AWS
Last updated
Last updated
List of best practices for every AWS services:
AWS Security Cheatsheet:
Treat the parent account like root. Long password with hardware base MFA. Don't use the parent account for anything besides required services, create less privileged child accounts for everything else.
Using identity federation allows for access control to be managed by a on prem authentication server... allowing for easier control of authenticated accounts.
Use groups for allowing access, not accounts.
Part of the IAM console that show what assets uses and accesses, allowing you to more finely tune least privilege.
Access Analyzer allows you to view and manage an assets accessibility based on what it uses.
If there is a deny anywhere it is denied.
If there is no deny and there is an allow anywhere, its allowed.
If nobody says anything about it, it is denied.
For kms encrypted assets, You need to specifically allow decryption permissions for assets using a specific key. Decryption permissions are not automatically granted if retrieve permissions are granted.
Security Groups: They are just statefull firewalls.
You can allow one security group to allow in another security group.
You can specify what traffic you expect on what group from what port
Rout tables: Allows you to specify traffic paths. Anything not specified will be black-holed. Also allows you to specify default gateways.
Used to record all api-calls made by an application.
Use a second account for logging so an attacker can not delete access logs.
Always deny public access to buckets unless explicitly needed. You can deny public bucket access at an account level which overrides individual bucket settings.
From