Instance security requires that you fully understand AWS security groups, along with OS patch protocols, key pairs, and your various tenancy options.
Moving on from last week’s AWS Shared Responsibility Model post, I’d like to discuss instance-level security within your Virtual Private Cloud (VPC). I will describe AWS security groups and how they are used to protect your EC2 instances in some depth. We’ll also explore applying security patches to your instances, multi-tenancy vs. dedicated deployments, and the proper use of EC2 Key Pairs.
From last week’s blog, you will remember that instance-level security is your responsibility and that AWS provides you with the tools you’ll need completely control access to your instances.
If you were to adopt only one of those tools as a result of this article, I would suggest that it should be AWS security groups. Security groups are easy to set up, easy to manage and add a great deal of security to your resources.
AWS security groups and cloud security
AWS security groups (SGs) are associated with EC2 instances and provide security at the protocol and port access level. Each security group – working much the same way as a firewall – contains a set of rules that filter traffic coming into and out of an EC2 instance. There are no ‘Deny’ rules. Rather, if there is no rule that explicitly permits a particular data packet, it will be dropped.
Each security group must have a name, allowing you to easily identify it from account menus. It’s always a good idea to choose a descriptive name that will quickly tell you this group’s purpose. In fact, you would be well served to define and use a consistent convention for naming all objects in your AWS account.
Security groups exist within individual VPCs. When you create a new group, make sure that it’s in the same VPC as the resources it’s meant to protect.
AWS Security Groups: rules
The actual rule set that filters traffic is made up of two tables: ‘Inbound’ and ‘Outbound’. AWS Security groups are stateful, meaning you do not need the same rules for both outbound traffic and inbound. Therefore any rule that allows traffic into an EC2 instance, will allow responses to pass back out without an explicit rule in the Outbound rule set.
Each rule is comprised of four fields: ‘Type’, ‘Protocol’, ‘Port Range’, and ‘Source’. This applies for both ‘Inbound’ and ‘Outbound’ rules.
- Type. The drop-down list allows you to select common protocols like SSH, RDP, or HTTP. You can also choose custom protocols.
- Protocol. This is typically greyed out, as it’s covered by most ‘Type’ choices. However, if you create a custom rule, you can specify your protocol (TCP/UDP etc.) here.
- Port Range. This value will also usually be pre-filled, reflecting the default port or port range for your chosen protocol. However, there might be times when you prefer to use custom ports.
- Source. This can be a Network Subnet range, a specific IP address, or another AWS security group. You can also leave access open to the entire Internet using the ‘Anywhere (0.0.0.0/0)’ value.
Creating AWS Security Groups
You can create security groups in a number different ways, including at the sixth step of the creation of a new Instance:
…From the Console under ‘EC2 > Network & Security > Security Groups > Create Security Group’:
…Or even through the AWS CLI.
While AWS security groups are normally associated with instances on startup, you can also add or remove them from running instances through the AWS Console. Again, go to ‘EC2 > Instances’, select the instance you want to modify, and click Actions > Networking > Change Security Groups’.
Before building a complex plan that involves creating large numbers of security groups within a single VPC, be aware that you are limited to only 100 security groups per VPC. You can request that AWS increases the limit, but you may notice a network performance impact.
There is also a limit of 250 rules per network interface on your instances. With this in mind, you could create five security groups with 50 rules each, or ten security groups with 25 rules in each. As long as you stay below the overall limit of 250. Also, it’s worth noting that you can’t have more than sixteen security groups per network interface.
OS Patch Management
Applying the latest security patches to your instances is, again, your responsibility – even if you built your instance from an AWS defined AMI. No matter which operating system you deploy, I recommend that you regularly download the latest security patches. New bugs and security flaws are being discovered and fixed all the time, and you just can’t afford to ignore them.
I also suggest that you apply the latest patches immediately after creating an instance. You could look at automating this process through instance User data when creating your instances. For example, entering the following on a Linux based AMI would automatically perform a Yum update at instance launch:
#!/bin/bash yum update
The ‘User data’ section can be found in ‘Step 3: Configure Instance Details’ under Advanced Details:
Ensuring the latest patches are installed on your instances, protects you from vulnerabilities and threats to your OS. This is a simple yet necessary security addition to your instance rollouts.
Multi-tenancy vs Dedicated
When deploying your Instances through the Console you will be asked which ‘Tenancy’ type you want for your instance:
Your two choices are ‘Shared Tenancy (Multi-Tenant Hardware)’ or ‘Dedicated Tenancy (Single-Tenant Hardware)’.
Shared Tenancy is when your instance will be hosted on shared hardware. This means there might be other AWS customers running their instances on the same physical server. You will never know who those customers are or how many of them there might be, but they will be equally ignorant about you. Security and separation are managed at the Hypervisor layer, where AWS maintains operational control and support. AWS guarantees that there will be no data crossover between account resources.
The major advantage of Shared Tenancy is its lower cost. This is the product of the fact that there is no need for AWS to isolate hardware for your explicit use…which, incidentally, is the definition of ‘Dedicated Tenancy’. If you are not happy sharing hosts, or need additional physical security separation, then select Dedicated Tenancy.
Not all instance types are eligible for Dedicated Tenancy, so if you are thinking of using it, consult the AWS documentation.
EC2 Key Pairs
If you plan to remotely log into your EC2 instances, then you’ll need to create key pairs and associate them with your instances. A key pair consists of a public key and a private key. The public key is kept on your instance, while the private key must be available only to you, and will generally live on your local PC. AWS will not keep a copy of the private key. You will only be able to directly connect to your instance by invoking the private key. Public-key cryptography is used to encrypt/decrypt both keys.
These keys provide an added layer of security ensuring only people and resources holding the private key are allowed to make API calls to the instance. I suggest you download and keep a secure copy of your private key when prompted during your instance launch, as you will not be allowed to access your instance if you lose it.
When creating a new EC2 instance, you must specify which key pair you wish to associate. If you want to use a brand new key pair, you can create and configure one during this selection process.
There are a number of ways to create new key pairs. You can use the AWS Console, the AWS CLI, or Windows PowerShell. AWS uses 2048-bit SSH-2 RSA keys, with a limit of up to 5000 pairs per AWS Region.
Should you wish to create your own key pairs outside of AWS, they must be RSA compliant. EC2 will accept OpenSSH, Base64 encoded DER, and SSH Public key formats as per RFC4716. More information on how to create and import your own Keys can be found here.
Let’s review what we’ve seen.
- Instance level security is your responsibility and it’s up to you to implement as much or as little as you see fit for your purpose. I recommend implementing security groups as tightly as possible. I have seen people leaving themselves vulnerable to attacks through wide open security groups.
- Implement a Patch Management policy/strategy when deploying your instances – either manually or automatically via User Data.
- Weigh the additional security against the cost when deciding on your instance tenancy (i.e., Shared vs. Dedicated): do you really need the additional physical separation of Dedicated Tenancy?
- Finally, understand and manage your EC2 instance key pairs and keep your private keys safe to ensure you can connect to your instances via API calls using protocols like SSH and RDP.
You might also want to take Cloud Academy’s Introduction to Security Best Practices course for more useful information.
Next week I plan to address more Virtual Private Cloud (VPC) security concepts, focusing on network level security. I will explain how to set up and implement Network ACLs and how they can be used to control network traffic and prevent DDOS attacks at the network level. I will also touch on the proper use of private and public subnets within your environment, along with Bastion hosts, NAT instances, and VPC Peering.
Thank you for taking the time to read my article. If you have any feedback please do leave a comment below.
Cloud Migration Risks & Benefits
If you’re like most businesses, you already have at least one workload running in the cloud. However, that doesn’t mean that cloud migration is right for everyone. While cloud environments are generally scalable, reliable, and highly available, those won’t be the only considerations dri...
Real-Time Application Monitoring with Amazon Kinesis
Amazon Kinesis is a real-time data streaming service that makes it easy to collect, process, and analyze data so you can get quick insights and react as fast as possible to new information. With Amazon Kinesis you can ingest real-time data such as application logs, website clickstre...
Google Cloud Functions vs. AWS Lambda: The Fight for Serverless Cloud Domination
Serverless computing: What is it and why is it important? A quick background The general concept of serverless computing was introduced to the market by Amazon Web Services (AWS) around 2014 with the release of AWS Lambda. As we know, cloud computing has made it possible for users to ...
Google Vision vs. Amazon Rekognition: A Vendor-Neutral Comparison
Google Cloud Vision and Amazon Rekognition offer a broad spectrum of solutions, some of which are comparable in terms of functional details, quality, performance, and costs. This post is a fact-based comparative analysis on Google Vision vs. Amazon Rekognition and will focus on the tech...
New on Cloud Academy: CISSP, AWS, Azure, & DevOps Labs, Python for Beginners, and more…
As Hurricane Dorian intensifies, it looks like Floridians across the entire state might have to hunker down for another big one. If you've gone through a hurricane, you know that preparing for one is no joke. You'll need a survival kit with plenty of water, flashlights, batteries, and n...
Amazon Route 53: Why You Should Consider DNS Migration
What Amazon Route 53 brings to the DNS table Amazon Route 53 is a highly available and scalable Domain Name System (DNS) service offered by AWS. It is named by the TCP or UDP port 53, which is where DNS server requests are addressed. Like any DNS service, Route 53 handles domain regist...
How to Unlock Complimentary Access to Cloud Academy
Are you looking to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Cloud Security, Python, Java, or another technical skill? Then you'll want to mark your calendars for August 23, 2019. Starting Friday at 12:00 a.m. PDT (3:00 a.m. EDT), Cloud Academy is offering c...
What Exactly Is a Cloud Architect and How Do You Become One?
One of the buzzwords surrounding the cloud that I'm sure you've heard is "Cloud Architect." In this article, I will outline my understanding of what a cloud architect does and I'll analyze the skills and certifications necessary to become one. I will also list some of the types of jobs ...
Boto: Using Python to Automate AWS Services
Boto allows you to write scripts to automate things like starting AWS EC2 instances Boto is a Python package that provides programmatic connectivity to Amazon Web Services (AWS). AWS offers a range of services for dynamically scaling servers including the core compute service, Elastic...
Content Roadmap: AZ-500, ITIL 4, MS-100, Google Cloud Associate Engineer, and More
Last month, Cloud Academy joined forces with QA, the UK’s largest B2B skills provider, and it put us in an excellent position to solve a massive skills gap problem. As a result of this collaboration, you will see our training library grow with additions from QA’s massive catalog of 500+...
DevSecOps: How to Secure DevOps Environments
Security has been a friction point when discussing DevOps. This stems from the assumption that DevOps teams move too fast to handle security concerns. This makes sense if Information Security (InfoSec) is separate from the DevOps value stream, or if development velocity exceeds the band...
Test Your Cloud Knowledge on AWS, Azure, or Google Cloud Platform
Cloud skills are in demand | In today's digital era, employers are constantly seeking skilled professionals with working knowledge of AWS, Azure, and Google Cloud Platform. According to the 2019 Trends in Cloud Transformation report by 451 Research: Business and IT transformations re...