Clear and Simple AWS Advanced Security 2022

In this video, you'll learn about the AWS Shared Responsibility Model, which divides security responsibilities between AWS and the customer. AWS manages the security of the cloud, including the physical infrastructure and managed services, while the customer is responsible for security in the cloud, such as managing user access, configuring security groups, and securing their own data and applications.

In this video, you'll learn how to manage root credentials and perform essential Day 1 tasks for securing your AWS account. Key actions include setting up multi-factor authentication (MFA) for the root account, deleting root access keys to prevent unauthorized access, and transitioning to using IAM users for day-to-day account management.

In this video, you'll learn how to create users and groups in AWS using the IAM console. The lesson covers adding users with specific permissions, organizing them into groups for easier management, and using tags to categorize users for reporting purposes, emphasizing the benefits of managing permissions at the group level.

In this video, you'll learn about creating and managing IAM policies in AWS, including how to attach them to users, groups, and roles. The lesson covers the differences between AWS-managed policies, customer-managed policies, and inline policies, emphasizing their scope and use cases within your AWS account.

In this video, you'll learn how to examine and create IAM policies in AWS, including viewing the JSON structure of managed and custom policies. The lesson also demonstrates how to apply these policies to users and groups, and highlights best practices for maintaining a clean and organized AWS environment by regularly deleting unused policies and groups.

In this video, we explore AWS Organizations and how it helps manage and secure multiple AWS accounts by creating organizational units (OUs) and applying service control policies (SCPs). The lesson covers the hierarchical structure of AWS Organizations, the application of SCPs across OUs and individual accounts, and their role in managing access and compliance across a large-scale AWS environment.

In this lesson, we learn that AWS Organizations' service control policies (SCPs) can restrict the root user's access to AWS services, contrary to the common perception that the root user has unrestricted access. The lesson highlights that the root user's permissions are limited by the intersection of the SCP and any IAM policies, ensuring global enforcement of controls within an AWS account.

In this demo, we explore AWS S3 bucket policies, which allow you to set specific permissions on an S3 bucket, taking precedence over IAM policies in case of a conflict. The lesson demonstrates how to create and apply a bucket policy, emphasizing the importance of including object-level permissions and how bucket policies simplify managing access to S3 resources without modifying existing IAM policies.

In this demo, we explore creating an S3 bucket policy for sensitive data, aiming to restrict access to all users except a specific IAM group. However, we also see that bucket policies cannot directly grant access to IAM groups and highlights how explicit deny statements in a bucket policy override any allow statements, leading to the failure of the intended configuration.

In this demo, we explore the use of S3 ACLs (Access Control Lists) to manage permissions for individual objects within an S3 bucket, including granting public access and testing the effects of inline IAM policies on S3 object permissions. We'll emphasize the importance of understanding policy conflicts and encourages hands-on practice with bucket policies and IAM configurations for effective AWS management.

In this demo, we explore how explicit denies in IAM policies and S3 bucket policies override explicit allows, demonstrating the priority of denies in resolving permission conflicts. This is all essential for understanding the behavior of access controls in AWS, especially for preparing for certification exams where handling these conflicts is a key concept.

In this demo, we demonstrate how to use the AWS policy generator to enforce secure transport for accessing an S3 bucket by denying access to any connection not using HTTPS. This involves creating a bucket policy that blocks all HTTP requests, ensuring that only secure, encrypted sessions can access the bucket's contents.

In this lesson, we explore cross-region replication in AWS S3, focusing on its security implications, permissions required, and the specifics of what gets replicated and what does not. The lesson emphasizes the importance of understanding replication configurations, especially for the AWS Certified Security Specialty exam, and encourages reviewing provided documentation for a deeper understanding.

In this demo, we show how to create an EC2 instance with full access to S3 by assigning it an IAM role with the necessary permissions. This setup will be used in future lessons to explore more advanced AWS concepts.

In this demo, we show how to create a pre-signed URL for an S3 object using the AWS CLI on an EC2 instance, which allows temporary, secure access to the object. After generating the pre-signed URL, we test its functionality and ensure proper cleanup by deleting the associated S3 bucket.

In this demo, we explore how to create a Glacier Vault and implement a Vault Lock policy, which secures data with compliance requirements such as preventing deletion or modification for a set period. This demonstration includes creating the vault, setting up a Vault Lock policy to enforce a one-year retention period, and the importance of validating the policy within 24 hours to ensure it takes effect.

In this lesson, we explore a scenario where an EC2 instance with S3 access could potentially be exploited to upload backups to a malicious S3 bucket, and how to mitigate this risk using a VPC endpoint. By configuring the VPC endpoint to only allow access to a legitimate S3 bucket and applying a network ACL to block public S3 endpoints, we ensure that the EC2 instance can only connect to the authorized bucket, preventing unauthorized data transfers.

In this demo, we'll learn how to secure access to objects in an S3 bucket by setting up a CloudFront distribution with an Origin Access Identity (OAI), ensuring that all public access to the S3 bucket is routed through CloudFront. This setup enhances security by enforcing SSL encryption, utilizing CloudFront's web application firewall, and preventing direct access to the S3 bucket, thereby ensuring that only requests through CloudFront can retrieve the content.

In this lesson, we'll explore the AWS Security Token Service (STS) and its applications in three scenarios: Active Directory Identity Federation, Web Identity Federation, and cross-account access within AWS. The lesson covers how STS is used to issue temporary credentials for users authenticated through these identity providers, ensuring secure and temporary access to AWS resources based on the roles and policies configured.

In this demo, we'll set up cross-account roles in AWS to allow users in one account to access resources in another, specifically enabling an auditor in an audit account to gain read-only access to a production account. This tutorial demonstrates creating the necessary IAM roles, assigning permissions, and configuring trust relationships to securely manage cross-account access, highlighting best practices for limiting and securing access between accounts.

In this demo, we'll explore how to securely grant a third-party auditor access to your AWS account using an external ID. By configuring an IAM role that trusts a unique external ID provided by the third party, you can ensure that only authorized external users can assume the role and access your resources, without needing to create IAM users or share sensitive credentials.

In this lesson, we'll provide a quick summary of Amazon Cognito, highlighting its role in managing user identities for mobile and web applications, including support for identity federation with third-party providers like Facebook, Google, and Apple. We'll cover the basics of Cognito user pools and identity pools, which allow for secure user sign-ups, sign-ins, and role-based access control within AWS, preparing you for more in-depth hands-on demonstrations in the next lesson.

In this demo, we'll show how to best set up a user pool in Amazon Cognito to allow users to sign up and log in to a service through a custom landing page. We'll cover creating the user pool, configuring app client settings, and setting up roles and groups within the pool, with an emphasis on how users can authenticate and gain specific permissions in your AWS account.

In this lesson, you'll be introduced to AWS Secrets Manager, a service that securely manages and rotates secrets like database credentials. We'll explore how to store and retrieve these secrets in AWS environments, such as EC2 instances and Lambda functions, and discuss the importance of using IAM policies to control access to these secrets, which is crucial for the AWS Security Specialty exam.

In this demo, we'll show how to install the AWS Systems Manager (SSM) Agent on an EC2 instance, assign the necessary IAM role, and manage the instance using AWS Systems Manager Fleet Manager. This includes tasks like viewing file systems, managing users, and performing various administrative actions on the EC2 instance directly through the AWS console.

In this demo, we explore how to use AWS Systems Manager's Session Manager to connect to an EC2 instance without requiring a network connection to the instance itself, unlike EC2 Instance Connect which needs SSH access. We demonstrate the setup, including verifying the necessary IAM role and SSM agent, and show how Session Manager continues to work even when the instance's security group blocks SSH access.

In this demo, we'll see how to use AWS Systems Manager Parameter Store to securely store sensitive data, such as database credentials, as a secure string encrypted with KMS. We also cover the necessary IAM permissions required for Lambda functions or EC2 instances to access and decrypt these secure strings, ensuring that sensitive information is securely managed and protected.

In this demo, we'll see the steps to set up an Active Directory Federation Services (ADFS) relationship between an on-premises Active Directory and an AWS account, enabling single sign-on (SSO) for users. Key steps include creating a SAML identity provider in AWS IAM, setting up IAM roles that map to Active Directory security groups, and configuring ADFS as a relying party to establish a secure connection between the on-premises environment and AWS.

In this lesson, we explore the basics of AWS CloudTrail, focusing on how it logs API calls made within an AWS account, regardless of whether they originate from the AWS Console, CLI, or SDKs. CloudTrail provides crucial features for compliance, intrusion detection, and incident investigation, and it allows centralized log aggregation across multiple AWS accounts, with logs typically stored in an S3 bucket for long-term retention and analysis.

In this demo, we'll explore the default configuration for AWS CloudTrail and learn how to set up an S3 bucket to store CloudTrail logs for long-term retention. We'll also discuss how to enable log file encryption, manage lifecycle policies to control the retention of logs, and how to review and audit the logs to track API activity within your AWS account.

In this demo, we explore methods to secure AWS CloudTrail logs, focusing on protecting the S3 buckets where these logs are stored. We cover best practices such as implementing restrictive IAM and bucket policies, enabling encryption and MFA delete, and setting up lifecycle rules, as well as using Lambda functions and SNS notifications to monitor log integrity and ensure compliance with security standards.

In this lesson, we introduce the basics of AWS CloudWatch, including its monitoring capabilities, CloudWatch Logs for centralizing and monitoring log files, and CloudWatch Events for responding to system changes in near real-time. We also highlight the importance of understanding how CloudWatch differs from other AWS services like CloudTrail and CloudFormation, and outline the setup of alarms, custom metrics, and automated actions based on various AWS events.

In this demo, we'll see how to create a CloudWatch Dashboard, allowing you to visualize and monitor key metrics from your AWS resources in one central location. You'll learn how to customize the dashboard by adding widgets to track various metrics like CPU utilization, disk usage, and network activity in real-time.

In this demo, we'll see how to create a CloudWatch log group and explore its basic configurations, such as setting retention policies and enabling encryption with AWS KMS. Additionally, you'll learn about installing the CloudWatch agent on EC2 instances to collect logs and push them into the created log group, providing centralized log management within AWS.

In this demo, we'll explore how to use CloudWatch Events (now integrated into EventBridge) to create rules that trigger automated actions in response to specific events, such as changes in EC2 instance states. We also discuss how these rules can invoke targets like Lambda functions or SNS topics, providing automated, real-time responses to security-relevant events within your AWS environment.

In this demo, we'll see how to create a CloudWatch alarm for monitoring root account usage through CloudTrail logs, focusing on a scenario relevant to the AWS Security Specialty exam. The process involves setting up a CloudTrail trail, configuring CloudWatch Logs, creating a metric filter to detect root account usage, and establishing an alarm that triggers notifications via SNS when such activity is detected.

Before taking your AWS Security Specialty certification exam, it's important to review the FAQs for both CloudWatch and CloudTrail, as they are heavily featured in the exam content. These FAQ pages provide valuable insights that are directly applicable to the types of questions you'll encounter during the exam.

In this lesson, we explore AWS Config, a service that tracks configuration changes to AWS resources, providing valuable compliance and troubleshooting insights. We also discuss how AWS Config integrates with CloudTrail and CloudWatch, supports multi-account and multi-region data aggregation, and allows for custom rules to enforce compliance across your AWS environment.

In this demo, we walk through the basic setup of AWS Config, including enabling it in a specific region, configuring it to record changes for all resources, and setting up an S3 bucket and SNS topic for storing and monitoring configuration changes. We also demonstrate how to create and apply AWS Config rules, such as ensuring no EC2 instances have public IPs, and how to monitor and manage compliance with these rules over time.

In this lesson, we explore AWS Inspector, a tool used to scan applications for vulnerabilities, security exposures, and deviations from best practices, such as EC2 instances with public internet access or outdated software versions. The demonstration includes setting up an Inspector assessment, installing the Inspector agent on an EC2 instance, and reviewing the findings to identify potential security issues.

In this demo, we explore AWS Trusted Advisor, a service that provides real-time guidance to help optimize your AWS environment by recommending best practices for cost optimization, performance, security, and fault tolerance. The demonstration covers how to access and use Trusted Advisor to review your AWS account and implement suggested improvements.

In this lesson, we discuss how to access instance metadata and user data from within an EC2 instance, highlighting that this information is available by querying a specific IP address directly from the instance. We also cover the importance of ensuring that any operating system firewall allows access to this IP address on port 80 to retrieve metadata, which is crucial for the exam.

In this lesson, we'll explore AWS Key Management Service (KMS) and its role in managing encryption keys for AWS services, focusing on the difference between multi-tenant KMS and single-tenant CloudHSM. We'll also cover key concepts like symmetric and asymmetric encryption, customer-managed keys, and the importance of key rotation for security and compliance.

In this demo, we explore how to use AWS Key Management Service (KMS) to encrypt an EBS volume associated with an EC2 instance. This tutorial demonstrates taking a snapshot of an unencrypted volume, creating a new encrypted volume using a customer-managed key from KMS, and attaching that volume to an EC2 instance to ensure data security.

In this demo, we'll show how to create a CloudWatch alarm that detects the usage of an AWS KMS key that is pending deletion. The demonstration walks through configuring a CloudTrail to log KMS events, setting up a metric filter to monitor for pending deletion keys, and creating an alarm that triggers notifications when such a key is detected, highlighting key considerations for AWS certification exams.

In this review, we'll demonstrate how to create an EC2 instance with full access to S3 using an IAM role. The lesson walks through the steps of creating the role, launching an EC2 instance, and verifying that the instance can execute AWS CLI commands against S3, ensuring seamless access and management of S3 resources.

In this demo, we'll see how to use AWS Key Management Service (KMS) by creating an IAM user and assigning it a customer managed key to manage access to encrypted resources. The demonstration includes setting up an S3 bucket, encrypting objects with KMS, and showing how permissions affect access to encrypted data, highlighting the importance of managing and securing encryption keys in AWS.

In this lesson, we'll learn how to import your own key material into AWS Key Management Service (KMS) to create a customer master key (CMK) with your own encryption keys, a process crucial for meeting specific regulatory and security requirements. The tutorial covers the steps for creating a CMK without key material, obtaining and using AWS's public key and import token to encrypt your key material, and finally importing and managing that key within KMS, including setting expiration and rotation policies.

In this demo, we'll learn how to create an EC2 instance in AWS and configure it with a key pair for secure SSH access. The demonstration includes steps to generate and manage key pairs using Putty, connect to the instance, and view the authorized keys that allow access to the instance.

In this demo, We'll see how to generate a new SSH key pair directly on an EC2 instance, add it to the instance's authorized keys, and then download the private key to your local machine for secure access. This process involves creating the key pair on the instance, uploading it to an S3 bucket, converting it into a format compatible with Putty, and using it to connect back to the EC2 instance.

In this demo, we'll see how deleting a key pair from the AWS console does not immediately prevent access to an EC2 instance if the key is still stored locally. To fully remove access, you must manually delete the key from the EC2 instance's authorized keys file, which will then prevent the deleted key from being used to access the instance.

In this brief lesson, we discuss KMS grants, which provide a way to programmatically delegate the use of customer master keys to other AWS principals as an alternative to key policies. Grants are often used for temporary permissions, such as allowing third-party applications access to KMS, and understanding their basic purpose is sufficient for the exam.

In this lesson, we'll introduce key networking concepts necessary for understanding AWS security, such as VPCs, subnets, security groups, and network access lists, which are crucial for the AWS Security Specialty exam. While we'll cover the basics, more advanced topics like VPNs and Direct Connect are not included in this course but are available in the advanced networking course if needed.

In this lesson, we'll explore basic Virtual Private Cloud (VPC) concepts, focusing on how VPCs serve as logical data centers within AWS, allowing you to create and manage resources like route tables, subnets, and network access lists. We'll also cover the structure of VPCs, including how they span availability zones, utilize internet gateways for connectivity, and support both public and private subnets, all while maintaining control over network traffic.

In this demo, we'll see how to create a custom VPC in the AWS console, starting with deleting the default VPC for enhanced security and control. The demonstration will guide you through manually setting up the VPC, configuring subnets, and understanding key components like network ACLs, route tables, and public versus private IP assignments, laying the foundation for future networking demonstrations in the course.

In this demo, we'll see how to create an internet gateway in AWS, associate it with a VPC, and explain its role in providing internet access to resources within that VPC. This lesson is crucial for understanding the distinction between public and private subnets, which is important for the AWS Security Specialty exam.

In this demo, we'll see how to configure public and private subnets within an AWS VPC, highlighting the key differences between them. You'll learn how to create a public subnet, set up a custom route table with an internet gateway, and adjust settings to automatically assign public IP addresses, ensuring that instances within the public subnet have internet access.

In this demo, we'll see how to create and configure a Bastion host (jump box) within an AWS VPC to access privately addressed EC2 instances from the internet. You'll learn how to set up a public EC2 instance, configure it with a public IP, and use it to securely connect to private EC2 instances within the VPC using SSH.

In this lesson, we'll explore NAT gateways and compare them to NAT instances, highlighting their role in providing internet access to instances within a private subnet in an AWS VPC. We'll discuss how NAT gateways handle outbound traffic from private instances, key characteristics for the AWS Security Specialty exam, and why NAT gateways are generally preferred over NAT instances for ease of management and security.

In this demo, we'll see how to create a NAT Gateway in AWS to provide internet access to instances within a private subnet. By updating the route table of the private subnet to point to the NAT gateway, instances in the subnet can now access the internet for tasks like software updates, without needing to be directly exposed to the internet.

In this lesson, we introduce AWS Security Groups, which act as virtual firewalls to control inbound and outbound traffic to AWS resources. We explore how to configure security groups to manage access to your instances effectively, focusing on their role in securing your cloud environment.

In this lesson, we explore the architecture and key differences between AWS Security Groups and Network ACLs. We demonstrate how Security Groups act as stateful firewalls at the instance level, while Network ACLs are stateless and applied at the subnet level, highlighting their roles in controlling traffic within a VPC.

In this demo, we explore how to create and utilize VPC flow logs in AWS to monitor and analyze network traffic within a VPC. We'll demonstrate how flow logs can be used to track accepted and rejected traffic for troubleshooting and security purposes, including setting up IAM roles, creating flow logs, and interpreting the data collected.

In this lesson, you'll learn how to configure SSL termination on an AWS Elastic Load Balancer (ELB) and the implications of terminating SSL/TLS at different points in the architecture, such as the load balancer or the EC2 instances themselves. The tutorial also covers the use of AWS Certificate Manager for managing SSL certificates and discusses the differences between application and network load balancers, including their suitability for different types of traffic and performance requirements.

In this demo, we'll explore AWS Web Application Firewall (WAF), a security service that helps protect your web applications from common web exploits and vulnerabilities. We'll cover how to configure WAF to monitor and control HTTP/S requests based on customizable rules to enhance the security of your web applications.

In this video, we provide an overview of AWS Shield, a service that offers protection against distributed denial of service (DDoS) attacks. We cover the differences between Shield Standard, which is free and automatically included, and Shield Advanced, which offers enhanced protection and 24/7 access to the DDoS response team for a substantial monthly fee, making it suitable for larger organizations.

In this video, we explore third-party Web Application Firewalls (WAFs) available in the AWS Marketplace and demonstrate how to deploy them in a "sandwich" architecture for enhanced security. The sandwich model involves placing WAF instances between two elastic load balancers, allowing for dynamic scaling and thorough inspection of incoming traffic before it reaches your web servers.

In this lesson, we explore VPC endpoints and how they enable secure, private access to AWS services like S3 and DynamoDB without the need for internet gateways, NAT instances, or VPNs. We also discuss the types of VPC endpoints, their integration with route tables, and the importance of configuring DNS resolution and IAM policies for securing and managing traffic within a VPC.

In this lesson, we cover how VPC endpoints powered by PrivateLink can be used to securely connect to AWS KMS without requiring internet access, ensuring all traffic stays within the AWS network. This is crucial for the exam, as it allows direct private communication with KMS, avoiding the need for internet gateways or NAT gateways.

In this lesson, we explore AWS Athena, a serverless service that allows you to query data stored in S3 using SQL, making it easy to analyze large datasets quickly, especially useful for querying CloudTrail logs. The focus is on understanding the basic concepts of Athena and its primary use case for the exam, which involves efficiently querying extensive CloudTrail log data.

In this lesson, we cover AWS Macie, a service that automatically discovers, classifies, and protects sensitive data in S3 buckets, such as personally identifiable information (PII). The focus is on understanding Macie's use case for the exam, particularly its ability to monitor data access, generate alerts for potential risks, and differentiate it from Athena, which is used for querying large datasets.

In this video, we explore Amazon GuardDuty, a threat detection service that continuously monitors for malicious activity and unauthorized behavior using sources like CloudTrail, VPC Flow Logs, and DNS logs. We also cover how to configure GuardDuty, generate sample findings, and use these insights to automate responses to potential security threats.

In this video, we explore AWS Artifact, a central resource for accessing compliance-related reports and certifications issued by auditors, which can be used to demonstrate regulatory compliance to authorities. We walk through how to search for, access, and download key reports, such as those related to PCI, SOC, and ISO standards, within the AWS console to support your organization's compliance efforts.

In this demo, we'll see how to use AWS Systems Manager's Session Manager to securely access EC2 instances without needing a Bastion host or open inbound ports. The session is controlled via IAM roles, and all interactions can be logged in CloudWatch, providing a secure and auditable way to manage EC2 instances directly from the AWS console.

In this lesson, we explore the concept of Distributed Denial of Service (DDoS) resiliency in AWS, focusing on how to protect AWS resources from such attacks by utilizing AWS services like Route 53, CloudFront, and Elastic Load Balancers. We discuss best practices from the AWS DDoS Resiliency Whitepaper, including techniques for obfuscating resources, leveraging auto-scaling, and implementing AWS Shield and Web Application Firewall (WAF) to mitigate and manage potential DDoS threats.

In this lesson, we explore the steps to investigate a potential security incident on an AWS EC2 instance, following the AWS Security Incident Response Guide. Key actions include capturing metadata, enabling termination protection, isolating the instance with a restrictive security group, detaching it from auto-scaling groups and load balancers, creating a snapshot of the root volume, tagging the instance as quarantined, and deciding between online or offline investigation methods.

In this lesson, we cover the steps to take if AWS access keys are inadvertently exposed, such as on platforms like GitHub. The process involves assessing the impact of the exposed keys, invalidating them, considering the invalidation of temporary security credentials, restoring appropriate access, and thoroughly reviewing account activity using tools like CloudTrail and S3 bucket logs to detect any unauthorized actions.

In this lesson, we discuss the updated AWS policy on penetration testing, highlighting the eight AWS services that now allow penetration testing without prior approval, such as EC2 and Lambda. We also explore penetration testing tools available in the AWS Marketplace, like Kali Linux, and emphasize the importance of regularly reviewing AWS policies to ensure compliance when conducting penetration tests.

In this demo, we explore how to use AWS Certificate Manager (ACM) to generate and manage SSL/TLS certificates, which can be used with AWS services like CloudFront and Application Load Balancers. The process includes purchasing a domain through Route 53, validating the domain via DNS, and applying the certificate to AWS services, while emphasizing that certificates are region-specific and must be used with AWS services only.

In this lesson, we explore the concept of microservices and compare them to traditional monolithic applications. Microservices break down a large, complex application into smaller, independent services that can be easily managed, scaled, and deployed, enhancing resilience and flexibility, particularly when using AWS services like Elastic Container Service (ECS) or Lambda for deployment.

In this lesson, we explore the basics of containers and their importance in ensuring software runs reliably across different environments by encapsulating all dependencies within a single, portable "bubble." We also compare containers to traditional virtual machines, highlighting their efficiency, lightweight nature, and suitability for microservices, with Docker being the dominant container technology, and discuss container options in cloud environments like AWS.

In this demo, we'll walk through how to get started with AWS Elastic Container Service (ECS) by launching a simple web server application using Fargate. We'll cover the entire process, from setting up the container definition and configuring the necessary resources, to deploying the application and cleaning up the environment afterward.

In this lesson, we discuss essential security best practices for AWS Elastic Container Service (ECS), including avoiding storing credentials in containers, using IAM roles for permissions, and ensuring containers don't run as root. We also highlight the importance of using trusted images, checking for vulnerabilities, and minimizing the attack surface by keeping containers simple and focused on specific functions.