Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS-Security - Coggle Diagram

- - - - Effect block
        
        The reason for using a Deny statement is that it overrides any Allow statements on the same action.
        
        The Effect is typically Allow, since by default all permissions not specified are denied
      - Action block
        
        Action: 's3:*'
        
        Action: '*'
        
        Action: 'ec2:List*'
      - Resource block
        
        Amazon resource names
        
        arn
        
        the partition
        
        aws
        
        aws-cn
        
        aws-us-gov
        
        The service short name
        
        The region
        
        The account ID
        
        The resource identifier
        
        special cases
        
        ListTables: and so the resource block is typically left as '*'
        
        ListAllMyBuckets: is the same
        
        Create actions: and so the resource block is typically left as '*'
      - The Condition block
      - NotAction & NotResource blocks
    - - Inline policies
      - Managed policies
        
        A user can only have ten managed policies attached at a time
        
        only create up to 1500 managed policies.
  - - - However, if either the resource policy or the identity policy have an explicit deny for the action and resource in the request, then it will be denied even if the other policy allows it
  - - - password
      - Access Key
- - - - S3
    - - EC2
    - - IAM
  - - - Statefull và Stateless
        Security group là stateful, những gì thay đổi ở inbound rule cũng sẽ tự động được áp dụng cho outbound rule.
        VD: Nếu bạn set inbound rule cho port 80, nó cũng sẽ tự động open port 80 ở outbound rule.
        Network ACLs là stateless, ngược lại với security group, những thay đổi ở inbound rule sẽ ko được áp dụng tự động cho outbound rule, thay vào đó ta phải cài đặt thủ công.
- - - - Avaibility Zones
      - Regions
      - Edge Locations
    - - PHYSICAL/ENVIRONMENTAL SECURITY
        
        Physical access to the machine running your EC2 instance is protected by security staff
        
        AWS also manages power backup systems
      - HOST SECURITY
        
        eg: The first is an attacker gaining access to the Host OS and messing with your Guest OS
        
        eg: The second is an attacker with a Guest OS on the same machine escaping its virtualized environment and gaining access to yours, often called VM escape
      - NETWORK SECURITY
        
        AWS to ensure that those controls(Security Groups...) are enforced. It's also AWS' responsibility to ensure the integrity of all the traffic within it's network.