AWS Control Tower & VPC Traffic Mirroring

AWS re:Inforce 2019 is a two-day conference for security, identity, and compliance learning and community building. This year’s keynote, presented by AWS Vice President and CIO, Stephen Schmidt, announced the general availability of AWS Control Tower and the new VPC Traffic Mirroring feature. These two announcements resonated with me, and I wanted to expand upon them to help you gain valuable insights into how Amazon Web Services (AWS) manages security at scale.

In this article, we’ll take a closer look at each of these topics. To dive deeper and train on the leading security tools and best practices in the cloud, test your skills, and keep your cloud environment secure and compliant, check out Cloud Academy’s Security Training Library

AWS Control Tower

Migrating to AWS can be a big challenge for organizations. Any help with infrastructure, account design, security, and implementing operational controls would be welcomed by many.  This is where AWS Control Tower can help. It has been designed to help create and outline a multi-account AWS environment that conforms to best practices defined within the AWS Well-Architected Framework, including security and key operational services as a landing zone.  

AWS Control Tower helps ensure that your AWS accounts meet standards required and stipulated by specific compliance controls. It includes the option to adopt and implement AWS Config Rules as a part of the deployment, ensuring specific controls are being met. AWS Config Rules provide a great method to help you enforce specific compliance controls and checks across your resources and allows for you to adopt an ‘ideal’ deployment specification for each of your resource types. Each rule is simply a Lambda function. When called upon, it evaluates the resource and carries out some simple logic to determine the compliance result with the rule.  AWS Control Tower will also provide a summary of each AWS account to show its compliance with your policies to show if there is a violation against any AWS Config Rules.

Guardrails

Control Tower also uses a feature known as guardrails within your AWS Organizations organizational unit (OU). These guardrails can be both mandatory and optional to help enforce security compliance and governance across your accounts. Examples of mandatory guardrails include controls such as:

  • Disallowing changes to IAM roles set up for AWS Control Tower
  • Disallowing public read access to log archive
  • Disallowing policy changes to log archive

In addition to these mandatory guardrails, there are also numerous recommended guardrails that you can enable or disable, such as disallowing public write access to Amazon S3 buckets. As well as being either mandatory or optional, these guardrails fall into two categories: preventive and detective. Preventive guardrails stop actions that fail to comply with your policies, and detective guardrails identify non-compliance within your accounts.  

AWS Control Tower automatically and efficiently implements new accounts. This can be configured to use other management tools,  such as AWS Organizations and AWS Service Catalog, to help you maintain greater control over your AWS environment. 

Blueprints

Much of this configuration is simplified in an automated setup through the use of Control Tower blueprints. These best-practice blueprints provide a template configuration centered around AWS security and management services. This helps to deploy your infrastructure using key features, such as federation, logging, audit control, enhanced network design, and workflows to help provision accounts.

Here are a number of examples of what the different blueprints can assist you with:

  • Configure AWS Organizations to create a multi-account environment
  • Provide identity management using AWS SSO Users and Groups 
  • Federate access using AWS single sign-on
  • Centralize logging using AWS CloudTrail and AWS Config
  • Enable cross-account security audits using AWS IAM
  • Implement network design using Amazon VPC
  • Define workflows for provisioning accounts using AWS Service Catalog

As a part of the overall management of your multi-account environment, AWS Control Tower allows you to view your infrastructure from a top-level summary via a dashboard which provides information such as:

  • Number of accounts provisioned
  • Number of policies enabled across all of your accounts
  • Compliance status of your accounts

Summary

In short, AWS Control Tower is a powerful new addition to the ever-expanding security, identity & compliance category of AWS services to govern and secure multiple AWS accounts. For more information on AWS Config and AWS Organizations, check out the following links:

VPC Traffic Mirroring

Within any organization, security analysts strive to understand what traffic is being generated by resources across the network to discover potential security threats and weaknesses and to troubleshoot incidents. By using AWS virtual private clouds (VPCs), one method of capturing this traffic is to deploy agents across your resources to track and capture network traffic from your EC2 instances. As your environments grow and you deploy more and more VPCs, this approach of agent-based deployments can become very cumbersome and difficult to maintain and manage.

I am pleased to report that AWS has now developed and designed a new solution to resolve this problem. VPC Traffic Mirroring is a new feature within the VPC service, allowing you to duplicate network traffic generated from your resources within your VPC. This traffic can then be sent to another instance or appliance for further analysis and inspection without the use of any third party agents installed on your resources, simplifying management and control of traffic capturing. VPC Traffic Mirroring is only available on sources running Nitro-based instances

Bandwidth

As this process duplicates traffic, this additional load counts towards your bandwidth associated with the source instance. If your bandwidth limit reaches capacity, causing congestion, then AWS will first drop your mirrored traffic used by VPC Traffic Mirroring to help alleviate the congestion. 

Design

Per design best practices, it’s recommended that you forward your duplicated network traffic to a Network Load Balancer (NLB), which then forwards the traffic to a fleet of appliances sitting behind it via a UDP listener. If required, you can simply forward the traffic to a single instance or appliance, but you should design with high availability in mind.

The great thing about VPC Traffic Mirroring is that the instances or appliance that performs the traffic analysis can be in a different VPC than that of the source generating the traffic. This allows you to achieve a hub and spoke design, drawing in traffic collated from multiple different VPCs all being directed from a single VPC dedicated for security analysis and detecting network anomalies. Again, this design helps with management and control of your resources.

Mirror filter

With added configurational parameters, its possible to implement mirror filtering to allow you to specify which network packets you are interested in capturing. For example if you want to analyze all traffic using a specific port and protocol, such as SSH, then this could be configured via a mirror filter.  

VPC Mirror Filter

Any traffic that matches the mirror filter criteria would be captured, and any that didn’t would be dropped at the source. This prevents your appliances and instances from having to analyze ALL traffic generated by a resource when you may only be interested in a specific subset of the traffic.

Components

The components used within VPC Traffic Mirroring are easy to define. Firstly, we need a source.  This can be any resource within your VPC which uses an Elastic Network Interface (ENI), such as an EC2 instance.  

You must also have a mirror target as well, which is where the traffic will be sent. As I explained earlier, this would generally be a network load balancer, but you can specify an ENI of another instance or appliance as required. This target can even be in a different VPC as the source.

To restrict which traffic is captured at your source, you can set and configure your mirror filters which are created as rules, based on protocols, ranges, and CIDR blocks. These rules are then read in order and the appropriate action is taken as soon as a match is found, much like a network access control list (NACL).

The final component is a mirror session. This essentially defines the logical connection between a source and a target and it’s associated mirror filters. You can create more than one mirror session for a source. For example, as shown in the diagram below, you can create a mirror session (Mirror session 1) that captures all TCP traffic from Source A to Target A. Then another mirror session (Mirror session 2) captures all UDP traffic from Source A (again) but to a different Target: Target B.  

VPC Mirroring Traffic

This might be helpful if you have different tools on each target that you will use to analyze different types of traffic. However, be aware there is a limit of three mirror sessions per ENI.

Summary

Being able to monitor network traffic across multiple VPCs without having to implement agents on monitored resources simplifies network analysis for incident identification and resolution, security anomalies, and compliance. The ability to couple this configuration with existing security tools obtained from the AWS Marketplace makes this a very powerful tool in the security of VPCs.

Avatar

Written by

Stuart Scott

Stuart has been working within the IT industry for two decades covering a huge range of topic areas and technologies, from data center and network infrastructure design, to cloud architecture and implementation. To date, Stuart has created 100+ courses relating to Cloud reaching over 120,000 students, mostly within the AWS category and with a heavy focus on security and compliance. Stuart is a member of the AWS Community Builders Program for his contributions towards AWS. He is AWS certified and accredited in addition to being a published author covering topics across the AWS landscape. In January 2016 Stuart was awarded ‘Expert of the Year Award 2015’ from Experts Exchange for his knowledge share within cloud services to the community. Stuart enjoys writing about cloud technologies and you will find many of his articles within our blog pages.


Related Posts

Amanda Cross
Amanda Cross
— April 9, 2021

New Content: Platforms, Programming, and DevOps – Something for Everyone

This month our team of expert certification specialists released three new or updated learning paths, 16 courses, 13 hands-on labs, and four lab challenges! New content on Cloud Academy You can always visit our Content Roadmap to see what’s just released as well as what’s coming soon....

Read more
  • alibaba
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • programming
  • Security
Luca Casartelli
Luca Casartelli
— March 31, 2021

Mastering AWS Organizations Service Control Policies

Service Control Policies (SCPs) are IAM-like policies to manage permissions in AWS Organizations. SCPs restrict the actions allowed for accounts within the organization making each one of them compliant with your guidelines. SCPs are not meant to grant permissions; you should consider ...

Read more
  • AWS
  • Organizations
  • SCP
Amanda Cross
Amanda Cross
— March 12, 2021

New Content: Focus on DevOps and Programming Content this Month

This month our team of expert certification specialists released 12 new or updated learning paths, 15 courses, 25 hands-on labs, and four lab challenges! New content on Cloud Academy You can always visit our Content Roadmap to see what’s just released as well as what’s coming soon. Ja...

Read more
  • alibaba
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • programming
Amanda Cross
Amanda Cross
— February 12, 2021

New Content: Get Ready for the CISM Cert Exam & Learn About Alibaba, Plus All the AWS, GCP, and Azure Courses You Know You Can Count On

This month our team of intrepid certification specialists released five learning paths, seven courses, 19 hands-on labs, and three lab challenges!  One particularly interesting new learning path is Certified Information Security Manager (CISM) Foundations. After completing this learn...

Read more
  • alibaba
  • AWS
  • Azure
  • cism
  • DevOps
  • Google Cloud Platform
  • programming
Avatar
Cloud Academy Team
— January 31, 2021

Which Certifications Should I Get?

The old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and companies. With all that in mind, the s...

Read more
  • AWS
  • Azure
  • Certifications
  • Cloud Computing
  • Google Cloud Platform
Avatar
Andrew Larkin
— January 31, 2021

The 12 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing. As the market leader and most ma...

Read more
  • AWS
  • AWS Certifications
Avatar
Stuart Scott
— January 29, 2021

AWS Certified Solutions Architect Associate: A Study Guide

Want to take a really impactful step in your technical career? Explore the AWS Solutions Architect Associate certificate. Its new version (SAA-C02) was released on March 23, 2020. The AWS Solutions Architect - Associate Certification (or Sol Arch Associate for short) offers some ...

Read more
  • AWS
  • AWS Certifications
  • AWS Certified Solutions Architect Associate
Amanda Cross
Amanda Cross
— January 7, 2021

New Content: AWS Terraform, Java Programming Lab Challenges, Azure DP-900 & DP-300 Certification Exam Prep, Plus Plenty More Amazon, Google, Microsoft, and Big Data Courses

This month our Content Team continues building the catalog of courses for everyone learning about AWS, GCP, and Microsoft Azure. In addition, this month’s updates include several Java programming lab challenges and a couple of courses on big data. In total, we released five new learning...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Avatar
Stuart Scott
— December 17, 2020

Where Should You Be Focusing Your AWS Security Efforts?

Another day, another re:Invent session! This time I listened to Stephen Schmidt’s session, “AWS Security: Where we've been, where we're going.” Amongst covering the highlights of AWS security during 2020, a number of newly added AWS features/services were discussed, including: AWS Audit...

Read more
  • AWS
  • AWS re:Invent
  • cloud security
Joe Nemer
Joe Nemer
— December 4, 2020

AWS re:Invent: 2020 Keynote Top Highlights and More

We’ve gotten through the first five days of the special all-virtual 2020 edition of AWS re:Invent. It’s always a really exciting time for practitioners in the field to see what features and services AWS has cooked up for the year ahead.  This year’s conference is a marathon and not a...

Read more
  • AWS
  • AWS Glue Elastic Views
  • AWS re:Invent
Bryony Harrower
Bryony Harrower
— November 6, 2020

WARNING: Great Cloud Content Ahead

At Cloud Academy, content is at the heart of what we do. We work with the world’s leading cloud and operations teams to develop video courses and learning paths that accelerate teams and drive digital transformation. First and foremost, we listen to our customers’ needs and we stay ahea...

Read more
  • AWS
  • Azure
  • content roadmap
  • GCP
Joe Nemer
Joe Nemer
— October 25, 2020

Excelling in AWS, Azure, and Beyond – How Danut Prisacaru Prepares for the Future

Meet Danut Prisacaru. Danut has been a Software Architect for the past 10 years and has been involved in Software Engineering for 30 years. He’s passionate about software and learning, and jokes that coding is basically the only thing he can do well (!). We think his enthusiasm shines t...

Read more
  • AWS
  • careers
  • champions
  • upskilling