AWS Security – Tightening up your Amazon Deployments

We’ve talked about AWS security before – what tools AWS has created for us and some common mistakes people make – but you never can really cover the whole thing. So I’ve put together a checklist of some key best practices that’s guaranteed to mess with your next night’s sleep.

Thinking of launching an EC2 instance as a testbed? Not sure whether it’ll still be up a month from now? Don’t stop reading…now’s the time to think about AWS security!

Avoid using the default AWS security group

Everyone loves a default setting because it can help you avoid thinking for yourself…and who has time for that? Sure, you can always keep adding new policies to a single AWS security group so it will work with all your nodes, but try not to.

Instead, create separate security groups for each network traffic profile you plan to use and use them only when the fit is perfect. Besides the risk of introducing vulnerabilities, overusing default configurations can lead to bad architecture design and practices. Also, if you force yourself to create new security groups for each project, you’ll actually end up thinking a whole lot more about your larger design, which will probably improve it.

Open only those ports that are absolutely necessary

If the only access you will need is SSH, then make sure that’s all you leave open. Afraid you may need POP3 or MySQL access some time over the next six months? Wait until you actually need it.

Restrict access to sessions originating on your IP

When you set up a security group in AWS and open a certain port, you can also choose the Source. This controls which traffic will be allowed to reach your instance. Rather than leaving it wide open (0.0.0.0/0), specify a single IP address or an IP address range in CIDR notation (for example, 203.0.113.0/24).

Even better: if you select “My IP” for “source”, AWS should automatically populate your public IP.

Use meaningful names

You may not think it is possible, but twelve months from now, you may be looking after a huge AWS infrastructure with 50 or more security groups. Which of these AWS security group names do you think would work best?

  1. security_group1
  2. my-sg
  3. ssh_access_port22_only_WordPress_server
  4. jimmies_best_security_group_ever

Hopefully, you guessed (2) ssh_access_port22_only because it tells us exactly what it does and what it’s meant for. You get the idea.
If you look at the screenshot below, I’m in the middle of configuring the launch of an EC2 instance. In Step 6: Configure Security Group, I chose:

  • A meaningful security group name.
  • A description that explains it even better.
  • SSH access only
  • Only my IP
AWS Security - Create a new security group

Remove (or don’t even generate) a Root Account Access Key

One of the best ways to protect your account is to not have an access key for your root account. Unless there’s some reason that you absolutely must have a root access key (which is very rare), it is best not to generate one. Instead, the recommended best practice is to create one or more AWS Identity and Access Management (IAM) users, give them the necessary permissions, and use IAM users for everyday interaction with AWS.

If you already have an access key for your account, AWS recommends that you find all the applications currently relying on it key, replace the root access key with an IAM user access key, and then disable and remove the root access key.

AWS security: summary

Security is important – and nowhere more so than in the cloud. From my experience, you need to get the basics in place first and the rest of your security should build out naturally. So, to review, I would suggest focusing on these points for your AWS security plan:

  • Avoid using the default security group.
  • Only open ports that need to be open.
  • Use names that are meaningful for your Security Group
  • Choose to access from your IP only unless wider access is needed (eg:HTTP)
  • Remove (or don’t generate) a Root Account Access Key

If you want to get a jump start on cloud security, check out Cloud Academy’s Security training library.

Avatar

Written by

Michael Sheehy

I have been UNIX/Linux System Administrator for the past 15 years and am slowly moving those skills into the AWS Cloud arena. I am passionate about AWS and Cloud Technologies and the exciting future that it promises to bring.


Related Posts

Alisha Reyes
Alisha Reyes
— January 28, 2020

Cloud Academy’s Blog Digest: Top 5 AWS Salary Report Findings, How To Become a Cybersecurity Professional, 8 Financial Benefits of Cloud Migration, and more

Now that it's 2020, how many times have you caught yourself dating a paper 2019? Don't lie. It's happened at least once or twice — or a handful of times — I'm sure. And if you're a member of the "perfect club" that hasn't made any 2020 mistakes, then we're still happy to have you in our...

Read more
  • AWS
  • aws salary
  • blog digest
  • Cloud Academy
  • Cloud Adoption
  • Cloud Migration
  • Cybersecurity
Patrick Navarro
Patrick Navarro
— January 22, 2020

Top 5 AWS Salary Report Findings

At the speed the cloud tech space is developing, it can be hard to keep track of everything that’s happening within the AWS ecosystem. Advances in technology prompt smarter functionality and innovative new products, which in turn give rise to new job roles that have a ripple effect on t...

Read more
  • AWS
  • salary
Alisha Reyes
Alisha Reyes
— January 6, 2020

New on Cloud Academy: Red Hat, Agile, OWASP Labs, Amazon SageMaker Lab, Linux Command Line Lab, SQL, Git Labs, Scrum Master, Azure Architects Lab, and Much More

Happy New Year! We hope you're ready to kick your training in overdrive in 2020 because we have a ton of new content for you. Not only do we have a bunch of new courses, hands-on labs, and lab challenges on AWS, Azure, and Google Cloud, but we also have three new courses on Red Hat, th...

Read more
  • agile
  • AWS
  • Azure
  • Google Cloud Platform
  • Linux
  • OWASP
  • programming
  • red hat
  • scrum
Alisha Reyes
Alisha Reyes
— December 24, 2019

Cloud Academy’s Blog Digest: Azure Best Practices, 6 Reasons You Should Get AWS Certified, Google Cloud Certification Prep, and more

Happy Holidays from Cloud Academy We hope you have a wonderful holiday season filled with family, friends, and plenty of food. Here at Cloud Academy, we are thankful for our amazing customer like you.  Since this time of year can be stressful, we’re sharing a few of our latest article...

Read more
  • AWS
  • azure best practices
  • blog digest
  • Cloud Academy
  • Google Cloud
Avatar
Guy Hummel
— December 12, 2019

Google Cloud Platform Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— December 10, 2019

New Lab Challenges: Push Your Skills to the Next Level

Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...

Read more
  • AWS
  • Azure
  • Google Cloud
  • hands-on
  • labs
Alisha Reyes
Alisha Reyes
— December 5, 2019

New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More

Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...

Read more
  • AWS
  • AWS solution architect
  • AZ-203
  • Azure
  • cyber security
  • FCCS
  • Foundation Certificate in Cyber Security
  • Google Cloud Platform
  • Kubernetes
Avatar
Cloud Academy Team
— December 4, 2019

Understanding Enterprise Cloud Migration

What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...

Read more
  • AWS
  • Azure
  • Data Migration
Wendy Dessler
Wendy Dessler
— November 27, 2019

6 Reasons Why You Should Get an AWS Certification This Year

In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...

Read more
  • AWS
  • Certifications
  • certified
Avatar
Andrea Colangelo
— November 26, 2019

AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around

The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...

Read more
  • AWS
Avatar
Dzenan Dzevlan
— November 20, 2019

Application Load Balancer vs. Classic Load Balancer

What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...

Read more
  • ALB
  • Application Load Balancer
  • AWS
  • Elastic Load Balancer
  • ELB
Albert Qian
Albert Qian
— November 13, 2019

Advantages and Disadvantages of Microservices Architecture

What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...

Read more
  • AWS
  • Docker
  • Kubernetes
  • Microservices