AWS Security · Domain 3
Infrastructure Security
About 18% of the exam
Security groups against network ACLs
Security group
- Stateful, return traffic allowed automatically
- Attached to an elastic network interface
- Allow rules only
- All rules evaluated together
- Can reference another security group
Network ACL
- Stateless, needs ephemeral port rules
- Attached to a subnet
- Allow and deny rules
- Lowest rule number wins
- Good for a blunt address block
Choosing
- Microsegment with security groups
- Block a bad range with ACLs
- Changes apply almost immediately
- The default ACL allows everything
Security groups are the precise tool and network ACLs are the coarse backstop at the subnet edge
VPC building blocks
- Subnet
- lives in one Availability Zone
- Internet gateway
- public traffic in and out
- NAT gateway
- outbound only for private subnets
- Egress-only gateway
- outbound only for IPv6
- Route table
- decides where the packet goes
- Blackhole route
- drops traffic to that range
- Peering
- point to point, not transitive
- Transit Gateway
- hub with separate routing domains
VPC endpoints and PrivateLink
- Gateway endpoint for S3 and DynamoDB
- Gateway endpoint is a route entry
- Interface endpoint is a private ENI
- Interface endpoints carry security groups
- Endpoint policy limits which principals
- PrivateLink publishes your own service
- Keeps traffic off the public internet
- aws:PrincipalOrgID scopes an endpoint policy
Access without bastions
- Session Manager replaces SSH bastions
- Needs ssm, ssmmessages and ec2messages endpoints
- No inbound ports, no key pairs
- Port forwarding tunnels to private hosts
- Session logs to S3 and CloudWatch
- Run-as user set in preferences
- Instance Connect Endpoint for direct SSH
The instance metadata service
- Metadata service hands out role credentials
- IMDSv2 requires a session token first
- Set HttpTokens to required fleet wide
- Hop limit of one blocks containers
- Server side request forgery steals credentials
- Launch templates enforce the default
- Block pod access to node metadata
Edge and inspection services
AWS WAF
- Web ACL on ALB, CloudFront, API Gateway
- Managed rule groups consume capacity units
- Rate based rules throttle floods
- Count mode before you block
- Bot Control and CAPTCHA actions
Shield
- Standard is free network layer protection
- Advanced adds DDoS cost protection
- Shield Response Team on call
- Automatic application layer mitigation
Network Firewall
- Stateful Suricata rules per VPC
- TLS inspection with your certificate
- Alert logs and flow logs differ
- Gateway Load Balancer speaks GENEVE
DNS controls
- Resolver DNS Firewall blocks bad domains
- Block response can be NXDOMAIN
- Resolver query logging records every lookup
- Long random subdomains suggest exfiltration
- Private hosted zones need both DNS attributes
- enableDnsSupport and enableDnsHostnames must be on
Compute hardening
- Golden images built by Image Builder
- Dedicated Hosts give single tenant hardware
- Nitro Enclaves isolate sensitive processing
- Patch Manager reports patch compliance
- Lambda code signing in enforce mode
- ECR immutable tags stop silent overwrites
- Pull through cache for upstream images
Container and serverless boundaries
- ECS task role scopes each task
- The awsvpc mode gives tasks an ENI
- IRSA maps service accounts to roles
- Cluster OIDC provider is the trust anchor
- Lambda in private subnets plus endpoints
- Layer permissions limit who consumes them
Connectivity choices
- Site-to-Site VPN
- encrypted tunnels over the internet
- Direct Connect
- private circuit, predictable latency
- MACsec
- layer two encryption on Direct Connect
- Link aggregation group
- bundles circuits for more bandwidth
- VPN CloudHub
- branch sites through one gateway
- Transit Gateway
- hub and spoke at scale
- PrivateLink
- one service, many consumer VPCs
- Client VPN
- remote users into the VPC
Direct Connect is private but not encrypted on its own, so layer a VPN over it or use MACsec
The inspection path
- CloudFront
- WAF web ACL
- Load balancer
- Network Firewall
- Workload subnet
Centralize inspection in a hub VPC and pull spoke traffic through it with the Transit Gateway
Traffic visibility
- Flow Logs at VPC, subnet or interface
- Custom format adds packet level fields
- Traffic Mirroring copies packets to appliances
- Truncation limits how much is mirrored
- Firewall alert logs show rule matches
- Flow Logs never contain payloads
Network mistakes the exam punishes
Reachability
- Peering treated as segmentation
- Ephemeral ports missing on network ACLs
- Forgotten route makes the endpoint unreachable
- Private DNS attributes left off
Exposure
- Open security group on the database
- Public subnet chosen out of habit
- IMDSv1 still enabled on instances
- Endpoint service open to everyone
Blind spots
- No Flow Logs on the VPC
- Encrypted traffic never inspected
- DNS queries never logged
- Firewall running only in alert mode
Service names to know
- Managed web firewall
- AWS WAF web ACL
- Volumetric flood
- AWS Shield Advanced
- Suricata rules
- AWS Network Firewall
- Third-party appliance
- Gateway Load Balancer
- Shell without SSH
- Systems Manager Session Manager
- Private service exposure
- AWS PrivateLink
- Domain blocking
- Route 53 Resolver DNS Firewall
- Policy across accounts
- AWS Firewall Manager
Know the order
- Route table
- Network ACL
- Security group
- Host firewall
- Application
A packet must survive every layer in order, so check the route table before blaming the security group
Reference strip: segmentation, private access, edge, hardening, visibility
Segmentation
- Separate subnets per tier
- Security groups referencing each other
- Network ACLs as coarse deny
- Transit Gateway routing domains
Private access
- Gateway endpoints for S3, DynamoDB
- Interface endpoints for the rest
- PrivateLink for partner services
- Endpoint policies scope principals
Edge defense
- CloudFront in front of origins
- WAF managed rule groups
- Shield Advanced for large floods
- Rate based rules on login paths
Hardening
- IMDSv2 required everywhere
- Golden images and patch baselines
- Session Manager instead of bastions
- Task and pod level roles
Visibility
- VPC Flow Logs
- Resolver query logging
- Traffic Mirroring for packets
- Firewall alert and flow logs
Quick exam traps
- Trap: Security groups are stateless, so return traffic needs its own rule
- Trap: A network ACL can reference a security group as its source
- Trap: VPC peering is transitive across a chain of peered VPCs
- Trap: Interface endpoints are free in the same way gateway endpoints are
- Trap: Shield Standard has to be purchased and switched on per account
- Trap: Session Manager needs an inbound SSH rule on the instance
- Trap: Direct Connect encrypts traffic between the data center and AWS
- Trap: A NAT gateway gives instances a way to accept inbound connections
cybercertprep.com · original revision sheet written from the public body of knowledge