Amazon Web Services (AWS) approaches security using a shared responsibility model with our customers. We manage and control the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. As part of that model, our customers are responsible for building secure applications. We will provide a complete walkthrough from a blank canvas to a secure architecture from a development perspective. No matter the size of your team, you can implement your IT solutions using industry wide best security practices.

1. A Walk through the AWS Cloud: Building
Secure Architectures on AWS
Oyvind Roti
Solutions Architect
Amazon Web Services

3. Migrate existing apps &
data to the cloud
Build new apps, sites,
services & lines of
businesses
Augment On-Premises
resources with cloud
capacity
How customers use AWS

4. No Up-Front Capital Expense Pay Only for What You Use
Easily Scale Up and Down Improve Agility & Time-to-Market
Low Cost
Deploy
Self-Service Infrastructure

5. AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Amazon
AWS Global Infrastructure - Resilience

6. Compute
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Amazon
AWS Foundation Services
Amazon EC2
Storage Database Networking
Amazon S3
Amazon EBS
Amazon Glacier
DynamoDB
Amazon RDS
Amazon Redshift Route 53
Amazon VPC
AWS Direct Connect
Foundation Services

7. Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Amazon
AWS Platform Security
• SOC 1 (SSAE 16 & ISAE 3204) Type II Audit (was SAS70)
• SOC 2 Type 1 Audit, SOC 3 Report
• ISO 27001 Certification
• Payment Card Industry Data Security Standard (PCI DSS)
Level 1 Service Provider
• FedRAMP (FISMA), ITAR, FIPS 140-2
• Cloud Security Alliance Questionnaire
• MPAA (best practices for storage, processing, delivery)

8. Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Client-side Data Encryption & Data Integrity
Authentication
Server-side Encryption
(File System and/or Data)
Network Traffic Protection
(Encryption/Integrity/Identity)
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer DataAmazonYou
Shared responsibility model

9. Securing your cloud
applications

10. Resilience and Availability
DR in SNG
DR in US-WEST

11. • Security Groups
• Inbound traffic must be explicitly
specified by protocol, port, and
security group
• VPC adds outbound filters
• VPC also adds Network Access Control
Lists (ACLs): inbound and outbound
stateless filters
• OS Firewall (e.g., iptables) may be
implemented
• user controlled security layer
• granular access control of
discrete hosts
• logging network events
Encrypted
File System
Encrypted
Swap File
OSFirewall
AmazonSecurityGroups
VPCNetworkACL
Inbound Traffic
Network Security Layers

16. Virtual Private Cloud – an extension of your DC
AWS Direct
Connect
AWS Virtual Private Cloud

17. Identity and Access Management (IAM)
• Users and Groups within Accounts
• Unique security credentials
• Access keys
• Login/Password
• optional MFA device
• Policies control access to AWS APIs
• API calls must be signed by either:
• X.509 certificate
• secret key
• Deep integration into some Services
• S3: policies on objects and buckets
• Simple DB: domains
• AWS Management Console supports User log on
• Not for Operating Systems or Applications
• use LDAP, Active Directory/ADFS, etc...

18. IAM Federation

19. • Access controls at bucket and
object level:
– Read, Write, Full
• Owner has full control
• Customer Encryption
• SSL Supported
• Durability 99.999999999%
• Availability 99.99%
• Versioning (MFA Delete)
• Detailed Access Logging
Amazon S3 Security

20. • Secure Key Storage: Tamper-resistant, customer controlled
hardware security module within your VPC
• Only you have access to your keys (including Amazon
administrators who manage and maintain the appliance).
• Common Criteria EAL4+, NIST FIPS 140-2.
• Reliable & Durable Key Storage: available in multiple AZs and
Regions, or replicate to on-premise HSMs
http://aws.amazon.com/cloudhsm/
CloudHSM (new in 2013)

21. • Answers to many security & privacy questions
• Security whitepaper
• Risk and Compliance whitepaper
• Security bulletins
• Customer penetration testing
• Security best practices
• More information on:
• AWS Identity & Access Management (AWS IAM)
• AWS Multi-Factor Authentication (AWS MFA)
AWS Security and Compliance Centre
http://aws.amazon.com/security