Data security on AWS mindmap

Data security on AWS

Protecting data across its life: knowing where it is, who can reach it, how it is encrypted and how it is recovered

• Fundamentals
  • Classify data: Label data by sensitivity so protection matches its value
  • Least privilege: People and workloads get only the access they need
  • Encrypt everywhere: At rest and in transit
  • Keep people away from data: Use tools and automation instead of direct access
  • Plan the lifecycle: Retention, archival and deletion
• Discovery and classification
  • Amazon Macie: Sensitive data in Amazon S3
  • AWS Glue sensitive data detection: PII in data pipelines
  • Amazon Comprehend: Detect and redact PII in text
  • Tags: Data classification tags drive attribute-based access control
• Encryption and keys
  • AWS Key Management Service: Keys for encryption at rest across AWS services
  • AWS CloudHSM: Dedicated hardware security modules
  • AWS Certificate Manager: TLS certificates for encryption in transit
  • AWS Private Certificate Authority: Private PKI
  • AWS Secrets Manager: Store and rotate credentials
  • AWS Payment Cryptography: Payment HSM operations
• Access and data perimeters
  • AWS Identity and Access Management: Identity and resource policies
  • Data perimeters: SCPs, RCPs and VPC endpoint policies so only trusted identities reach trusted resources on expected networks
  • S3 Block Public Access: Stop public buckets at the account level
  • AWS Lake Formation: Fine-grained access to data lakes
  • Amazon Verified Permissions: Authorization inside your applications
• Resilience
  • AWS Backup: Central backups, with Vault Lock and logically air-gapped vaults
  • S3 Object Lock: Write once, read many retention
  • Versioning and replication: Recover from deletion and Regional events
• Monitoring
  • CloudTrail data events: Who read or changed which objects
  • GuardDuty S3 Protection: Threats to data in S3
  • AWS Config: Detect unencrypted or public resources
  • Amazon Security Lake: Central security data for analysis