AWS for Cloud Computing

Module 4- AWS Security and

Compliance
Module 4-AWS Security and Compliance
• AWS Identity and Access Management (IAM),
• AWS Shared Responsibility Model in Security,
• AWS Key Management Service (KMS),
• AWS Inspector,
• AWS Organizations,
• AWS Trusted Advisor,
• Compliance on AWS.
AWS Key Management Service (KMS)
Introduction KMS
• AWS KMS is a safe and resilient service that uses hardware security protocols
that are tested or are in the process of being tested to protect our keys.
• AWS Key Management Service provides a highly available key storage,
management, and auditing solution for you to encrypt data within your own
applications and control the encryption of stored data across AWS services.
 AWS Key Management Service (KMS)
• It is a secure and reliable service that helps you manage and protect
encryption keys.
• It makes sure your keys are stored safely, always available when
needed, and tracked for auditing.
• You can use these keys to encrypt your own application data or to
control how data is encrypted in other AWS services.
 Example: Online Shopping Website
• Imagine you run an online shopping website.
Customers enter sensitive data such as:
• Credit card details
• Personal addresses
• Login passwords
• You need to keep this data safe.
 Example: Online Shopping Website
Without KMS:
• You would have to build your own system to create,
store, rotate (update), and protect encryption keys.
• If hackers or even employees got access to those keys,
customer data could be stolen.
 Example: Online Shopping Website
• With AWS KMS:
• AWS creates and securely stores your encryption keys inside special,
tamper-proof hardware.
• Your database (e.g., Amazon RDS) or storage (e.g., Amazon S3)
automatically asks KMS for permission whenever it needs to encrypt
or decrypt customer data.
• You control who can use which key (e.g., only the payments team can
use the “CreditCardKey”).
• Every use of a key is logged, so you know when, where, and by whom
a key was used.
 AWS Key Management Service (KMS)
• our customer data stays encrypted, your team
doesn’t need to directly handle keys, and you
meet security and compliance requirements
easily.
Introduction KMS

• It is a managed service provided by Amazon Web Services (AWS) that allows

companies to create, control and manage the cryptographic
keys that encrypt and protect their data.
• With AWS KMS, organizations get a world-class key storage, management
and auditing system that makes it easy to control the encryption of data stored
across their AWS services.
• As the name suggests, AWS KMS is an encryption and key management
service scaled for use in the AWS cloud.
• Organizations can use the encryption keys and functionality provided by
AWS KMS to protect data in all their applications that use AWS. The service
can also generate data keys that can be used outside of AWS
KMS. Symmetric and asymmetric KMS keys can be generated for encryption
and signing using AWS KMS.
 AWS Key Management Service (KMS)
A tool in AWS that helps companies:
• Create, store, and protect encryption keys (special
codes that lock and unlock data).
• Control who can use the keys to keep data safe.
• Keep records (auditing) of when and how keys are
used.
 AWS Key Management Service (KMS)
• It works across many AWS services (like S3, RDS, EBS),
so you don’t need to build your own security system.
• KMS can also create data keys that you can use
outside AWS if needed.
• It supports both symmetric keys (same key to
lock/unlock) and asymmetric keys (different keys for
locking and unlocking, like public/private key pairs).
 Real-World Example: Hospital Records
A hospital stores patient reports in Amazon S3.
• With KMS, the hospital creates a key called
PatientDataKey.
• Every time a report is uploaded, S3 automatically
asks KMS to encrypt it using that key.
 Real-World Example: Hospital Records
• When a doctor wants to see a report, S3 again
checks with KMS to decrypt it.
• The hospital admin sets rules: only doctors can
use PatientDataKey, not receptionists.
• KMS logs every time the key is used, so the
hospital knows who accessed patient data.
Introduction KMS
• A symmetric encryption KMS key
is the most used type of KMS key.
It never leaves AWS KMS
unencrypted and is created by
default when a user creates an AWS
KMS key. The same key is used for
encryption and decryption.
• An asymmetric encryption KMS
key represents a mathematically
related public key and private key
pair. The private key never leaves
AWS KMS unencrypted and to use
it, the user must call AWS KMS.
The public key can be used within
AWS KMS by calling the AWS
KMS API operations.
 Symmetric KMS Key (Most Common)
• How it works: The same key is used to lock (encrypt)
and unlock (decrypt) data.
• Security: The key never leaves AWS KMS; AWS
services (like S3, RDS, EBS) call KMS whenever
encryption or decryption is needed.
• Use case: Best for large-scale data encryption.
 Symmetric KMS Key (Most Common) -
Example
• A company stores customer invoices in Amazon S3.
• They use a symmetric KMS key.
• When uploading, the invoice file is encrypted with this
key.
• When downloading, the same key decrypts it.
The company doesn’t see or handle the key — AWS
KMS manages it.
 Asymmetric KMS Key (Public & Private Pair)

•How it works: Two linked keys are created:

•Public key → can be shared and used to encrypt data or verify
signatures.
•Private key → kept secret in KMS, used to decrypt data or create
signatures.
•Security: The private key never leaves KMS; you must call the KMS
API to use it.
•Use case: Best for digital signatures, authentication, or when keys
need to be shared externally.
 Asymmetric KMS Key - Example
• A bank uses asymmetric keys for customer
transactions.
• The public key is shared with customers so they can
encrypt their transaction requests.
• The encrypted request is sent to the bank.
• The bank’s systems call KMS to use the private key to
decrypt the request securely.
• Symmetric key = one key for both encrypt &
decrypt (faster, used for general data storage).
• Asymmetric key = two keys (public/private) for
special cases like signatures and secure
communications.
Example KMS

• Let’s imagine that your database server was hacked, hackers got get right
of entry to all the sensitive information about your consumer and the
business.
• If your records are closing as plain text hackers can do what they want
with this information. But your information is encrypted already hackers
will have a difficult time decrypting your database statistics. There are
main techniques of encryption: purchaser-aspect encryption and server-
aspect encryption.
• In client-side encryption, you may encrypt your information and manage
your keys. You can use KMS for it if required. Next in the server-aspect
encryption your server Amazon Web Services (AWS) will encrypt your
information and manage the key for you. Most of the AWS services
like EBS, and S3 offer this server-side encryption with the help of KMS.
Example- symmetric encryption KMS key
Features of AWS KMS
• It is an easy way to control and access your data using
managed encryption.
• With AWS Key Management Service, the process of key
management is reduced to a few simple clicks.
• It is also integrated with other AWS services
including Amazon EBS, Amazon S3, and Amazon RedShift to
simplify the encryption of your data within these services.
• AWS KMS enables you to create, rotate, disable, enable, and
define usage policies for master keys and audit their usage.
• It is a centralized key management
 Features of AWS KMS
• AWS Key Management Service (KMS) is an easy
way to protect and control your data using
encryption keys, without dealing with complex
security setups.
 Features of AWS KMS
• You can create, rotate, disable, enable, and set rules
for your encryption keys.
• All key usage is audited, so you know who used the
keys and [Link] is integrated with AWS services
like S3, EBS, and Redshift, making it simple to encrypt
data in these services.
• It acts as a centralized place to manage all your keys,
so you don’t have to manage them separately for each
service.
 Example: Photo Storage App
• A photo storage app keeps users’ pictures in Amazon S3:
• Upload: When a user uploads a photo, S3 uses a KMS key to encrypt
it automatically.
• Download: When the user wants to view it, S3 calls KMS to decrypt
the photo.
• Central control: The admin can disable the key if needed, rotate it
periodically, or check logs to see who accessed photos.
Result: The app’s data is secure, key management is simple, and
everything is centralized in KMS.
 Advantages of AWS KMS
• Fully Managed: You control who can use the keys, and AWS takes
care of storing and protecting them safely.
• Centralized Key Management: KMS gives you a single place to
manage all your keys and set rules across AWS services and your
own apps.
• Integrated with AWS Services: KMS works directly with services
like S3, EBS, and Redshift, making it easy to encrypt data
automatically.
• Encrypt in Your Applications: You can use simple APIs or the AWS
SDK to encrypt data within your own apps, wherever they run.
 Advantages of AWS KMS
• Digital Signing: KMS lets you create digital signatures using
asymmetric keys to verify data integrity.
• Low Cost: Using KMS itself is free; you pay only when you
use or manage keys beyond the free tier.
• Secure: KMS uses validated hardware (FIPS 140-2 certified)
to protect keys.
• Keys never leave these secure devices unencrypted and stay
within the AWS region where they were created.
 Example: Financial App
• A mobile banking app uses KMS to:
• Encrypt customer transactions in S3.
• Sign sensitive documents to ensure they aren’t tampered
with.
• Let only authorized staff access keys, while AWS handles key
security.
• Result: Encryption is simple, secure, centralized, and
integrated with apps and AWS services.
 Advantages of AWS KMS
• Fully Managed: You access the encrypted data by assigning permissions to use the keys while
AWS Key Management Service deals with the long-lasting and physical security of your keys,
hence enforcing your permissions.
• Centralized Key Management: AWS KMS provides a single point and defines policies
continuously across AWS services and also your own applications.
• Manage Encryption for AWS Service: AWS KMS is integrated with AWS services to simplify the
encryption of data.
• Encrypt Data In your Applications: Using simple APIs you can also build encryption and key
management into your own applications wherever they run. Using AWS SDK you can encrypt
data locally within your application.
• Digitally Sign Data: To maintain the integrity of your data, AWS Key Management Service
enables you to perform digital signing using asymmetric key pairs.
• 6. Low Cost: As such there are no charges to use AWS Key Management Service. You are only
charged when you use or manage the keys beyond the free tier.
• 7. Secure: AWS KMS uses hardware security modules that have been validated under FIPS
140-2(Federal Information Processing Standard Publication) or are in the process of being
validated, to generate and protect keys. Your keys are only used inside these devices and can
never leave them unencrypted. KMS keys are never shared outside the AWS region in which
they were created.
 Advantages of AWS KMS
• Fully Managed: You access the encrypted data by assigning permissions to use the keys while
AWS Key Management Service deals with the long-lasting and physical security of your keys,
hence enforcing your permissions.
• Centralized Key Management: AWS KMS provides a single point and defines policies
continuously across AWS services and also your own applications.
• Manage Encryption for AWS Service: AWS KMS is integrated with AWS services to simplify the
encryption of data.
• Encrypt Data In your Applications: Using simple APIs you can also build encryption and key
management into your own applications wherever they run. Using AWS SDK you can encrypt
data locally within your application.
• Digitally Sign Data: To maintain the integrity of your data, AWS Key Management Service
enables you to perform digital signing using asymmetric key pairs.
• 6. Low Cost: As such there are no charges to use AWS Key Management Service. You are only
charged when you use or manage the keys beyond the free tier.
• 7. Secure: AWS KMS uses hardware security modules that have been validated under FIPS
140-2(Federal Information Processing Standard Publication) or are in the process of being
validated, to generate and protect keys. Your keys are only used inside these devices and can
never leave them unencrypted. KMS keys are never shared outside the AWS region in which
they were created.
AWS Inspector
 Introduction
• Amazon Inspector is an automated security assessment service to
test the network accessibility of EC2 instances. It helps you to
identify vulnerabilities within your EC2 instances and
applications. And allows you to make security testing more
regular occurrence as part of the development and IT operations.
• Amazon Inspector provides a clear list of security and compliance
findings assigned a priority by the severity level. Moreover, these
findings can be analyzed directly or as part of comprehensive
assessment records available via the API or AWS Inspector
console. AWS Inspector security assessments help you check for
unintended network accessibility of EC2 instances and
vulnerabilities on those EC2 instances.
Benefits of AWS Inspector
• Automated Service: AWS Inspector is a beneficial service for the application’s security
in the AWS cloud. It can fix automatically without the interaction of human resources.
• Regular Security Monitoring: Amazon Inspector helps to find security vulnerabilities
in applications, as well as departures from security best practices, both before they’ve
been deployed or running in production. This improves the overall security of your
AWS-hosted applications.
• Leverage Aws Security Expertise: AWS Inspector includes a knowledge base of the
number of rules charted to common security best practices and vulnerability
definitions. It uses AWS’s Security Expertise, where AWS is constantly updating the
security best practices and rules, so one gets the best of both worlds.
• Integrate Security Into DevOps: AWS Inspector is an API-bound service that analyzes
network configurations in your AWS account. Moreover, it uses an optional agent for
visibility into EC2 instances. The agent makes it easy to build Inspector assessments
right into your existing DevOps process and empowers both development and
operations teams to make security assessments an essential part of the deployment
process.
• Network reachability price package regulations: Assessments performed by
Amazon Inspector Classic that include network reachability rules are priced
per instance per assessment (instance assessment) per month. One instance
assessment is one that you perform against one instance. Ten instance
assessments will result from doing one assessment against ten instances.
With bulk reductions, pricing can be lowered to $0.04 per instance assessment
per month from the starting price of $0.15 per instance assessment per
month.
• Package prices for host assessment rules: The host assessment rules packages
for Amazon Inspector Classic employ an agent that is deployed on the Amazon
EC2 Instances running the apps you want to evaluate. Each month, host
rules assessments (sometimes known as “agent assessments”) are charged per
agent. A single-agent assessment is one that is performed against a single
agent. Ten agent assessments will result from running one assessment
against ten agents. With volume reductions, pricing can be lowered to as little
as $0.05 per agent assessment per month from the starting price of $0.30 per
agent assessment per month.
 How Amazon Inspector Works?
Amazon Inspector performs an
automatic assessment and
generates a findings report
containing steps to keep the
environment safe. To use this
service, you need to define the
collection of AWS and all the
resources that complete the
application to proceed and
tested. It is followed by adding
and performing security
practices. You can also set the
duration of that assessment
which can vary from 15 Min to
12 Hrs or last for one day.
Features
Configuration scanning and activity monitoring engine
• Amazon Inspector gives an agent that examines system and resource
configuration. It additionally screens movement to figure out what an
evaluation target resembles, how it carries on, and its needy segments. The
combination of this telemetry gives a total image of the objective and its
possible security or consistent issues.
Built-in content library
• Amazon Inspector incorporates an inherent library of rules and reports. These
incorporate checks against best practices, common compliance standards, and
vulnerabilities. The checks incorporate point by point suggested ventures for
settling potential security issues.
Automation through an API
• Amazon Inspector can be completely mechanized through an API. This
permits you to consolidate security testing into the turn of events and
configuration process, including choosing, executing, and announcing the
consequences of those tests.