Network and edge security on AWS :: The AWS network and edge services that protect workloads, from the edge of the AWS network down to each network interface > Network security on AWS works in layers. Edge services such as CloudFront, WAF and Shield absorb and filter traffic far from your workloads, and VPC controls filter what reaches each subnet and network interface. > No single control is enough. Combine layer 7 filtering (AWS WAF), layer 3 and 4 DDoS defense (AWS Shield), stateful and stateless VPC filtering, private connectivity, and logging for visibility. > Under the shared responsibility model, AWS secures the global network, and you configure the rules, routing and exposure of your own resources. + Network and application protection on AWS + Infrastructure protection in the Security Pillar + AWS Security Reference Architecture Edge protection > Edge services sit in front of your application so attacks are filtered before they reach your Region. CloudFront serves content from edge locations, and WAF and Shield attach to it. > Putting CloudFront in front of an origin and locking the origin to CloudFront is a common way to reduce exposure. + Network and application protection on AWS Amazon CloudFront @amazon-cloudfront :: TLS at the edge, origin access control, geographic restrictions > CloudFront terminates TLS at the edge, can require HTTPS, and uses origin access control to let only CloudFront read from S3 or other supported origins. Geographic restrictions allow or block countries. + Restrict access to an Amazon S3 origin AWS WAF @aws-waf :: Web application firewall > AWS WAF inspects HTTP and HTTPS requests and allows, blocks, counts or challenges them (CAPTCHA or Challenge) using rules in a web ACL. It attaches to CloudFront, Application Load Balancer, API Gateway REST APIs, AppSync, Cognito user pools, App Runner, Verified Access and other supported resources. Managed rule groups :: Rules maintained by AWS and AWS Marketplace sellers > Managed rule groups cover common threats such as the OWASP Top 10 and known bad inputs, and are updated for you. Start in count mode to check for false positives. Rate-based rules :: Limit requests from one source > A rate-based rule counts requests over a time window by IP address or other aggregation keys and acts when the limit is exceeded. It helps against brute force and some layer 7 floods. Bot Control :: Detect and manage bots > Bot Control is a managed rule group with common and targeted protection levels. You are charged additional fees for this managed rule group. Fraud Control :: Account takeover and fake account creation prevention > Account takeover prevention (ATP) and account creation fraud prevention (ACFP) are managed rule groups for login and sign-up pages. Amazon Route 53 @amazon-route-53 :: DNSSEC signing and health checks > Route 53 can sign public hosted zones with DNSSEC using a KMS key so resolvers can validate answers. Health checks and failover routing keep traffic away from unhealthy endpoints. AWS Global Accelerator @aws-global-accelerator :: Static anycast IP addresses on the AWS network > Global Accelerator gives you static anycast IP addresses that route traffic onto the AWS global network to the optimal healthy Regional endpoint. Shield Standard helps protect standard accelerators, and Shield Advanced can be added. DDoS protection > DDoS attacks try to exhaust bandwidth, connections or application capacity. AWS Shield provides two tiers, and good architecture adds resilience. > Distribute traffic with CloudFront and Route 53, and scale out so an attack does not take down a single resource. + AWS Shield + AWS Best Practices for DDoS Resiliency AWS Shield Standard @aws-shield :: Automatic protection against common layer 3 and 4 attacks, at no cost > Shield Standard is on for all AWS customers with no setup, and defends against the most common network and transport layer attacks. It gives particular benefit to Route 53 hosted zones, CloudFront distributions and Global Accelerator standard accelerators. AWS Shield Advanced @aws-shield :: Response team access, cost protection and application layer mitigation > Shield Advanced is a paid subscription for resources you choose, such as CloudFront distributions, Route 53 hosted zones, Global Accelerator standard accelerators, Application and Classic Load Balancers, and Elastic IP addresses. It adds access to the Shield Response Team, DDoS cost protection and automatic application layer mitigation when paired with AWS WAF. VPC traffic filtering > Inside a VPC you filter at several points. Security groups act at the network interface, network ACLs at the subnet, and Network Firewall or appliances inspect traffic in the path. > Use security groups as the main control, and add the others when you need deny rules, deep inspection or central egress filtering. + Infrastructure protection in the Security Pillar Security groups @amazon-virtual-private-cloud :: Stateful filtering at each network interface > Security groups have allow rules only, and return traffic is allowed automatically because they are stateful. They can reference other security groups, which keeps rules readable as instances change. Network ACLs @amazon-virtual-private-cloud :: Stateless filtering at each subnet > Network ACLs have numbered allow and deny rules evaluated in order, and they are stateless, so you must allow return traffic including ephemeral ports. Use them for explicit denies such as blocking an address range. AWS Network Firewall @aws-network-firewall :: Stateful inspection, intrusion prevention, domain filtering and TLS inspection > Network Firewall is a managed, stateful firewall and intrusion detection and prevention service. It supports Suricata-compatible IPS rules, domain filtering and 5-tuple rules, and you create a dedicated subnet for each firewall endpoint and route traffic through it. A newer next-generation firewall (NGFW) policy model layers deny-by-default firewall rules with IPS rules, gives each its own capacity and evaluates all rules as stateful. Route 53 Resolver DNS Firewall @amazon-route-53 :: Block DNS queries to malicious domains > DNS Firewall filters outbound DNS queries from your VPC against domain lists that you or AWS managed lists define. It helps stop exfiltration and malware lookups through DNS. Gateway Load Balancer @elastic-load-balancing :: Insert third-party virtual appliances > Gateway Load Balancer sends traffic to a fleet of virtual appliances such as third-party firewalls, using GENEVE encapsulation. It scales and balances the appliances transparently. Private connectivity > Private connectivity keeps traffic off the public internet. Choose by what you connect: a service in AWS, an application for users, or your own network. > Combine these with endpoint policies and security groups so private paths are also least privilege. + Connect your VPC to services and networks AWS PrivateLink @aws-privatelink :: Reach services without the internet > PrivateLink creates interface endpoints with private IP addresses in your VPC to reach AWS services or services exposed by other accounts. Traffic does not need an internet gateway, NAT device or VPN. AWS Verified Access @aws-verified-access :: Zero trust access to applications without a VPN > Verified Access checks each request against identity and device trust policies before allowing access to corporate applications. Users reach apps through a browser without a VPN. AWS Site-to-Site VPN @aws-site-to-site-vpn :: Encrypted tunnels to your network > Each VPN connection has two IPsec tunnels for redundancy over the internet. It is quick to set up and suits lower bandwidth or backup connectivity. AWS Direct Connect @aws-direct-connect :: Private links, with MACsec encryption on supported connections > Direct Connect provides a dedicated private network connection from your site to AWS. To encrypt the traffic, use MACsec on supported dedicated connections and link aggregation groups, or run an IPsec VPN over Direct Connect. Central management > In a multi-account organization, firewall rules should not be configured one account at a time. A central service applies and audits them. > Delegate administration to a security account so new accounts and resources are covered automatically. + AWS Firewall Manager AWS Firewall Manager @aws-firewall-manager :: One set of WAF, Shield Advanced, security group, Network Firewall and DNS Firewall policies across accounts > Firewall Manager requires AWS Organizations and a Firewall Manager administrator account. Its policies, which also cover VPC security groups and network ACLs, apply to accounts and resources you scope in the organization, and it can remediate non-compliant resources. Monitoring and analysis > You need visibility to detect attacks and misconfiguration. Flow logs show who talked to whom, mirroring shows packets, and analyzers show what could be reached. > Send logs to CloudWatch Logs, S3 or Security Lake so they can be searched and alerted on. + Logging IP traffic with VPC Flow Logs VPC Flow Logs @amazon-virtual-private-cloud :: Network traffic metadata > Flow logs record metadata such as addresses, ports, protocol and accept or reject, but not packet payloads. You can publish them to CloudWatch Logs, S3 or Data Firehose. Traffic Mirroring @amazon-virtual-private-cloud :: Copy packets for deep inspection > Traffic Mirroring copies network packets from the network interface of supported EC2 instances to a target for inspection. Use it for content-level analysis that flow logs cannot give. Network Access Analyzer @amazon-virtual-private-cloud :: Find unintended network access paths > Network Access Analyzer evaluates your VPC configuration against access scopes you define and reports paths that violate them. It checks configuration and does not analyze live traffic. Amazon GuardDuty @amazon-guardduty :: Threat detection from network activity > GuardDuty analyzes VPC Flow Logs, DNS logs and CloudTrail events without you enabling those logs yourself. It reports findings such as communication with known malicious addresses.

Network and edge security mindmap