5 Keys to Improve the Security of Your AWS Accounts
One of the features we value most about Amazon Web Services is the security offered both for users and for the services deployedHowever, it is important to remember that one of the responsibilities as users of this platform is the security of our accounts (corresponding to the cloud security of the AWS responsibility model).
For this reason, we take advantage of this post to give you 5 Key Tips to Improve the Security of Your AWS Accounts and Services.
If you find this topic interesting, we invite you to download our free Ebook «How to migrate to Amazon Web Services?«
1 – Multi-factor authentication (MFA)
A best practice is Integrate MFA into the root user and all IAM users to protect accounts from unauthorized accessWith the AWS Single Sign-On tool, it is possible to manage access centrally and select only those users with access permissions.
2 – Analyze IAM roles
La Periodic re-evaluation of IAM roles and permissions is essential to reduce the number of unused IAM users. AWS offers the tool IAM Access Analyzer to discover external shared access to AWS accounts and internal resources, and refine permissions based on historical access and resource usage.
3 – Creating Security Groups
When we create security groups we enable network access to AWS resources. Usually these groups are deployed for EC2 instances as they allow us to control outgoing and incoming traffic. They basically act as a virtual firewall and to make sure we have everything under control it is It is important to verify that only the required ports are open and that the connection is enabled only from known network ranges.
4 – Rotation of access keys
In case of using access keys instead of roles, It is recommended to rotate them periodically and eliminate those with long periods of disuse.AWS recommends using IAM roles instead of access keys, which ensure that users only have the necessary privileges. Here is a guide in English about the IAM roles. Best practices for managing access keys.
5 – Logs in CloudTrail
Once the accesses, roles and permissions have been defined, it is also crucial monitor actions that users take on the AWS account. All this data will allow us to improve our security policies. How can we do this? AWS recommends Write CloudTrail logs to an S3 bucket designated for logging. Permissions on S3 should prevent deletion of logs and they should also be encrypted. Once logs are centralized, you can integrate them with SIEM solutions or use AWS services to analyze them.
With these keys, it is possible to reinforce the security of everything that happens within AWS accounts and obtain a resilient and agile infrastructure in just a few steps and at the lowest cost. And if you found this interesting, follow our blog for more news about the AWS cloud.
Do you have a cloud migration project? Our AWS cloud experts can guide you through the roadmap that best suits your business. Contact Us and we will help you speed up the digital transformation of your company.
