Security foundations
Influence the future of the AWS Security Reference Architecture (AWS SRA) by taking a short survey |
The AWS Security Reference Architecture aligns to three AWS security foundations: the AWS Cloud Adoption Framework (AWS CAF), AWS Well-Architected, and the AWS Shared Responsibility Model.
AWS Professional Services created AWS CAF
-
The security perspective of the AWS CAF helps you structure the selection and implementation of controls across your business. Following the current AWS recommendations in the security pillar can help you meet your business and regulatory requirements.
AWS
Well-Architected
-
The Well-Architected security pillar describes how to take advantage of cloud technologies to help protect data, systems, and assets in a way that can improve your security posture. This will help you meet your business and regulatory requirements by following current AWS recommendations. There are additional Well-Architected Framework focus areas that provide more context for specific domains such as governance, serverless, AI/ML, and gaming. These are known as AWS Well-Architected lenses
.
Security and compliance are a shared responsibility
between AWS and the customer
Within the guidance provided by these foundational documents, two sets of concepts are particularly relevant to the design and understanding of the AWS SRA: security capabilities and security design principles.
Security capabilities
The security perspective of AWS CAF outlines nine capabilities that help you achieve the confidentiality, integrity, and availability of your data and cloud workloads.
-
Security governance to develop and communicate security roles, responsibilities, policies, processes, and procedures across your organization's AWS environment.
-
Security assurance to monitor, evaluate, manage, and improve the effectiveness of your security and privacy programs.
-
Identity and access management to manage identities and permissions at scale.
-
Threat detection to understand and identify potential security misconfigurations, threats, or unexpected behaviors.
-
Vulnerability management to continuously identify, classify, remediate, and mitigate security vulnerabilities.
-
Infrastructure protection to help validate that systems and services within your workloads are protected.
-
Data protection to maintain visibility and control over data, and how it is accessed and used in your organization.
-
Application security to help detect and address security vulnerabilities during the software development process.
-
Incident response to reduce potential harm by effectively responding to security incidents.
Security design principles
The security pillar of the Well-Architected Framework captures a set of seven design principles that turn specific security areas into practical guidance that can help you strengthen your workload security. Where the security capabilities frame the overall security strategy, these Well-Architected principles describe what you can start doing. They are reflected very deliberately in this AWS SRA and consist of the following:
-
Implement a strong identity foundation – Implement the principle of least privilege, and enforce separation of duties with appropriate authorization for each interaction with your AWS resources. Centralize identity management, and aim to eliminate reliance on long-term static credentials.
-
Enable traceability – Monitor, generate alerts, and audit actions and changes to your environment in real time. Integrate log and metric collection with systems to automatically investigate and take action.
-
Apply security at all layers – Apply a defense-in-depth approach with multiple security controls. Apply multiple types of controls (for example, preventive and detective controls) to all layers, including edge of network, virtual private cloud (VPC), load balancing, instance and compute services, operating system, application configuration, and code.
-
Automate security best practices – Automated, software-based security mechanisms improve your ability to securely scale more rapidly and cost-effectively. Create secure architectures, and implement controls that are defined and managed as code in version-controlled templates.
-
Protect data in transit and at rest – Classify your data into sensitivity levels and use mechanisms such as encryption, tokenization, and access control where appropriate.
-
Keep people away from data – Use mechanisms and tools to reduce or eliminate the need to directly access or manually process data. This reduces the risk of mishandling or modification and human error when handling sensitive data.
-
Prepare for security events – Prepare for an incident by having incident management and investigation policy and processes that align to your organizational requirements. Run incident response simulations and use tools with automation to increase your speed for detection, investigation, and recovery.