SlideShare una empresa de Scribd logo
1 de 13
Descargar para leer sin conexión
Keeping Secrets: Securing Your Data with AWS Cryptography (SEC353-R1) - AWS re:Invent 2018
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Keeping Secrets: Securing your Data
with AWS Cryptography
Jeff Levine
Security & Compliance Solutions Architect
Amazon Web Services
Ahmed Gouda
Solutions Architect
Amazon Web Services
r e : I n v e n t 2 0 1 8 S E C 3 5 3
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Introduction
AWS KMS
AWS Secrets Manager
AWS CloudHSM
Demo Walkthrough
Customer Collaboration / Q & A
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS KMS
• Allows you to create and manage your encryption keys.
• Uses FIPS 140.2 validated hardware.
• Is a regional service with high availability and durability.
• In our demo, we will show:
• The use of AWS KMS in AWS CloudFormation for volume encryption
• The use of AWS KMS in AWS CloudFormation for encrypting an Amazon RDS database
• The presence of AWS KMS-related events in the audit trail
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudHSM
• Cloud-based Hardware Security Module that enable you to easily generate and
use your own encryption keys.
• Uses FIPS 140-2 Level 3 validated HSMs.
• Flexibility to integrate with application using PKCS#11, JCE, KSP/CNG and OpenSSL.
• Fully-managed service with automated backup.
• In our demo, we will show how to:
• Provision an AWS CloudHSM cluster using AWS Step Functions and AWS Lambda
• Access CloudHSM from an Amazon EC2 instance
• Configure SSL Offloading using Private Key stored on CloudHSM
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Secrets Manager
• Provides for the complete lifecycle management of secrets
• Storage, Rotation, Auditing, Deletion
• In our demo we will show how to:
• Access a database with hardcoded credentials and via Secrets Manager
• Enable rotation
• Show how an application can poll for a new password
• Display rotation events in the audit trail
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
- Our environment is a WordPress site running within AWS.
- TLS/SSL offloading is handled by AWS CloudHSM.
- WordPress is running on an Amazon EC2 under Amazon Linux 2.
- WordPress is running on an volume encrypted with AWS KMS.
- WPCLI is used to install and configure WordPress using a command line.
- Amazon RDS for MariaDB provides the backend WordPress database.
- Encryption is provided by AWS KMS.
- The database credential is managed through AWS Secrets Manager
- A password monitor shell script updates WordPress when the Amazon RDS password changes.
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
- AWS CloudTrail captures the API calls.
- Amazon CloudWatch events captures relevant API event and invokes
an AWS Lambda function which uses Amazon SNS to send e-mail notifications.
- AWS Systems Manager Session Manager provides access.
- The demo environment is built with AWS CloudFormation.
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo Architecture
Internet gateway
Route table
VPC 10.200.0.0/16
Region eu-west-1
Amazon EC2
Amazon Linux 2
Apache
WordPress
Subnet 10.200.11.24/0
eu-west-1a
Amazon RDS
MariaDB AWS KMS
AWS
Secrets Manager
AWS
CloudHSM
AWS
CloudTrail
AWS
CloudWatch
Events
AWS
Lambda
AWS
SNS User
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

Más contenido relacionado

La actualidad más candente

Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...
Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...
Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...Amazon Web Services
 
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...Amazon Web Services
 
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018Amazon Web Services
 
DEM16 Cisco ACI Anywhere – AWS Extensions
DEM16 Cisco ACI Anywhere – AWS ExtensionsDEM16 Cisco ACI Anywhere – AWS Extensions
DEM16 Cisco ACI Anywhere – AWS ExtensionsAmazon Web Services
 
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018Amazon Web Services
 
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...Amazon Web Services
 
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018Amazon Web Services
 
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018Amazon Web Services
 
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...Amazon Web Services
 
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018Amazon Web Services
 
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...Amazon Web Services
 
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...Amazon Web Services
 
AWS 微服務中的 Container 選項比較 (Level 400)
AWS 微服務中的 Container 選項比較   (Level 400)AWS 微服務中的 Container 選項比較   (Level 400)
AWS 微服務中的 Container 選項比較 (Level 400)Amazon Web Services
 
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018Amazon Web Services
 
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPC
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPCDEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPC
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPCAmazon Web Services
 
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018Amazon Web Services
 
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech Talks
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech TalksBuilding an Immersive VR Streaming Solution on AWS - AWS Online Tech Talks
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech TalksAmazon Web Services
 
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...Amazon Web Services
 
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...Amazon Web Services
 
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS Config
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS ConfigSRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS Config
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS ConfigAmazon Web Services
 

La actualidad más candente (20)

Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...
Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...
Deploy and Scale a Cloud Application with Amazon Lightsail (CMP410-R2) - AWS ...
 
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...
Reserve Amazon EC2 On-Demand Capacity for Any Duration with On-Demand Capacit...
 
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018
VPC Design Scenarios for Real-Life Use Cases (NET320) - AWS re:Invent 2018
 
DEM16 Cisco ACI Anywhere – AWS Extensions
DEM16 Cisco ACI Anywhere – AWS ExtensionsDEM16 Cisco ACI Anywhere – AWS Extensions
DEM16 Cisco ACI Anywhere – AWS Extensions
 
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018
Protecting Game Servers Against DDoS Attacks (SEC420-R1) - AWS re:Invent 2018
 
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...
Secure Your Site: Use CDN Security Features to Protect Your Content & Infrast...
 
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018
Executive Security Simulation Workshop (WPS206) - AWS re:Invent 2018
 
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
Mastering Identity at Every Layer of the Cake (SEC401-R1) - AWS re:Invent 2018
 
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...
Tailor-Made SaaS: Multi-Tenant Customizations with AWS Lambda (GPSCT311) - AW...
 
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018
Build AWS CloudFormation Custom Resources (DEV417-R2) - AWS re:Invent 2018
 
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...
Maximizing Throughput and Performance on Amazon EFS (STG406) - AWS re:Invent ...
 
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
[NEW LAUNCH!] Deep Dive on Amazon FSx for Windows File Server (STG322-R) - AW...
 
AWS 微服務中的 Container 選項比較 (Level 400)
AWS 微服務中的 Container 選項比較   (Level 400)AWS 微服務中的 Container 選項比較   (Level 400)
AWS 微服務中的 Container 選項比較 (Level 400)
 
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018
SPEKE-ing of Content Protection & DRM (MAE302) - AWS re:Invent 2018
 
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPC
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPCDEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPC
DEM05 Reducing Costs and Strengthening Your Security Posture with a Transit VPC
 
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018
Running Amazon EC2 Workloads at Scale (CMP402-R1) - AWS re:Invent 2018
 
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech Talks
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech TalksBuilding an Immersive VR Streaming Solution on AWS - AWS Online Tech Talks
Building an Immersive VR Streaming Solution on AWS - AWS Online Tech Talks
 
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...
AWS Snowball Edge and AWS Greengrass for Fun and Profit (STG388) - AWS re:Inv...
 
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...
AWS Encryption SDK: The Busy Engineer's Guide to Client-Side Encryption (SEC3...
 
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS Config
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS ConfigSRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS Config
SRV209 Monitor Cross-Account and Cross-Region Compliance Status with AWS Config
 

Similar a Keeping Secrets: Securing Your Data with AWS Cryptography (SEC353-R1) - AWS re:Invent 2018

AWS Cryptography Services – Addressing your data security and compliance need...
AWS Cryptography Services – Addressing your data security and compliance need...AWS Cryptography Services – Addressing your data security and compliance need...
AWS Cryptography Services – Addressing your data security and compliance need...Amazon Web Services
 
Getting Started with AWS Security
Getting Started with AWS SecurityGetting Started with AWS Security
Getting Started with AWS SecurityAmazon Web Services
 
Data protection using encryption in AWS - SEC201 - Santa Clara AWS Summit
Data protection using encryption in AWS - SEC201 - Santa Clara AWS SummitData protection using encryption in AWS - SEC201 - Santa Clara AWS Summit
Data protection using encryption in AWS - SEC201 - Santa Clara AWS SummitAmazon Web Services
 
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018Amazon Web Services
 
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도Amazon Web Services Korea
 
Data Protection in Transit and at Rest
Data Protection in Transit and at RestData Protection in Transit and at Rest
Data Protection in Transit and at RestAmazon Web Services
 
Data Protection in Transit and at Rest
Data Protection in Transit and at RestData Protection in Transit and at Rest
Data Protection in Transit and at RestAmazon Web Services
 
Using AWS Key Management Service for Secure Workloads
Using AWS Key Management Service for Secure WorkloadsUsing AWS Key Management Service for Secure Workloads
Using AWS Key Management Service for Secure WorkloadsAmazon Web Services
 
Well-Architected for Security: Advanced Session
Well-Architected for Security: Advanced SessionWell-Architected for Security: Advanced Session
Well-Architected for Security: Advanced SessionAmazon Web Services
 
How encryption works in AWS: What assurances do you have that unauthorized us...
How encryption works in AWS: What assurances do you have that unauthorized us...How encryption works in AWS: What assurances do you have that unauthorized us...
How encryption works in AWS: What assurances do you have that unauthorized us...Amazon Web Services
 
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018Amazon Web Services
 
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...Amazon Web Services
 
Protecting Your Data with Encryption on AWS
Protecting Your Data with Encryption on AWSProtecting Your Data with Encryption on AWS
Protecting Your Data with Encryption on AWSAmazon Web Services
 
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAmazon Web Services
 
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAmazon Web Services
 
Protecting your data in AWS
Protecting your data in AWS Protecting your data in AWS
Protecting your data in AWS Dinah Barrett
 

Similar a Keeping Secrets: Securing Your Data with AWS Cryptography (SEC353-R1) - AWS re:Invent 2018 (20)

AWS Cryptography Services – Addressing your data security and compliance need...
AWS Cryptography Services – Addressing your data security and compliance need...AWS Cryptography Services – Addressing your data security and compliance need...
AWS Cryptography Services – Addressing your data security and compliance need...
 
Getting Started with AWS Security
Getting Started with AWS SecurityGetting Started with AWS Security
Getting Started with AWS Security
 
Data protection using encryption in AWS - SEC201 - Santa Clara AWS Summit
Data protection using encryption in AWS - SEC201 - Santa Clara AWS SummitData protection using encryption in AWS - SEC201 - Santa Clara AWS Summit
Data protection using encryption in AWS - SEC201 - Santa Clara AWS Summit
 
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
 
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도
AWS re:Invent re:Cap - 종단간 보안을 위한 클라우드 아키텍처 구축 - 양승도
 
Data Protection in Transit and at Rest
Data Protection in Transit and at RestData Protection in Transit and at Rest
Data Protection in Transit and at Rest
 
Data Protection in Transit and at Rest
Data Protection in Transit and at RestData Protection in Transit and at Rest
Data Protection in Transit and at Rest
 
Using AWS Key Management Service for Secure Workloads
Using AWS Key Management Service for Secure WorkloadsUsing AWS Key Management Service for Secure Workloads
Using AWS Key Management Service for Secure Workloads
 
Well-Architected for Security: Advanced Session
Well-Architected for Security: Advanced SessionWell-Architected for Security: Advanced Session
Well-Architected for Security: Advanced Session
 
How encryption works in AWS: What assurances do you have that unauthorized us...
How encryption works in AWS: What assurances do you have that unauthorized us...How encryption works in AWS: What assurances do you have that unauthorized us...
How encryption works in AWS: What assurances do you have that unauthorized us...
 
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018
Security Best Practices for Microsoft Workloads (WIN307) - AWS re:Invent 2018
 
Protecting Your Data in AWS
Protecting Your Data in AWSProtecting Your Data in AWS
Protecting Your Data in AWS
 
Securing Your Data in AWS
Securing Your Data in AWSSecuring Your Data in AWS
Securing Your Data in AWS
 
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...
AWS re:Invent 2016: Get the Most from AWS KMS: Architecting Applications for ...
 
Protecting Your Data in AWS
Protecting Your Data in AWSProtecting Your Data in AWS
Protecting Your Data in AWS
 
SEC301 Security @ (Cloud) Scale
SEC301 Security @ (Cloud) ScaleSEC301 Security @ (Cloud) Scale
SEC301 Security @ (Cloud) Scale
 
Protecting Your Data with Encryption on AWS
Protecting Your Data with Encryption on AWSProtecting Your Data with Encryption on AWS
Protecting Your Data with Encryption on AWS
 
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
 
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS EncryptionAWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
AWS June Webinar Series - Deep Dive: Protecting Your Data with AWS Encryption
 
Protecting your data in AWS
Protecting your data in AWS Protecting your data in AWS
Protecting your data in AWS
 

Más de Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateAmazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSAmazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAmazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceAmazon Web Services
 

Más de Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Keeping Secrets: Securing Your Data with AWS Cryptography (SEC353-R1) - AWS re:Invent 2018

  • 2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Keeping Secrets: Securing your Data with AWS Cryptography Jeff Levine Security & Compliance Solutions Architect Amazon Web Services Ahmed Gouda Solutions Architect Amazon Web Services r e : I n v e n t 2 0 1 8 S E C 3 5 3
  • 3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda Introduction AWS KMS AWS Secrets Manager AWS CloudHSM Demo Walkthrough Customer Collaboration / Q & A
  • 4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS KMS • Allows you to create and manage your encryption keys. • Uses FIPS 140.2 validated hardware. • Is a regional service with high availability and durability. • In our demo, we will show: • The use of AWS KMS in AWS CloudFormation for volume encryption • The use of AWS KMS in AWS CloudFormation for encrypting an Amazon RDS database • The presence of AWS KMS-related events in the audit trail
  • 5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS CloudHSM • Cloud-based Hardware Security Module that enable you to easily generate and use your own encryption keys. • Uses FIPS 140-2 Level 3 validated HSMs. • Flexibility to integrate with application using PKCS#11, JCE, KSP/CNG and OpenSSL. • Fully-managed service with automated backup. • In our demo, we will show how to: • Provision an AWS CloudHSM cluster using AWS Step Functions and AWS Lambda • Access CloudHSM from an Amazon EC2 instance • Configure SSL Offloading using Private Key stored on CloudHSM
  • 6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Secrets Manager • Provides for the complete lifecycle management of secrets • Storage, Rotation, Auditing, Deletion • In our demo we will show how to: • Access a database with hardcoded credentials and via Secrets Manager • Enable rotation • Show how an application can poll for a new password • Display rotation events in the audit trail
  • 7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Overview - Our environment is a WordPress site running within AWS. - TLS/SSL offloading is handled by AWS CloudHSM. - WordPress is running on an Amazon EC2 under Amazon Linux 2. - WordPress is running on an volume encrypted with AWS KMS. - WPCLI is used to install and configure WordPress using a command line. - Amazon RDS for MariaDB provides the backend WordPress database. - Encryption is provided by AWS KMS. - The database credential is managed through AWS Secrets Manager - A password monitor shell script updates WordPress when the Amazon RDS password changes.
  • 9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Overview - AWS CloudTrail captures the API calls. - Amazon CloudWatch events captures relevant API event and invokes an AWS Lambda function which uses Amazon SNS to send e-mail notifications. - AWS Systems Manager Session Manager provides access. - The demo environment is built with AWS CloudFormation.
  • 10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Demo Architecture Internet gateway Route table VPC 10.200.0.0/16 Region eu-west-1 Amazon EC2 Amazon Linux 2 Apache WordPress Subnet 10.200.11.24/0 eu-west-1a Amazon RDS MariaDB AWS KMS AWS Secrets Manager AWS CloudHSM AWS CloudTrail AWS CloudWatch Events AWS Lambda AWS SNS User
  • 11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 12. Thank you! © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.