Security - Virtual Andon on AWS


When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared model can reduce your operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. For more information about security on AWS, visit AWS Cloud Security.

IAM roles

AWS Identity and Access Management (IAM) roles allow customers to assign granular access policies and permissions to services and users on the AWS Cloud. Virtual Andon on AWS creates several IAM roles, including roles that grant the solution’s AWS Lambda functions and Amazon Cognito identity pool to access the other AWS services used in this solution.

Amazon CloudFront

This solution deploys a static website hosted in an Amazon Simple Storage Service (Amazon S3) bucket. To help reduce latency and improve security, this solution includes an Amazon CloudFront distribution with an origin access identity, which is a special CloudFront user that helps provide public access to the solution’s website bucket contents. For more information, refer to Restricting Access to Amazon S3 Content by Using an Origin Access Identity.

The solution uses the default CloudFront certificate which supports TLS v1.0 only. To use TLS v1.1 or TLS v1.2, you must use a custom SSL certificate instead of the default CloudFront certificate. For more information, refer to How do I configure my CloudFront distribution to use an SSL/TLS certificate.

Amazon S3 buckets

By default, the Amazon S3 buckets deployed by the Virtual Andon on AWS solution are automatically activated with encryption at rest, logging, blocked public access, and access restricted to Amazon CloudFront origin access identity.

Amazon Cognito

Virtual Andon on AWS uses Amazon Cognito to provide secure access (username and password) to its web interface. An admin user is created in a Cognito user pool as part of the solution’s deployment. Access to the web interface is restricted to authorized users using an Amazon Cognito identity pool.

SAML identity provider

This solution creates an Amazon Cognito user pool and an identity pool for authentication, authorization, and user management for the solution’s web interface. You have the option to add and configure a SAML identity provider (IdP) to the Cognito user pool. The AWS CloudFormation template provides the following parameters so you can set up this security mechanism: Cognito Domain Prefix, SAML Provider Name, and SAML Provider Metadata Url. For more information about adding a SAML IdP, refer to Adding SAML Identity Providers to a User Pool in the Amazon Cognito Developer Guide.

After users initially sign in to Virtual Andon on AWS using SAML IdP, administrators will be able to assign them to groups and set permissions through the web interface. Alternatively, the Amazon Cognito trigger microservice can be used to automate the initial configurations of new SAML IdP users.