AWS Security Essentials

AdrianHu99 / NOTES

0 stars 0 forks source link

Closed AdrianHu99 closed 5 years ago

AdrianHu99 commented 5 years ago

AdrianHu99 commented 5 years ago

Automation

All infrastructure is recorded as code (e.g. Terraform, CloudFormation, Ansible, etc.)
All infrastructure changes are made by an automated tool
Console logins are restricted (perhaps to a handful of admins)
Teams are educated and empowered to make necessary changes with automation

AdrianHu99 commented 5 years ago

IAM

Any existing directory (e.g. Active Directory) is replicated into AWS and used as the system of record
Root account usage is limited to the tasks that require the root account
Root account has MFA enabled
Root account has no access keys (if possible)
Users have no permissions outside ability to use STS to assume roles (side effect: less console usage!)
MFA is enabled for all human users
MFA required to access privileged roles
Users are trained and given tools to make role assumption seamless and easy
Users have no inline IAM policies

AdrianHu99 commented 5 years ago

Network Design

Everything is deployed inside a VPC
Flow logs are enabled and monitored
Everything has a security group attached
Any security group that allows access from 0.0.0.0/0 (any host on the Internet) has a detailed description and justification (perhaps using tags)

AdrianHu99 commented 5 years ago

Encryption

AdrianHu99 commented 5 years ago

Auditing

AdrianHu99 commented 5 years ago

Continuous Integration

All infrastructure changes trigger configuration audits
Critical issues found in CI trigger an immediate response
Use the CI pipeline to create a sign-off process that allows teams to move faster