Instance security requires that you fully understand AWS security groups, along with OS patch protocols, key pairs, and your various tenancy options.
Moving on from last week’s AWS Shared Responsibility Model post, I’d like to discuss instance level security within your Virtual Private Cloud (VPC). I will describe AWS security groups and how they are used to protect your EC2 instances in some depth. We’ll also explore applying security patches to your instances, multi-tenancy vs. dedicated deployments, and the proper use of EC2 Key Pairs.
From last week’s blog, you will remember that instance level security is your responsibility, and that AWS provides you with the tools you’ll need completely control access to your instances.
If you were to adopt only one of those tools as a result of this article, I would suggest that it should be AWS security groups. Security groups are easy to set up, easy to manage, and add a great deal of security to your resources.
AWS security groups and cloud security
AWS security groups (SGs) are associated with EC2 instances and provide security at the protocol and port access level. Each security group – working much the same way as a firewall – contains a set of rules that filter traffic coming into and out of an EC2 instance. There are no ‘Deny’ rules. Rather, if there is no rule that explicitly permits a particular data packet, it will be dropped.
Each security group must have a name, allowing you to easily identify it from account menus. It’s always a good idea to choose a descriptive name that will quickly tell you this group’s purpose. In fact, you would be well served to define and use a consistent convention for naming all objects in your AWS account.
Security groups exist within individual VPCs. When you create a new group, make sure that it’s in the same VPC as the resources it’s meant to protect.
AWS Security Groups: rules
The actual rule set that filters traffic is made up of two tables: ‘Inbound’ and ‘Outbound’. AWS Security groups are stateful, meaning you do not need the same rules for both outbound traffic and inbound. Therefore any rule that allows traffic into an EC2 instance, will allow responses to pass back out without an explicit rule in the Outbound rule set.
Each rule is comprised of four fields: ‘Type’, ‘Protocol’, ‘Port Range’, and ‘Source’. This applies for both ‘Inbound’ and ‘Outbound’ rules.
- Type. The drop down list allows you to select common protocols like SSH, RDP, or HTTP. You can also choose custom protocols.
- Protocol. This is typically greyed out, as it’s covered by most ‘Type’ choices. However, if you create a custom rule, you can specify your protocol (TCP/UDP etc.) here.
- Port Range. This value will also usually be pre-filled, reflecting the default port or port range for your chosen protocol. However, there might be times when you prefer to use custom ports.
- Source. This can be a Network Subnet range, a specific IP address, or another AWS security group. You can also leave access open to the entire Internet using the ‘Anywhere (0.0.0.0/0)’ value.
Creating AWS Security Groups
You can create security groups in a number different ways, including at the sixth step of the creation of a new Instance:
…From the Console under ‘EC2 > Network & Security > Security Groups > Create Security Group’:
…Or even through the AWS CLI.
While AWS security groups are normally associated with instances on start up, you can also add or remove them from running instances through the AWS Console. Again, go to ‘EC2 > Instances’, select the instance you want to modify, and click Actions > Networking > Change Security Groups’.
Before building a complex plan that involves creating large numbers of security groups within a single VPC, be aware that you are limited to only 100 security groups per VPC. You can request that AWS increases the limit, but you may notice a network performance impact.
There is also a limit of 250 rules per network interface on your instances. With this in mind, you could create five security groups with 50 rules each, or ten security groups with 25 rules in each. As long as you stay below the overall limit of 250. Also, it’s worth noting that you can’t have more than sixteen security groups per network interface
OS Patch Management
Applying the latest security patches to your instances is, again, your responsibility – even if you built your instance from an AWS defined AMI. No matter which operating system you deploy, I recommend that you regularly download the latest security patches. New bugs and security flaws are being discovered and fixed all the time, and you just can’t afford to ignore them.
I also suggest that you apply the latest patches immediately after creating an instance. You could look at automating this process through instance User data when creating your instances. For example entering the following on a Linux based AMI would automatically perform a Yum update at instance launch:
The ‘User data’ section can be found in ‘Step 3: Configure Instance Details’ under Advanced Details:
Ensuring the latest patches are installed on your instances, protects you from vulnerabilities and threats to your OS. This is a simple yet necessary security addition to your instance rollouts.
Multi-tenancy vs Dedicated
When deploying your Instances through the Console you will be asked which ‘Tenancy’ type you want for your instance:
Your two choices are ‘Shared Tenancy (Multi-Tenant Hardware)’ or ‘Dedicated Tenancy (Single-Tenant Hardware)’.
Shared Tenancy is when your instance will be hosted on shared hardware. This means there might be other AWS customers running their instances on the same physical server. You will never know who those customers are or how many of them there might be, but they will be equally ignorant about you. Security and separation are managed at the Hypervisor layer, where AWS maintains operational control and support. AWS guarantees that there will be no data crossover between account resources.
The major advantage of Shared Tenancy is its lower cost. This is the product of the fact that there is no need for AWS to isolate hardware for your explicit use…which, incidentally, is the definition of ‘Dedicated Tenancy’. If you are not happy sharing hosts, or need additional physical security separation, then select Dedicated Tenancy.
Not all instance types are eligible for Dedicated Tenancy, so if you are thinking of using it, consult the AWS documentation.
EC2 Key Pairs
If you plan to remotely log into your EC2 instances, then you’ll need to create key pairs and associate them with your instances. A key pair consists of a public key and a private key. The public key is kept on your instance, while the private key must be available only to you, and will generally live on your local PC. AWS will not keep a copy of the private key. You will only be able to directly connect to your instance by invoking the private key. Public-key cryptography is used to encrypt/decrypt both keys.
These keys provide an added layer of security ensuring only people and resources holding the private key are allowed to make API calls to the instance. I suggest you download and keep a secure copy of your private key when prompted during your instance launch, as you will not be allowed to access your instance if you lose it.
When creating a new EC2 instance, you must specify which key pair you wish to associate. If you want to use a brand new key pair, you can create and configure one during this selection process.
There are a number of ways to create new key pairs. You can use the AWS Console, the AWS CLI, or Windows PowerShell. AWS uses 2048-bit SSH-2 RSA keys, with a limit of up to 5000 pairs per AWS Region.
Should you wish to create your own key pairs outside of AWS, they must be RSA compliant. EC2 will accept OpenSSH, Base64 encoded DER, and SSH Public key formats as per RFC4716. More information on how to create and import your own Keys can be found here.
Let’s review what we’ve seen.
- Instance level security is your responsibility and it’s up to you to implement as much or as little as you see fit for your purpose. I recommend implementing security groups as tightly as possible. I have seen people leaving themselves vulnerable to attacks through wide open security groups.
- Implement a Patch Management policy/strategy when deploying your instances – either manually or automatically via User Data.
- Weigh the additional security against the cost when deciding on your instance tenancy (i.e., Shared vs. Dedicated): do you really need the additional physical separation of Dedicated Tenancy?
- Finally, understand and manage your EC2 instance key pairs and keep your private keys safe to ensure you can connect to your instances via API calls using protocols like SSH and RDP.
You might also want to take Cloud Academy’s “Introduction to Security Best Practices” course for more useful information.
Next week I plan to address more Virtual Private Cloud (VPC) security concepts, focusing on network level security. I will explain how to set up and implement Network ACLs and how they can be used to control network traffic and prevent DDOS attacks at the network level. I will also touch on the proper use of private and public subnets within your environment, along with Bastion hosts, NAT instances, and VPC Peering.
Thank you for taking the time to read my article. If you have any feedback please do leave a comment below.