hamburger icon close icon

AWS Security Best Practices: Protecting Your Cloud Resources

Subscribe to our blog

April 14, 2021

Topics: Cloud Insights AWSElementary

What are AWS Security Best Practices?

When setting up your resources and data in AWS, it can take a few tries to get your security configurations right. This may be okay if you test your deployment with dummy data but if you have live data in AWS, you need to get security right from the start. AWS security  best practices can help you do that. These practices are based on the experience and expertise of established AWS users and engineers.

In this article, you will learn:

AWS Security Best Practices

Whether you’re new to AWS or interested in confirming your security policies, the following best practices are a good place to start. These practices can help ensure that your most valuable assets are covered and that you’re taking appropriate preventative measures.

1. Maintain Full Visibility

Cloud resources are flexible and highly dynamic which can make it difficult for you to maintain visibility over your deployment. This is especially true if you have hybrid or multi-cloud environments with different infrastructures and monitoring solutions.  

To overcome these challenges, it is important to implement solutions that enable you to centralize monitoring and that can correlate data from multiple sources. Additionally, you should incorporate tools with service and device discovery features to ensure that no assets are overlooked.

2. Limit Privileges to the Minimum

Over assigning privileges to users creates multiple types of risks. Users with too lax of privileges may accidentally modify settings or delete data without being aware of the consequences. Additionally, if users' credentials are compromised, attackers have much greater access to your systems and data.

To avoid these issues, you should restrict privileges to the minimum needed for applications or users to perform their jobs. You should also consider dividing high-level privileges into multiple roles or sets of credentials. This way, even if one set is compromised, the attacker still has only a small set of privileges.

3. Implement Strong Authentication

Stolen or abused credentials are one of the greatest threats to cloud services. Making sure that credentials are not exposed is a start to fixing this issue and strong authentication practices are another. You should create strict password policies preventing password reuse, enforcing complexity, and ensuring time limits.

Additionally, you should consider enforcing multi-factor authentication (MFA). MFA requires two or more proofs of identity before access is granted. AWS’s Identity and Access Management (IAM) service supports MFA and enables you to implement it on a per user or device basis.

4. Limit Network Traffic

Limiting the traffic that is allowed between your services or on your network is one way to restrict your vulnerabilities and potential attackers. When limiting traffic, make sure to pay attention to both inbound and outbound traffic. Blocking inbound can prevent attackers from entering while blocking outbound can help prevent insider breaches or data exfiltration.

In AWS, you can limit traffic with tools like AWS Firewall manager or access rules based on Security Groups. These groups enable you to attach rules at the resource or network level. When creating rules, make sure that your allowed IP ranges are limited. Additionally, tools such as the Inspector Network Reachability package can help you identify which traffic is currently allowed and provide recommendations for increasing security.

Related content: read our guide to AWS security services .

5. Comply With Regulations

Regulatory compliance can help you maintain your data security and avoid significant costs, including loss of revenue and fines. Compliance requires understanding which regulations apply to your data, what those regulations require, and auditing to ensure that requirements are continuously covered.

Many AWS services meet compliance standards out-of-the-box but it is up to you to ensure that available protections and settings are correctly configured. You should also consider limiting the amount of compliance covered data you are storing in the first place. If you can anonymize data or restrict its collection, you can reduce your compliance burden.

6. Use Backups

Backups are not obviously related to security but can provide significant value if your systems or data are compromised. For example, having ready backups of databases or application servers can enable you to simply take down compromised copies and restore clean versions from backup. This is especially useful against ransomware infections.

While AWS automatically duplicates data for durability, most services do not automatically back up. For this, you can either use manual methods, built-in snapshot methods, or a service like AWS Backup. The last may be your easiest option as it enables you to schedule automatic backups and manage backups across your services from a central dashboard.

7. Delete your Account Access Keys

Admin or root access keys are a liability, particularly if enabled with programmatic access. If an attacker were to get these keys they would have complete control over your systems and account. Restricting account level access to non-programmatic interfaces, such as the AWS Management Console is best.

To configure this, you should consider creating IAM users with limited root privileges for your various admin tasks. These users can then be used individually to complete programmatic API calls. Once these users are created, you can delete your root access keys and rely on IAM to issue the restricted access keys as needed.

8. Store Secrets Safely

Storing secrets, such as credentials or API keys in your applications with hard coding is a risk that you should avoid. When secrets are hard-coded, any attacker that can compromise your application has access to your resources.

To prevent this, you can use AWS Secrets Manager to control your secrets and deliver them as secure variables. This prevents access to the actual secrets through your application code while still enabling access as needed with legitimate calls.

9. Centralize Logs

CloudTrail is AWS’s default service for collecting and managing events and activity logs. It enables you to collect log data, which you can then store in S3 buckets designated as a Log Archive. These logs are not centralized by default; neither are logs from CloudWatch Logs, AWS load balancers, or other monitoring services.

By centralizing your logging data you make it easier to secure logs and prevent their accidental deletion. You also simplify the ingestion of log data by your preferred monitoring solutions. This means you can more reliably correlate log data across services and ensure that performance and security are maintained.

AWS Monitoring and Visibility with NetApp Cloud Insights 

NetApp Cloud Insights is an infrastructure monitoring tool that gives you visibility into your complete infrastructure. With Cloud Insights, you can monitor, identify security issues, troubleshoot and optimize both public clouds and private data centers.

Cloud Insights helps organizations reduce mean time to resolution by 90%, prevent 80% of cloud issues from impacting end users, and reduce cloud infrastructure costs by an average of 33%. It can even reduce your exposure to insider threats by identifying risks to sensitive data.

In particular, NetApp Cloud Insights protects organizational data from being misused by malicious or compromised users, through advanced machine learning and anomaly detection.

Start a 30-day free trial of NetApp Cloud Insights. No credit card required
Cloud Insights Team