Improve Governance over Configuration Changes
•
0 gefällt mir•665 views
AWS Config enables you to discover what resources are used on AWS, understand how resources are configured and gives you unprecedented visibility into changes to configurations over time – all without disrupting end user productivity. With Config Rules, you can continuously evaluate whether changes to resources are compliant with policies. You can set up predefined rules, provided and managed by AWS, or author your own rules using Amazon Lambda, and these rules are evaluated whenever relevant resources are modified. You can use this visibility and control to assess and improve your security and compliance posture.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Andere mochten auch (20)
Mehr von Amazon Web Services
Mehr von Amazon Web Services (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Improve Governance over Configuration Changes
- 1. Improve Governance Over Configuration Changes Liron Dor, Technical Account Manager
- 2. Governance Requirements • Allow our organization to move fast • Visibility over used resources • Define Best Practices and enforce them • Meet Compliance and Regulations • Validate compliance continuously • Alerting and Auto-healing • Automatic control over Manual control © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 3. Governance Challenges • Dynamic environments • High complexity • Different requirements for different environments • Multiple Accounts © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 4. Tools We Offer • Tracking • AWS Config • AWS CloudTrail • VPC Flow Logs • Amazon Inspector • Track / Log • Amazon CloudWatch Logs • Amazon DynamoDB • Amazon ElasticSearch • Alert • AWS Config Rules • Amazon Simple Notification Service (SNS) • AWS Trusted Advisor • Amazon CloudWatch Events • And More… © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 5. AWS Config • Records configuration changes continuously • Capturing the state of your AWS resources • “Configuration Item” contains all attributes for a resource • Capturing the relationship between resources • Discover resources that exists or deleted • Receive notifications on configuration changes © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 6. AWS Config Rules © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 7. AWS Config Rules • Validate configuration record • Enforce Best Practices and procedures • Result is either “compliant” or “non-compliant” © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 8. AWS Config Rules Demo • “Center of Internet Security” (CIS) is a Non Profit organization dedicated to enhancing the cybersecurity readiness and response among public and private sector entities. • Published “CIS AWS Foundations” Security Best Practices document • AWS Config Rules Repository © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 9. Demo © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
- 10. Summary • Allow our organization to move fast • Know your account, wanted and unwanted changes • Automate your best practices / compliance metrics • Use Logs for forensic, Alerts for immediate actions © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Hinweis der Redaktion
- Available in all regions except Beijing Price Currently: Config: $0.003 per Configuration Item recorded Config Rules: $2 per active rule per month & $0.10 per thousand evaluations (Beyond 20K Evaluations that are free)
- Current Existing Regions: Virginia, Oregon, Ireland, Frankfurt, Tokyo, Missing: Seoul, California, Singapore, Sydney, Sao Paulo Put Evaluation (The Evaluation Result structure) [ { "ComplianceResourceType": "string", "ComplianceResourceId": "string", "ComplianceType": "COMPLIANT"|"NON_COMPLIANT"|"NOT_APPLICABLE"|"INSUFFICIENT_DATA", "Annotation": "string", "OrderingTimestamp": timestamp } ... ]
- Current Existing Regions: Virginia, Oregon, Ireland, Frankfurt, Tokyo, Missing: Seoul, California, Singapore, Sydney, Sao Paulo Put Evaluation (The Evaluation Result structure) [ { "ComplianceResourceType": "string", "ComplianceResourceId": "string", "ComplianceType": "COMPLIANT"|"NON_COMPLIANT"|"NOT_APPLICABLE"|"INSUFFICIENT_DATA", "Annotation": "string", "OrderingTimestamp": timestamp } ... ]
- https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf https://github.com/awslabs/aws-config-rules