Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared responsibility model reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit AWS Cloud Security.

API security

The solution’s Amazon API Gateway file manager REST API is secured with an IAM authorizer. Valid AWS Identity and Access Management (IAM) credentials are granted to a user via AWS Security Token Service (AWS STS) after they successfully authenticate with the solution-deployed Amazon Cognito user pool and if they belong to an Amazon Cognito group that has an adequately scoped IAM role associated with it. Refer to the sequence diagram on GitHub for further details.

IAM roles

AWS Identity and Access Management (IAM) roles allow customers to assign granular access policies and permissions to services and users on the AWS Cloud. This solution creates IAM roles that grant the solution’s AWS Lambda functions access to create Regional resources. The solution also creates the EFSFileManagerIamRole IAM role that has Amazon API Gateway execute-api permissions on all file manager API endpoints.

Amazon CloudFront

This solution deploys a web UI hosted in an Amazon Simple Storage Service (Amazon S3) bucket. To help reduce latency and improve security, this solution includes an Amazon CloudFront distribution with an origin access identity, which is a CloudFront user that provides public access to the solution’s website bucket contents. For more information, refer to Restricting Access to Amazon S3 Content by Using an Origin Access Identity in the Amazon CloudFront Developer Guide.

AWS Lambda

When you create AWS Lambda file manager functions, you must ensure that the default settings fit your use case and security requirements. By allowing the default settings, the users created in the Simple File Manager for Amazon EFS Amazon Cognito user pool will have full access to files present in the directory specified.