SEC01-BP06 Automate deployment of standard security controls
Apply modern DevOps practices as you develop and deploy security controls that are standard across your AWS environments. Define standard security controls and configurations using Infrastructure as Code (IaC) templates, capture changes in a version control system, test changes as part of a CI/CD pipeline, and automate the deployment of changes to your AWS environments.
Desired outcome: IaC templates capture standardized security controls and commit them to a version control system. CI/CD pipelines are in places that detect changes and automate testing and deploying your AWS environments. Guardrails are in place to detect and alert on misconfigurations in templates before proceeding to deployment. Workloads are deployed into environments where standard controls are in place. Teams have access to deploy approved service configurations through a self-service mechanism. Secure backup and recovery strategies are in place for control configurations, scripts, and related data.
Common anti-patterns:
-
Making changes to your standard security controls manually, through a web console or command-line interface.
-
Relying on individual workload teams to manually implement the controls a central team defines.
-
Relying on a central security team to deploy workload-level controls at the request of a workload team.
-
Allowing the same individuals or teams to develop, test, and deploy security control automation scripts without proper separation of duties or checks and balances.
Benefits of establishing this best practice: Using templates to define your standard security controls allows you to track and compare changes over time using a version control system. Using automation to test and deploy changes creates standardization and predictability, increasing the chances of a successful deployment and reducing manual repetitive tasks. Providing a self-serve mechanism for workload teams to deploy approved services and configurations reduces the risk of misconfiguration and misuse. This also helps them to incorporate controls earlier in the development process.
Level of risk exposed if this best practice is not established: Medium
Implementation guidance
When following the practices described in SEC01-BP01 Separate workloads using accounts, you will end up with multiple AWS accounts for different environments that you manage using AWS Organizations. While each of these environments and workloads may need distinct security controls, you can standardize some security controls across your organization. Examples include integrating centralized identity providers, defining networks and firewalls, and configuring standard locations for storing and analyzing logs. In the same way you can use infrastructure as code (IaC) to apply the same rigor of application code development to infrastructure provisioning, you can use IaC to define and deploy your standard security controls as well.
Wherever possible, define your security controls in a declarative
way, such as in
AWS CloudFormation
You can also define templates to standardize defining and
deploying AWS accounts, services, and configurations. This
technique allows a central security team to manage these
definitions and provide them to workload teams through a
self-service approach. One way to achieve this is by using
Service Catalog
Implementation steps
-
Determine how you will store and maintain your templates in a version control system.
-
Create CI/CD pipelines to test and deploy your templates. Define tests to check for misconfigurations and that templates adhere to your company standards.
-
Build a catalog of standardized templates for workload teams to deploy AWS accounts and services according to your requirements.
-
Implement secure backup and recovery strategies for your control configurations, scripts, and related data.
Resources
Related best practices:
Related documents:
Related examples:
Related tools:
