Data Encryption: AWS enables encryption of data both in transit and at rest. For data in transit, SSL/TLS is enabled for all AWS API requests. For data at rest, services like Amazon EBS and Amazon S3 support server-side encryption using AES-256. Customers can also manage their own encryption of data stored in AWS services.
Identity and Access Management (IAM): IAM allows creation of individual accounts and fine-grained access permissions for individuals or applications to only perform authorized actions. Authentication is enforced at the API level through signature version 4 signing process. Policies can be attached to users, groups and roles to control what resources they can access and the level of access. IAM enables integration with existing identity systems through SAML 2.0 and OpenID Connect.
Monitoring and Auditing: Detailed logging is enabled by default for all AWS API activity at granular level down to individual API calls and their parameters. CloudTrail service collects API activity logs from across all AWS regions and makes them available for monitoring, forensic analysis, and policy evaluation. Config service tracks configuration changes to resources and notifies customers of any changes that can impact compliance or security posture.
Network Security: Firewalls, security groups, network ACLs and WAFs provide network security controls. Security groups act as virtual firewall at the instance level, network ACLs filter traffic between subnets/Vpcs. WAFs protect web applications from common exploits and vulnerabilities. Direct internet access to EC2 instances is prevented by default. Access requires going through Load Balancers or application proxies which are exposed to internet.
Infrastructure Security: AWS infrastructure is isolated and segmented. Services and resource instances are deployed across multiple, isolated Availability Zones within a Region with their own independent power, network and physical security. Regions are isolated from each other with minimal connectivity required between them, providing greater fault tolerance. Physical security controls include – badge access, biometric recognition systems, video surveillance, intrusion detection systems etc. Strict protocols are followed for hardware and software delivery and maintenance.
Incident response: Detailed incident response plans, automated response procedures and regular DR exercises ensure availability of services. Postmortem reviews following incidents help improve security controls. The AWS security team stays up to date on the latest threats through direct information sharing with customers, research groups and other providers
Operational Best Practices: Guidelines provided through AWS Compliance Programs help customers achieve security and compliance standards like PCI DSS Level 1, FedRAMP Moderate, HIPAA, SOC 1/SOC 2/SOC 3. CIS benchmarks provide security configuration recommendations. Well-Architected Framework helps build secure and reliable systems. Automation tools like CloudFormation enables confidential infrastructure as code.
Service Specific Security: Features like S3 Vault lock for sensitive data access, secrets management through Secrets Manager, database security through VPC endpoints, fine grained IAM policies improve security of individual services.Encryption, authentication and authorization is enforced at the service level and vulnerabilities are addressed through regular patching and updates.
Third Party Assessment & Validation: AWS undergoes regular external audits and assessments by third parties like independent auditors under SOC, PCI, and FedRAMP programs to validate security controls. Penetration tests also help identify vulnerabilities. Attestations and certifications provide customers with confidence in AWS security posture.
AWS implements a defense-in-depth approach to security spanning people, processes and technologies. Strong identity and access management, encryption, monitoring capabilities, infrastructure segmentation, incident response plans and compliance help secure the cloud platform and assist customers in building and operating secure systems on AWS. Regular reviews and third party validations further strengthen the security control environment. Together, these measures provide customers with industryleading security to deploy applications and run their workloads securely on AWS. AWS security capabilities enable customers to focus on their applications rather than the underlying infrastructure security issues.