SlideShare a Scribd company logo
1 of 22
Security
in the
AWS Cloud

Steve Riley
steriley@amazon.com
@steveriley
@awscloud
http://stvrly.wordpress.com
Amazon Web Services: 4 regions
Amazon CloudFront: 16 edge locations (including NY!)
Amazon S3
 Amazon SimpleDB        ++   ++
Amazon RDS (multi AZ)

    Amazon EBS
Amazon RDS (one AZ)     ++
       Amazon EC2
0 0 0 00 0

00 0 0 0

00 0 0 0




/ /////


// / / /

// / / /
Customer only
  Customer 1           Customer 2              …     Customer n         SSH, ID/pw, X.509
                                                                        Root/admin control

   Customer 1
virtual interfaces
                        Customer 2
                     virtual interfaces
                                               …      Customer n
                                                   virtual interfaces
                                                                        Customer only
                                                                        Inbound flows
                                                                        Default deny
  Customer 1
security groups
                       Customer 2
                     security groups
                                               …     Customer n
                                                   security groups


                           AWS firewall
                                                                        AWS admins only
                          Hypervisor layer                              SSH via bastions
                                                                        Audits reviewed
                         Physical interfaces
Web tier             Application tier     Database tier




HTTP/HTTPS           SSH/RDP management   SSH/RDP management
from Internet        from corpnet         from corpnet, vendor
SSH/RDP management
from corpnet
ec2-authorize WebSG -P tcp -p 80 -s 0.0.0.0/0
ec2-authorize WebSG -P tcp -p 443 -s 0.0.0.0/0
ec2-authorize WebSG -P tcp -p 22|3389 -s CorpNet

ec2-authorize AppSG -P prot -p AppPortRange -o WebSG
ec2-authorize AppSG -P tcp -p 22|3389 -s CorpNet

ec2-authorize DBSG -P prot -p DBPortRange -o AppSG
ec2-authorize DBSG -P tcp -p 22|3389 -s CorpNet
ec2-authorize DBSG -P tcp -p 22|3389 -s Vendor
Your VPC

                                     Amazon
                                     Web Services
                                     Cloud
 IPsec tunnel mode
 128-bit AES, SHA-1, PFS, BGP




Your corporate network
Currently
                                    •   EC2 on-demand and reserved
                                    •   EBS
                                    •   CloudWatch
                                    •   Linux/Unix and Windows
                                    •   US-East, EU-West
          Your VPC
                                    Upcoming
                     Amazon
                                    •   >1 AZ, >1 router
                     Web Services
                                    •   Outbound Internet
                     Cloud
                                    •   Elastic IPs
                                    •   Elastic Load Balancing
                                    •   Autoscaling
Your corporate network              •   DevPay
                                    •   Inter-subnet security groups
• Read
                          • Write
                          • Full




•Read
•Write
•Full



 “Key” = name of object
Compliance
• Sarbanes-Oxley Act
  – Ongoing
• HIPAA
  – Current customer deployments
  – Whitepaper describes the specifics
• SAS 70 type II
  – Second audit complete
  – Physical security, access controls, change
    management, operations
• ISO 27001
  – In progress
Thank you
very much!

Steve Riley
steriley@amazon.com
@steveriley
@awscloud
http://stvrly.wordpress.com

More Related Content

What's hot

What's hot (19)

(NET406) Deep Dive: AWS Direct Connect and VPNs
(NET406) Deep Dive: AWS Direct Connect and VPNs(NET406) Deep Dive: AWS Direct Connect and VPNs
(NET406) Deep Dive: AWS Direct Connect and VPNs
 
Advanced Security Best Practices Masterclass
Advanced Security Best Practices MasterclassAdvanced Security Best Practices Masterclass
Advanced Security Best Practices Masterclass
 
(ARC203) Expanding Your Data Center with Hybrid Infrastructure | AWS re:Inven...
(ARC203) Expanding Your Data Center with Hybrid Infrastructure | AWS re:Inven...(ARC203) Expanding Your Data Center with Hybrid Infrastructure | AWS re:Inven...
(ARC203) Expanding Your Data Center with Hybrid Infrastructure | AWS re:Inven...
 
Introduction to AWS VPC & Networking
Introduction to AWS VPC & NetworkingIntroduction to AWS VPC & Networking
Introduction to AWS VPC & Networking
 
(SDD302) A Tale of One Thousand Instances - Migrating from Amazon EC2-Classic...
(SDD302) A Tale of One Thousand Instances - Migrating from Amazon EC2-Classic...(SDD302) A Tale of One Thousand Instances - Migrating from Amazon EC2-Classic...
(SDD302) A Tale of One Thousand Instances - Migrating from Amazon EC2-Classic...
 
(ARC403) From One To Many: Evolving VPC Design
(ARC403) From One To Many: Evolving VPC Design(ARC403) From One To Many: Evolving VPC Design
(ARC403) From One To Many: Evolving VPC Design
 
(ENT308) Best Practices for Implementing Hybrid Architecture Solutions | AWS ...
(ENT308) Best Practices for Implementing Hybrid Architecture Solutions | AWS ...(ENT308) Best Practices for Implementing Hybrid Architecture Solutions | AWS ...
(ENT308) Best Practices for Implementing Hybrid Architecture Solutions | AWS ...
 
AWS VPC, ELB, Route53 and CloudFront
AWS VPC, ELB, Route53 and CloudFrontAWS VPC, ELB, Route53 and CloudFront
AWS VPC, ELB, Route53 and CloudFront
 
Webinar AWS 201 - Using Amazon Virtual Private Cloud (VPC)
Webinar AWS 201 - Using Amazon Virtual Private Cloud (VPC)Webinar AWS 201 - Using Amazon Virtual Private Cloud (VPC)
Webinar AWS 201 - Using Amazon Virtual Private Cloud (VPC)
 
Selecting the Best VPC Network Architecture (CPN208) | AWS re:Invent 2013
Selecting the Best VPC Network Architecture (CPN208) | AWS re:Invent 2013Selecting the Best VPC Network Architecture (CPN208) | AWS re:Invent 2013
Selecting the Best VPC Network Architecture (CPN208) | AWS re:Invent 2013
 
Amazon Virtual Private Cloud
Amazon Virtual Private CloudAmazon Virtual Private Cloud
Amazon Virtual Private Cloud
 
Security on AWS
Security on AWSSecurity on AWS
Security on AWS
 
(ARC401) Black-Belt Networking for the Cloud Ninja | AWS re:Invent 2014
(ARC401) Black-Belt Networking for the Cloud Ninja | AWS re:Invent 2014(ARC401) Black-Belt Networking for the Cloud Ninja | AWS re:Invent 2014
(ARC401) Black-Belt Networking for the Cloud Ninja | AWS re:Invent 2014
 
AWS Hybrid Cloud Connectivity - VPN Solutions
AWS Hybrid Cloud Connectivity - VPN SolutionsAWS Hybrid Cloud Connectivity - VPN Solutions
AWS Hybrid Cloud Connectivity - VPN Solutions
 
AWS Direct Connect & VPN's - Pop-up Loft Tel Aviv
AWS Direct Connect & VPN's - Pop-up Loft Tel AvivAWS Direct Connect & VPN's - Pop-up Loft Tel Aviv
AWS Direct Connect & VPN's - Pop-up Loft Tel Aviv
 
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
 
AWS VPC & Networking basic concepts
AWS VPC & Networking basic conceptsAWS VPC & Networking basic concepts
AWS VPC & Networking basic concepts
 
High Availability Application Architectures in Amazon VPC (ARC202) | AWS re:I...
High Availability Application Architectures in Amazon VPC (ARC202) | AWS re:I...High Availability Application Architectures in Amazon VPC (ARC202) | AWS re:I...
High Availability Application Architectures in Amazon VPC (ARC202) | AWS re:I...
 
Aws Architecture Training
Aws Architecture TrainingAws Architecture Training
Aws Architecture Training
 

Viewers also liked

AWS Customer Presentation - mediabrands - marc dispensa
AWS Customer Presentation - mediabrands - marc dispensa AWS Customer Presentation - mediabrands - marc dispensa
AWS Customer Presentation - mediabrands - marc dispensa
Amazon Web Services
 
AWSome Day 2014 Kuala Lumpur - Keynote
AWSome Day 2014 Kuala Lumpur - KeynoteAWSome Day 2014 Kuala Lumpur - Keynote
AWSome Day 2014 Kuala Lumpur - Keynote
Amazon Web Services
 
AWS Summit 2014 - Perth - Keynote
AWS Summit 2014 - Perth - KeynoteAWS Summit 2014 - Perth - Keynote
AWS Summit 2014 - Perth - Keynote
Amazon Web Services
 
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
Amazon Web Services
 
AWS - Migrating Internal IT Applications
AWS - Migrating Internal IT Applications AWS - Migrating Internal IT Applications
AWS - Migrating Internal IT Applications
Amazon Web Services
 

Viewers also liked (20)

AWS Customer Presentation - mediabrands - marc dispensa
AWS Customer Presentation - mediabrands - marc dispensa AWS Customer Presentation - mediabrands - marc dispensa
AWS Customer Presentation - mediabrands - marc dispensa
 
AWSome Day 2014 Kuala Lumpur - Keynote
AWSome Day 2014 Kuala Lumpur - KeynoteAWSome Day 2014 Kuala Lumpur - Keynote
AWSome Day 2014 Kuala Lumpur - Keynote
 
AWS Summit 2014 - Perth - Keynote
AWS Summit 2014 - Perth - KeynoteAWS Summit 2014 - Perth - Keynote
AWS Summit 2014 - Perth - Keynote
 
Deploy, Scale and Manage your Microsoft Investments with AWS
Deploy, Scale and Manage your Microsoft Investments with AWS Deploy, Scale and Manage your Microsoft Investments with AWS
Deploy, Scale and Manage your Microsoft Investments with AWS
 
Effective Security Response in the Cloud - Session Sponsored by Trend Micro
Effective Security Response in the Cloud - Session Sponsored by Trend Micro Effective Security Response in the Cloud - Session Sponsored by Trend Micro
Effective Security Response in the Cloud - Session Sponsored by Trend Micro
 
Effective Security Response in the Cloud - Session Sponsored by Trend Micro
 Effective Security Response in the Cloud - Session Sponsored by Trend Micro Effective Security Response in the Cloud - Session Sponsored by Trend Micro
Effective Security Response in the Cloud - Session Sponsored by Trend Micro
 
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
AWS Public Sector Symposium 2014 Canberra | Storage and Archiving options on ...
 
DynamoDB at HasOffers
DynamoDB at HasOffers DynamoDB at HasOffers
DynamoDB at HasOffers
 
(BDT307) Running NoSQL on Amazon EC2 | AWS re:Invent 2014
(BDT307) Running NoSQL on Amazon EC2 | AWS re:Invent 2014(BDT307) Running NoSQL on Amazon EC2 | AWS re:Invent 2014
(BDT307) Running NoSQL on Amazon EC2 | AWS re:Invent 2014
 
AWS Paris Summit 2014 - T1 - Startup Showcase
AWS Paris Summit 2014 - T1 - Startup ShowcaseAWS Paris Summit 2014 - T1 - Startup Showcase
AWS Paris Summit 2014 - T1 - Startup Showcase
 
When Clouds Collide - Session Sponsored by Datacom
When Clouds Collide - Session Sponsored by DatacomWhen Clouds Collide - Session Sponsored by Datacom
When Clouds Collide - Session Sponsored by Datacom
 
(APP202) Deploy, Manage, and Scale Your Apps with AWS OpsWorks and AWS Elasti...
(APP202) Deploy, Manage, and Scale Your Apps with AWS OpsWorks and AWS Elasti...(APP202) Deploy, Manage, and Scale Your Apps with AWS OpsWorks and AWS Elasti...
(APP202) Deploy, Manage, and Scale Your Apps with AWS OpsWorks and AWS Elasti...
 
(SDD414) Amazon Redshift Deep Dive and What's Next | AWS re:Invent 2014
(SDD414) Amazon Redshift Deep Dive and What's Next | AWS re:Invent 2014(SDD414) Amazon Redshift Deep Dive and What's Next | AWS re:Invent 2014
(SDD414) Amazon Redshift Deep Dive and What's Next | AWS re:Invent 2014
 
APN Partner Webinar - AWS Marketplace & Test Drive
APN Partner Webinar - AWS Marketplace & Test DriveAPN Partner Webinar - AWS Marketplace & Test Drive
APN Partner Webinar - AWS Marketplace & Test Drive
 
SAP HANA - The Foundation of Real Time, Now on the AWS Cloud Computing Platform
SAP HANA - The Foundation of Real Time, Now on the AWS Cloud Computing PlatformSAP HANA - The Foundation of Real Time, Now on the AWS Cloud Computing Platform
SAP HANA - The Foundation of Real Time, Now on the AWS Cloud Computing Platform
 
AWS - Migrating Internal IT Applications
AWS - Migrating Internal IT Applications AWS - Migrating Internal IT Applications
AWS - Migrating Internal IT Applications
 
AWS Webcast - Amazon Elastic Map Reduce Deep Dive and Best Practices
AWS Webcast - Amazon Elastic Map Reduce Deep Dive and Best PracticesAWS Webcast - Amazon Elastic Map Reduce Deep Dive and Best Practices
AWS Webcast - Amazon Elastic Map Reduce Deep Dive and Best Practices
 
DynamoDB In-depth & Developer Drill Down
DynamoDB In-depth & Developer Drill Down DynamoDB In-depth & Developer Drill Down
DynamoDB In-depth & Developer Drill Down
 
Bringing Governance to an Existing Cloud at NASA’s Jet Propulsion Laboratory ...
Bringing Governance to an Existing Cloud at NASA’s Jet Propulsion Laboratory ...Bringing Governance to an Existing Cloud at NASA’s Jet Propulsion Laboratory ...
Bringing Governance to an Existing Cloud at NASA’s Jet Propulsion Laboratory ...
 
Webinar AWS 201 Delivering apps without servers
Webinar AWS 201 Delivering apps without serversWebinar AWS 201 Delivering apps without servers
Webinar AWS 201 Delivering apps without servers
 

Similar to Security Overview

AWS Summit 2011: Application Security Best Practices
AWS Summit 2011: Application Security Best PracticesAWS Summit 2011: Application Security Best Practices
AWS Summit 2011: Application Security Best Practices
Amazon Web Services
 
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYCAWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
Amazon Web Services
 
AWS Summit 2011: Overview of Security and Compliance in the cloud
AWS Summit 2011: Overview of Security and Compliance in the cloudAWS Summit 2011: Overview of Security and Compliance in the cloud
AWS Summit 2011: Overview of Security and Compliance in the cloud
Amazon Web Services
 
Ram chinta hug-20120922-v1
Ram chinta hug-20120922-v1Ram chinta hug-20120922-v1
Ram chinta hug-20120922-v1
Ram Chinta
 
Aws security overview q3 2010 v2
Aws security overview q3 2010 v2Aws security overview q3 2010 v2
Aws security overview q3 2010 v2
ReadMaloney
 
Security in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve RileySecurity in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve Riley
Amazon Web Services
 

Similar to Security Overview (20)

AWS - Security and Compliance Overview
AWS - Security and Compliance OverviewAWS - Security and Compliance Overview
AWS - Security and Compliance Overview
 
AWS Summit 2011: Application Security Best Practices
AWS Summit 2011: Application Security Best PracticesAWS Summit 2011: Application Security Best Practices
AWS Summit 2011: Application Security Best Practices
 
Securing The AWS Cloud, Steve Riley, AWS Events, April 2010
Securing The AWS Cloud, Steve Riley, AWS Events, April 2010Securing The AWS Cloud, Steve Riley, AWS Events, April 2010
Securing The AWS Cloud, Steve Riley, AWS Events, April 2010
 
Cloud Security with Amazon Web Services
Cloud Security with Amazon Web ServicesCloud Security with Amazon Web Services
Cloud Security with Amazon Web Services
 
AWS Introduction - Ryland
AWS Introduction - RylandAWS Introduction - Ryland
AWS Introduction - Ryland
 
Smartronix - Building Secure Applications on the AWS Cloud
Smartronix - Building Secure Applications on the AWS CloudSmartronix - Building Secure Applications on the AWS Cloud
Smartronix - Building Secure Applications on the AWS Cloud
 
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYCAWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
AWS Security Overview - AWS CISO Steve Schmidt - AWS Summit 2012 - NYC
 
[AWS Summit 2012] ソリューションセッション#4 AWS: Overview of Security Processes
[AWS Summit 2012] ソリューションセッション#4 AWS: Overview of Security Processes[AWS Summit 2012] ソリューションセッション#4 AWS: Overview of Security Processes
[AWS Summit 2012] ソリューションセッション#4 AWS: Overview of Security Processes
 
AWS Summit 2011: Overview of Security and Compliance in the cloud
AWS Summit 2011: Overview of Security and Compliance in the cloudAWS Summit 2011: Overview of Security and Compliance in the cloud
AWS Summit 2011: Overview of Security and Compliance in the cloud
 
NHGRI Cloud Computing talk
NHGRI Cloud Computing talkNHGRI Cloud Computing talk
NHGRI Cloud Computing talk
 
Security and Privacy in the Cloud - Stephen Schmidt - AWS Summit 2012 Australia
Security and Privacy in the Cloud - Stephen Schmidt - AWS Summit 2012 AustraliaSecurity and Privacy in the Cloud - Stephen Schmidt - AWS Summit 2012 Australia
Security and Privacy in the Cloud - Stephen Schmidt - AWS Summit 2012 Australia
 
Microsoft Best Practices - AWS India Summit 2012
Microsoft Best Practices - AWS India Summit 2012Microsoft Best Practices - AWS India Summit 2012
Microsoft Best Practices - AWS India Summit 2012
 
Ram chinta hug-20120922-v1
Ram chinta hug-20120922-v1Ram chinta hug-20120922-v1
Ram chinta hug-20120922-v1
 
Aws security overview q3 2010 v2
Aws security overview q3 2010 v2Aws security overview q3 2010 v2
Aws security overview q3 2010 v2
 
Aws Security Overview
Aws Security OverviewAws Security Overview
Aws Security Overview
 
セキュリティを意識したAWS使用法
セキュリティを意識したAWS使用法セキュリティを意識したAWS使用法
セキュリティを意識したAWS使用法
 
Securing Your Virtual Data Center in the Cloud (NET202) - AWS re:Invent 2018
Securing Your Virtual Data Center in the Cloud (NET202) - AWS re:Invent 2018Securing Your Virtual Data Center in the Cloud (NET202) - AWS re:Invent 2018
Securing Your Virtual Data Center in the Cloud (NET202) - AWS re:Invent 2018
 
Security in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve RileySecurity in the AWS Cloud - Steve Riley
Security in the AWS Cloud - Steve Riley
 
CloudStack Networking Deepdive CCCEU13
CloudStack Networking Deepdive CCCEU13CloudStack Networking Deepdive CCCEU13
CloudStack Networking Deepdive CCCEU13
 
Deploy, Scale and Manage your Microsoft Investments with AWS
Deploy, Scale and Manage your Microsoft Investments with AWSDeploy, Scale and Manage your Microsoft Investments with AWS
Deploy, Scale and Manage your Microsoft Investments with AWS
 

More from Amazon Web Services

Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Recently uploaded

EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
Earley Information Science
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Recently uploaded (20)

Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 

Security Overview

  • 1. Security in the AWS Cloud Steve Riley steriley@amazon.com @steveriley @awscloud http://stvrly.wordpress.com
  • 2. Amazon Web Services: 4 regions Amazon CloudFront: 16 edge locations (including NY!)
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9. Amazon S3 Amazon SimpleDB ++ ++ Amazon RDS (multi AZ) Amazon EBS Amazon RDS (one AZ) ++ Amazon EC2
  • 10. 0 0 0 00 0 00 0 0 0 00 0 0 0 / ///// // / / / // / / /
  • 11. Customer only Customer 1 Customer 2 … Customer n SSH, ID/pw, X.509 Root/admin control Customer 1 virtual interfaces Customer 2 virtual interfaces … Customer n virtual interfaces Customer only Inbound flows Default deny Customer 1 security groups Customer 2 security groups … Customer n security groups AWS firewall AWS admins only Hypervisor layer SSH via bastions Audits reviewed Physical interfaces
  • 12. Web tier Application tier Database tier HTTP/HTTPS SSH/RDP management SSH/RDP management from Internet from corpnet from corpnet, vendor SSH/RDP management from corpnet
  • 13.
  • 14. ec2-authorize WebSG -P tcp -p 80 -s 0.0.0.0/0 ec2-authorize WebSG -P tcp -p 443 -s 0.0.0.0/0 ec2-authorize WebSG -P tcp -p 22|3389 -s CorpNet ec2-authorize AppSG -P prot -p AppPortRange -o WebSG ec2-authorize AppSG -P tcp -p 22|3389 -s CorpNet ec2-authorize DBSG -P prot -p DBPortRange -o AppSG ec2-authorize DBSG -P tcp -p 22|3389 -s CorpNet ec2-authorize DBSG -P tcp -p 22|3389 -s Vendor
  • 15. Your VPC Amazon Web Services Cloud IPsec tunnel mode 128-bit AES, SHA-1, PFS, BGP Your corporate network
  • 16. Currently • EC2 on-demand and reserved • EBS • CloudWatch • Linux/Unix and Windows • US-East, EU-West Your VPC Upcoming Amazon • >1 AZ, >1 router Web Services • Outbound Internet Cloud • Elastic IPs • Elastic Load Balancing • Autoscaling Your corporate network • DevPay • Inter-subnet security groups
  • 17. • Read • Write • Full •Read •Write •Full “Key” = name of object
  • 18.
  • 19.
  • 20. Compliance • Sarbanes-Oxley Act – Ongoing • HIPAA – Current customer deployments – Whitepaper describes the specifics • SAS 70 type II – Second audit complete – Physical security, access controls, change management, operations • ISO 27001 – In progress
  • 21.
  • 22. Thank you very much! Steve Riley steriley@amazon.com @steveriley @awscloud http://stvrly.wordpress.com