Improve Security Posture with Baseline Security Measures”

Hey there! It sounds like you’re ready to take some steps towards securing your AWS account and resources, and that’s great! In this article, we’ll cover some fundamental areas to get you started, whether you’re just getting started on AWS or you need to improve your current security posture. Keep in mind that this is just a starting point, and there may be other areas to consider based on your specific use case. But don’t worry, we’ll make sure you’re on the right track!

Part 1 – Secure Your AWS Account

Ok so you have a shiny new AWS account. Here are a few things you can do to protect it right from the beginning.

1. Protect the Root User

That’s right! The root user is the most privileged user in your AWS account, and securing this account should be your first priority. Enabling multi-factor authentication (MFA) adds an extra layer of security and helps prevent unauthorized access to your account. It’s also a best practice to delete any access keys associated with the root account to prevent unauthorized programmatic access to your account. With these two actions, you can significantly improve the security of your AWS account.

2. Create Users and Groups

That’s correct! Creating a user with admin rights and using that user for your daily operations is a best practice for securing your AWS account. By doing this, you can control the level of access that each user has to your resources and you can limit the potential for accidental or intentional harm.

Creating user groups with specific permissions and assigning users to those groups can also help streamline access control management and make it easier to manage user permissions. It’s important to regularly review and update user permissions to ensure that they are still appropriate and aligned with business needs.

3. CloudTrail

Alrighty then! AWS CloudTrail is like a detective that helps you keep tabs on what’s going on in your AWS account. It’s a log of all the API calls made through AWS Management Console, AWS SDKs, command-line tools, and other AWS services. That means you’ll know who did what, when they did it, and what services they used. And the best part? It’s enabled by default for most AWS services like Amazon S3, AWS Lambda, and Amazon EC2.

With CloudTrail, you can monitor and log all kinds of account activity, from user actions to services and roles. This way, you’ll always know who’s doing what, when, and where. It’s like having a security camera for your AWS account! Plus, CloudTrail can send logs to Amazon S3 or Amazon CloudWatch Logs for storage, analysis, and archiving. So, you can always go back and review the logs to make sure everything is on the up-and-up.

Don’t forget, it’s important to review your CloudTrail logs regularly to stay on top of all the activity in your AWS account. You never know what kind of security or compliance issues you might uncover!

4. Preventing Public Access to S3

Now, let’s talk about why it’s so important to prevent public access to S3, shall we? S3 is a cloud-based storage service offered by AWS that’s used to store all sorts of data, including sensitive and confidential information. Allowing public access to this data can be a real doozy, resulting in serious security breaches, privacy violations, and data leaks that can cause all sorts of trouble. Plus, it can drive up your costs, as unauthorized access can consume additional storage and bandwidth resources. To avoid all this hullabaloo, it’s crucial to put some proper access controls in place, like limiting access to specific users and roles.

5. Configuring Alarms

All righty then, let me tell you something important about AWS! You gotta configure those billing alarms, like pronto! AWS is a powerful tool, but you can rack up some serious bills if you’re not careful. That’s where the billing alarms come in, my friend. They’ll alert you when you’re getting close to your budget or if your costs start skyrocketing like a flock of bats. Trust me, you don’t want to be caught with your pants down when that AWS bill comes in! So, make sure you configure those billing alarms like a true pet detective, and you’ll never be caught off guard.

6. What to do with unused VPC resources?

So, let me tell you something interesting. When you create a new AWS account, a default VPC is set up for you automatically in every Region. Pretty cool, huh? But here’s the thing – this default VPC is preconfigured to assign public IP addresses to resources in public subnets, which could be a bit risky if you’re not careful. So, what you need to do is make sure you delete or disable any resources you’re not using to minimize the chances of unintended exposure.

7. AWS Trusted Advisor

Listen up, amigos! We got ourselves an AWS Trusted Advisor in the house! This little fella here can passively scan your entire AWS infrastructure for any high-risk or high-impact issues related to security, performance, cost, and reliability. And guess what? It ain’t just a scanner, it’s got all the juicy deets about the affected resources and remediation recommendations too!

Now, let me tell ya, this service is a real gem! You definitely want to use it, I’m not kiddin’ ya! In fact, you should make it a part of your regular routine to review the Trusted Advisor findings and fix any issues pronto! Don’t be slacking off on this one, folks. AWS Trusted Advisor is your best bet for keeping your AWS game strong!

8. GuardDuty

Well, well, well…let me tell you about this AWS service called Amazon GuardDuty. It’s a smart little fella that keeps a watchful eye on all the malicious and unauthorized behavior that may threaten your AWS accounts, workloads, Kubernetes clusters, and data stored in Amazon S3. And when it detects something fishy, it delivers detailed security findings so you can quickly take action to protect your assets.

Now, I’ve covered GuardDuty in quite a few of my content pieces, and let me tell you, it’s a lifesaver. This bad boy can sniff out all sorts of trouble, from sneaky cryptocurrency mining activity to sketchy Tor clients and relays, and even compromised IAM credentials. That’s some serious firepower.

So, my advice to you? Don’t be a rookie. Make it a priority to set up GuardDuty in either a single AWS Account or in a multi-account AWS Organizations. Take some time to learn how to read GuardDuty findings, and make sure you set up EventBridge and SNS to get notified of any GuardDuty findings by email. Trust me, you’ll sleep a lot better at night knowing GuardDuty has got your back.

Part 2 – Securing Your Workloads

Now that the account is secure, let’s dive into some ways to keep your workloads safe and sound on AWS.

1. IAM Permissions

Ah, yes, IAM! It’s the backbone of your security on AWS, and it touches everything in your AWS account. One of the top security design principles is to implement a strong identity foundation. That means you gotta implement the principle of least privilege and enforce separation of duties with the right authorization for every interaction with your AWS resources. And let me tell ya, centralizing identity management is absolutely crucial. We want to eliminate reliance on long-term static credentials!

To get this done, you can use IAM roles for compute environment permissions, use ephemeral secrets or a secrets management service, and keep those application secrets from being exposed.

2. Protecting Data

Ho-ho-hold on a second! When it comes to safeguarding your data on AWS, you gotta get your encryption game on! Encryption takes your precious data and transforms it into unreadable ciphertext that only you and your trusted peeps can decrypt. It’s like putting your data in a lockbox and only giving the key to the people you trust. AWS offers a range of features to help you implement encryption and other security measures to protect your data from prying eyes.

Here are some tasks you can do to beef up your data security game:

1. Keep those private Amazon S3 buckets private, and don’t let any uninvited guests sneak in!
2. Log data events for S3 buckets that contain sensitive data so you can keep an eye on things.
3. Encrypt those Amazon EBS volumes and keep your data safe from snoopers.
4. Protect your Amazon RDS databases with encryption to keep your data under lock and key.
5. Make sure all your public web endpoints use HTTPS so your data doesn’t get intercepted by any shady characters.

3. Securing Infrastructure

Oh, ho ho, securing your network is no laughing matter, folks. It’s serious business. And let me tell you, AWS has got some serious firepower to help you protect your assets. We’re talking about AWS Systems Manager, the big dog in town when it comes to secure access to your resources. Forget about old school SSH or RDP. And while we’re at it, keep your private resources in private subnets, where they belong. That’s just common sense. Don’t forget to lock it down with security groups and NACLs. And for public endpoints, you’ll want to bring in the big guns: AWS WAF and AWS Network Firewall. Trust me, folks, with these tools at your disposal, you’ll be well on your way to securing your network like a pro.

4. Advanced Protection

Oh, you better believe it, there’s a lot more you can do to tighten up your security game! It’s like adding layers to a delicious cake – the more layers you add, the more delicious and secure it becomes. Some of these extra measures include detecting and fixing exposed secrets, limiting credential access with resource-based policies, using VPC endpoints to access AWS and external services, and setting up security controls with templates and deploying them with CI/CD practices. Don’t leave any stone unturned when it comes to security – protect your AWS environment like a mama bear protects her cubs!

Conclusion

Hey there, pet detective! That was some great information you just shared. If you’re looking to learn more about AWS security, be sure to check out the Security Essentials page I put together. And if you want to see me in action, you can catch me on Twitch or watch my videos on Youtube. Don’t forget to like, subscribe, and share with your fellow detectives!

Name that tone!

If you’re reading this and wondering why it might not sound like me, its because I’ve written the entire article and had AI convert it to the one of one of my favorite characters from the 90’s. Can you name the tone?