AWS Security Primer
cloudonaut.io
AWS Security Primer
1–10 of 43 posts
Re: AWS Security Primer
#2Great write up. I knew there was a lot, but visualizing really puts it into perspective, especially for the more niche services like cognito & IOT.
My current job has about 14 different AWS accounts, a few are prod, some are lab and others are meta accounts. I've been thinking about having a dedicated account just for security related stuff but I see the value in collect cloudtrail, config and other stuff but, I'm not 100% sure it's worth the effort to get setup right now. Thoughts?
Re: AWS Security Primer
#3Excellent! Pleased to see VPC Flow Logs included; they are underrated as a security tool and one big advantage AWS has over other providers.
At work I co-develop an open source Python library for reading VPC Flow Logs - it can be an easy way to get started analyzing them for security: https://github.com/obsrvbl/flowlogs-reader
Re: AWS Security Primer
#4AWS is so f-ing confusing sometimes.
Re: AWS Security Primer
#5I wonder at what point the complexity of interacting security systems hits dimishing returns? Not trying to be negative, I'm a fan of how much power AWS gives you. But seeing how many systems have interacting security implications laid out in a graph like that makes me curious how far you can take it before it becomes difficult to reason about. Maybe the systems are sufficiently isolated and well defined that it's not even an issue.
Re: AWS Security Primer
#6Great write up. I knew there was a lot, but visualizing really puts it into perspective, especially for the more niche services like cognito & IOT. My current job has about 14 different AWS accounts, a few are prod, some are lab and others are meta accounts. I've been thinking about having a dedicated account just for security related stuff but I see the value in collect cloudtrail, config and other stuff but, I'm no…
Cloudtrail and config buckets should be in a separate account with no access at all (besides root) otherwise an attacker can delete the cloudtrail logs and you have no idea what he did
Re: AWS Security Primer
#7Slightly off-topic: The Mindmap looks pretty cool. Does somebody know which technology he used for that?
Re: AWS Security Primer
#8AWS is so f-ing confusing sometimes.
Maybe MindNode? https://mindnode.com
Could also be https://www.draw.io
Re: AWS Security Primer
#9I wonder at what point the complexity of interacting security systems hits dimishing returns? Not trying to be negative, I'm a fan of how much power AWS gives you. But seeing how many systems have interacting security implications laid out in a graph like that makes me curious how far you can take it before it becomes difficult to reason about. Maybe the systems are sufficiently isolated and well defined that it's no…
> Not trying to be negative, I'm a fan of how much power AWS gives you.
I am.
I find AWS API incredibly baroque and has a lot of historic baggage. I suspect a lot of this complexity is a result of an accumulation of features made by multiple people in multiple teams over the years and inertia of customers relying on it, so there is (understandably) no will to change it.
Re: AWS Security Primer
#10AWS is so f-ing confusing sometimes.
So do AWS veterans have good job security?