Securing resources on AWS: encryption in transit and at rest, and the services customers use to protect workloads

Why this matters

AWS secures the cloud itself, but everything a company builds inside it is the company's to protect. That is the shared responsibility model from lesson 6, and this lesson is where it becomes practical. Which switch encrypts a disk? Which service tells you a server has a known vulnerability? Which one notices that an instance has started talking to a criminal's server at three in the morning? And when it does notice, whose job is it to act?

A salesperson will hear "is our data encrypted?" from nearly every serious customer. A manager has to decide whether to pay for extra DDoS protection or a dedicated key store. A junior engineer is asked to "turn on GuardDuty" or "get us a certificate" in their first week. Each of these has a specific AWS answer, and the names are close enough to be confused: Inspector, GuardDuty, Detective, Macie and Security Hub all sound like they do the same job. They do not, and this lesson gives each one a single sentence you can rely on.

The lesson

Benefits of cloud security (for example, encryption)

Moving to AWS changes the economics of security. A small company gets physical security, hardware and a hardened network that it could never build itself, and it inherits those controls from AWS. Security tools that once meant buying an appliance are now services you switch on and pay for as you use them, and they can be turned on in every account at once.

Cloud security also gains from visibility and automation. Because every change on AWS is an API call, every change can be recorded, checked and, where needed, reversed by a script rather than by someone walking to a server room. The same control can be applied to every account through templates and central services, instead of being configured box by box, and the logs from many services feed the detection tools described below.

Encryption is the clearest example. Encryption turns readable data into ciphertext that only someone holding the right key can turn back. On AWS it is built into many services and integrates with AWS Key Management Service, so protecting stored data is often a matter of turning on a setting rather than writing code. Amazon S3, for instance, now applies server-side encryption to new objects by default.

Two misunderstandings are worth clearing up early:

• Encryption does not replace access controls. If an identity is allowed to read the data and use the key, the data is decrypted for it. IAM permissions still decide who gets in (lesson 9).
• Encryption does not remove the customer's compliance duties. It is one control among many, and the customer remains responsible for choosing it, configuring it and controlling who can use the keys.

How customers protect their workloads: Inspector, Security Hub, GuardDuty, Shield and related services

Each of these services has one job. Learn the job and the name together.

• Amazon GuardDuty is threat detection. It continuously analyses AWS CloudTrail events, VPC Flow Logs and DNS logs for signs of malicious or unauthorised activity, such as an instance communicating with a known cryptocurrency-mining domain or credentials being used in an unusual way.
• Amazon Inspector is vulnerability management. It automatically scans EC2 instances, container images in Amazon ECR and Lambda functions for known software vulnerabilities and for unintended network exposure. It finds weaknesses before an attacker uses them; GuardDuty spots activity that may already be an attack.
• AWS Security Hub is the single view. It aggregates and prioritises findings from services such as GuardDuty, Inspector and Macie, across accounts, and runs automated checks of your environment against security best practices.
• Amazon Detective is investigation. After a finding is raised, Detective uses collected log data to build linked views of resources, users and activity, so an analyst can work out the root cause.
• Amazon Macie is sensitive data discovery. It uses machine learning and pattern matching to find and report sensitive data, such as personally identifiable information (PII), in Amazon S3.
• AWS Shield is DDoS protection. A distributed denial-of-service (DDoS) attack floods a site with traffic from many sources to knock it offline. AWS Shield Standard protects every AWS customer automatically against common network and transport layer DDoS attacks, at no additional charge. AWS Shield Advanced is a paid subscription that adds enhanced protection, access to the Shield Response Team around the clock, and cost protection against the scaling charges an attack can cause.
• AWS WAF is a web application firewall. It inspects HTTP requests and blocks common attacks against the application itself, such as SQL injection and cross-site scripting, and it works with services including Amazon CloudFront. Shield deals with floods of traffic; WAF deals with malicious requests.
• AWS Firewall Manager applies firewall rules centrally. For a company using AWS Organizations, it configures AWS WAF rules, Shield Advanced protections and security group policies across the accounts from one place.

A sorting rule for scenario questions: "find weaknesses before they are exploited" points to Inspector, with Security Hub's best-practice checks; "detect malicious activity in logs" points to GuardDuty; "investigate a finding" points to Detective; "where is our PII?" points to Macie; "one place for all findings" points to Security Hub.

Using these services does not hand the response to AWS. If GuardDuty reports that one of your EC2 instances is compromised, the instance and its software belong to you, so your team investigates and fixes it. AWS provides the detection; acting on it is security in the cloud.

Encryption options: in transit and at rest

There are two states in which data needs protecting, and the exam expects you to put an example in the right one.

Encryption in transit protects data while it moves between systems. Examples:

• TLS, the protocol behind HTTPS, between a user's browser and a load balancer or website. AWS Certificate Manager (ACM) provisions and manages the TLS certificates used with services such as Elastic Load Balancing and Amazon CloudFront.
• AWS Site-to-Site VPN, which creates encrypted IPsec tunnels between a company's own network and its VPC across the public internet. By contrast, AWS Direct Connect is a private, dedicated connection that does not use the internet, and it is not encrypted by default. Both are covered further in lesson 17.

Encryption at rest protects stored data. Examples:

• Turning on encryption for Amazon EBS volumes, the disks attached to EC2 instances.
• Server-side encryption in Amazon S3: S3 encrypts each object as it writes it to storage and decrypts it when an authorised user reads it. With SSE-KMS, the keys are managed in AWS KMS.
• Encrypting Amazon RDS databases and their snapshots.

The alternative to server-side encryption is client-side encryption, where the customer encrypts the data before uploading it and S3 only ever stores ciphertext. The customer then manages that process and its keys itself.

Behind encryption at rest sits key management, and there are two services to tell apart:

• AWS Key Management Service (AWS KMS) creates and controls encryption keys and integrates with services such as S3 and EBS. The keys are protected by hardware security modules (HSMs) that AWS operates as a shared, managed service. Key policies and IAM decide who may use each key.
• AWS CloudHSM provides dedicated, single-tenant HSMs in the AWS Cloud that the customer controls exclusively. If a regulator requires keys to be held in hardware that no other customer shares and that only the company controls, the answer is CloudHSM, not KMS.

One more distinction that catches people: ACM is about certificates for traffic, KMS is about keys for stored data, and AWS Secrets Manager, covered in lesson 10, is about storing secrets such as database passwords. None of them substitutes for the others.

A short scenario

An online retailer stores order records in S3, runs its shop on EC2 behind a load balancer, and has just been hit by a traffic flood. To protect it properly, it serves the shop over HTTPS with a certificate from ACM (in transit), encrypts its S3 objects with SSE-KMS and its EBS volumes (at rest), relies on Shield Standard and considers Shield Advanced for the response team and cost protection, places AWS WAF in front of the site to block injection attempts, turns on Inspector to scan its instances, GuardDuty to watch for threats, Macie to locate customer PII in its buckets, and Security Hub to see all the findings in one place. Every one of those choices, and every response to a finding, is the retailer's responsibility.