Book Image

AWS Security Cookbook

By : Heartin Kanikathottu
Book Image

AWS Security Cookbook

By: Heartin Kanikathottu

Overview of this book

As a security consultant, securing your infrastructure by implementing policies and following best practices is critical. This cookbook discusses practical solutions to the most common problems related to safeguarding infrastructure, covering services and features within AWS that can help you implement security models such as the CIA triad (confidentiality, integrity, and availability), and the AAA triad (authentication, authorization, and availability), along with non-repudiation. The book begins with IAM and S3 policies and later gets you up to speed with data security, application security, monitoring, and compliance. This includes everything from using firewalls and load balancers to secure endpoints, to leveraging Cognito for managing users and authentication. Over the course of this book, you'll learn to use AWS security services such as Config for monitoring, as well as maintain compliance with GuardDuty, Macie, and Inspector. Finally, the book covers cloud security best practices and demonstrates how you can integrate additional security services such as Glacier Vault Lock and Security Hub to further strengthen your infrastructure. By the end of this book, you'll be well versed in the techniques required for securing AWS deployments, along with having the knowledge to prepare for the AWS Certified Security – Specialty certification.
Table of Contents (12 chapters)

Cross-account CloudTrail logging

In this recipe, we will learn how to send the CloudTrail logs of one account to another account. By storing logs in a separate account, we isolate the logs from the source account, which will prevent anyone with access to the source account from tampering with the logs. We can provide account-level access to the log account to a limited set of people. Sending logs from multiple accounts to a single account also provides a central place for us to query logs.

Getting ready

We'll need two working AWS accounts to complete this recipe. We will call them log account and logger account. The logger account will send logs to the log account.

Log in to the logger account, which is where logs will...