Please enable JavaScript.

Coggle requires JavaScript to display documents.

test (KMS (HSM (no shared environment (backed up to multiple regions…

- - - - backed up to multiple regions
        
        Unavailable only with HSM and disconnected
    - - CloudWatch Alarms
        
        state changes
        
        CloudWatch Events
        
        take corrective Actions
        
        Cloudwatch Logs
        
        access/monitor/store from Cloudtrail
  - - - auto not available for imported
  - - - also thought as manually rotating key
        
        Rotation event to Cloudwatch Events
  - - - aliases makes this easier
        
        UpdateAlias
  - - - grants root
        
        all IAM policies full access to CMK
  - - - to reimport you must delete existing key material
- - - - SNS topic
        
        Alarm State
- - - - SAML 2.0
    - - AWS directory Service
    - - assigned to Roles
  - - - Temp creds
        
        not diend
        
        service accepts
        
        not expired
        
        role/user permissions
        
        session policies
      - service
        
        permission to call on service
        
        resource policy allows
        
        key value pair
    - - Cant assume role
        
        name role
        
        policy grants permission to call STS role
        
        conditions met
  - - - Roles for Apps on EC2
        
        Roles to Delegate Perms
        
        Bucket Policies
- - - - MFA delte
        
        https(tls) secure:transport on bucket policies
        
        Config
        
        S3-Bucket-SSL-Requests-Only
    - - PII
  - - - open access permissions
        
        fault tolerance
- - - - Implement write only
        
        KMS rotate every year
        
        compromised host
        
        AWS artifact for image state
        
        EBS snapshot of volumes
        
        Mem dump
        
        s3 - encrypted transit/rest/logging of all retrievals
        
        3rd partyreporting service logs
        
        Encrypt/decrypt Secure String errors
        
        2 more items...
        
        lambda
        
        Default encryption
        
        cloudwatch logs for account
        
        1 more item...
        
        AWS managed CMK
      - Cloud trail in each region
        
        specify single s3 bucket
- - - - IAM role with access to KMS by suing EC2/Lambda principals
        
        add role to ec2 instance
        
        attach instance profle to ec2 and function
- - - - Systems store manager to store creds as SSP. Secure using KMS key
- - - - Permissions to allow creation of log groups/treams
        
        invalid time stamps in var
- - - - implement SG so s3 can only be accessed by Cloudfront Distro
- - - - Directory Services
        
        firewall manager
        
        Guard Duty
        
        IAM
        
        Federation
        
        Inspector
        
        2 more items...
        
        SAML
        
        2 more items...
        
        trusted advisor can look for long lived keys
        
        Resource Policy
        
        2 more items...
        
        Cloudtrail/vpc flow logs/ and nds logs
        
        meta data, AWS threat intel, ML
        
        looks for recon, instance compromise, account compromise
        
        1 more item...
        
        centrally manage WAF rules across ELB and Cloudfront Via Orgs
        
        assign IAM roles to AD users
        
        Manged Microsoft
        
        AD connector
        
        proxy for a specific list of aws services
        
        SSO, management Console, EC2 windows
        
        AWS domain resource where computer obj stoerd
        
        On prem becomes account domain
        
        join existing AD trust relationships
        
        EBS volumes encrypted
        
        no remote access orpowershell
      - OAuth
        
        Temp AWS creds
        
        Roles based on mapping defined
        
        API gateway direct support
        
        sync store/ key value
    - - region locked unless cloudfront is used
- - - - ALB
        
        Network Load Balancer
        
        TCP/TLS
        
        no SNI
        
        RSA certs only
        
        HTTP/HTTPS
        
        in SG
        
        integrated with WAF
        
        lambda as target
        
        access logging to S3
  - - - resource policies
        
        functions, their versions and alieases
        
        used to give other services and accounts permissions to run lambda
        
        ID policies
        
        VPC access
        
        subnet/SG is specified
        
        give users ability to create functions
      - assumed to run
- - - - Use validation
        
        Config
      - AWS managed
        
        unique to region
        
        protect resources within service created
        
        rotated auto 3 years
        
        no deletion
      - Customer Managed
        
        opt in auto rotation once a year
        
        can be dleted
        
        controllled via KMS/IAM policy
        
        Imported
        
        set expiration time for key material and delete
      - Lambda variables
      - SSM
        
        data/parameters across Services wthout exposing values
        
        access controls
        
        audit when data is accessed
    - - execution duration
        
        function level
    - - governance,compliance,operational auditing
    - - inspect cookies to rewrite urls
        
        send different obj based on headers
        
        inspect headers, inserting header
        
        modify headers
        
        redirects