Visibility and control over AWS infrastructure

How does AWS CloudTrail aid in gaining visibility over AWS infrastructure?

AWS CloudTrail helps to gain visibility over AWS infrastructure by providing a log of all user activities and API usage across your AWS account. It records and retains account activity for audits, enabling governance, compliance, operational auditing, and risk auditing of your AWS account. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.

How can you implement fine-grained access control to your AWS resources?

You can implement fine-grained access control using AWS Identity and Access Management (IAM). IAM allows you to create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. IAM policies can be attached to these entities to define the level of access control. IAM also supports conditions in policies for specifying when, where, and how resources can be accessed.

Describe how you would use Amazon GuardDuty for threat detection.

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior to help protect your AWS accounts and workloads. You would enable it across all your AWS accounts and regions, it then uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. GuardDuty analyzes events across multiple AWS data sources such as VPC Flow Logs, CloudTrail event logs, and DNS logs.

Can you explain how AWS Config helps maintain compliance and enhances visibility?

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It provides a detailed view of the configuration of resources in your AWS account, including how resources are related to one another and how they were configured historically. This helps with compliance, as it records changes to the environment, ensuring that required configurations are in place and alerting when changes occur that might take you out of compliance.

What security advantages does Amazon VPC Flow Logs provide?

Amazon VPC Flow Logs provide visibility into network traffic that traverses your VPC, allowing you to capture information about the IP traffic going to and from network interfaces in your VPC. This enables you to detect anomalous traffic or monitor network security by logging the IP, port, and protocol. It’s useful for troubleshooting, as well as for ensuring that network access rules are allowing the desired traffic and blocking the rest.

Describe the steps for setting up a centralized logging solution in AWS.

To set up a centralized logging solution in AWS, you would:

• Enable AWS CloudTrail and Amazon CloudWatch Logs across all accounts and regions.
• Create an Amazon S3 bucket to store logs and configure access policies for security.
• Aggregate logs using AWS services or third-party solutions by configuring forwarding rules.
• Optionally use AWS Lambda functions to transform or process logs as they arrive.
• Integrate Amazon Elasticsearch Service or another log analytics service to index and analyze the log data.
• Set up monitoring, alerts, and dashboards using CloudWatch or a similar service to visualize and respond to log data.

What role does AWS Service Catalog play in controlling your AWS environment?

AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. This helps to standardize provisioning and manage resources effectively. It ensures that only pre-configured and approved resources can be provisioned, thus enabling consistency, compliance, and control across the AWS infrastructure.

How would an AWS KMS Customer Master Key (CMK) improve your infrastructure’s security?

An AWS KMS Customer Master Key (CMK) improves infrastructure security by enabling you to create, manage, and use your own encryption keys to protect your data. AWS services use the CMKs to encrypt resources, such as S3 bucket contents or EBS volumes. The use of CMKs ensures that you control access to the key and, by extension, the data.

What mechanisms are in place in AWS to detect and prevent DDoS attacks?

AWS provides AWS Shield, with standard and advanced options, to protect applications against DDoS attacks. AWS Shield Standard offers protection against common, most frequently occurring network and transport layer DDoS attacks and is included at no extra cost with AWS services. AWS Shield Advanced provides additional protection against larger and more sophisticated attacks, detailed attack diagnostics, and the cost of scaling in response to DDoS attacks.

How can AWS Systems Manager help you manage your server fleet?

AWS Systems Manager provides visibility and control over your infrastructure on AWS by allowing you to centrally manage servers at scale. It provides a unified user interface to view operational data from multiple AWS services and allows you to automate operational tasks across your AWS resources. With Systems Manager, you can group resources, like EC2 instances or RDS databases, define their desired state, and automate tasks such as patching, software provisioning, and configuration management.

What is Amazon Macie, and how does it help secure AWS data services?

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in AWS. Macie automatically provides an inventory of Amazon S3 buckets, classifies data to highlight potentially sensitive content, and provides an alert system when it detects data access anomalies or when data may be at risk.

What function does AWS WAF serve in application security?

AWS WAF (Web Application Firewall) helps protect web applications and APIs from common web exploits and bots that may affect availability, compromise security, or consume excessive resources. It allows you to control traffic to your application by configuring rules that block, allow, or monitor (count) web requests based on conditions like IP addresses, HTTP headers, HTTP body, or custom URIs. This enables you to mitigate application-layer attacks, such as SQL injection and cross-site scripting (XSS).