The cloud enables users to run workloads more securely than they could in a traditional data center. However, customers are still not sure how to harden their AWS accounts and resources in order to enforce compliance. Consistency around governance can also be a concern when large customers have multiple accounts. In this session, we show you how to use automation, tools, and techniques to harden and audit your AWS account as well as how to leverage AWS Organizations to ensure compliance in your enterprise.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Brad Dispensa
Specialist, Security / Compliance AWS Public Sector
SID202
Secure Your AWS Account and Your
Organization’s Accounts

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is going on here?
You want to know:
• How can I better secure my AWS environment?
• How can I make sure all the accounts in our organization are
following the rules?
• How can I detect threats in one or many accounts?
• What tools should I be using?
• How can I know that new accounts are secure by default?

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. AWS
ENDPOINTS
AWS GLOBAL
INFRASTRUCTURE
REGIONS
AVAILABILITY
ZONES
EDGE
LOCATIONS
FOUNDATION
SERVICES
STORAGE DATABASES NETWORKINGCOMPUTE
AWSIAM
OPTIONAL – OPAQUE DATA:
0s & 1s (In transit / at rest)
CLIENT-SIDE DATA ENCRYPTION
& DATA INTEGRITY AUTHENTICATION
OPERATING SYSTEM, NETWORK & FIREWALL CONFIGURATION
PLATFORM & APPLICATION MANAGEMENT
CUSTOMER DATA
MANAGED BY
AWS CUSTOMERS
MANAGED BY
AMAZON WEB
SERVICES
NETWORK TRAFFIC PROTECTION PROVIDED BY THE PLATFORM
Protection of data in transit
SERVER SIDE ENCRYPTION PROVIDED BY THE PLATFORM
Protection of data at rest
AWS
ENDPOINTS
AWS GLOBAL
INFRASTRUCTURE
REGIONS
AVAILABILITY
ZONES
EDGE
LOCATIONS
FOUNDATION
SERVICES
STORAGE DATABASES NETWORKINGCOMPUTE
AWSIAM
OPTIONAL – OPAQUE DATA: 0s & 1s (In transit / at rest)
CLIENT-SIDE DATA ENCRYPTION
& DATA INTEGRITY
AUTHENTICATION
SERVER-SIDE ENCRYPTION
File System and/or Data
NETWORK TRAFFIC PROTECTION
Encryption / Integrity / Identity
OPERATING SYSTEM, NETWORK & FIREWALL CONFIGURATION
PLATFORM & APPLICATION MANAGEMENT
CUSTOMER DATA
CUSTOMERIAM
MANAGED BY
AWS CUSTOMERS
MANAGED BY
AMAZON WEB
SERVICES
AWS
ENDPOINTS
AWS GLOBAL
INFRASTRUCTURE
REGIONS
AVAILABILITY
ZONES
EDGE
LOCATIONS
FOUNDATION
SERVICES
STORAGE DATABASES NETWORKINGCOMPUTE
AWSIAM
OPTIONAL – OPAQUE DATA: 0s & 1s (In transit / at rest)
CLIENT-SIDE DATA ENCRYPTION
& DATA INTEGRITY
AUTHENTICATION
NETWORK TRAFFIC PROTECTION
Encryption / Integrity / Identity
OPERATING SYSTEM, NETWORK CONFIGURATION
PLATFORM & APPLICATION MANAGEMENT
CUSTOMER DATA
CUSTOMERIAM
MANAGED BY
AWS CUSTOMERS
MANAGED BY
AMAZON WEB
SERVICES
FIREWALL
CONFIGURATION
Shared responsibility model
Infrastructure
services
Containers
services
Abstract services

7. Set a standard to follow
1. Map your infrastructure against control frameworks
1. NIST
2. PCI
3. CIS Benchmark
4. CJIS
5. HIPAA

8. CIS example
Example: OSS validation for CIS AWS Foundation Framework
$ git clone https://github.com/awslabs/aws-security-benchmark.git
$ cd aws-security-benchmark/aws_cis_foundation_framework
$ python aws-cis-foundation-benchmark-checklist.py

9. Report this way…

10. Or this…

11. Or maybe just this
{"Failed":["1.3", "1.4", "1.5", "1.6", "1.7", "1.8", "1.9", "1.10", "1.11", "1.14", "1.16",
"1.22", "1.23", "2.2", "2.4", "2.5", "2.6", "2.6", "2.8", "3.1", "3.2", "3.3", "3.4", "3.5",
"3.6", "3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "etc"]}

12. Or maybe just this
{"Failed":["1.3", "1.4", "1.5", "1.6", "1.7", "1.8", "1.9", "1.10", "1.11", "1.14", "1.16",
"1.22", "1.23", "2.2", "2.4", "2.5", "2.6", "2.6", "2.8", "3.1", "3.2", "3.3", "3.4", "3.5",
"3.6", "3.7", "3.8", "3.9", "3.10", "3.11", "3.12", "etc"]}
Control output based on consumer of data and post-processing of result

13. Goals
Supplement active security events with automation
• Automation doesn’t sleep, eat, or need coffee in the morning
Prevent bad configurations before they are implemented
Autocorrect / remediate violations where possible
Daily / instant benchmark validation of infrastructure
• Validate against industry frameworks
• Extend to remediation

14. OSS code to learn from
git-secrets – Prevents you from committing passwords and other sensitive information to a git repository
aws-security-benchmark – Benchmark scripts mapped against trusted security frameworks
aws-config-rules – [Node, Python, Java] Repository of sample custom rules for AWS Config
Netflix/security_monkey – Monitors policy changes and alerts on insecure configurations in an AWS account
Netflix/edda – Edda is a service to track changes in your cloud deployments
ThreatResponse – Open Source Security Suite for hardening and responding in AWS
CloudSploit – Capturing things like open security groups, misconfigured VPCs, and more
Stelligent/Cfn_nag – Looks for patterns in CloudFormation templates that may indicate insecure infrastructure
Capitalone/cloud-custodian – Rules engine for AWS fleet management

17. Amazon EC2 Systems Manager
Run Command State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store Documents

19. Amazon EC2 Systems Manager
Run Command State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store Documents

20. Amazon EC2 Systems Manager
Run Command

23. AWS CloudTrail
Run
Command
Data flow example
client
AWS API
Amazon S3
bucket
Security account
Amazon
EC2

26. Run
Command
Data flow example
client
AWS API
Amazon
EC2

27. Automatic remediation
GuardDuty CloudWatch Events Lambda
Amazon
GuardDuty
Amazon
CloudWatch
CloudWatch
Events
Lambda
function
AWS Lambda

29. import boto3
import json
def lambda_handler(event, context):
try:
if event['detail']['type'] in [‘Backdoor:EC2/C&CActivity.B!DNS’]:
response =‘<do something here>’
except Exception, e:
print e

30. Run
Command
Data flow example
Client
AWS API
Amazon
EC2
Lambda
function

32. VPC Flow Logs
• Agentless
• Enable per ENI, per subnet, or per VPC
• Logged to Amazon CloudWatch Logs
• Create CloudWatch metrics from log data
• Alarm on those metrics
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start/end time
Accept
or reject

33. VPC Flow Logs: Automation
Amazon
SNS
CloudWatch
Logs
Private subnet
Compliance
app
AWS
Lambda
If SSH REJECT > 10,
then…
Elastic
Network
Interface
Metric filter
Filter on all
SSH REJECTFlow Logs group
CloudWatch
alarm
Source IP

34. Let’s go even further

35. Security threats via IP ranges
IP-threats.json
SG-ALB
Amazon SNS
AWS Lambda

36. Account A
Account B
Account B
Security account
Amazon S3
bucket1.2.3.4/32
1.2.3.4/32
1.2.3.4/32

38. Port scanning?

39. Use the API instead

41. Availability Zone A
Private subnet Private subnet
AWS Region
Virtual
Private
Gateway
VPN
connection
Intranet
app
Intranet
app
Availability Zone B
Internal customers
Private route table
Destination Target
10.1.0.0/16 Local
Corp CIDR VGW
VPC
Internal application to VPC
Customer
network

42. Availability Zone A
Private subnet Private subnet
AWS
Region
Virtual
Private
Gateway
VPN
connection
Intranet
app
Intranet
app
Availability Zone B
You really don’t want to do this:
Amazon
S3
Internet
Customer
border router
Customer VPN
Internet
VPC
Customer
network

43. Availability Zone A
Private subnet Private subnet
AWS
Region
Virtual
Private
Gateway
Intranet
app
Intranet
app
Availability Zone B
So do this instead:
Amazon
S3
VPC
VPN
connection
VPC Endpoints
• No IGW
• No NAT
• No public IPs
• Free
• Robust access
control
Customer
network

44. Private subnet Private subnet
AWS
Region
Intranet
apps
Compliance
app
Endpoints in action
VPC
Compliance Backups
VPCE1 VPCE2
Private subnet
Intranet
apps
Private subnet Private subnet
Private subnet

45. AWS PrivateLink
Share AWS, customer and
partner services privately
between VPCs and
on-premises networks
Secure. Scalable. Reliable.
On-Premises
Resources
Service VPC
Network
Load-
Balancer
AWS
Direct
Connect
Client VPC 1
Client VPC 2
Client VPC 3
VPC Endpoint
VPC
Endpoint
VPC
Endpoint

47. AWS Config Rules
• Set up rules to check configuration changes recorded
• Use pre-built rules provided by AWS
• Author custom rules using AWS Lambda
• Invoked automatically for continuous assessment
• Use dashboard for visualizing compliance and identifying offending changes

51. AWS
Config
Rule Amazon
CloudWatch
Rule AWS
Lambda
1. Delete the security group change
2. Lock users account

52. AWS CloudTrail
Web service that records AWS API calls for your account and delivers logs
Who? When? What? Where to? Where from?
Bill 3:27pm Launch Instance us-west-2 72.21.198.64
Alice 8:19am Added Bob to
admin group
us-east-1 127.0.0.1
Steve 2:22pm Deleted
DynamoDB table
eu-west-1 205.251.233.176

54. Access Advisor is cool, but today it’s GUI access only

55. select
useridentity.sessioncontext.sessionIssuer.userNa
me as uid, eventsource, eventname
from cloudtrail_logs
Where
useridentity.sessioncontext.sessionIssuer.userNa
me = ‘target-name’
GROUP BY
useridentity.sessioncontext.sessionIssuer.userNa
me, eventsource, eventname
Query cloud trail data for the target user or role with
Athena

56. https://github.com/Netflix-Skunkworks/aardvark https://github.com/Netflix/Repokid

57. Event
(event-based)
Amazon
CloudWatch
AWS re:Invent 2016: Automating Security Event Response, from Idea to Code to
Execution (SEC313)
https://youtu.be/x4GkAGe65vE
Adversary Responder

58. Adversary
cloudtrail:StopLogging
CloudTrail

59. CloudWatch
Events event
Adversary
{
"detail-type": [ "AWS API Call via CloudTrail" ],
"detail": {
"eventSource": [ "cloudtrail.amazonaws.com" ],
"eventName": [ "StopLogging" ]
}
}

60. Adversary Responder
cloudtrail.start_logging

62. Restrict an IAM role to a region
{ "Version": "2012-10-17",
"Statement": [
{ "Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets",
"ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "ec2:DescribeInstances", "ec2:DescribeImages",
"ec2:DescribeKeyPairs", "rds:Describe*", "iam:ListRolePolicies", "iam:ListRoles",
"iam:GetRole", "iam:ListInstanceProfiles", "iam:AttachRolePolicy", "lambda:GetAccountSettings"
],
"Resource": "*" },
{ "Effect": "Allow",
"Action": [ "ec2:RunInstances", "rds:CreateDBInstance", "rds:CreateDBCluster",
"lambda:CreateFunction", "lambda:InvokeFunction" ],
"Resource": "*",
"Condition": {"StringEquals": {"aws:RequestedRegion": ”us-east-1"}} }, {
"Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::account-
id:role/Please-use-a-specific-role" } ]
}

64. Amazon Inspector
• Vulnerability Assessment Service
• Built from the ground-up to support DevSecOps
• Automatable via APIs
• Integrates with CI/CD tools
• On-Demand Pricing model
• Static & Dynamic Rules Packages
• Generates Findings

65. Assessments and results

67. Amazon Inspector Rules
• Rules packages
• Common vulnerabilities & exposures
• Center for Internet Security (CIS) Benchmarks
• Security best practices
• Runtime behavior analysis

68. Amazon Inspector security best practices
• Authentication
• Network security
• Operating system
• Application security
• Disable root login over SSH
• Password complexity
• Permissions for system directories
• Secure protocols
• Data execution prevention enabled

75. Example Corp.
AWS
Organizations
Compliance
accounts
Research
accounts
HIPAA PCI Clinical Non-Clinical
A
B
C D E
F

76. OCP supported in Service Control Policies (SCPs)
• Enables you to control which AWS service APIs are accessible
- Define the list of APIs that are allowed – whitelisting
- Define the list of APIs that must be blocked – blacklisting
• Cannot be overridden by local administrator
• Resultant permission on IAM user/role is the intersection
between the SCP and assigned IAM permissions
• Must be used in unison with IAM policy
• IAM policy simulator is SCP aware

77. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "redshift:*",
"Resource": "*"
}
]
}
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances",
"ec2:DescribeImages",
"ec2:DescribeKeyPairs",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": "*"
}
]
}
Blacklisting example Whitelisting example

78. Security Audit account
ec2 describe-instances
ec2 describe-security-groups
…
Account A
Security
Account B
user
Read only
Audit
AWS
CloudTrail
AWS
CloudTrail
Log-DataAmazon
S3
Amazon
CloudWatch
Amazon
CloudWatch
Amazon
SNS
Alarm Topic
SNSTopic
SNSTopic
MFA token
long-term
security
credential
Log Analysis
Amazon
EC2

79. Example Corp.
Compliance
accounts
Research
accounts
HIPAA PCI Clinical Non-Clinical
A
B
C D E
F
Security
account
Read only
Audit

81. GuardDuty account relationships
• Adding accounts to the services is simple and done via the console or API
• Invites accepted from an account will be designated as “Member” accounts. The requestor
will be the “Master” account
Member
account
……. .
1
Member
account
1000 (max)
Master account
Can do the following to all accounts:
• Generate sample findings
• Configure and view/manage findings
• Suspend guardduty service
• Upload and manage trusted IP and threat
IP lists (coming soon!)
Can only disable own account. Member accounts
must all be removed first and by the member
account
Member Account actions and
visibility is limited to the member
account
Each Account Billed Separately.

82. Enforce consistency

83. From To

84. AWS CloudFormation + AWS Organizations

89. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
That’s just the first part

90. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Default Security group example
Account A
Security Account B
AWS
CloudFormation
stack
TemplatesAmazon
S3
AWS
Lambda
AWS
Lambda
AWS
Lambda

91. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

92. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

93. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Default security group example
Account A
Security Account B
AWS
CloudFormation
Stack
TemplatesAmazon
S3
AWS
Lambda
AWS
Lambda
AWS
Lambda

94. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

95. AWS Service Catalog
DevelopersOrganizations
Standardize
Control
Govern
Agility
Self-service
Time to market
…allows organizations to create and manage catalogs of
IT services and software on AWS

96. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Landing Zone
https://aws.amazon.com/answers/aws-landing-zone/

97. Control AWS provisioning (cost, security, governance)
self-service portal – one-stop shop
Standardized deployments
Version control for AWS users
Enforce governance and compliance proactively
Integrate with ITSM tools
Centrally manage IT service lifecycle
Use cases
Why use an AWS Service Catalog?

98. Summary

99. Submit Session Feedback
1. Tap the Schedule icon.
2. Select the session you
attended.
3. Tap Session Evaluation to
submit your feedback.

100. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!