Hello, my name is Demetria Crawford, and in this lesson, we will review the AWS security and infrastructure. AWS customers inherit all of the best practices of AWS policies, infrastructure, and operational processes. Benefits of AWS security include: keeping data safe, privacy protection, meeting compliance requirements, high availability, and saving money by minimizing the cost of managing security of on-premise data centers. Let's take a look at the AWS security services that are provided. As you see, we have an AWS category specifically for Security, Identity and Compliance. We will go through a high-level review in this lesson. More detailed lessons are provided later in the course for the individual services. Let's start by taking a look at IAM. IAM stands for identity and access management. IAM gives us the ability to manage who has access to the services provided within the AWS environment, who has access to your AWS account, and what they are able to do, what are their permission sets? One of the key things that we must do to provide quality security is to provide only the permissions that are needed to do the role assigned to an individual. We call this providing least privilege. So to do that, you have to have an understanding of how to use IAM, so we have user groups, users, you can apply roles with specific permission sets, policies that you can provide a more granular set of controls with, and also account settings. One more thing you're able to do here is identity providers. With identity providers, you can use other third party resources as a part of the authentication process. For example, you may choose Facebook as an authenticator as one of the identity providers. You may also choose to use something such as Active Directory. We're gonna get in more detail about this in another lesson. So let's take a look at KMS. KMS is Key Management Service. This allows AWS customers to centrally manage your encryption keys. You may control or manage your AWS provided keys. You can use your own keys within the AWS environment as well and manage them as customer managed keys. There's also the ability to have a custom key store that we'll talk about in more detail in the encryption section. Next, let's take a look at CloudWatch. CloudWatch is where we handle all of our logging within AWS. Whenever a service is running, no matter if it's an EC2 service or if your VPC or network is up and functional, logs will be generated. And what CloudWatch allows us to do is to set alarms such that, if something occurs, an alert is given regarding the AWS environment. For example, if you're running an EC2 instance and the CPU usage goes above 75%, you can set an alarm to let you know that this particular EC2 has overrun the threshold that you've set it to be. So there are a lot of things that we can do with CloudWatch. We will also use CloudWatch with other services as well. But when we're talking about logging and managing logs, we tend to come back to CloudWatch and create custom dashboards to monitor and manage the security of the environment, the availability of services. If one of our EC2s is not functional, then the availability is not there, and that is a part of security. Next, let's take a look at CloudTrail. Now, CloudTrail gives us the ability to query and monitor active changes within the AWS environment from someone who has permission to do so. So that can come in the form of APIs, or from a user who's actively making changes, and these events are monitored, and you can query for changes as well. Now GuardDuty. Amazon GuardDuty is a threat protection service. This is an active, continuous monitoring service that looks for threats within your AWS environment. It checks against accounts, data, and workloads within their AWS Cloud environment. Next, let's take a look at WAF. WAF is your web application firewall. This protects your web applications from common web exploits. We can create web access controls with WAF. We can also use it as more of a monitoring type tool for our websites. There are a lot of different things and ways we can use WAF for security purposes, but once again, we're gonna go more details in this in another lesson. Next is our AWS Audit Manager. AWS Audit Manager allows us to continuously audit our AWS environment for usage, for risk management, and compliance purposes. This is a great way to identify if your environment is meeting your compliance requirements. Now, finally, we're gonna take a look at some of the pieces or services that we use together to provide network security. We have several different options. First, we have to start with our VPC, which is where we are now, and what you see are various services we can run within a region. We have our NAT Gateways, which allow us to identify or specify which EC2s or services can use a public IP address versus private IP addresses. So basically it will translate from one to the other. We have VPC Peering Connections that allow VPCs to communicate with each other, that you can give the rights to do so. Network Access Controls and Security Groups are probably the most commonly used here as far as the initial setup of your environment to provide security from a network perspective. Security Groups allows us to identify what is allowed in and out of your EC2s or various services that you're running. Whereas Network Access Controls, or what we like to call NACLs, that happens at a higher level as a gateway entry into your VPCs in and out, so what IP addresses do we wanna allow into our VPC environment? What ports do we want to allow? Do we wanna turn off SSH, or do we want to allow SSH? We can identify and set goals, or set access controls, is what they're called, to identify what we will allow in or out. So let's take a look at one. Network Access Controls. I have one set here, and you'll notice we have inbound rules, where I'm allowing all traffic in, and we have outbound rules, where I'm allowing all traffic out. We can be more particular as to how we wanna set these rules to where we can block specific services if we wanted to. So that's a high-level view of some of the things that we can do within the AWS infrastructure. In this lesson, we reviewed the AWS security and infrastructure. Stay tuned for the next lesson where I will discuss AWS compliance. Thanks for watching.
