Content Domain 2: Security and Compliance

Task Statement 2.4: Identify components and resources for security

Let's get started with the fourth task statement to identify components and resources for security support. An important thing to remember is as a cloud practitioner it's likely you yourself will not be building out security solutions. But it is likely that you will be guiding people towards solutions that meet their needs. And in order to do this you must know what security services exist, and how to find more information on them. Take network security, for example. You'll need to be able to answer questions about the basic functionality for AWS security services like security groups, network access control list, and AWS WAF. You should understand the use cases for these services, and the differences between them. Again, you do not need to know the specifics around how these work in-depth, but you should know enough to be able to answer questions about when to use each one, and their function. For example, what can you use to secure your Amazon VPC subnets? Network access control lists act as a firewall to control traffic traversing your subnet. Know the difference between network access control lists and security groups. Network access control lists are used for traffic entering or leaving a subnet, because network access control lists are associated with the subnet, not with the resources. Network access control lists only manage traffic that is crossing that subnet boundary. If you have two Amazon EC2 instances in your Amazon VPC that are communicating, network access control list will have no involvement because the communication between the two instances are not crossing the subnet boundary. Network access control lists are stateless, in which they only see traffic going one way. So if you allow an inbound rule, then you must also allow an outbound rule so your network access control list will explicitly see that that traffic that was allowed inbound is also allowed out. Network access control lists see the traffic as two separate, different streams, so you must have two rules. One rule for each stream. If you do not add your outbound rule, then the traffic will only be allowed in. Security groups secure your resource level network such as your Amazon EC2 instances or Amazon RDS instances. They do not operate at the subnet level. They actually operate at the resources Elastic Network Interface level. Security groups also have inbound and outbound rules, but they are stateful, meaning that if the traffic is allowed in then that traffic is automatically allowed back out. Security groups see both the inbound and outbound traffic as part of the same stream. One big difference between security groups and network access control lists is that security groups recognize AWS resources. You can add rules for other security groups, or add a rule for the security group themselves. And another is that security groups have a hidden explicit deny, and that means that anything that's not explicitly allowed is denied. For the exam, make sure to understand security groups cannot explicitly deny. If you need to explicitly deny, then you need to use a network access control list. Security groups also accept rules with IP addresses, IP address ranges, and again, the security group IDs as a source or destination for the inbound and outbound rules. Let's continue on talking about AWS security services. What AWS service would you choose if you need to create rules to filter web traffic based on conditions such as IP addresses, HTTP headers, or custom URLs? AWS WAF helps to control traffic with rules that you define that block common attack patterns, such as SQL injections or cross-site scripting. Here's another question, can you conduct security assessment and penetration testing without prior approval against your AWS resources? Yes, but only for certain services. There are also some AWS services, like AWS Trusted Advisor or Amazon Inspector, that can give you the recommendations around security, and you should be aware of that for the exam. But you should also recognize sometimes the solution to your security and compliance needs could be third-party software or tools. So, where can you find available third-party software that you can deploy in your AWS account? The answer is the AWS MarketPlace. Knowing what exists at a high level for AWS services versus the types of solutions you can find via the AWS Marketplace is important knowledge for the exam. It is also likely when working with AWS you'll need to be able to identify resources to dive deeper into cloud topics when necessary. For security and compliance there are a few different places you should be comfortable with when looking for information or doing research. The AWS Knowledge Center is one place to find answers to your questions, and the Security Center is another place for information related to security in AWS. You should also be comfortable reading AWS security blogs, and working with the AWS Security Forum to find information. If you're feeling like you need to brush up on security before your exam, check out the AWS documentation for best practices, the whitepapers for deeper dives, and the AWS official documentation for general information, use cases, and information on what services exist, and how they work. Let's get started with our third walkthrough question.