---
type: archive
area: archive
status: archived
date: 2026-05-03
created: 2026-05-03
updated: 1980-01-01
tags:
  - archive
---
## Security
- AWS provide high security standards 

### Shared Responsibility Model :
- Security of cloud computing infrastructure and data is shared responsibility between the customer and AWS
- Aws : Security of the cloud
	- Aws is responsible for protecting the infrastructure such as physical security of data centers hosting the AWS Cloud. (hardware software networking that rung the cloud)
- Yous: Security in the cloud
	- You or customer reponsible for security in cloud like access managment firewalls

### Security in cloud :
- IAM (identity and access management)
- Detective controls
- Infrastructure protection
- Data protection
- incident response
Security should be applied on all layers
Data should be protected at rest and at transit

### Security resources and services:
 **Services**: Amazon Inspector, AWS Shield, Amazon GuardDuty

### Auditing (التدقيق) on AWS
َAWS Security Hub, AWS Config , AWS Cloud Trail, Aws Audit manager

### IAM Policies 
- Defines who can access what
- Identities service , role, group of users, workload (group of applications), Federated identity (SSO)
- One of the best ways to control access  is by using roles
- Traffic control by security groups or  Network  access control lists 
- ![[img-20240907-130124-80102f10.png]]
- ![[img-20240907-130703-e7e44fd1.png]]
- Iam used to manage users, IAM roles, federated users
#### Method 1
- Users
- ![[img-20240907-130951-2ccc5e9e.png]]
#### Method 2
- Roles
- ![[img-20240907-131131-bc0018de.png]]
- ![[img-20240907-131148-0624b672.png]]
#### Method 3
- Can use any identity management solution that uses SAML 2.0 or one of the AWS federation samples
![[img-20240907-131413-2c170e4a.png]]

#### Benefits of IAM
![[img-20240907-132130-ebdfcb39.png]]
 - Permission are global applicable across all regions 
 - Always start with minimum set of permissions, and grant additional permissions only as necessary
 - AWS secret manager manages all credentials 
#### AWS Systems Manager
- Centrelized control tower to manage AWS resources in multicloud and hybrid environements
- Visualize and operate on multiple AWS services from one place
- Create logical groups of resources 
#### WAF
- Protects web apps running on the AWS Cloud from web exploits
- firewall for web apps
- WAF protect from apps that uses excessive resources
#### AWS shield
- Protect from DDoS Attack by minimizing effects of it
- 2 Tiers
	- Standard free to use
	- Advanced Near real time visibility into events.
		- integrates with waf 
		- protects against charges for EC2, elastic load balancers ...
		- Application can be hosted anywhere and be protected against DDoS attack.
#### Amazon Inspector
- Automated security assessment service for applications
- Automatically assesses for exposure, vulnerabilities , and deviations from best practices.
- Reduce the risk of introducing security issues during deployment and development
#### Amazon Trusted Advisor:
- Guide provisioning of resources to follow AWS best practices.
- Scans your infrastructure and advises you on how its not following AWS best practices .
- Based on  categories: cost optimization, performance, security, fault tolerance, service limits.

![[img-20240908-121252-6bdd3010.png]]
![[img-20240908-121322-f55e5c7b.png]]
- All these are available in free account
- In enterprise plan there is more 
#### Amazon Guard Duty
- 24/7 threat detection service  for AWS cloud 
- Monitors for malicious activity and unauthorized behavior
- Send actionable alerts via CloudWatch
- Uses machine learning, anomaly detection
- Easy to deploy
#### AWS Artifacts:
- on-demand self-service portal to download aws security and compliance
- Review accept and track status of AWS agreements specific to your organization's industry
#### Governance and Compliance services
![[img-20240908-123350-22d0167c.png]]

![[img-20240908-123417-219b17d3.png]]