We’ve talked about AWS security before – what tools AWS has created for us and some common mistakes people make – but you never can really cover the whole thing. So I’ve put together a checklist of some key best practices that’s guaranteed to mess with your next night’s sleep.
Thinking of launching an EC2 instance as a testbed? Not sure whether it’ll still be up a month from now? Don’t stop reading…now’s the time to think about AWS security!
Avoid using the default AWS security group
Everyone loves a default setting because it can help you avoid thinking for yourself…and who has time for that? Sure, you can always keep adding new policies to a single AWS security group so it will work with all your nodes, but try not to.
Instead, create separate security groups for each network traffic profile you plan to use and use them only when the fit is perfect. Besides the risk of introducing vulnerabilities, overusing default configurations can lead to bad architecture design and practices. Also, if you force yourself to create new security groups for each project, you’ll actually end up thinking a whole lot more about your larger design, which will probably improve it.
Open only those ports that are absolutely necessary
If the only access you will need is SSH, then make sure that’s all you leave open. Afraid you may need POP3 or MySQL access some time over the next six months? Wait until you actually need it.
Restrict access to sessions originating on your IP
When you set up a security group in AWS and open a certain port, you can also choose the Source. This controls which traffic will be allowed to reach your instance. Rather than leaving it wide open (0.0.0.0/0), specify a single IP address or an IP address range in CIDR notation (for example, 203.0.113.0/24).
Even better: if you select “My IP” for “source”, AWS should automatically populate your public IP.
Use meaningful names
You may not think it is possible, but twelve months from now, you may be looking after a huge AWS infrastructure with 50 or more security groups. Which of these AWS security group names do you think would work best?
Hopefully, you guessed (2) ssh_access_port22_only because it tells us exactly what it does and what it’s meant for. You get the idea.
If you look at the screenshot below, I’m in the middle of configuring the launch of an EC2 instance. In Step 6: Configure Security Group, I chose:
- A meaningful security group name.
- A description that explains it even better.
- SSH access only
- Only my IP
Remove (or don’t even generate) a Root Account Access Key
One of the best ways to protect your account is to not have an access key for your root account. Unless there’s some reason that you absolutely must have a root access key (which is very rare), it is best not to generate one. Instead, the recommended best practice is to create one or more AWS Identity and Access Management (IAM) users, give them the necessary permissions, and use IAM users for everyday interaction with AWS.
If you already have an access key for your account, AWS recommends that you find all the applications currently relying on it key, replace the root access key with an IAM user access key, and then disable and remove the root access key.
AWS security: summary
Security is important – and nowhere more so than in the cloud. From my experience, you need to get the basics in place first and the rest of your security should build out naturally. So, to review, I would suggest focusing on these points for your AWS security plan:
- Avoid using the default security group.
- Only open ports that need to be open.
- Use names that are meaningful for your Security Group
- Choose to access from your IP only unless wider access is needed (eg:HTTP)
- Remove (or don’t generate) a Root Account Access Key
If you want to get a jump start on cloud security, check out Cloud Academy’s Security training library.
Cloud Academy’s Blog Digest: Top 5 AWS Salary Report Findings, How To Become a Cybersecurity Professional, 8 Financial Benefits of Cloud Migration, and more
Now that it's 2020, how many times have you caught yourself dating a paper 2019? Don't lie. It's happened at least once or twice — or a handful of times — I'm sure. And if you're a member of the "perfect club" that hasn't made any 2020 mistakes, then we're still happy to have you in our...
Top 5 AWS Salary Report Findings
At the speed the cloud tech space is developing, it can be hard to keep track of everything that’s happening within the AWS ecosystem. Advances in technology prompt smarter functionality and innovative new products, which in turn give rise to new job roles that have a ripple effect on t...
New on Cloud Academy: Red Hat, Agile, OWASP Labs, Amazon SageMaker Lab, Linux Command Line Lab, SQL, Git Labs, Scrum Master, Azure Architects Lab, and Much More
Happy New Year! We hope you're ready to kick your training in overdrive in 2020 because we have a ton of new content for you. Not only do we have a bunch of new courses, hands-on labs, and lab challenges on AWS, Azure, and Google Cloud, but we also have three new courses on Red Hat, th...
Cloud Academy’s Blog Digest: Azure Best Practices, 6 Reasons You Should Get AWS Certified, Google Cloud Certification Prep, and more
Happy Holidays from Cloud Academy We hope you have a wonderful holiday season filled with family, friends, and plenty of food. Here at Cloud Academy, we are thankful for our amazing customer like you. Since this time of year can be stressful, we’re sharing a few of our latest article...
Google Cloud Platform Certification: Preparation and Prerequisites
Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2019, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the second consecuti...
New Lab Challenges: Push Your Skills to the Next Level
Build hands-on experience using real accounts on AWS, Azure, Google Cloud Platform, and more Meaningful cloud skills require more than book knowledge. Hands-on experience is required to translate knowledge into real-world results. We see this time and time again in studies about how pe...
New on Cloud Academy: AWS Solution Architect Lab Challenge, Azure Hands-on Labs, Foundation Certificate in Cyber Security, and Much More
Now that Thanksgiving is over and the craziness of Black Friday has died down, it's now time for the busiest season of the year. Whether you're a last-minute shopper or you already have your shopping done, the holidays bring so much more excitement than any other time of year. Since our...
Understanding Enterprise Cloud Migration
What is enterprise cloud migration? Cloud migration is about moving your data, applications, and even infrastructure from your on-premises computers or infrastructure to a virtual pool of on-demand, shared resources that offer compute, storage, and network services at scale. Why d...
6 Reasons Why You Should Get an AWS Certification This Year
In the past decade, the rise of cloud computing has been undeniable. Businesses of all sizes are moving their infrastructure and applications to the cloud. This is partly because the cloud allows businesses and their employees to access important information from just about anywhere. ...
AWS Regions and Availability Zones: The Simplest Explanation You Will Ever Find Around
The basics of AWS Regions and Availability Zones We’re going to treat this article as a sort of AWS 101 — it’ll be a quick primer on AWS Regions and Availability Zones that will be useful for understanding the basics of how AWS infrastructure is organized. We’ll define each section,...
Application Load Balancer vs. Classic Load Balancer
What is an Elastic Load Balancer? This post covers basics of what an Elastic Load Balancer is, and two of its examples: Application Load Balancers and Classic Load Balancers. For additional information — including a comparison that explains Network Load Balancers — check out our post o...
Advantages and Disadvantages of Microservices Architecture
What are microservices? Let's start our discussion by setting a foundation of what microservices are. Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs). ...