Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS Certified Security Speciality Exam Notes - Coggle Diagram

- - - - Scale to 10Gbps
      - More secure
    - - Disable Source/Destination Checking
      - Bottleneck - single EC2 in single AZ
      - Must be in public subnet
      - Behind a SG
  - - - Stateful - only inbound rules
    - - Rules in increments of 100
      - Custom NACLs default to deny
      - Steteless - need to create both in and out-bound rules
      - Only 1 NACL per subnet association
  - - - VPC
      - Subnet
      - Network Interface
    - - Log Group
      - S3
    - - Amazon DNS
      - Windows License Activation
      - Traffic to 169.254.169.254
      - Traffic to the default router .1
      - DHCP traffic
    - - Source address
      - Destination address
      - Source port
      - Destination port
      - Protocol
      - Number packets
  - - - Session logs -> CloudWatch / S3
      - No ports to open
      - Powershell / Bash interactive sessions
      - Connection Logs -> CloudTrail
  - - - DynamoDB
      - S3
- - - - Key Policy
      - IAM Policy (ext acc)
  - - - ALB
      - CloudFront
      - API Gateway
      - AppSync
  - - - Private CA
      - Public Cert
        
        Auto-renews
        
        Can't Export
        
        Works With
        
        ELB
        
        CloudFront
        
        API Gateway
        
        ElasticBeanstalk
  - - - Passed to CloudFormation/Lambda/etc...
      - Can store passwords (secrets manager better?)
      - Value can be encrypted with KMS
    - - Automate common admin tasks
      - Needs SSM agent
      - Works with on-prem & EC2
      - Use case: update security patches at scale
  - - - Content Type (eg JSON)
      - File ext
      - Theme (Amex, VISA)
      - RegEx
  - - - Failed logins
      - Port scanning
      - CloudTrail Logs
      - VPC Flow Logs
      - DNS Logs
  - - - MySQL
      - PostreSQL
      - Aurora
  - - - PCI-DSS
      - CIS
    - - GuardDuty :!:
      - Macie :!:
      - Inspector :!:
      - IAM Access Analyzer
      - Firewall Manager
      - 3rd Party Tools
      - CloudWatch / CloudWatch Events
  - - - VPC Flow Logs
      - CloudTrail
      - GuardDuty Findings
  - - - Transit Gateways
      - Subnets
      - License Manager
      - R53 Resolver Rules
  - - - WAFs
      - WAF Rules
      - Shield
      - Manage SGs
      - Deploy Network Firewalls
      - Deploy R53 DNS Firewall
- - - - AssumeRoleWithSAML
      - AssumeRoleWithWebIdentity
      - AssumeRole
        
        15min - 1 hour
  - - - ?