This document covers field notes, observations and best practice recommendations for stabilizing any AWS Cloud operation. Information in this report will help to establish the minimum security levels, availability and potential cost savings within the cloud environment.
Below are some guidelines to follow to ensure that you make the most of your AWS cloud investment:
- Design for High-Availability:
- Design with failure in mind (leverage multiple availability zones).
- Deploy Global/External Load balancers: when configuring ELB, ensure that you add all the necessary subnets.
- Launch Configuration: when creating your launch configuration, right-size and select the correct AMI.
- Use Auto-scaling functionality: when creating the auto-scaling group, select the right network, add multiple availability zones, and select a group size of 3 instances (Recommended).
- Define a scaling policy: for scaling-up and scaling-down.
- Deploy Across Multiple Availability Zones:
- For Production systems, leverage multiple ‘Availability Zones’ to distribute workload across multiple data centers within a given region. This is a very effective approach to lowering risk in case of an outage.
- Network Segmentation:
- Virtual Private Cloud: Segment by VPC’s: DEV, QA/Staging and Production. VPC’s can also be created by line of business applications and by data sensitivity/classification. Avoid using EC2 classic, VPC offers several security and advanced networking features that are not available with EC2 classic.
- Subnets: Plan your public and private subnets appropriately and take steps to reduce your attack surface.
- Cost Optimization – Keep track and manage your AWS resources:
- Right Size your instances: Select and right-size newer instances (for example: EC2): It’s always a good practice to do application benchmarking to have an idea of the most suitable instance type, CPU, RAM, I/O, etc. (Newer instance types are much more cost effective than older instance types).
- Reserved Instances: Leverage reserved instances and AWS Savings plan: Do not pay on-demand pricing. Reserved instances can potentially save you up-to 40% over the AWS annual on-demand billing period.
-
- Tracking resource utilization frequently and make the relevant instance trade-offs to optimize utilization and cost efficiencies.
- Snapshot Creation and Retention: Snapshots are important, but taking too many EBS volume snapshots can lead to unnecessary complexity when managing backups, can also increase storage costs on an aggregated basis.
- Clean up stale resources: You should ideally keep only those volumes that will be needed in the future. Keeping volumes that aren’t planned for the future, or those just forgotten about can lead to unexpectedly high bills and a management headache.
- Don’t leave idle resources running: Especially in DEV environments (for example: nights and weekends). Leaving instances on will typically increase your AWS monthly bills.
- Protect against accidental termination: enable “termination protection” to protect against accidental termination of instances.
- Enable Basic Cloudwatch Monitoring and Notification: this “free” basic CloudWatch feature is useful in providing real-time activity into your Cloud resources.
- Tracking resource utilization frequently and make the relevant instance trade-offs to optimize utilization and cost efficiencies.
- Backup Strategy:
- Have a backup strategy your data in the cloud, encrypt your backup data.
- Vulnerability and Patch Management:
- Have a stringent patch management procedure for OS, applications and open-source components.
- Harden your operating system images, create “Golden Images” where possible.
- Have a vulnerability scanning and management strategy.
- Operational Monitoring:
- Use AWS cloud-native tools for operational monitoring and visibility. By gathering data streams from multiple compute resources and crunching this data, these services enable AWS customers to discover usage patterns, identify security vulnerabilities and gain more control over availability.
- Task Automation: Schedule or automate tasks, for example you can schedule an instance to be backed-up, or for a snapshot to be created or for the instance to be rebooted at a particular day and time.
- Security Logging, Monitoring and Auditing:
- Identity and Access Management | Instance Security Best Practices:
- Do not use the AWS root account, enforce MFA but avoid using this account.
- Single Sign-On: Enable SSO for user authentication (AuthN) via SAML 2.0 or similar protocols to simplify the sign-in process. Map RBAC roles to the predefined IAM roles and adopt principle of “Least Privilege” for authorization (AuthZ).
- Enforce MFA for the Cloud Console, CLI and AWS SDKs.
- Rename the administrator accounts (especially on Windows Servers) to something else, helps in thwarting brute force and old school password based Windows attacks.
- Enable logging and auditing for AWS Server instances.
- RDP Access: Avoid using straight RDP to access the cloud instances remotely. Leverage Bastion Hosts instead or explore setting up VPN services to establish IPSec sessions to AWS. RDP is constantly under attack by hackers. Another option is to leverage more secure remote access options like the RDP Gateway or something similar secure remote access options. If you have to allow, lock down the source IP Subnet and don’t open RDP to the internet 0.0.0.0/0.
- Identity and Access Management | Instance Security Best Practices:
- Security Group and NACL: Define a process for reviewing your Security Group and NACL rules regularly, do not use the predefined AWS security groups, watch out for mis-configured rules. Use IAM features where applicable, lock down your ports and only allow access to services that are required. Leverage Security Groups (SG’s) to partition Web application and Database Servers. Enable firewall logging and use “network tags” with precision.
- Access Keys: Protect your AWS access ID and secret keys, should not be provided to team members or vendors that don’t need it.
- Trusted Advisor: Have a process for reviewing trusted advisor reports regularly and take action on the recommendations.
- Key Management | Secrets Management:
- Leverage AWS KMS to protect your encryption keys and sensitive data.
-
- Use Secrets Manager to store API keys, database credentials, passwords and certificates, etc.
- Security Operations Logging:
- SIEM: For visibility into network, resource, and application activity, centrally integrate with a SIEM tool for effective security monitoring and response.
- Enable CloudTrail to get a history of AWS API calls and higher-level AWS services like CloudFormation. AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.
-
- Enable other services like GuardDuty for threat detection.
- Cloud Security Posture Management (CSPM):
-
- CSPM tools help to assess the security posture on cloud environments against established industry benchmarks: CIS, NIST, PCI DSS, HIPAA, etc. Will identify misconfigurations and vulnerabilities in the setup and provide recommendations for remediation. This helps to enforce security, compliance, and governance policies for your cloud environment.
-
- DevSecOps:
-
- AppSec: “shift-left” and adopt secure CI/CD pipelining process for your applications.
- Static and Dynamic Code scanning: Have a DAST, SAST, IAST and Software Composition Analysis (SCA) process and toolset.
- Do not store your secrets in code, leverage a secrets management tool.
- AppSec: “shift-left” and adopt secure CI/CD pipelining process for your applications.
- Encryption:
-
- Data-in-Transit Encryption: Enforce TLS 1.2 or 1.3 at the network layer, leverage AWS Certificate Manager to streamline this process.
- Data-at-Rest Encryption: Enforce for storage buckets, EBS volumes, backups and other storage devices.
- Data-in-Transit Encryption: Enforce TLS 1.2 or 1.3 at the network layer, leverage AWS Certificate Manager to streamline this process.
- Databases:
- Managed Database Service (RDS): It is strongly recommended to use RDS managed database service because of the benefits it offers.
-
- General database security guidelines include:
- Manage plane security: secure your logical server.
- Data plane security: limit and secure access to your data. Reduce your attack surface – use private endpoints where possible and avoid exposing your databases to the internet.
- Data-in-Transit Encryption: encrypt data-in-transit for your database sessions.
- Data-at-Rest Encryption: encrypt data-at-rest for your data.
- Auditing: audit changes to the data and forward the logs to a SIEM or security analytics tool for further analysis.
- General database security guidelines include: