Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared model can reduce your operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. For more information about security on AWS, visit AWS Cloud Security.

IAM roles

AWS Identity and Access Management (IAM) roles allow you to assign granular access policies and permissions to services and users in the AWS Cloud. This solution creates IAM roles that grants the AWS Lambda function access to the other AWS services used in this solution.

Amazon Cognito

The Amazon Cognito user created by this solution is a local user with permissions to access only the RestAPIs for this solution. This user does not have permissions to access any other services in your AWS account. For more information, refer to Amazon Cognito User Pools in the Amazon Cognito Developer Guide.

The solution optionally supports external SAML sign-in through the configuration of federated identity providers and the hosted UI functionality of Amazon Cognito.

Amazon CloudFront

This default solution deploys a web console hosted in an Amazon S3 bucket. To help reduce latency and improve security, this solution includes an Amazon CloudFront distribution with an origin access identity, which is a special CloudFront user that helps provide public access to the solution’s website bucket contents. For more information, refer to Restricting Access to Amazon S3 Content by Using an Origin Access Identity in the Amazon CloudFront Developer Guide.

If a private deployment type is selected during stack deployment, then a CloudFront distribution is not deployed, and requires that another web hosting service is used to host the web console.

AWS WAF - Web Application Firewall

If deployment type selected in the stack is Public with AWS WAF then the CloudFormation will deploy the required AWS WAF Web ACLs and Rules configured to protect CloudFront, API Gateway, and Cognito endpoints created by the CMF solution. These endpoints will be restricted to allow only specified source IP addresses to access these endpoints. During stack deployment, two CIDR ranges must be supplied with the facility to add additional rules after deployment via the AWS WAF console.