AWS Security: Services and Practices

Qué incluye

What does Amazon Detective do?

Provides analytics data to identify suspicious activity in AWS system architecture

What data sources does Amazon Detective automatically process data from?

1. VPC flow logs
2. Cloud Trail
3. Guard Duty

What are cloudtrail logs for?

Cloudtrail logs are used to record actions taken by users, roles, or other services with an AWS account.

What are Cloudwatch logs used for?

Capturing and storing log data from apps, services, and AWS resources. Think application, service logs.

What pentesting activities are forbidden on AWS infrastructure?

1. DNS zone walking via Amazon route 53 hosted zones
2. DOS/DDOS
3. Port Flooding, protocol flooding, request flooding

If you want to stress test your infrastructure for a DDOS, who can you go to?

An AWS test partner.

What are the 4 recommended settings for S3 hardening

1. Block public access
2. Enforce strong bucket policies and user policies
3. Use VPC endpoints for S3 and limit access to just one VPC
4. Use S3 presigned URLs

How does EC2 Instance Connect work?

An instance connect agent is contacted by AWS and the agent copies a temporary public SSH key to ~/.ssh/authorized_keys.

If you wanted to troubleshoot boot issues with an EC2 instance, how would you connect?

EC2 Serial console

What are the requirements for EC2 serial console

1. Nitro based EC2 instance
2. Serial console is enabled on the account level (disabled by default)

How many connections can you have at once with an EC2 serial console?

1

How to regain access to a linux EC2 with EBS volume swap (6 steps)

1. Create a new key pair
2. Stop the original EC2
3. Detach EBS root volume
4. Attach EBS volume to a temp EC2 as a second volume
5. Edit ~/ssh/authorized_keys
6. Reattach volume

How does Amazon inspector collect information about EC2 instances?

Using AWS SSM agent

When does Amazon inspector assess container images?

When they are pushed

Where does Amazon inspector send its findings?

Security Hub

What 2 things does inspector look for in lambda functions?

1. Vulnerable libraries/packages
2. The functions themselves as they are deployed.

What do AWS config rules do?

Help you evaluate if AWS configs comply with best practices

What service can be used to quickly analyze logs with SQL?

Amazon Athena. You must store in S3 first.

What AWS permission policy is needed to allow SSM to manage an EC2 instance?

AmazonSSMManagedInstanceCore

What is a free form way you can use to describe your EC2 instances?

Tags

What do resource groups allow you to do?

Resource groups allow you to group instances and automate tasks on them at once.

What is an SSM document?

A YAML/JSON file that defines parameters and actions System Manager will perform on your instances

What does SSM Run Command allow you to do?

Run scripts/commands on systems and save the output to S3/CloudWatch.

What is the difference between SSM Automations and SSM Run Command

SSM Automations is used for high level (orchestration) tasks. SSM Run Command is used for lower level (automation) tasks. Run Command is exclusive to EC2 instances

What does SSM Parameter store do?

Secure storage for configurations and secrets

How does SSM parameter store perform encryption?

KMS

Are parameter policies offered in standard SSM Parameter store?

No

What do Parameter Policies do?

Allow you to set an expiration date on creds to force them to be updated or deleted.

What does SSM Inventory allow you to do?

Collect metadata from managed instances such as software, OS driver, configs, updates, services, etc.

What does AWS State manager do?

Automate the process of keeping instances in a state you defined

What is a state manager association?

A configuration you assign to EC2 instances to maintain a specific state.

What SSM feature is used to create State Manager Associations?

SSM Documents

What are some example State Manager Associations you can make?

Mandatory AV/EDR installation, closing ports.

What is SSM Data Sync used for?

Synchronizing inventory data from multiple AWS regions to a single S3 bucket to allow for centralized management

What is SSM Patch Manager used for?

Keeping systems updated using automation

What is a patch baseline?

Defines what patches should be installed on your instances

What is the default behavior for patch baselines?

Only critical and security patches are installed

What is an SSM Patch Group?

Associates sets of instances with a patch baseline

Where can you send records of SSM session manager sessions?

Cloudwatch and S3

What does the Unified Cloudwatch Agent do?

Collect system metrics such as RAM, CPU, Storage, etc. and sends it to cloudwatch

What is the default namespace for logs collected by the Unified Cloudwatch Agent?

CWAgent

What does the procstat Cloudwatch agent plugin do?

Collects metrics about individual processes running on your systems.

What is Amazon Athena?

A serverless query service to analyze data in S3

What are 4 ways you can improve performance with Amazon Athena?

1. Use columnar data
2. Compress data
3. Partition data sets
4. Use larger files

What report can you use to list all the accounts and users and the statuses of their credentials?

IAM credentials Report

What IAM security tool would you use to show the service permissions granted to and when they were last accessed?

IAM access advisor

What 2 main things does IAM access analyzer do?

1. Find resources that are exposed outside of the zone of trust.
2. Help you identify vulnerabilities in IAM policies and generate more secure ones.

What is a CloudWatch log group?

An arbitrary name to group the logs. Usually by application.

What is a CloudWatch Log stream?

A CloudWatch log stream is a sequence of log events that share the same source

What are the log expiration policies you can set for CloudWatch logs?

1 day - 10 years or never.

Are CloudWatch logs encrypted by default?

Yes, at rest with service-managed keys; a KMS customer-managed key is optional per log group.

What does CloudWatch insights allow you to do?

Write queries to filter through CloudWatch logs.

How long can it take for cloudwatch logs to become available after being exported to S3?

12 hours

What does a log subscription do?

Real time stream of logs from CloudWatch.

Where can you send data from logs subscriptions to?

KDS, KDF, Lambda

What does a CloudWatch subscription filter do?

Allows you to filter logs from a CloudWatch logs subscription as they are being delivered.

What are the three CloudWatch alarm states?

1. OK
2. Insufficient data
3. Alarm

What is a CloudWatch alarms period?

Period is the length of time to use to evaluate the metric or expression to create each individual data point for an alarm.

What are composite cloudwatch alarms?

An alarm that monitors the status of other alarms.

How can CloudWatch composite alarms reduce noise?

You can configure alarms with AND/OR conditions so that a notification is only sent if certain conditions are true.

What does cloudwatch contributor insights do?

Analyze the amount of noise each log source generates.

What are three things you can trigger with AWS event bridge?

1. Cron jobs
2. Event pattern (react to a service doing something)
3. Trigger lambda

What are EventBridge event busses?

Amazon EventBridge uses event buses to route events from multiple sources to multiple destinations.

What types of data does the Default event bus support in amazon EventBridge?

AWS native services such as EC2, Lambda, S3.

What types of data does the Partner event bus support in amazon EventBridge?

AWS SaaS partners

What types of data does the Custom event bus support in amazon EventBridge?

Your apps or apps without a partner event bus

How can you access an event bus from a separate AWS account?

Resource based policies

What does Amazon Event Bridge schema registry do?

Stores schemas for AWS

What does EventBridge Schema discovery do?

Listens for events sent to event bridge and analyzes their structure to generate a schema

What is an Athena Federated query?

Allows you to run SQL across data stored in relational, non-relational, object and custom data sources.

How does Athena federated queries access data that is not in S3?

Data source connectors that run on AWS lambda

What is the best place to look if something is deleted in AWS?

Cloudtrail

Is CloudTrail enabled by default?

Yes it is.

Where can you store cloudtrail logs?

S3 or Cloudwatch

What are the four kinds of CloudTrail events?

1. Management Events
2. Data events
3. Cloudtrail insights events
4. Network activity events

What are cloudtrail management events?

Operations performed on resources in your aws account.

What are CloudTrail data events?

High volume events that show resource-level activity

What is the difference between management events and data events in CloudTrail?

Management events are control plane (CreateBucket, Delete Bucket)
Data events are data plane (GetObject, PutObject)

What are CloudTrail insights events?

CloudTrail Insights detects unusual API activity patterns in management events and records them as Insights events.

Are CloudTrail insights events enabled by default?

No, they are a paid feature

Are CloudTrail DataEvents enabled by default

No, because they are very high volume.

What are CloudTrail digest files?

Logs that reference the log files for the last hour and keeps a hash of each

What combination of services can be used to respond to ANY type of API call in your account?

CloudTrail and Event Bridge

How can you aggregate all CloudTrail logs across multiple accounts to one account?

Use a management account as a hub and member account as spokes.

What does aws config do?

Stores a configuration history of your AWS account.

What does Amazon Macie do?

Discovers and classifies sensitive data, such as PII, stored in S3, using managed and custom data identifiers.

What are Macie Data identifiers?

A pattern matching rule to detect sensitive data in your AWS environment

What are the two kinds of Macie data identifiers?

1. Managed
2. Custom

What would you use if you wanted to exclude a specific type of data from Amazon Macie?

Allow lists

What are the two kinds of Macie findings?

1. Policy findings
2. Sensitive data findings

Is a security misconfiguration with an S3 bucket a policy finding or sensitive data finding with Macie?

Policy

Is financial data a policy finding or sensitive data finding with Macie?

Sensitive data finding

What are S3 event notifications?

S3 event notifications are a way for Amazon S3 to automatically alert other AWS services when certain actions happen to your objects (like uploads, deletes, etc.).

What field do you view to determine the actions performed by your security groups in a VPC flow log?

The action field

What traffic is not captured by VPC flow logs (7 kinds)

1. Amazon DNS servers
2. Amazon windows license activation
3. Traffic for 169.254.169.254
4. DHCP
5. Mirrored traffic
6. Traffic to VPC router reserved IP address
7. Traffic between VPC endpoint ENI and network load balancer ENI

What does VPC traffic mirroring do?

Basically SPAN for AWS

Can you do VPC traffic mirroring if the interfaces are in different VPCs?

Yes you can, but you must have VPC peering enabled between those interfaces.

What AWS service can you use to centralize your VPC traffic monitoring

Use a transit gateway to route traffic to set up a hub and spoke with the security VPC as the hub.

Can you do VPC peering between organizations?

Yes

What does the VPC network access analyzer do?

Helps you understand potential network paths to/from your resources

What is a network access scope (Network Access Analyzer)?

Json data that contains conditions to define your network security policy

What is Route53 DNS query logging?

Logs public queries the Route 53 resolver recognizes.

What is a bastion host?

Basically a hardened, internet facing jumpbox

What is a site to site VPN used for in AWS?

Connecting on prem resources to your AWS resources.

What does VGW stand for

Virtual private gateway

What does a Virtual Private gateway do?

It is the AWS side of the VPN connection or AWS direct connection

What is AWS Direct connect?

Allows you to directly connect your resources to AWS without going through the internet.

What does CGW stand for?

Customer Gateway

What is the CGW?

It is the customer side of the VPN connection

Do you need a CGW with AWS direct connect?

No you do not

What is AWS route propagation?

Allows your VPC route tables to automatically receive routes for your on-premises network

How are routes shared between CGW and VGW

BGP session between the two

What do VPC endpoints do?

Allow you to connect to AWS services within your private network instead of a public network

What services are supported by VPC Endpoint gateway?

S3 and DynamoDB

What do VPC endpoint gateways do?

VPC endpoints for S3 and DynamoDB that use route tables.

Can you use VPC peering to allow one VPC to contact a VPC Endpoint Gateway?

No

What are VPC Endpoints?

An ENI in your VPC that connects you to AWS services.

What does AWS PrivateLink do?

AWS PrivateLink enables secure, private connectivity between your VPC and AWS services, third-party SaaS applications, or other VPCs; without exposing traffic to the public internet.

What are VPC Endpoints Interfaces used for?

Provides an interface within your VPC that allows you to connect to AWS service. Uses PrivateLink.

Do you need private DNS configured to use privatelink

Private DNS is strongly recommended, so the service's default DNS names resolve to your endpoint instead of the public internet.

What are VPC Endpoint Policies?

Resource based policies for VPC endpoints.

What IAM key can you use to restrict access to a resource to just the organization?

aws:PrincipalOrgId

What are the two VPC endpoints for code deploy?

1. API
2. Agent

What are the four ways that you can expose your VPC's services to other VPCs?

1. Make it public
2. VPC Peering
3. AWS Private Link
4. Transit Gateway

What do you need on the Service VPC side with VPC peering?

NLB

What do you need on the customer VPC side with VPC peering

ENI or GWLB

Can your NLB and ENI/GWLB be in different availability zones with VPC peering?

No

Where are NACLs applied?

Between subnets

How many NACLs can you have per subnet?

1

Is a NACL stateless or stateful?

Stateless

What are prefix lists?

Groups of CIDRs you can use to match large numbers of subnets

If you need multicast between your VPCs, what service should you use?

Transit gateway

What can be connected to a transit gateway? (three things)

1. VPC
2. Direct Connect Gateway
3. Customer Gateway/site to site VPN

How can a transit gateway improve bandwidth for a site to site VPN?

It can do ECMP across two different site to site VPN connections.

How much throughput can you have per site to site VPN connection?

1.25 Gbps

What are three ways you can restrict access to CloudFront resources?

1. Geo location
2. Signed URLs
3. Signed Cookies

What do signed URLs do?

A URL signed by CloudFront that grants access to content for an ephemeral time.

What are signed cookies?

A cookie that grants access to a resource for a ephemeral time period

Where does encryption happen for CloudFront Field level encryption?

At the edge location, closer to the user.

What direction does CloudFront field level encryption work in?

Sending data from the user to the server.

What is SSE-KMS?

Encrypts objects in S3 using KMS

What does OAC stand for?

Origin Access Control

What does OAC do?

Restrict access to content stored in S3 using signed authorization headers.

What is the benefit of using OAC and SSE-KMS

You can specify that CloudFront is the only one able to decrypt the S3 bucket content by giving CloudFront explicit permissions to decrypt.

How can you ensure that authorization headers work properly with CloudFront?

Using Cache policy to forward the unmodified header between CloudFront and the server.

How can you configure your ALB to only accept traffic from CloudFront? (two things)

1. Configure the ALB to only forward requests with a custom preshared HTTP Header.
2. Restrict access to your ALB to CloudFront Public IPs only.

What is AWS cognito for?

Provides end user authentication and authorization.

What 4 locations can WAF be deployed at?

1. ALB
2. API Gateway
3. CloudFront
4. AppSync

Does WAF provide DDOS protection?

No, AWS shield does this

What are the 5 rule actions for WAF?

1. Count
2. Allow
3. Block
4. CAPTCHA (user interaction)
5. Challenge (only client interaction)

Where can WAF logs be sent to?

1. CloudWatch
2. KDF
3. S3

How can you enhance security between CloudFront and WAF?

Create a filter for the x-origin-verify header and put a psk in the header that CF sends to AWS WAF.

What does AWS Shield do?

Protect from floods, reflections, and other ddos attacks.

What does AWS Firewall Manager do?

Manages all FW rules in all accounts of an AWS organization

What are Shield advanced CloudWatch Metrics for?

Detecting if a DDoS is happening

What does API GW do?

Create and manage an API at scale

True/False: You can expose any AWS service through API gateway

True

How do you restrict access to API gateway?

Resource policy

How can you make an API gateway accessible between VPCs in the same region?

Configure a VPC interface endpoint in the source account to send traffic to API GW (destination)

What limit is used to throttle API gateway across all methods and clients?

Stage limits

What limit is used to throttle API gateway across specific methods?

Method Limit

What limit is used to throttle per client usage in API gateway?

Usage Plans

What does AWS artifact do?

Gives compliance reports and tracks status of compliance

Does DNSSEC work in private hosted zones?

No

Do you manage the DNSSEC KSK?

Yes

Do you manage the DNSSEC ZSK?

No, managed by AWS

What is the TTL for DNSSEC records in a R53 hosted zone?

7 days

What is AWS SES?

Simple Email Service

What do "Not Actions" do in IAM policies?

Provide access to all actions in he service except for actions specifically mentioned

What is MFA Delete used for in S3

Forces the user to perform MFA before deleting something

What needs to be enabled in order to enable MFA Delete?

Versioning

Is AWS IAM credentials report or AWS config remediations superior?

AWS config remediations because it is automated.

What does STS stand for?

Security Token Service

What does STS do?

Generates temporary credentials

What is used to solve the confused deputy problem?

An external ID

What does IMDS stand for?

Instance Meta Data Service

What is the URL for IMDS?

http://169.254.169.254/latest/meta-data

What do CloudFormation intrinsic functions allow you to do?

Assign values to resources in your template using logic. ie Fn::Join

How many resources are allowed in a CF stack?

500

How can you overcome the CloudFormation 500 resource limit?

Nested Stacks

How do you assign permissions to a CFM stack to allow it to perform its task?

Stack roles

By default what permissions does a CFM stack assume?

The role of the user

What AWS service can be used to connect AWS to your on-prem AD?

AD connector

What area does the AD connector fall short of MS AD in AWS?

High availability

When is it better to use Cognito rather than IAM?

Cognito is better for large numbers of external users

What area is AWS SAML federation still useful?

Temporary, programmatic access

What is a presigned URL?

A URL that gives someone the same permissions as the user that granted the URL.

Can you make a presigned URL for an object you have no access to?

Yes you can, but the URL will not be useful.

What happens to the presigned URL when your temporary credentials with the IAM role expire?

The presigned URL stops working

What is an S3 object lock?

Prevents an S3 object from being deleted or overwritten

What needs to be enabled in order to use S3 object lock?

Versioning

What type of S3 lock would be used to prevent all users, including the root user from modifying the object until the retention period expires?

Compliance Mode

What type of S3 lock would be used to prevent allow specific users with special permissions to override the lock?

Governance

What can you place on an S3 object to prevent deletion until it is removed?

Legal hold

If S3 versioning is enabled, what happens when you delete an object

It is marked for deletion and it is hidden. It is not actually deleted.

How do you truly delete an S3 object if versioning is enabled?

Delete it by specifying the ID of the object.

How many route tables can a subnet be associated with?

1

Can a subnet span across multiple AZs?

No

What IP is used in each VPC for DNS?

Network+2

What IP is the network+3 address used for in a VPC?

Reserved

+226 tarjetas más