What did AWS Re: Invent bring us in terms of Security?
Re: Invent is the most anticipated event by the AWS community, not only because of the networking and relationships that are based there but also because it is time to learn first-hand what new tools or features AWS will offer us for this new cycle.
In the case of security, the announcements have contemplated various tools, let's see what they are about.
Amazon Security Lake
Allows you to centralize security events automatically from cloud, on-premises, and custom security sources across Regions, giving you the chance to optimize and manage security data for more efficient storage and query performance.
The current AWS services that provide info to compile logs activity are:
Amazon VPC
Amazon S3
AWS Lambda
Amazon Route 53
AWS CloudTrail
AWS Security Hub
Also, by intermediating Security Hub, any service that has integration with it can send info to the data lake.
The principal benefit of this data lake is that it allows you to analyze the data using your preferred analytics tools while retaining control and ownership of your security data. You can use Amazon Athena, Detective, OpenSearch or SageMaker from the AWS side, or any other 3rd party tool. This is possible because the data is normalized to an industry standard like Open Cybersecurity Schema Framework, avoiding vendor lock-in.
Amazon GuardDuty RDS Protection
It’s a threat detection for Amazon Aurora databases that allows you to identify potential threats to data stored in your Amazon Aurora databases. It uses machine learning by continuously monitoring existing and new Amazon Aurora databases in your organization.
So now, you will easily identify if your DB users are having anomalous behavior, like trying to connect from outside the organization when always connecting from inside, or if your database is facing password spraying, or suffering brute force attacks trying to discover your user's passwords.
It has a free trial and you shouldn’t have a database performance impact or require modifications to enable it.
Amazon Inspector for Lambda Functions
With this, Amazon Inspector is able to map vulnerabilities detected in software dependencies (CVE) used in AWS Lambda functions and in the underlying Lambda layers. It supports automatic exclusion for functions that haven’t been invoked during 90 days and manual exclusion based on tags. -it costs 0.30 U$S per function, per month (don’t need to pay extra per re-scan)
Amazon Macie Automated Data Discovery
The interactive S3 data map allows you to easily check the strength of your data security posture; how many buckets are encrypted, allow public access, etc.
Another benefit of this map is that due that Macie now automatically scans bucket objects searching for sensitive data, you can check in the interactive map the report of sensitive data and sensitivity score for each bucket, providing you cost-efficient visibility into sensitive data stored in Amazon S3.
It has a 30-day free trial and then It’s billed according to the total amount of objects in s3 for your account, on a daily basis.
Amazon Verified Permissions
It validates user identity through the integration with several trust providers allowing you to sync user profiles, attributes, and group memberships; and the accompaniment of fine-grained Permissions and authorization rules. This way it generates a security perimeter around the application, with policy and schema management
It simplifies compliance audits at scale, identifies overprovisioned permissions, and connects to monitoring workflows that analyze millions of permissions across applications with the power of automated reasoning
It allows you to build applications faster and support Zero Trust, architectures with dynamic, real-time authorization decisions based on the govern fine-grained permissions within applications and data with policy lifecycle management
AWS KMS external key store (XKS)
This feature has as its objective to provide users who want to protect their data with a ciphered key that isn’t stored in the cloud (due to country regulations or compliance requirements): it extends existing AWS KMS custom key store feature beyond AWS CloudHSM (customer-controlled, single-tenant HSM inside AWS datacenters) to keys in on-premises HSM, providing the same integration that KMS has with all the AWS services.
AWS Config Proactive Compliance
Proactively check for compliance with AWS Config rules prior to resource provisioning. Running these rules before provisioning, for example in an infrastructure-as-code CI/CD pipeline, you can earlier detect non-compliant resources, and this saves you time remediating non-compliant resources in the future when all the system is operative!
AWS Control Tower – Comprehensive Controls Management
By defining a map, and managing the controls required to meet the most common control objectives and regulations you can apply managed preventative, detective, and proactive controls to accounts and organizational units (OUs) by service, control objective, or compliance framework, reducing the time to vet AWS services from months or weeks to minutes
AWS Control Tower Account Factory Customization (AFC)
Previously, only standard settings were available for VPCs, etc., and customization required a combination of Customization for Control Tower, etc. Now, Service Catalog products can be specified when creating an account or adding an Account to Control Tower. The product is automatically deployed when an account is created, and the initial setup of the account is performed.
Service Catalog products are defined in CloudFormation templates, allowing for flexible initial setup.
If you are interested in learning more about these new features, you can check the playlist with the re: Invent sessions related to Security, compliance, and Identity.
To learn about the top announcements click here.
Lourdes Dorado
Cloud Engineer
Teracloud
If you want to know more about Cloud Security, we suggest going check Best Security Practices, Well-Architected Framework
If you are interested in learning more about our #TeraTips or our blog's content, we invite you to see all the content entries that we have created for you and your needs. And subscribe to be aware of any news! 👇
