and System and Organization Control (SOC) reports.
• Artifact Agreements — review, accept and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA), for an individual account or across your organization.
• Can be used to support internal audit or compliance.

Real-world example

An auditor asks for proof that the underlying infrastructure is PCI compliant. You do not open a support case — you download the PCI report from AWS Artifact.

11. Amazon GuardDuty

Intelligent threat discovery to protect your AWS account.

• Uses machine learning algorithms, anomaly detection and 3rd-party data.
• One click to enable (30-day trial), no need to install software.

Input data includes:

• CloudTrail Events Logs — unusual API calls, unauthorized deployments
• CloudTrail Management Events — create VPC subnet, create trail…
• CloudTrail S3 Data Events — get object, list objects, delete object…
• VPC Flow Logs — unusual internal traffic, unusual IP address
• DNS Logs — compromised EC2 instances sending encoded data within DNS queries
• Optional features — EKS Audit Logs, RDS & Aurora, EBS, Lambda, S3 Data Events…

You can set up EventBridge rules to be notified in case of findings, and those rules can target AWS Lambda or SNS. GuardDuty can protect against cryptocurrency attacks — it has a dedicated “finding” for it.

Exam tip

“Detect malicious or unauthorized behavior using CloudTrail, VPC Flow Logs and DNS Logs, with no agent to install” is GuardDuty. The dedicated cryptocurrency finding is a favourite detail.

12. Amazon Inspector

Automated security assessments, for exactly three targets:

• EC2 instances — leveraging the AWS Systems Manager (SSM) agent; analyzes against unintended network accessibility and analyzes the running OS against known vulnerabilities.
• Container images pushed to Amazon ECR — assessment of container images as they are pushed.
• Lambda functions — identifies software vulnerabilities in function code and package dependencies; assessment of functions as they are deployed.

Findings are reported and integrated with AWS Security Hub, and can be sent to Amazon EventBridge.

What Inspector evaluates:

• Remember: only for EC2 instances, container images and Lambda functions.
• Continuous scanning of the infrastructure, only when needed.
• Package vulnerabilities (EC2, ECR and Lambda) — against a database of CVE.
• Network reachability (EC2).
• A risk score is associated with all vulnerabilities for prioritization.

Exam tip

GuardDuty looks for active threats in logs; Inspector looks for vulnerabilities in EC2, ECR images and Lambda. If the question says “CVE” or “software vulnerabilities”, it is Inspector.

13. AWS Config

• Helps with auditing and recording compliance of your AWS resources.
• Helps record configurations and changes over time.
• Possibility of storing the configuration data into S3 (analyzed by Athena).

Questions AWS Config can answer:

• Is there unrestricted SSH access to my security groups?
• Do my buckets have any public access?
• How has my ALB configuration changed over time?

Other facts:

• You can receive alerts (SNS notifications) for any changes.
• AWS Config is a per-region service.
• It can be aggregated across regions and accounts.

For a given resource you can view compliance over time, view configuration over time, and view CloudTrail API calls if enabled.

Exam tip

Config answers “what did this resource look like, and was it compliant?” over time. CloudTrail answers “who called which API?”. Questions often put the two side by side.

14. Amazon Macie

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

• Macie helps identify and alert you to sensitive data, such as personally identifiable information (PII).
• The flow on the slide: Macie analyzes S3 buckets to discover sensitive data (PII), then notifies Amazon EventBridge for integrations.

Real-world example

Someone uploads a spreadsheet of customer national ID numbers into an S3 bucket. Macie discovers the PII, raises a finding, and an EventBridge rule notifies the security team.

15. AWS Security Hub and Amazon Detective

AWS Security Hub

• Central security tool to manage security across several AWS accounts and automate security checks.
• Integrated dashboards showing current security and compliance status so you can quickly take action.
• Automatically aggregates alerts in predefined or personal findings formats from various AWS services and AWS partner tools: Config, GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Systems Manager, AWS Firewall Manager, AWS Health, AWS Partner Network solutions.
• You must first enable the AWS Config service.

The diagram shows Security Hub collecting potential issues and findings, running automated checks, generating Security Hub Findings and an EventBridge event, across multiple accounts — and handing off to Amazon Detective to investigate.

Amazon Detective

• GuardDuty, Macie and Security Hub are used to identify potential security issues, or findings.
• Sometimes security findings require deeper analysis to isolate the root cause and take action — a complex process.
• Amazon Detective analyzes, investigates and quickly identifies the root cause of security issues or suspicious activities, using ML and graphs.
• Automatically collects and processes events from VPC Flow Logs, CloudTrail and GuardDuty and creates a unified view.
• Produces visualizations with details and context to get to the root cause.

Exam tip

Security Hub aggregates findings across accounts (and needs AWS Config enabled first); Detective investigates the root cause of a finding. “Find why this happened” is Detective.

16. AWS Abuse

Report suspected AWS resources used for abusive or illegal purposes. The abusive and prohibited behaviors listed:

• Spam — receiving undesired emails from an AWS-owned IP address; websites and forums spammed by AWS resources.
• Port scanning — sending packets to your ports to discover the unsecured ones.
• DoS or DDoS attacks — AWS-owned IP addresses attempting to overwhelm or crash your servers/software.
• Intrusion attempts — logging in on your resources.
• Hosting objectionable or copyrighted content — distributing illegal or copyrighted content without consent.
• Distributing malware — AWS resources distributing software to harm computers or machines.

You contact the AWS Abuse team through the AWS abuse form or at abuse@amazonaws.com.

Exam tip

The trigger is an AWS resource attacking you, not your own account being attacked from outside. That is the AWS Abuse team’s job.

17. Root user privileges

• Root user = Account Owner, created when the account is created.
• Has complete access to all AWS services and resources.
• Lock away your AWS account root user access keys!
• Do not use the root account for everyday tasks, even administrative tasks.

Actions that can be performed only by the root user:

• Change account settings (account name, email address, root user password, root user access keys)
• View certain tax invoices
• Close your AWS account
• Restore IAM user permissions
• Change or cancel your AWS Support plan
• Register as a seller in the Reserved Instance Marketplace
• Configure an Amazon S3 bucket to enable MFA
• Edit or delete an Amazon S3 bucket policy that includes an invalid VPC ID or VPC endpoint ID
• Sign up for GovCloud

Exam tip

Root-only actions are a guaranteed question. The four the summary slide repeats are: change account settings, close your AWS account, change or cancel your AWS Support plan, and register as a seller in the Reserved Instance Marketplace.

18. IAM Access Analyzer

Find out which resources are shared externally:

• S3 Buckets
• IAM Roles
• KMS Keys
• Lambda Functions and Layers
• SQS queues
• Secrets Manager Secrets

You define a Zone of Trust = an AWS Account or an AWS Organization. Access outside the zone of trust produces findings.

Real-world example

A bucket policy quietly grants read access to an account outside your Organization. IAM Access Analyzer flags it as a finding because that account sits outside the zone of trust.

19. Section summary

• Shared Responsibility on AWS.
• Shield — automatic DDoS protection + 24/7 support for Advanced.
• WAF — firewall to filter incoming requests based on rules.
• KMS — encryption keys managed by AWS.
• CloudHSM — hardware encryption, we manage encryption keys.
• AWS Certificate Manager — provision, manage and deploy SSL/TLS certificates.
• Artifact — get access to compliance reports such as PCI, ISO, etc.
• GuardDuty — find malicious behavior with VPC, DNS and CloudTrail Logs.
• Inspector — find software vulnerabilities in EC2, ECR images and Lambda functions.
• Network Firewall — protect a VPC against network attacks.
• Config — track config changes and compliance against rules.
• Macie — find sensitive data (e.g. PII) in Amazon S3 buckets.
• CloudTrail — track API calls made by users within an account.
• AWS Security Hub — gather security findings from multiple AWS accounts.
• Amazon Detective — find the root cause of security issues or suspicious activities.
• AWS Abuse — report AWS resources used for abusive or illegal purposes.
• Root user privileges — change account settings; close your AWS account; change or cancel your AWS Support plan; register as a seller in the Reserved Instance Marketplace.
• IAM Access Analyzer — identify which resources are shared externally.
• Firewall Manager — manage security rules across an Organization (WAF, Shield…).

Quick recap

Concept	What to remember for the exam
Shared Responsibility Model	AWS = security of the cloud (infrastructure, managed services); customer = security in the cloud (guest OS, firewall/network config, IAM, data encryption); shared = patch management, configuration management, awareness & training
AWS Shield Standard	Free, activated for every customer; SYN/UDP floods, reflection and other layer 3/4 attacks
AWS Shield Advanced	$3,000/month per organization; EC2, ELB, CloudFront, Global Accelerator, Route 53; 24/7 DDoS response team; protects against DDoS-driven cost spikes
AWS WAF	Layer 7 (HTTP) filtering on ALB, API Gateway and CloudFront; Web ACL on IPs, headers, body, URI; SQL injection, XSS, size constraints, geo-match, rate-based rules
AWS Network Firewall	Protects the entire VPC, Layer 3 to 7, any direction including VPC-to-VPC, internet, Direct Connect and Site-to-Site VPN
AWS Firewall Manager	One security policy across all — and future — accounts of an AWS Organization: Security Groups, WAF rules, Shield Advanced, Network Firewall
Penetration testing	Allowed without prior approval on 8 listed services; DoS/DDoS, port, protocol and request flooding, and Route 53 DNS zone walking are prohibited
Data at rest vs in transit	At rest = stored on a device; in transit = moving over the network; encrypt both
AWS KMS	AWS manages the encryption keys; opt-in for EBS, S3 (SSE-S3 default, SSE-KMS opt in), Redshift, RDS, EFS; automatic for CloudTrail Logs, S3 Glacier, Storage Gateway
KMS key types	Customer Managed (rotation policy, bring your own key), AWS Managed (aws/s3, aws/ebs, aws/redshift), AWS Owned (you can’t view them), CloudHSM keys
CloudHSM	AWS provisions dedicated hardware, you manage the keys; tamper resistant, FIPS 140-2 Level 3
AWS Certificate Manager	Provision, manage and deploy SSL/TLS certificates; free for public certs; automatic renewal; ELB, CloudFront, API Gateway
AWS Secrets Manager	Store secrets with forced rotation every X days, generation via Lambda, KMS encryption, mostly RDS integration
AWS Artifact	Portal for compliance reports (ISO, PCI, SOC) and agreements (BAA, HIPAA)
Amazon GuardDuty	ML threat detection from CloudTrail Events/Management/S3 Data Events, VPC Flow Logs and DNS Logs; one click, no software; EventBridge to Lambda or SNS; dedicated cryptocurrency finding
Amazon Inspector	Vulnerability assessment for EC2 (via SSM agent), ECR container images and Lambda functions; CVE package vulnerabilities, network reachability, risk score; integrates with Security Hub and EventBridge
AWS Config	Records configuration and changes over time, compliance against rules, SNS alerts, per-region but aggregatable across regions and accounts, data to S3 for Athena
Amazon Macie	ML and pattern matching to discover sensitive data such as PII in S3; notifies EventBridge
AWS Security Hub	Central aggregation of findings across accounts from Config, GuardDuty, Inspector, Macie, IAM Access Analyzer, Systems Manager, Firewall Manager, Health and partners; requires AWS Config enabled first
Amazon Detective	Root-cause investigation using ML and graphs over VPC Flow Logs, CloudTrail and GuardDuty
AWS Abuse	Report AWS resources used for spam, port scanning, DoS/DDoS, intrusion attempts, objectionable content or malware
Root user	Account owner; lock away the access keys, never use for daily tasks; only it can change account settings, close the account, change/cancel the Support plan, register as a seller in the RI Marketplace, and the other listed actions
IAM Access Analyzer	Finds S3 buckets, IAM roles, KMS keys, Lambda functions and layers, SQS queues and Secrets Manager secrets shared outside the zone of trust (account or Organization)