Amazon Web Services, or AWS for short, is the world’s biggest provider of cloud infrastructure used by thousands of companies. And while it provides an unparalleled number of cloud services of excellent quality, it also gives its clients a bit of headache when it comes to security.

The thing is, cloud IT security differs from the on-premises IT one in several important ways. This, in addition to the shared responsibility security model, often leads to confusion and risks as AWS clients are not fully aware of what they are supposed to do. In this article, we will walk through AWS security best practices and will provide you with tips on how to get the maximal benefit from your AWS solution with minimal risks.

Understanding AWS cloud security

In order to understand how AWS security works, let’s first define it. AWS cloud security is a set of built-in protocols and checks aimed at securing the cloud infrastructure that you are working in. It is important to remember that Amazon secures only the cloud while the client has to secure everything outside the cloud. This model is called shared responsibility - we’ll talk about it in detail a bit later.

Taking into consideration the shared responsibility model, some may ask: how secure is AWS, really? The good news is that Amazon takes its security part very seriously. AWS invests an impressive amount of resources in maintaining an excellent level of cloud security. In this way, the security of AWS cloud itself surpasses that of many on-premises environments.

The bad news is that there is also your part of shared responsibility, and the security of everything outside the cloud will be exactly how you make it. So to answer the question: AWS is extremely secure if you invest the same amount of time and resources into security as Amazon does.

So how is AWS cloud security working?

AWS cloud security is aimed at protecting the infrastructure where the AWS services run. The infrastructure includes software, hardware, facilities and networking. And if you need examples of processes that Amazon is responsible for, think of configuration management and maintenance or patch management. As we already said, Amazon takes care of everything happening in the cloud - now it’s time to learn what the customer is responsible for.

The shared responsibility model explained

We’ve already mentioned that Amazon is responsible for everything happening in the cloud, while customers are responsible for everything happening outside the cloud. This security landscape is called “a shared responsibility model” and implies that security is divided equally between the provider and the customer.

Let’s first talk about the security provided by Amazon. AWS ensures security for the hosting infrastructure that contains cloud applications. To be more specific, it includes security of the regional data centers, the operating system, and the virtualization layer. AWS manages such operations as threat monitoring, logging, and software updates, so its IaaS remains as robust as possible.

Now, to the customer’s part of the security. AWS clients have to take care of the following:

Security of their data;
Access management;
Operating systems in use;
Firewall configurations;
Network traffic monitoring;
Data encryption;
External threat neutralization.

And the list is not even full. As you can see, an AWS user needs to do a lot of work on their side in order to establish effective defense against the possible threats. Thus, if an organization decides to shift to the cloud, it should be ready to adopt the needed policies.

Cloud vs on-premises IT security: main differences

Cloud security may sound intimidating, especially if you have not worked in the cloud before. Many people wrongly assume that a cloud requires a brand-new approach towards security and that all processes are to be redesigned.

While there are certain differences between the cloud and on-premises security, the overall pattern remains the same. You need to:

Identify your assets (what you are securing);
Define a protection plan (how you will secure the assets);
Implement security controls;
Detect threats;
Design a threat response strategy;
Design a recovery strategy.

To make things even better, you can use one of the most common security frameworks (like NIST cybersecurity framework) to protect your cloud environment.

But now, let’s turn to the main differences between cloud and on-premises security. If not considered in advance, these differences may quickly turn into bottlenecks or escalate into breaches.

Responsibility distribution

Though we’ve already discussed the shared responsibility model, let’s review it one more time. When talking about the cloud, the responsibility for the security will always be distributed among the cloud provider and the client.

So if employees in your organization wrongly believe that the cloud provider is responsible for a certain aspect, this may lead to big issues in the future. The reason for that is that employees will not be paying enough attention to the security, assuming they are not responsible for it. But how do you know exactly what you and the provider are responsible for?

To make things easier, AWS established a shared responsibility model and explained in detail the area of responsibility of every party involved. You can read more about on the official website. We can also add that it is highly important to conduct corresponding employee training, so everyone understands their tasks and roles when it comes to securing your cloud environment.

Fast creation and deployment of assets

One of the biggest aspects regarding the cloud environment management is the speed and ease of creation and deployment of assets. While you have full control over your on-premises IT infrastructure, and it might take a while to add any new asset, in the cloud, it may happen almost instantly. Any user with the corresponding access rights can create, add, or remove an asset in the cloud. On one hand, this makes the cloud infrastructure modification really easy. On the other, such speed may lead to vulnerabilities and calls for specific security controls.

You can’t apply traditional security checks to the cloud infrastructure, simply because the asset you are checking may not exist in a few minutes anymore. Also, every new/changed asset calls for proper configuration and users often don’t dedicate enough time to it. This is something to keep in mind when planning your security strategy.

Issues with maintaining a holistic view of the environment

Due to the speed of change of the cloud environment, it may be challenging to maintain a holistic view of this environment and to keep a relevant inventory of all assets. But if you don’t know what to secure, you won’t be able to secure it at all. And that’s one of the biggest pitfalls organizations face when working with the cloud.

What challenges does working with AWS bring?

It may seem that shared responsibility is already a challenge that is big enough, but there are a few more things to consider. All of them are manageable on the condition that you plan ahead - so let’s dive in.

Maintaining visibility of AWS services

Remember we talked about how quickly assets can be created and deployed in the cloud? This leads to low visibility of these assets, meaning that your team may not even be 100% sure about what services are currently in use. And if you don’t know what services are in use, how can you effectively protect them?

Add to that the risk of shadow IT. We’ve written about it on our blog already, so let’s briefly walk through the main points. The term shadow IT refers to software and/or hardware that employees use without the approval of the IT department. There may be several reasons for shadow IT to occur, but the most common is that employees simply find their software easier and less confusing than a company-approved one. Shadow IT heavily impacts the company’s security and leads to possible breaches and, hence, massive financial losses.

Getting back to AWS, in order to maintain high visibility of your cloud assets, it is crucial to develop a solid strategy on their proper management. Note that it is especially important for hybrid and multi-cloud environments.

Compliance with required regulations

Same as with on-premises IT security, cloud IT security calls for compliance with data protection regulations (i.e. GDPR). The thing is, it’s harder to manage the needed compliance when you have a hybrid or multi-cloud environment that is constantly changing and evolving.

Thus, you will have to check the compliance of every asset and cloud solution that you use in order to establish the needed level of security. And that might take quite a lot of time and resources, so keep that in mind.

Consistent application of security policies

When talking about ever-changing environments, consistency is not the first thing that comes to mind (let’s be honest here). However, it is an absolute must and a big headache for companies operating in the cloud. By that, we mean consistent and uniform policies applied to all available apps and solutions.

You might think now: how do I establish consistent security policies when everything can change at any time? Fortunately, AWS provides native tools to help you out, plus there are available security management systems that facilitate the process of establishing and maintaining such policies.

Why is it crucial to maintain strong AWS cloud security?

The obvious reason for maintaining strong AWS security is protection of your data and the data of your customers. According to the reports by the IBM and the Ponemon Institute, the average cost of a data breach in 2022 was $4.35 million. That means, even the tiniest vulnerability may become the cause of a massive financial loss, not to mention a hit at the company’s reputation.

With its rigorous approach towards security, AWS helps companies navigate through the main risks and establish robust defense on their side. And that means, AWS contributes greatly to keeping your data safe and to helping you cut costs, typically associated with security measures and policies.

You might find the following articles interesting:

A bit on the Security Pillar of the AWS Well-Architected Framework

To help organizations build robust and effective cloud workloads, Amazon came up with the AWS Well-Architected framework. It consists of useful guidelines, AWS best practices and recommendations on designing and operating secure and sustainable workloads.

The Well-Architected framework is based on six pillars:

Operational Excellence: focus on running and monitoring systems and on continuous improvement of processes.
Security: focus on protecting the system and the data.
Reliability: focus on workloads’ performance and on their recovery in case of an issue.
Performance Efficiency: focus on correct allocation of resources.
Cost Optimization: focus on avoiding extra costs and on maintaining the defined budget.
Sustainability: focus on reducing the environmental impact of working cloud environments.

Though each pillar is worth your attention, we will take a closer look at the security pillar. In the official documentation, you can read about:

Security foundations: including design principles, AWS account management, and secure operation of workloads;
Identity and access management: describes identity and permissions management;
Detection of unexpected / unwanted configuration changes, and the detection of unexpected behavior;
Infrastructure protection: describes control methodologies for safeguarding your infrastructure;
Data protection: includes data classification, protection of data at rest, and protection of data in transit;
Incident response: explains how to correctly respond to an incident;
Application security: includes the best practices for building secure and high-performing workloads.

AWS security best practices checklist

As you can see, AWS provides a lot of useful information for its clients and assists in creating safe and secure environments. And now, the fun part - the AWS security best practices checklist!

Use AWS knowledge base

In order to design a robust cybersecurity strategy, you first need to get acquainted with AWS cloud security best practices. This is where the Well-Architected framework steps in and serves as your number one source of valuable information. We highly recommend studying the available documentation and using it as a base for your policies.

Create an inventory of your assets

We’ve already talked about the importance of assets’ visibility, so it’s natural that your next step will be creating an inventory for all assets in use. That means, you need to have a detailed map of all apps and storage containers, as well as the purpose of every asset listed down. You will need to define and document such things as:

Security classification of every asset;
Value of the data that the asset stores and/or processes;
Importance of the asset for everyday workflows.

Once you have all your assets mapped out, it will be much easier to assign the corresponding security controls to them. It will also become easier to detect vulnerabilities and risks, as well as expanding cloud deployments.

Design your cybersecurity baseline and enforce it

This is probably the most complex, but also a highly important step: creating a security baseline for your environment. All your teams, including the DevOps one, should define how your environment will be protected. For that, you will need to design a solid strategy to cover all needed aspects, from assets configuration to threat response.

You might want to consider introducing DevSecOps since this approach towards security was designed specifically for DevOps teams. And if you are feeling overwhelmed and don’t know where to start, you can always use the AWS Well-Architected Framework and CIS security controls as a baseline.

You will also need to think about the baseline enforcement. Below are several tips that you might find helpful:

Provide infrastructure templates to your developers, so it would be easier for them to adhere to the security baseline.
Use a monitoring solution to detect cloud misconfigurations and timely respond to them - the solution can be either an AWS Security Hub or a third-party vulnerability management solution with the built-in monitoring feature.
Use a Cloud security posture management (CSPM) solution to monitor accounts from multiple cloud providers, automate visibility, remediate risks, and automatically fix misconfigurations.

Implement cloud security controls

Setting up proper AWS cloud security is a complex process, and obviously, there are many security controls involved. Below, we will focus on the most important ones to consider and implement in the first place:

Use Identity and Access Management (IAM) tools: these tools significantly help with access management as they assign temporary and role-based privileges to AWS users. In this way, you can be sure that users have access only to those resources that they need and only for the needed period of time.
Implement multi-factor authentication: while not exclusive for the cloud, multi-factor authentication is a highly effective security control that can minimize risks of unauthorized agents accessing sensitive data.
Encourage password hygiene: make sure that all AWS users use strong and complex passwords and that these passwords are time-limited.
Perform scheduled privileged audits: when employees leave your company or stop working in the cloud environment, it is critical that they do not have access to assets anymore and that their accounts are inactive. You can check it with regular privileged audits.
Pay double attention to root access privilege: root access is an extremely important privilege, as it grants access to any resource and allows executing any command. Hence, you need to pay extra attention to whom you are assigning root access privilege and to the way root access keys are guarded.
Consider implementing micro-segmentation: micro-segmentation is a network security technique used to logically divide the data center into separate segments so that each segment has its own unique security controls. In the case of AWS, micro-segmentation will allow you to keep each application in its own compartment, which, in turn, will minimize possible risks.
Pay attention to EC2 security: Amazon EC2 is a virtual machine that represents a physical server for your app. Unfortunately, EC2 breaches are a common cause, so make sure to properly control access to EC2 (i.e., by introducing the least privilege principle).

Use encryption for the data outside the cloud

Remember what we said about the security of assets outside the cloud? While AWS provides a security layer for the data resting in the cloud, it can’t protect the data that is outside. Thus, it is your responsibility to secure this data and one of the best ways to do so is by using encryption. For example, you can use client-side encryption on local WANs (Wide Area Network) or use VPNs for safeguarding remote connections.

Use data backups

Data backups are an effective method for preventing or mitigating data loss in case of an application failure or a security breach. And since ransomware was the biggest cybersecurity threat in 2022, it comes as no surprise that companies started actively backing up their data.

You can pay attention to the AWS Backup service that allows users to schedule backups of databases, storage containers, and file systems. As well, consider implementing the 3-2-1 rule. It implies that an organization should always have three copies of the data on two different media and with one copy off-site for the disaster recovery.

Review access rights and user roles

Even though we’ve talked a bit about user roles and permissions, let’s dig a bit deeper into the subject. The assignment of user roles and privileges is crucial, as it determines who can access what and on what conditions. A wrongly assigned role may lead to major issues, such as data breach, so you’d want to properly manage the assignment of user roles and access rights.

The good news is that AWS got your back here too. Amazon provides the AWS Identity Access Management (IAM) governing model that helps AWS clients better understand user roles, permissions, and privileges and how to work with them.

There are several components that IAM comprises:

Users: individuals who interact with AWS;
Credentials: methods with which users access the system (i.e., passwords, logins, access keys, etc.);
Groups: collections of users (with groups, you can manage permissions for all users in a group at once);
Roles: similar to users, but with temporary access for a single session;
Policies: JSON docs that allow performing an action.

And the good news does not end up here. AWS also has a list of best practices for IAM that thoroughly describe how to manage all IAM components. This list includes such practices as user management through federated SSO, requirements for MFA, regular rotation of access keys, and many others.

Implement a threat response strategy

When talking about cybersecurity, it is not enough to prevent a threat - you also need to know how to correctly respond to one in order to timely take the needed measures and mitigate the damage. Thus, you need to plan a robust threat response strategy that will outline whom you will need to address in case of a threat occurrence and what your steps will be.

In addition to that, do not underestimate the importance of constant threat monitoring. For that, you can use specialized monitoring tools from reliable security partners.

Keep your AWS assets updated

Regular software updates are crucial since there are new cyber threats appearing on a regular basis, and you need to be prepared for them. Thus, you need to regularly perform application patching to eliminate existing vulnerabilities and prevent threat agents from attacking your software. And once again, AWS comes to your aid with its AWS Systems Manager Patch Manager. The tool helps with patching by enabling regular updates and allowing to perform security scans.

Capture and protect logs

Logs are highly important for the security of your applications as they contain all the activity and can help easily detect any malicious events. Log management is included in the NIST cybersecurity framework and assists not only in detecting threats, but also responding to them and recovering afterward.

AWS provides the CloudTrail service for log management. It automatically collects and stores AWS API activity and also allows creating “trails” but for a fee (so keep that in mind). “Trails” enable users to capture additional activity and send logs to S3 for storage and/or export.

Perform security training for employees

Last but not least - provide corresponding training for all your employees and C-level executives, so everyone understands the importance of cloud security and adheres to needed requirements.

Lack of understanding of cybersecurity and ignorance of needed actions (even if they seem non-significant, like logging out of one’s device) may lead to bigger problems in the future. Hence, security policies should be adopted on all levels of an organization and everyone should be informed on how to act, especially in the case of a threat.

Summing up

Cloud security may seem overwhelming at a first glance, but as you can see, AWS got you covered. With available official guidelines and documentation and our list of AWS security best practices, it will be much easier for you to define a suitable cybersecurity strategy that will be consistent, scalable, and effective. And considering the ever-growing number of cyber threats, it is critical for companies to establish a well-rounded security environment, especially if they operate in the cloud.

FAQ

Q: What is AWS security group?
A: Security groups in AWS are used to collect user accounts, computer accounts, and other groups into units that can be managed as a whole. One of the great things about a security group is that it controls the traffic that is allowed to reach and leave certain resources (the ones that are associated with the traffic).

Q: What is AWS security hub?
A: AWS security hub is a cloud security posture management service that is responsible for performing security checks, alerts aggregation, and automated remediation. The hub collects security data across your cloud environment (AWS accounts, services, third-party partner products) and helps in analyzing security trends.

Q: What security does AWS provide?
A: AWS provides a high level of security for everything that is happening in the cloud. AWS customers, on the other hand, are responsible for everything happening outside the cloud (i.e., access management). This is called a shared responsibility security model and implies that both the cloud provider and the client are responsible for the security of the environment.