Security pillar principles in AWS - Step-by-Step Execution

Process Flow - Security pillar principles

Identify sensitive data

↓

Control access tightly

↓

Protect data in transit and at rest

↓

Monitor and log activity

↓

Respond to security events

↓

Review and improve

This flow shows the main steps to keep cloud systems secure, from knowing what to protect to improving security over time.

Execution Sample

AWS

1. Identify sensitive data
2. Set access permissions
3. Encrypt data
4. Enable logging
5. Respond to alerts

This sequence outlines the key actions to secure cloud resources step-by-step.

Process Table

Step	Action	Purpose	Result
1	Identify sensitive data	Know what needs protection	List of sensitive resources created
2	Set access permissions	Limit who can see or change data	Access policies applied
3	Encrypt data	Protect data from unauthorized reading	Data encrypted at rest and in transit
4	Enable logging	Record activity for audits and alerts	Logs start capturing events
5	Respond to alerts	Act on suspicious activity quickly	Security incidents handled
6	Review and improve	Keep security up to date	Security posture enhanced
Exit	All steps done	Security principles applied	Cloud environment secured

💡 All security pillar principles steps completed to protect cloud resources

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
SensitiveDataList	empty	identified	identified	identified	identified	identified	identified
AccessPermissions	none	none	set	set	set	set	set
EncryptionStatus	none	none	none	enabled	enabled	enabled	enabled
LoggingStatus	off	off	off	enabled	enabled	enabled	enabled
IncidentResponse	none	none	none	none	none	active	active

Key Moments - 3 Insights

Why do we identify sensitive data first before setting permissions?

Because without knowing what data is sensitive (see Step 1 in execution_table), we cannot decide who should have access (Step 2).

Is encryption enough to secure data?

No, encryption protects data but logging and response (Steps 4 and 5) are also needed to detect and handle threats, as shown in the execution_table.

Why enable logging after setting permissions and encryption?

Logging records what happens after protections are in place, so we can monitor if they work or if there are attacks (Step 4 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after Step 3?

A Logs start capturing events

B Data encrypted at rest and in transit

C Access policies applied

D Security incidents handled

💡 Hint

Check the 'Result' column for Step 3 in the execution_table

At which step does logging get enabled according to the execution_table?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Action' column and find when 'Enable logging' happens

If we skip identifying sensitive data, which variable in variable_tracker remains empty?

A SensitiveDataList

B AccessPermissions

C EncryptionStatus

D LoggingStatus

💡 Hint

Check the 'SensitiveDataList' row in variable_tracker for its initial and after Step 1 values

Concept Snapshot

Security Pillar Principles:
1. Identify sensitive data to protect
2. Set strict access controls
3. Encrypt data in transit and at rest
4. Enable logging to monitor activity
5. Respond quickly to security events
6. Review and improve regularly

Full Transcript

The security pillar principles guide how to protect cloud resources. First, identify what data is sensitive. Then, set access permissions to limit who can use it. Next, encrypt data to keep it safe from unauthorized reading. Enable logging to track activity and detect problems. Respond quickly to any security alerts. Finally, review and improve security continuously to stay safe.

Practice

1. Which of the following is a primary goal of the AWS Security Pillar?

easy

A. Protect cloud resources from unauthorized access

B. Increase the speed of data processing

C. Reduce the cost of cloud services

D. Improve user interface design

Solution

1. Step 1: Understand the purpose of the Security Pillar

   The Security Pillar focuses on protecting cloud resources from threats and unauthorized access.

2. Step 2: Match the goal with the options

   Only Protect cloud resources from unauthorized access directly relates to protecting resources from unauthorized access, which is the main goal.

3. Final Answer:

   Protect cloud resources from unauthorized access -> Option A

4. Quick Check:

   Security Pillar = Protect resources [OK]

Hint: Security pillar means protecting resources from threats [OK]

Common Mistakes:

• Confusing security with cost or speed improvements
• Choosing options unrelated to protection
• Mixing security goals with usability goals

2. Which AWS service is primarily used to manage user access and permissions securely?

easy

A. Amazon S3

B. AWS CloudFormation

C. Amazon EC2

D. AWS Identity and Access Management (IAM)

Solution

1. Step 1: Identify the service for managing access

   AWS IAM is designed to control who can access AWS resources and what actions they can perform.

2. Step 2: Compare with other services

   Amazon S3 stores data, EC2 runs servers, CloudFormation manages infrastructure as code, but none manage user permissions directly.

3. Final Answer:

   AWS Identity and Access Management (IAM) -> Option D

4. Quick Check:

   Access control service = IAM [OK]

Hint: IAM controls user access and permissions in AWS [OK]

Common Mistakes:

• Confusing storage or compute services with access control
• Selecting services that do not handle permissions
• Ignoring the role of IAM in security

3. Consider this AWS CloudTrail configuration snippet:

{
  "TrailName": "MyTrail",
  "IsLogging": true,
  "IncludeGlobalServiceEvents": false
}

What is the effect of setting IncludeGlobalServiceEvents to false?

medium

A. Logging will be disabled for the trail

B. Global service events like IAM changes will not be logged

C. All AWS service events will be logged globally

D. Only global service events will be logged

Solution

1. Step 1: Understand the IncludeGlobalServiceEvents setting

   This setting controls whether global AWS service events (like IAM or AWS STS) are included in the logs.

2. Step 2: Interpret the false value

   Setting it to false means these global events will NOT be logged by this trail.

3. Final Answer:

   Global service events like IAM changes will not be logged -> Option B

4. Quick Check:

   IncludeGlobalServiceEvents false = no global logs [OK]

Hint: False means global events are excluded from logging [OK]

Common Mistakes:

• Assuming false disables all logging
• Confusing global events with regional events
• Thinking false means logging only global events

4. You wrote this IAM policy snippet but it does not restrict access as expected:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::example-bucket"
  }]
}

What is the main issue causing the policy to not restrict access properly?

medium

A. The Action "s3:*" is invalid syntax

B. The Effect should be Deny instead of Allow

C. The Resource ARN is missing the bucket objects path

D. The Version date is incorrect

Solution

1. Step 1: Check the Resource ARN format

   The ARN "arn:aws:s3:::example-bucket" refers only to the bucket itself, not the objects inside it.

2. Step 2: Understand access scope

   To allow or restrict access to objects, the ARN must include "/*" to cover all objects, e.g., "arn:aws:s3:::example-bucket/*".

3. Final Answer:

   The Resource ARN is missing the bucket objects path -> Option C

4. Quick Check:

   Bucket ARN needs /* for objects [OK]

Hint: Bucket ARN must include /* to cover objects [OK]

Common Mistakes:

• Using Allow instead of Deny incorrectly
• Assuming s3:* is invalid
• Ignoring the need for object path in ARN

5. You want to design a secure AWS environment that automatically detects unusual activity and isolates affected resources. Which combination of AWS services best supports this Security Pillar principle?

hard

A. AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager

B. AWS Config, Amazon S3, AWS Lambda

C. Amazon EC2, AWS IAM, AWS CloudFormation

D. AWS Trusted Advisor, Amazon RDS, AWS SNS

Solution

1. Step 1: Identify services for detecting unusual activity

   Amazon GuardDuty analyzes logs and detects suspicious behavior automatically.

2. Step 2: Identify services for logging and managing resources

   AWS CloudTrail records API activity for auditing, and AWS Systems Manager helps isolate and manage affected resources.

3. Step 3: Evaluate other options

   Other options lack the combination of detection, logging, and automated management needed for this security goal.

4. Final Answer:

   AWS CloudTrail, Amazon GuardDuty, AWS Systems Manager -> Option A

5. Quick Check:

   Detect + log + isolate = CloudTrail + GuardDuty + Systems Manager [OK]

Hint: Detect threats with GuardDuty, log with CloudTrail, manage with Systems Manager [OK]

Common Mistakes:

• Choosing services that do not detect threats automatically
• Ignoring the need for logging and management together
• Confusing monitoring with storage or compute services