Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Security

Security on AWS is not a single service. It is a set of services that each answer a different question, and most designs use several of them at once:

  • Who is making this call, and what may they do? — identity and access management.
  • Who holds the keys, and where do secrets live? — encryption and secret storage.
  • What traffic is allowed to reach the workload? — network controls.
  • What is an account permitted to do at all? — organisation-wide governance.
  • What is happening that should not be? — threat detection.

Two ideas run through all of them. The shared responsibility model divides security of the cloud — the hardware, the facilities and the managed service itself, which are AWS’s responsibility — from security in the cloud, which is the customer’s: data, configuration, identities, patching of anything the customer runs. Least privilege means granting the narrowest permission that lets the work happen, and preferring short-lived credentials over long-lived access keys.

The sections

Section titled “The sections”

IAM is the foundation. Every other identity mechanism on AWS eventually resolves to an IAM role and an IAM policy, so start here if you are unsure where a permission comes from.

Identity covers the services that sit in front of IAM: Amazon Cognito for application end users, AWS STS for temporary credentials, and AWS Directory Service for Active Directory workloads.

Encryption covers AWS KMS, AWS CloudHSM, AWS Certificate Manager, AWS Secrets Manager and Systems Manager Parameter Store — where keys and secrets are held and how they are rotated.

Network security covers the layered filtering stack: AWS Shield, AWS WAF, AWS Network Firewall, network ACLs and security groups, and how DDoS attacks work.

Organizations covers multi-account governance: service control policies, AWS Config, AWS Control Tower and IAM Identity Center as the way people reach many accounts.

Threat detection covers the monitoring services — Amazon GuardDuty, Amazon Inspector, Amazon Macie, Amazon Detective and AWS Security Hub CSPM — and which of them answers which question.