Summary and Quiz

In this lesson, we’ll summarize what we’ve learned in this chapter and test our knowledge with a short quiz.

Summary

In this chapter, we learned about security and compliance services offered by AWS. Here’s a brief summary of the services we covered:

• Shared Responsibility Model: In the AWS Shared Responsibility Model, AWS is responsible for the security “of” the cloud, which includes the infrastructure, hardware, and services. Customers are responsible for security “in” the cloud, covering their data, applications, identity and access management, and configuring services securely. AWS secures the underlying infrastructure, while customers must secure their usage of AWS services.

• AWS KMS: KMS is used to manage encryption keys in AWS. AWS provides both AWS-managed keys and customer-managed keys.

• AWS WAF: WAF is a network firewall used to protect our applications from malicious access. We can configure related web ACLs to defend our resources from specific types of attacks, including XSS scripting, SQL injections, and cross-site request forgery. WAF analyzes the request sent to the application and blocks any request that does not comply with the set ACL rules.

• AWS Shield: AWS Shield is a protection service that protects applications hosted in the AWS cloud from Distributed Denial of Service (DDoS) attacks. It operates on the OSI model’s network, transport, and application layer (3rd, 4th, and 7th layer).

• Amazon Detective: It helps organizations identify security issues, conduct efficient investigations, and proactively respond to potential threats by continuously analyzing and correlating log data from various AWS services, such as AWS CloudTrail and Amazon VPC Flow Logs. It does not resolve any security issues; rather, it just identifies them and recommends actions that can mitigate them.

• AWS Directory Service: With AWS Directory Service, organizations can centralize user identities and access management, simplifying authentication and authorization across AWS resources and applications.

• AWS Secret Manager: Secret Manager can store our passwords and credentials. All stored secrets within AWS Secrets Manager undergo encryption via AWS Key Management Service (KMS), which delivers resilient encryption standards and proficient key management capabilities.

• Amazon Macie: It helps organizations maintain their data assets’ confidentiality, integrity, and availability in AWS environments. It is a fully managed data security and privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in AWS.