4 Practices that Should Be Driving Your Security Strategy in 2018
Securing your data and applications in the cloud has never been more important.The headlines are a constant reminder of the disruptive (or cala...Learn More
Moving on from last week’s AWS Shared Responsibility Model post, I’d like to discuss instance level security within your Virtual Private Cloud (VPC). I will describe AWS security groups and how they are used to protect your EC2 instances in some depth. We’ll also explore applying security patches to your instances, multi-tenancy vs. dedicated deployments, and the proper use of EC2 Key Pairs.
From last week’s blog, you will remember that instance level security is your responsibility, and that AWS provides you with the tools you’ll need completely control access to your instances.
If you were to adopt only one of those tools as a result of this article, I would suggest that it should be AWS security groups. Security groups are easy to set up, easy to manage, and add a great deal of security to your resources.
AWS security groups (SGs) are associated with EC2 instances and provide security at the protocol and port access level. Each security group – working much the same way as a firewall – contains a set of rules that filter traffic coming into and out of an EC2 instance. There are no ‘Deny’ rules. Rather, if there is no rule that explicitly permits a particular data packet, it will be dropped.
Each security group must have a name, allowing you to easily identify it from account menus. It’s always a good idea to choose a descriptive name that will quickly tell you this group’s purpose. In fact, you would be well served to define and use a consistent convention for naming all objects in your AWS account.
Security groups exist within individual VPCs. When you create a new group, make sure that it’s in the same VPC as the resources it’s meant to protect.
The actual rule set that filters traffic is made up of two tables: ‘Inbound’ and ‘Outbound’. AWS Security groups are stateful, meaning you do not need the same rules for both outbound traffic and inbound. Therefore any rule that allows traffic into an EC2 instance, will allow responses to pass back out without an explicit rule in the Outbound rule set.
Each rule is comprised of four fields: ‘Type’, ‘Protocol’, ‘Port Range’, and ‘Source’. This applies for both ‘Inbound’ and ‘Outbound’ rules.
You can create security groups in a number different ways, including at the sixth step of the creation of a new Instance:
…From the Console under ‘EC2 > Network & Security > Security Groups > Create Security Group’:
…Or even through the AWS CLI.
While AWS security groups are normally associated with instances on start up, you can also add or remove them from running instances through the AWS Console. Again, go to ‘EC2 > Instances’, select the instance you want to modify, and click Actions > Networking > Change Security Groups’.
Before building a complex plan that involves creating large numbers of security groups within a single VPC, be aware that you are limited to only 100 security groups per VPC. You can request that AWS increases the limit, but you may notice a network performance impact.
There is also a limit of 250 rules per network interface on your instances. With this in mind, you could create five security groups with 50 rules each, or ten security groups with 25 rules in each. As long as you stay below the overall limit of 250. Also, it’s worth noting that you can’t have more than sixteen security groups per network interface.
Applying the latest security patches to your instances is, again, your responsibility – even if you built your instance from an AWS defined AMI. No matter which operating system you deploy, I recommend that you regularly download the latest security patches. New bugs and security flaws are being discovered and fixed all the time, and you just can’t afford to ignore them.
I also suggest that you apply the latest patches immediately after creating an instance. You could look at automating this process through instance User data when creating your instances. For example entering the following on a Linux based AMI would automatically perform a Yum update at instance launch:
#!/bin/bash yum update
The ‘User data’ section can be found in ‘Step 3: Configure Instance Details’ under Advanced Details:
Ensuring the latest patches are installed on your instances, protects you from vulnerabilities and threats to your OS. This is a simple yet necessary security addition to your instance rollouts.
When deploying your Instances through the Console you will be asked which ‘Tenancy’ type you want for your instance:
Your two choices are ‘Shared Tenancy (Multi-Tenant Hardware)’ or ‘Dedicated Tenancy (Single-Tenant Hardware)’.
Shared Tenancy is when your instance will be hosted on shared hardware. This means there might be other AWS customers running their instances on the same physical server. You will never know who those customers are or how many of them there might be, but they will be equally ignorant about you. Security and separation are managed at the Hypervisor layer, where AWS maintains operational control and support. AWS guarantees that there will be no data crossover between account resources.
The major advantage of Shared Tenancy is its lower cost. This is the product of the fact that there is no need for AWS to isolate hardware for your explicit use…which, incidentally, is the definition of ‘Dedicated Tenancy’. If you are not happy sharing hosts, or need additional physical security separation, then select Dedicated Tenancy.
Not all instance types are eligible for Dedicated Tenancy, so if you are thinking of using it, consult the AWS documentation.
If you plan to remotely log into your EC2 instances, then you’ll need to create key pairs and associate them with your instances. A key pair consists of a public key and a private key. The public key is kept on your instance, while the private key must be available only to you, and will generally live on your local PC. AWS will not keep a copy of the private key. You will only be able to directly connect to your instance by invoking the private key. Public-key cryptography is used to encrypt/decrypt both keys.
These keys provide an added layer of security ensuring only people and resources holding the private key are allowed to make API calls to the instance. I suggest you download and keep a secure copy of your private key when prompted during your instance launch, as you will not be allowed to access your instance if you lose it.
When creating a new EC2 instance, you must specify which key pair you wish to associate. If you want to use a brand new key pair, you can create and configure one during this selection process.
There are a number of ways to create new key pairs. You can use the AWS Console, the AWS CLI, or Windows PowerShell. AWS uses 2048-bit SSH-2 RSA keys, with a limit of up to 5000 pairs per AWS Region.
Should you wish to create your own key pairs outside of AWS, they must be RSA compliant. EC2 will accept OpenSSH, Base64 encoded DER, and SSH Public key formats as per RFC4716. More information on how to create and import your own Keys can be found here.
Let’s review what we’ve seen.
You might also want to take Cloud Academy’s “Introduction to Security Best Practices” course for more useful information.
Next week I plan to address more Virtual Private Cloud (VPC) security concepts, focusing on network level security. I will explain how to set up and implement Network ACLs and how they can be used to control network traffic and prevent DDOS attacks at the network level. I will also touch on the proper use of private and public subnets within your environment, along with Bastion hosts, NAT instances, and VPC Peering.
Thank you for taking the time to read my article. If you have any feedback please do leave a comment below.
AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...
As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in the cloud.As the market leader and most mature p...
The announcements at re:Invent just keep on coming! Let’s look at what benefits these two new EC2 instance types offer and how these two new instances could be of benefit to you. If you're not too familiar with Amazon EC2, you might want to familiarize yourself by creating your first Am...
Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2018, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the first time. In t...
In order to understand AWS VPC egress filtering methods, you first need to understand that security on AWS is governed by a shared responsibility model where both vendor and subscriber have various operational responsibilities. AWS assumes responsibility for the underlying infrastructur...
Is it possible to create an S3 FTP file backup/transfer solution, minimizing associated file storage and capacity planning administration headache?FTP (File Transfer Protocol) is a fast and convenient way to transfer large files over the Internet. You might, at some point, have conf...
Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs).Microservices have become increasingly popular over the past few years. The modular architectural style,...
There are many use cases for tags, but what are the best practices for tagging AWS resources? In order for your organization to effectively manage resources (and your monthly AWS bill), you need to implement and adopt a thoughtful tagging strategy that makes sense for your business. The...
Amazon S3 is the most common storage options for many organizations, being object storage it is used for a wide variety of data types, from the smallest objects to huge datasets. All in all, Amazon S3 is a great service to store a wide scope of data types in a highly available and resil...
One of the main promises of cloud computing is access to nearly endless capacity. However, it doesn’t come cheap. With the introduction of Spot Instances for Amazon Web Services’ Elastic Compute Cloud (AWS EC2) in 2009, spot instances have been a way for major cloud providers to sell sp...
A Comparison of Machine Learning Services on AWS, Azure, and Google CloudArtificial intelligence and machine learning are steadily making their way into enterprise applications in areas such as customer support, fraud detection, and business intelligence. There is every reason to beli...
The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services.So you’ve been using AWS for awhile and finally feel comfortable clicking your way through all the services....