AWS Security Best Practices

Build Secure, Resilient, and Compliant Architectures on AWS

Security is foundational to everything in the cloud. AWS provides a wide range of built-in services, tools, and controls to help secure infrastructure, applications, and data. But you share responsibility for securing what you build on AWS.

This chapter explores best practices, encryption, IAM boundaries, logging, monitoring, and proactive threat detection using AWS-native tools.

🧱 AWS Shared Responsibility Model

🔍 Who Secures What?

📌 AWS secures the cloud; you secure what’s in the cloud.

Core Pillars of Cloud Security

1. Identity & Access Management
2. Data Protection
3. Network Security
4. Monitoring & Logging
5. Incident Detection & Response
6. Compliance & Governance

Identity & Access Management (IAM)

• Follow least privilege: grant only what’s necessary
• Use IAM roles for applications and services
• Avoid root user for daily use
• Enforce MFA for all accounts
• Create IAM permission boundaries for scoped access
• Monitor unused users/roles via IAM Access Analyzer

🔐 Data Encryption: Protecting Data at Rest & In Transit

✅ At Rest:

In Transit:

• Use TLS (HTTPS) for web apps
• Enable encryption between Lambda + RDS
• Use SSL for S3 endpoints, API Gateway

🔐 Always use KMS-managed keys (SSE-KMS) for better auditability and control.

AWS Key Management Service (KMS)

AWS KMS allows you to:

• Create and manage encryption keys (Customer Master Keys)
• Use KMS for encryption in S3, EBS, Lambda, RDS
• Rotate keys automatically
• Define Key Policies and grants for fine-grained control

✅ Sample Policy: Restrict KMS Key Use

{
  "Effect": "Deny",
  "Action": "kms:Encrypt",
  "Resource": "*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestedRegion": "us-east-1"
    }
  }
}

{
  "Effect": "Deny",
  "Action": "kms:Encrypt",
  "Resource": "*",
  "Condition": {
    "StringNotEquals": {
      "aws:RequestedRegion": "us-east-1"
    }
  }
}

🧠 Use alias names (e.g., alias/app-key) instead of hardcoded key IDs.

Monitoring & Threat Detection Tools

Amazon GuardDuty

• Analyzes CloudTrail, DNS logs, VPC Flow Logs
• Detects: credential exfiltration, port scans, malware behavior
• Sends alerts via CloudWatch Events

✅ No agents needed. Just enable and monitor.

🧪 AWS Inspector (Now Inspector V2)

• Agent-based vulnerability scanner
• Scans:
  • EC2 for CVEs
  • Lambda for code risks
  • ECR container images for package vulnerabilities
• Integrated with Security Hub

🌐 Network Security – Control Ingress & Egress

✅ VPC Best Practices:

• Use private subnets for sensitive workloads
• Only expose public-facing apps to the internet
• Use NAT Gateways, not public IPs, for backend services
• Use VPC endpoints to connect privately to S3, DynamoDB
• Use security groups + NACLs to restrict traffic

🔐 Shield & WAF

🛡️ Shield integrates with CloudFront + Route 53. Use with WAF for full protection.

📊 Logging Best Practices

Compliance & Governance

• Enable AWS Config conformance packs
• Use Service Control Policies (SCP) in AWS Organizations
• Set up tagging policies for cost governance
• Enable Access Analyzer to detect risky configurations
• Integrate with Security Hub to centralize alerts

✅ AWS complies with HIPAA, PCI-DSS, ISO 27001, FedRAMP, and many more.

Summary of Best Practices