Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared responsibility model reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit AWS Cloud Security.

IAM roles

IAM roles allow customers to assign granular access policies and permissions to services and users on the AWS Cloud. This solution creates IAM roles that grant the solution’s Lambda functions access to create AWS Regional resources.

Amazon CloudFront

This solution deploys a web frontend hosted in an Amazon S3 bucket. To help reduce latency and improve security, this solution includes a CloudFront distribution with an origin access identity, which is a CloudFront user that provides public access to the solution’s website bucket contents. For more information, see Restricting Access to Amazon S3 Content by Using an Origin Access Identity in the Amazon CloudFront Developer Guide.

We recommend deploying AWS WAF in front of the CloudFront distribution for enhanced security. This is not enabled by default because AWS WAF for CloudFront can’t be deployed in all Regions supported by this solution. See Using AWS WAF to control access to your content in the Amazon CloudFront Developer Guide for details.