AWS Security and Compliance Crash Course

In this post we will provide you gist of the AWS security and compliance model.

Shared Security Model

AWS is responsible for securing the underlying infra. While customer is responsible for anything you put on the cloud or connect to the cloud.

Amazon is responsible for the security config of it's product that are considered managed services e.g. dynamoDB, Amazon RDS, Amazon redshift, Amazon workspaces, Amazon EMR.

IAAS :- Amazon EC2 and Amazon VPC are completely under customer's control and thus customer has to take steps to make them secure and compliant.

Storage decommissioning :-

AWS uses the technique detailed in DoD 5220.22-M and NIST 800-88 to destroy data as part of decommissioning process.

AWS Services to secure the cloud 

• AWS Config :- Manage configuration history and change notifications to enable security.
• AWS Service catalog :- Catalog allows you to centrally manage commonly-deployed IT services thus enabling users to deploy approved IT services in your organization.
• AWS Guard Duty:- Offers threat detection and continuous monitoring and malicious behaviors in your AWS accounts.
• AWS CloudHSM :- Protect your encryption keys with hardware security modules (HSM).
• Server-side Encryption :- If you prefer S3 to manage encryption process for you.
• AWS IAM  :- Secure access through IAM Users, Groups and Roles. IAM roles can be mapped to AD groups also.
• Amazon Macie :- Use Machine learning to automatically discover and protect sensitive data.
• AWS CloudTrail :- Records all API calls to your AWS account either programmatically or through console. 

 

AWS Artifact :- To get details of all the AWS compliance reports from third-party auditors.

Network security

• You can connect to AWS access point via http or https using SSL.
• AWS DirectConnect :- Private connectivity between yours and AWS datacenter.
• For customer who require additional security amazon provides Amazon VPC which provide private subnet within AWS cloud and the ability to use an IPsec VPN(Virtual private network) device to provide an encrypted tunnel between the amazon vpc and your data center.
• Amazon corporate network segregation:- Logically the amazon prod network is segregated from amazon corporate network by means of a complex set of network security/segregation devices.

Network Monitoring and Protection

Amazon protects from different type of attacks:-


DDoS:- A Denial of Service (DoS) attack is a malicious attempt to affect the availability of a targeted system, such as a website or application, to legitimate end users. Typically, attackers generate large volumes of packets or requests ultimately overwhelming the target system. In case of a Distributed Denial of Service (DDoS) attack, and the attacker uses multiple compromised or controlled sources to generate the attack.

Man in the Middle attacks(MITM) :- In cryptography and computer security, a man-in-the-middle attack (often abbreviated MitM, MiM attack, MitMA or the same using all capital letters) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

IP spoofing :- IP Spoofing is a technique used to gain unauthorized access to machines, whereby an attacker illicitly impersonate another machine by manipulating IP packets. IP Spoofing involves modifying the packet header with a forged (spoofed) source IP address, a checksum, and the order value.

Port Scanning :- Port scanner is an application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify services running on a host and exploit vulnerabilities.


AWS credentials types:-

• password
• Multi factor authentication (MFA)
• AWS Microsoft AD 
• IAM roles
• access keys
• key pairs
• X.509 certificates:- X.509 are only used to sign SOAP-based requests . You can have AWS create a x.509 certificate and a private key that you can download, or you can upload your own certificate by using the security credentials page.

Automation :-

Amazon Inspector :- It's an automated security assessment service. It can be very helpful in finding vulnerabilities on OS and suggesting the patches.

Source: https://aws.amazon.com/

AWS DynamoDB Cheat Sheet

DynamoDB is fast and flexible noSQL DB service for all application that need consistent single digit millisecond latency at any scale. It is a fully managed DB and support both document and key value data models.It is great for IoT, mobile/web gaming, and many other apps.

Quick facts of dynamodb

• Stored on SSD storage
• Spread across 3 geo distinct Ds.
• Eventual consistent reads:- Consistency across all copies is usually reached within a sec. Repeating a read after short time should return the updated data.(Best Read perf)
• Strongly consistent reads:- It returns a result that reflects all writes that received successful response prior to the read.

Table
Items(Like row of data in a table)
Attributes(Like column of data in a table)


Here everything between brackets {} is Item and 1587, Alan etc. are attributes.

{
"ID" : 1587,
"Name" : "Alan"
"Phone": "555-5555"
}


Two types of primary keys available:-
Single Attribute(Think unique ID)
Partition Key (Hash Key) composed of one attribute.

Composite(Think unique ID and date Range)
Partition key and Sort key (hash & Range) composed of 2 attributes


Partition key

• Dynamodb uses the partition key 's value as input to an internal hash function. The output from the hash function determines the partition(this is simply the physical location in which the data is stored)
• No two items in a table can have the same partition key value.

Partition Key and Sort Key

• Dynamodb uses the partition key 's value as input to an internal hash function. The output from the hash function determines the partition(this is simply the physical location in which the data is stored)
• Two items in a table can have the same partition key , but they must have a different sort key.
• All items with the same partition key are sorted together , in sorted order by sorted key value

Local secondary index

• It has the same partition key but different sort key
• Can only be created when creating a table. they cannot be removed or modified later.

Global secondary index:

• It has different partition key and different sort key.
• Can be created at table creation or added later.

DynamoDB streams

• If a new item is added to the table, the stream captures an image of the entire item, including all of its attributes
• If an item is updated, the stream captures the before and after image of any attributes that were modified in the item.
• If an item is deleted from the table, the stream captures an image of an entire item before it was deleted.

Query:-
A query operations find items in a table using only primary key attribute values. You must provide a partition attribute name and a distinct value to search for. You can optionally provide a sort key attribute name and value, and use a comparison operator to refine search results.
By default, a query returns all of the data attributes for the items with specified primary key(s) however you can use the ProjectionExpression parameter so that the query only returns some of the attributes, rather than all of them.

Query results are always sorted by the sort key. If the data type of the sort key is a number the results are returned in numeric order. Otherwise, the results are returned in order of ascii character code values. By default the sort order is ascending. To reverse the order set the ScanIndexForward parameter to false.

By default is eventually consistent but can be changed to strongly consistent.

SCAN:-
A Scan operation examines every item in the table. By default, a scan returns all of the data attributes of every item however you can use the ProjectionExpression parameter so that the scan only returns some of the attributes, rather than all of them.

Hope you find this quick glance of DynamoDB useful. Do let us know in comments if you have any query or suggestion.

Today we also want to share with you a good news that our blog is now included by Feedspot in the list of AWS Top 10 blogs . We would like to thank you all for your help and support in achieving this.

AWS certification exam cheat sheets

AWS certification exams grill you on vast topics and lot of services. In this post we have consolidated major services and topics of different exams so that you can access them from a single location.

Below links will give you better info on which topics and services are important for each exam and how to best prepare for them.

Which AWS certification is suitable for me?

How to prepare for AWS Certified Developer - Associate

How to prepare for AWS Certified SysOps Administrator – Associate

How to prepare for AWS Certified Solutions Architect - Associate

How to prepare for AWS Certified Solutions Architect - Professional

Once decided on which certification you want to pursue you can take a quick look of services in these cheat sheets for each service.

Services

Solved: How to use nmtui and nmcli tool to configure network in RedhatLinux

In this post we will see how to use nmtui for network management. This can be a very useful tool for starters in Redhat Linux 7.

• Login to your server using putty and execute command “nmtui” to invoke the interface. If your machine is not in network you can login via console and follow the same steps mentioned below.
• If you don’t have the nmtui tool installed, you can install it using yum (Note: If you don’t want to install a new package in your server you can use nmcli for network configuration. Refer the post for how to configure network with nmcli )

[root@cloudvedas ~]# yum install NetworkManager-tui

[root@cloudvedas ~]# nmtui

• Once you get the interface you can navigate using Arrow keys , Tab key and make selection using “enter” key. So, using arrow key select “Edit a connection” and press enter.

• We have two network interfaces enp0s8 and enp0s3 . Today we will be configuring enp0s3. As enps0s8 is already configured and in use. So once highlighted enp0s3 go to “Add” and press enter.

• Select the type of connection. For this tutorial we are selecting “Ethernet”.

• Once in “Edit connection” section enter “Profile name” , “Device”.  If you want static IP select “Manual” for IPv4 and select “Show”.

• Once you select  “Show” enter your IP detail with subnet id. Here subnet id is /24 or 255.255.255.0 . Also enter gateway. If you want to use DNS enter DNS server details else leave it blank and select OK.

• Once the IP configuration is done select “OK” again. Now you can see the new connection that you have created. Select “Quit” to come out.

• Now let’s activate the connection. Execute “nmtui” in putty or console again and select “Activate a connection”  and press Enter.

• Navigate with arrow key select the interface and then move right and Press enter on “Activate”. This will activate your interface as in image below.

• Check if the new IP is configured.

• Also let’s check in “nmcli” about the new connection.

If you want to change hostname refer this post on how to change hostname with nmtui or nmcli .
Hope this post is helpful. Do let me know if you have any query.

Solved: How to cap or limit memory usage of a docker container

In this post we will see how we can cap or restrict the maximum amount of memory the container can use.
Let’s first see the current usage of container id ec6ed4af7c34 with “docker stats”.

docker stats ec6ed4af7c34

In the below image we can see the current limit of the container is 300MiB

Now let’s change this limit to 200MiB of a running container.

docker container update -m 200m ec6ed4af7c34

Now when we look at “docker stats” we can see in the image below the new limit on the container.

If you want to set the memory limit at the time of launching the container itself do it as

docker run -exec -it -m 200m image-name /bin/bash

Compose file version 3
If you want to restrict the usage from the compose file itself you can follow below example, the redis service is constrained to use no more than 50M of memory and 0.50 (50%) of available processing time (CPU), and has 20M of memory and 0.25 CPU time reserved (as always available to it).

version: '3'
services:
  redis:
    image: redis:alpine
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 50M
        reservations:
          cpus: '0.10'
          memory: 20M

Hope this post is helpful to you. Do let me know if you have any query.