# SAA - C03 Certification: Security & Encryption

# KMS Service

* Manages encryption keys
    
* Able to audit KMS usage using **CloudTrail**
    
* Having **three** kinds of Keys:
    
    1. KMS Keys
        
    2. Symmetric
        
    3. Asymmetric
        

## KMS Keys

**Types of KMS Keys:**

* AWS Owned Keys (free): SSE-S3, SSE-SQS,…
    
* AWS Managed Keys (free): aws/service-name, ex: aws/rds
    
* Customer-managed keys created in KMS: **$1 per month**
    
* Customer-managed keys imported: **$1 per month**
    
    * pay for the API call to KMS ($0.03/10.000 calls)
        

**Automatic Key rotation:**

* AWS Managed Keys: automatic every 1 year
    
* Customer-managed keys: (must be enabled) automatic & on-demand
    
* Imported KMS key: only manual rotation possible using alias
    

## KMS Multi-Region Keys

* Identical KMS Keys in different regions that can be used interchangeably (you can encrypt in one Region and decrypt in Other Regions)
    
* Multi-region keys have the same **key ID, key material, and automatic rotation**….
    
* KMS multi regions are NOT global (Primary + Replicas)
    
* Use cases: global client-side encryption, encryption on Global DynamoDB, Global Aurora
    

## S3 Replication Encryption Considerations

* Unencrypted objects and objects encrypted with SSE-S3 are replicated by default.
    
* Objects encrypted with SSE-C (Customer Key) can be replicated
    
* For objects encrypted with SSE-KMS, you need to enable the option
    
    * Specify which KMS key to encrypt the objects
        
    * Adapt the KMS Key Policy for the target key
        
    * An IAM Role with kms:Decrypt for the source KMS Key and km:Encrypt for the target KMS Key
        
    * You might get KMS throttling errors, so you can request a Service Quotas increase.
        

## AMI Sharing Process Encrypted via KMS

1. Must modify the image attribute to add a Launch Permission
    
2. Must share the KMS Keys
    
3. The IAM Role/User in the target account must have permission to DescribeKey, ReEncrypted, CreateGrant, and Decrypt.
    
4. When launching an EC2 Instance from the AMI, the target account can optionally specify a new KMS Key to re-encrypt the volumes.
    

## SSM Parameter Store

* Secure storage for configuration and secrets
    
* Optional Seamless Encryption using KMS
    
* Serverless, scalable, durable, easy SDK
    
* Version tracking
    
* Security through IAM
    
* Notifications with EventBridge
    
* Integration with CloudFormation
    

#### Parameters Policies

* Allow to assign a TTL to a parameter to force updating or deleting
    
* Can assign multiple policies at a time
    

# AWS Secrets Manager

## Overview

* Capability to force rotation of secrets every X days
    
* Integration with RDS (MySQL, PostgreSQL, Aurora)
    
* Secrets are encrypted using KMS
    
* **Mostly meant for RDS integration**
    

## Multi-region Secrets

* **Secrets Manager** keeps reading replicas in sync with the primary Secret
    
* Ability to promote a read replica Secret to a standalone Secret
    
* Use cases: multi-region apps, disaster recovery, multi-region DB,…
    

# AWS Certificate Manager (ACM)

* Easily provision, manage, and deploy TLS Certificates
    
* Provision in-flight encryption to for websites (HTTPS)
    
* Supports both public and private TLS Certificates
    
* Free of charge for public TLS Certificates
    
* Automatic TLS certificate renewal
    
* Integration with (load TLS certificates on)
    
    * Elastic Load Balancers
        
    * CloudFront Distributions
        
    * APIs on API Gateway
        
* Cannot use ACM with EC2
    

## Requesting Public Certificates

1. List domain names to be included in the certificate
    
    * Fully Qualified Domain Name (FQDN): corp.example.com
        
    * Wildcard Domain: \*.example.com
        
2. Select Validation Method: DNS Validation or Email Validation
    
    * DNS Validation is preferred for automation purposes
        
    * Email validation will send emails to contact addressed in the WHOIS database
        
    * DNS Validation will leverage a CNAME record to DNS config
        
3. It will take a few hours to get verified
    
4. The Public Cerfificated will be enrolled for automatic renewal
    
    * ACM automatically renews ACM-generated certificates 60 days before expiry
        

## Importing Public Certificates

* No automatic renewal, must import a new certificate before expiry
    
* ACM sends daily expiration events starting **45 days** prior to expiration
    
    * The # of days can be configured
        
    * Events are appearing in **EventBridge**
        
* **AWS Config** has a managed rule named **acm-certificate-expiration-check** to check for expiring certificates
    

## Integration with API Gateway

* Create a Custom Domain Name in API Gateway
    
* **Edge-Optimized (default):** For global clients
    
    * Requests are routed through the CloudFront Edge locations (improves latency)
        
    * The API Gateway still lives in only one region
        
    * **The TLS Certificate must be in the same region as CloudFront**
        
    * Then setup CNAME or (better) A-Alias record in Route53
        
* **Regional**
    
    * For clients in the same region
        
    * **The TLS Certificates must be imported on API Gateway, in the same region as the API Stage**
        
    * Then setup CNAME or (better) A-Alias record in Route53
        

# Web Application Firewall (WAF)

* Protects web application from common web exploit (Layer 7)
    
* Layer 7 is HTTP (vs Layer 4 is TCP/UDP - WAF **does not support** this layer)
    
* Deploy on
    
    * **Application Load Balancer**
        
    * **API Gateway**
        
    * **CloudFront**
        
    * **Cognito User Pool**
        
    * **AppSync GraphSQL API**
        
* Define **Web ACL Rules: IP Sets, Rate-based rules,…**
    
* Web ACL are Regional except for CloudFront
    
* A rule group is a reusable set of rules that you can add to a web ACL
    

## Fixed IP while using WAF with a LB

* WAF does not support the Network Load Balancer (Layer 4)
    
* We can use **Global Accelerator which provides fixed IPv4** for fixed IP and WAF on the ALB
    

# Shield - DDOS Protection

* AWS Shield Standard
    
    * Free service that is active for every AWS customer
        
    * Provides protection form attacks such as SYN/UDP Floods, Refection attacks and other layer 3/payer 4 attacks
        
* AWS Shield Advanced
    
    * Optional DDoS mitigation service ($3000 per month per organization)
        
    * Protect against more **sophisticated attack** on EC2, ELB, CloudFront, AWS Global Accelerator, Route53
        
    * 24/7 access to AWS DDoS response team
        

# Firewall Manager

* Manage rules in all accounts of an AWS Organization
    
* Security policy: common set of security rules
    
    * WAF rules
        
    * AWS Shield Advanced
        
    * Security Group for EC2, ALB
        
    * AWS Network Firewall (VPC Level)
        
    * Route53 Resolver DNS Firewall
        
    * Policies are created at the region level
        
* **Rules are applied to new resources as they are created across all and future accounts in Organization**
    

# Amazon GuardDuty

* Intelligent Threat discovery to protect AWS Account
    
* Uses ML algorithms, anomaly detection, 3rd party data
    
* Input data includes: CloudTrail Events Logs, VPC Flow Logs, DNS Logs,…
    
* Can be setup EventBridgu rules to be notified in case of findings
    
* Can protect against **CryptoCurrency** attacks
    

# Amazon Inspector

* Automated Security Assessments
    
* Used for **EC2, Container Images, Lambda**
    
* Reporting & Integration with AWS Security Hub
    
* Send findings to EventBridge
    

# Amazon Macie

* Helps identify and alert to sensitive data such as personally identifiable information (PII)