Please enable JavaScript.

Coggle requires JavaScript to display documents.

Security, Reducing Security Threats, Lambda, Elastic Container Service…

- - - - Free
      - used by default if you pick encryption in most AWS services. Only that service can use them directly
      - Can view, Can Manage, Dedicated to My Account
  - - - Used by AWS on shared basis across many accounts; you typically won't see these
      - Can View, Can not Manage, Dedicated to My Account
  - - - Allows key rotation; controlled via key policies and can be enabled/disabled
      - Cannot view, Can mange, No Dedicated to My Account
- - - - Same key used for encryption and decryption
      - AES-256
      - Never leaves AWS unencrypted
      - Must call the KMS APIs to use
      - AWS services integrated with KMS use symmetric CMKs
      - Encrypt, decrypt, and re-encrypt data
      - Generate data keys, data key pairs, and random byte strings
      - Import your own key material
    - - Mathematically related public/private key pair
      - RSA and elliptic-curve cryptography (ECC)
      - Private key never leaves AWS unencrypted
      - Must call the KMS APIs to use private key
      - Download the public key and use outside AWS
      - Used outside AWS by users who can't call KMS APIs
      - AWS services integrated with KMS do not support asymmetric CMKs
- - - - IP addresses
      - Query string parameters
      - SQL query injection
- - - - Request properties
        
        Originating IP address
        
        Originating country
        
        Request size
        
        Values in request headers
        
        Strings in request matching regular expression (regex) patterns
        
        SQL code (injection)
        
        Cross-stie scripting (XSS)
- - - - Database connection strings
      - License codes
      - API Keys
      - Passwords
- - - - Automatically enabled for all customers at no cost
      - Stopped a 2.3 Tbps DDoS attack for three days in February 2020
      - :warning:
        
        Protects against common layer 3 and 4 attacks
        
        SYN/UDP floods
        
        Refection attacks
  - - - 3000 per month, per org
      - Enhanced protection for EC2, ELB, CloudFront, Global Accelerator Route 53
      - Business and Enterprise support customers get 24x7 access to the DDoS Response Team (DRT)
      - DDoS cost protection