Security pillar principles in AWS - Commands & Configuration

Introduction

Security is about protecting your cloud resources and data from unauthorized access and mistakes. The security pillar principles help you build safe and trustworthy systems in the cloud.

When you want to control who can access your cloud resources and what they can do

When you need to protect sensitive data like passwords, personal info, or payment details

When you want to monitor your cloud environment for unusual activity or threats

When you need to respond quickly to security incidents or breaches

When you want to follow best practices to keep your cloud setup secure and compliant

Commands

This command creates a new user named 'example-user' in AWS Identity and Access Management (IAM) to control access securely.

Terminal

aws iam create-user --user-name example-user

Expected Output

{

    "User": {

        "Path": "/",

        "UserName": "example-user",

        "UserId": "AIDAEXAMPLEUSERID",

        "Arn": "arn:aws:iam::123456789012:user/example-user",

        "CreateDate": "2024-06-01T12:00:00Z"

    }

}

→

--user-name - Specifies the name of the new IAM user

This command attaches a policy that grants read-only access to the user, following the principle of least privilege.

Terminal

aws iam attach-user-policy --user-name example-user --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Expected Output

No output (command runs silently)

→

--user-name - Specifies the user to attach the policy to

→

--policy-arn - Specifies the ARN of the policy to attach

This command creates a CloudTrail trail to record all API calls for auditing and monitoring security events.

Terminal

aws cloudtrail create-trail --name example-trail --s3-bucket-name example-cloudtrail-bucket

Expected Output

{

    "Name": "example-trail",

    "S3BucketName": "example-cloudtrail-bucket",

    "IncludeGlobalServiceEvents": true,

    "IsMultiRegionTrail": false,

    "TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/example-trail"

}

→

--name - Names the CloudTrail trail

→

--s3-bucket-name - Specifies the S3 bucket to store logs

This command starts logging API activity with the CloudTrail trail to monitor security events in real time.

Terminal

aws cloudtrail start-logging --name example-trail

Expected Output

No output (command runs silently)

→

--name - Specifies which trail to start logging

This command creates a new encryption key in AWS Key Management Service (KMS) to protect data at rest.

Terminal

aws kms create-key --description "Key for encrypting sensitive data"

Expected Output

{

    "KeyMetadata": {

        "AWSAccountId": "123456789012",

        "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",

        "Arn": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab",

        "CreationDate": "2024-06-01T12:00:00Z",

        "Enabled": true,

        "Description": "Key for encrypting sensitive data"

    }

}

→

--description - Adds a description to identify the key's purpose

Key Concept

If you remember nothing else from this pattern, remember: control who can do what, protect data, monitor activity, and respond quickly to keep your cloud secure.

Common Mistakes

Giving users more permissions than they need

This increases the risk of accidental or malicious actions that can harm your system.

Always assign the minimum permissions necessary for users to do their job.

Not enabling logging and monitoring

Without logs, you cannot detect or investigate security incidents effectively.

Set up CloudTrail or similar services to record all important actions.

Storing sensitive data without encryption

Data can be exposed if someone gains unauthorized access to storage.

Use AWS KMS keys to encrypt data at rest and in transit.

Summary

Create IAM users with specific permissions to control access.

Use CloudTrail to log and monitor all API activity for security auditing.

Protect sensitive data using encryption keys managed by AWS KMS.

Practice

1. Which of the following is a primary goal of the AWS Security Pillar?

easy

A. Protect cloud resources from unauthorized access

B. Increase the speed of data processing

C. Reduce the cost of cloud services

D. Improve user interface design

Solution

1. Step 1: Understand the purpose of the Security Pillar

   The Security Pillar focuses on protecting cloud resources from threats and unauthorized access.

2. Step 2: Match the goal with the options

   Only Protect cloud resources from unauthorized access directly relates to protecting resources from unauthorized access, which is the main goal.

3. Final Answer:

   Protect cloud resources from unauthorized access -> Option A

4. Quick Check:

   Security Pillar = Protect resources [OK]

Hint: Security pillar means protecting resources from threats [OK]

Common Mistakes:

• Confusing security with cost or speed improvements
• Choosing options unrelated to protection
• Mixing security goals with usability goals

2. Which AWS service is primarily used to manage user access and permissions securely?

easy

A. Amazon S3

B. AWS CloudFormation

C. Amazon EC2

D. AWS Identity and Access Management (IAM)

Solution

1. Step 1: Identify the service for managing access

   AWS IAM is designed to control who can access AWS resources and what actions they can perform.

2. Step 2: Compare with other services

   Amazon S3 stores data, EC2 runs servers, CloudFormation manages infrastructure as code, but none manage user permissions directly.

3. Final Answer:

   AWS Identity and Access Management (IAM) -> Option D

4. Quick Check:

   Access control service = IAM [OK]

Hint: IAM controls user access and permissions in AWS [OK]

Common Mistakes:

• Confusing storage or compute services with access control
• Selecting services that do not handle permissions
• Ignoring the role of IAM in security

3. Consider this AWS CloudTrail configuration snippet:

{
  "TrailName": "MyTrail",
  "IsLogging": true,
  "IncludeGlobalServiceEvents": false
}

What is the effect of setting IncludeGlobalServiceEvents to false?

medium

A. Logging will be disabled for the trail

B. Global service events like IAM changes will not be logged

C. All AWS service events will be logged globally

D. Only global service events will be logged

Solution

1. Step 1: Understand the IncludeGlobalServiceEvents setting

   This setting controls whether global AWS service events (like IAM or AWS STS) are included in the logs.

2. Step 2: Interpret the false value

   Setting it to false means these global events will NOT be logged by this trail.

3. Final Answer:

   Global service events like IAM changes will not be logged -> Option B

4. Quick Check:

   IncludeGlobalServiceEvents false = no global logs [OK]

Hint: False means global events are excluded from logging [OK]

Common Mistakes:

• Assuming false disables all logging
• Confusing global events with regional events
• Thinking false means logging only global events

4. You wrote this IAM policy snippet but it does not restrict access as expected:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::example-bucket"
  }]
}

What is the main issue causing the policy to not restrict access properly?

medium

A. The Action "s3:*" is invalid syntax

B. The Effect should be Deny instead of Allow

C. The Resource ARN is missing the bucket objects path

D. The Version date is incorrect

Solution

1. Step 1: Check the Resource ARN format

   The ARN "arn:aws:s3:::example-bucket" refers only to the bucket itself, not the objects inside it.

2. Step 2: Understand access scope

   To allow or restrict access to objects, the ARN must include "/*" to cover all objects, e.g., "arn:aws:s3:::example-bucket/*".

3. Final Answer:

   The Resource ARN is missing the bucket objects path -> Option C

4. Quick Check:

   Bucket ARN needs /* for objects [OK]

Hint: Bucket ARN must include /* to cover objects [OK]

Common Mistakes:

• Using Allow instead of Deny incorrectly
• Assuming s3:* is invalid
• Ignoring the need for object path in ARN

5. You want to design a secure AWS environment that automatically detects unusual activity and isolates affected resources. Which combination of AWS services best supports this Security Pillar principle?

hard

A. AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager

B. AWS Config, Amazon S3, AWS Lambda

C. Amazon EC2, AWS IAM, AWS CloudFormation

D. AWS Trusted Advisor, Amazon RDS, AWS SNS

Solution

1. Step 1: Identify services for detecting unusual activity

   Amazon GuardDuty analyzes logs and detects suspicious behavior automatically.

2. Step 2: Identify services for logging and managing resources

   AWS CloudTrail records API activity for auditing, and AWS Systems Manager helps isolate and manage affected resources.

3. Step 3: Evaluate other options

   Other options lack the combination of detection, logging, and automated management needed for this security goal.

4. Final Answer:

   AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager -> Option A

5. Quick Check:

   Detect + log + isolate = CloudTrail + GuardDuty + Systems Manager [OK]

Hint: Detect threats with GuardDuty, log with CloudTrail, manage with Systems Manager [OK]

Common Mistakes:

• Choosing services that do not detect threats automatically
• Ignoring the need for logging and management together
• Confusing monitoring with storage or compute services