Security in the AWS Cloud - Steve Riley
•
3 j'aime•832 vues
This document discusses security in the AWS cloud. It outlines the various AWS services like S3, EC2, VPC and how security groups can be used to restrict access between tiers (web, application, database). It also mentions that AWS provides strong security through control of physical infrastructure, access controls, audits and compliance with regulations like HIPAA and SOX. Customer data is protected and isolated from other customers.
Recommandé
Contenu connexe
En vedette
En vedette (20)
Similaire à Security in the AWS Cloud - Steve Riley
Similaire à Security in the AWS Cloud - Steve Riley (20)
Plus de Amazon Web Services
Plus de Amazon Web Services (20)
Dernier
Dernier (20)
Security in the AWS Cloud - Steve Riley
- 1. Securityin theAWS Cloud Steve Rileysteriley@amazon.com@steveriley@awscloud http://stvrly.wordpress.com
- 2. Amazon Web Services Amazon CloudFront
- 9. Amazon S3 Amazon SimpleDB Amazon RDS (multi AZ) Amazon EBS Amazon RDS (one AZ) Amazon EC2 ++ ++ ++
- 10. Customer 1 Customer 2 Customern … Customer only SSH, ID/pw, X.509 Root/admin control Customer 1virtual interfaces Customer 2virtual interfaces Customernvirtual interfaces … Customer only Inbound flows Default deny Hypervisor layer Customer 1securitygroups Customer 2securitygroups Customernsecurity groups … AWS firewall AWS admins only SSH via bastions Audits reviewed Physical interfaces
- 11. 0 / 0 / 0 / 0 / 0 / 0 / 0 / 0 / 0 / 0 0 / / 0 / 0 / 0 / 0 0 / /
- 12. Web tier Application tier Database tier HTTP/HTTPS from Internet SSH/RDP management from corpnet SSH/RDP management from corpnet, vendor SSH/RDP management from corpnet
- 14. ec2-authorize WebSG -P tcp -p 80 -s 0.0.0.0/0 ec2-authorize WebSG -P tcp -p 443 -s 0.0.0.0/0 ec2-authorize WebSG-P tcp-p 22|3389-s CorpNet ec2-authorize AppSG -P prot-p AppPortRange -o WebSG ec2-authorize AppSG -P tcp -p 22|3389 -s CorpNet ec2-authorize DBSG-P prot -p DBPortRange-o AppSG ec2-authorize DBSG -P tcp -p 22|3389 -s CorpNet ec2-authorize DBSG -P tcp -p 22|3389 -s Vendor
- 15. Your VPC AmazonWeb Services Cloud Your corporate network
- 17. EBS
- 18. CloudWatch
- 22. Elastic IPs
- 24. Autoscaling
- 25. DevPay
- 26. Inter-subnet security groupsYour VPC AmazonWeb Services Cloud Your corporate network
- 28. Write
- 29. Full
- 30. Read
- 31. Write
- 32. Full“Key” = name of object
- 35. Compliance Sarbanes-Oxley Act Ongoing HIPAA Current customer deployments Whitepaper describes the specifics SAS 70 type II Complete Physical security, access controls, change management, operations
- 37. Thank you very much! Steve Rileysteriley@amazon.com@steveriley@awscloud http://stvrly.wordpress.com