Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared responsibility model reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit the AWS Security Center.

Resource access

IAM roles

IAM roles allow customers to assign granular access policies and permissions to services and users on the AWS Cloud. Multiple roles are required to run Workload Discovery on AWS and discover resources in AWS accounts.

Amazon Cognito

Amazon Cognito is used to authenticate access with short-lived, strong credentials granting access to components needed by Workload Discovery on AWS.

Network access

Amazon VPC

Workload Discovery on AWS is deployed within an Amazon VPC and configured according to best practices to deliver security and high availability. For additional details, refer to Security best practices for your VPC. VPC endpoints allow non-internet transit between services and are configured where available.

Security groups are used to control and isolate network traffic between the components needed to run Workload Discovery on AWS.

We recommend that you review the security groups and further restrict access as needed once the deployment is up and running.

Amazon CloudFront

This solution deploys a web console UI hosted in an Amazon S3 bucket which is distributed by Amazon CloudFront. By using the origin access identity feature, the contents of this Amazon S3 bucket are accessible only through CloudFront. For more information, refer to Restricting access to an Amazon S3 origin in the Amazon CloudFront Developer Guide.

CloudFront activates additional security mitigations to append HTTP security headers to each viewer response. For additional details, refer to Adding or removing HTTP headers in CloudFront responses.

This solution uses the default CloudFront certificate which has a minimum supported security protocol of TLS v1.0. To enforce the use of TLS v1.2 or TLS v1.3, you must use a custom SSL certificate instead of the default CloudFront certificate. For more information, refer to How do I configure my CloudFront distribution to use an SSL/TLS certificate.

Application configuration

AWS AppSync

Workload Discovery on AWS GraphQL APIs have request validation provided by AWS AppSync according to the GraphQL specification. Furthermore, authentication and authorization are implemented using IAM and Amazon Cognito, which use the JWT provided by Amazon Cognito when a user authenticates successfully in the web UI.

AWS Lambda

By default, the Lambda functions are configured with the most recent stable version of the language runtime. No sensitive data or secrets are logged. Service interactions are carried out with the least required privilege. Roles that define these privileges are not shared between functions.

Amazon OpenSearch Service

Amazon OpenSearch Service domains are configured with an access policy that restricts access to stop any unsigned requests made to the OpenSearch Service cluster. This is restricted to a single Lambda function.

The OpenSearch Service cluster is built with node-to-node encryption activated to add an extra layer of data protection on top of the existing OpenSearch Service security features.

Log Retention

This solution captures application and service logs by creating CloudWatch logs groups in your account. By default, logs are kept for 1 year. You can adjust the LogRetentionPeriod parameter for each log group, keeping the default retention period, or choosing a period between one day and 10 years based on your requirements.