book

AWS Security Cookbook - Second Edition

Name: AWS Security Cookbook - Second Edition
Author: Heartin Kanikathottu
ISBN: 9781835081891

by Heartin Kanikathottu

October 2024

Intermediate to advanced

428 pages

10h 29m

English

Packt Publishing

Read now

Unlock full access

AWS Security Cookbook
Contributors
About the author
About the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesCode in ActionConventions usedSectionsGetting readyHow to do it…How it works…There’s more…See alsoGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Chapter 1: Setting Up AWS Accounts and Organization
Technical requirementsSetting up IAM, account aliases, and billing alertsGetting readyHow to do it...How it works...There’s more...See alsoMulti-account management with AWS OrganizationsGetting readyHow to do it...How it works...There’s more...See alsoUser management and SSO with IAM Identity CenterGetting readyHow to do it...How it works...There’s more...See also
Chapter 2: Access Management with IAM Policies and Roles
Technical requirementsCreating a customer-managed IAM policyGetting readyHow to do it...How it works...There’s more...See alsoUsing policy variables within IAM policiesGetting readyHow to do it...How it works...There’s moreSee alsoCreating customer-managed policies in IAM Identity CenterGetting readyHow to do it...How it works...There’s more...See alsoSetting IAM permission boundaries for IAM entitiesGetting readyHow to do it...How it works...There’s more...See alsoCentralizing governance in AWS Organizations with SCPsGetting readyHow to do it...How it works...There’s more...See alsoIAM cross-account role switching and identity account architectureGetting readyHow to do it...How it works...There’s more...See alsoCross-service access via IAM roles on EC2 instancesGetting readyHow to do it...How it works...There’s more...See also
Chapter 3: Key Management with KMS and CloudHSM
Technical requirementsCreating keys in KMSGetting readyHow to do it...How it works...There’s more...See alsoCreating keys with external key material (BYOK)Getting readyHow to do it...How it works...There’s more...See alsoRotating keys in KMSGetting readyHow to do it...How it works...There’s more...See alsoGranting permissions programmatically with grantsGetting readyHow to do it...How it works...There’s more...See alsoUsing key policies with conditional keysGetting readyHow to do it...How it works...There’s more...See alsoSharing customer-managed keys across accountsGetting readyHow to do it...How it works...There’s more...See alsoCreating, initializing, and activating a CloudHSM clusterGetting readyHow to do it...How it works...There’s more...See also
Chapter 4: Securing Data on S3 with Policies and Techniques
Technical requirementsCreating an S3 bucket policyGetting readyHow to do it...How it works...There’s more...See alsoWorking with S3 ACLsGetting readyHow to do it...How it works...There’s more...See alsoCreating S3 presigned URLsGetting readyHow to do it...How it works...There’s more...See alsoProtecting files with S3 versioning and object lockingGetting readyHow to do it...How it works...There’s more...See alsoEncrypting data on S3Getting readyHow to do it...How it works...There’s more...See also
Chapter 5: Network and EC2 Security with VPCs
Technical requirementsSetting up VPC plus VPC resources with minimal effortGetting readyHow to do it...How it works...There’s more...See alsoCreating a bare VPC and setting up public and private subnetsGetting readyHow to do it...How it works...There’s more...See alsoLaunching an EC2 instance with a web server using user dataGetting readyHow to do it...How it works...There’s more...See alsoCreating and configuring security groupsGetting readyHow to do it...How it works...There’s more...See alsoWorking with NACLsGetting readyHow to do it...How it works...There’s more...See alsoUsing a VPC gateway endpoint to connect to S3Getting readyHow to do it...How it works...There’s more...See alsoConfiguring and using VPC flow logsGetting readyHow to do it...How it works...There’s more...See alsoSetting up and configuring NAT gatewaysGetting readyHow to do it...How it works...There’s more...See also
Chapter 6: Web Security Using Certificates, CDNs, and Firewalls
Technical requirementsEnabling HTTPS for a web server on an EC2 instanceGetting readyHow to do it...How it works...There’s more...See alsoCreating an SSL/TLS certificate with ACMGetting readyHow to do it...How it works...There’s more...See alsoCreating ELB target groupsGetting readyHow to do it...How it works...There’s more...See alsoUsing an application load balancer with TLS termination at the ELBGetting readyHow to do it...How it works...There’s more...See alsoUsing a network load balancer with TLS termination at EC2Getting readyHow to do it...How it works...There’s more...See alsoSecuring S3 using CloudFront and TLSGetting readyHow to do it...How it works...There’s more...See alsoUsing a WAFGetting readyHow to do it...How it works...There’s more...See also

Chapter 7: Monitoring with CloudWatch, CloudTrail, and Config
Technical requirementsCreating an SNS topic to send emailsGetting readyHow to do it...How it works...There’s more...See alsoWorking with CloudWatch alarms and metricsGetting readyHow to do it...How it works...There’s more...See alsoCreating a CloudWatch log groupGetting readyHow to do it...How it works...There’s more...See alsoWorking with EventBridge (previously CloudWatch Events)Getting readyHow to do it...How it works...There’s more...See alsoReading and filtering logs in CloudTrailGetting readyHow to do it...How it works...There’s more...See alsoCreating a trail in CloudTrailGetting readyHow to do it...How it works...There’s more...See alsoUsing Athena to query CloudTrail logs in S3Getting readyHow to do it...How it works...There’s more...See alsoIntegrating CloudWatch with CloudTrail making use of a CloudFormation templateGetting readyHow to do it...How it works...There’s more...See alsoSetting up and using AWS ConfigGetting readyHow to do it...How it works...There’s more...See also
Chapter 8: Compliance with GuardDuty, Macie, Inspector, and Analyzer
Technical requirementsSetting up and using Amazon GuardDutyGetting readyHow to do it...How it works...There’s more...See alsoAggregating findings from multiple accounts in GuardDutyGetting readyHow to do it...How it works...There’s more...See alsoSetting up and using Amazon MacieGetting readyHow to do it...How it works...There’s more...See alsoSetting up and using Amazon InspectorGetting readyHow to do it...How it works...There’s more...See alsoSetting up and using AWS Security HubGetting readyHow to do it...How it works...There’s more...See alsoUsing IAM Access Analyzer to inspect unused accessGetting readyHow to do it...How it works...There’s more...See also
Chapter 9: Advanced Identity and Directory Management
Technical requirementsWorking with Amazon Cognito user poolsGetting readyHow to do it...How it works...There’s more...See alsoUsing identity pools to access AWS resourcesGetting readyHow to do it...How it works...There’s more...See alsoUsing AWS Simple AD for creating a lightweight directory solutionGetting readyHow to do it...How it works...There’s more...See alsoUsing Microsoft Entra ID as the identity provider within AWSGetting readyHow to do it...How it works...There’s more...See also
Chapter 10: Additional Services and Practices for AWS Security
Technical requirementsSetting up and using AWS RAMGetting readyHow to do it...How it works...There’s more...See alsoStoring sensitive data with the Systems Manager Parameter StoreGetting readyHow to do it...How it works...There’s more...See alsoUsing AWS Secrets Manager to manage RDS credentialsGetting readyHow to do it...How it works...There’s more...See alsoCreating an AMI instead of using EC2 user dataGetting readyHow to do it...How it works...There’s more...See alsoUsing security products from AWS MarketplaceGetting ready...How to do it...How it works...There’s more...See alsoUsing AWS Trusted Advisor for recommendationsGetting readyHow to do it...How it works...There’s more...See alsoUsing AWS Artifact for compliance reportsGetting readyHow to do it...How it works...There’s more...See also
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Overview

AWS Security Cookbook is your hands-on guide to mastering security in the AWS cloud. This book provides practical recipes that help you set up and maintain secure AWS environments, manage identities, protect data, and ensure compliance with industry standards. Whether you're enhancing your AWS architecture or preparing for the AWS Certified Security exam, this book has valuable insights for you.

What this Book will help me do

Understand the essentials of AWS security including resource isolation and user management.
Secure applications and data with encryption, identity policies, and secure VPC configurations.
Use AWS monitoring tools like CloudTrail and GuardDuty to ensure infrastructure compliance.
Implement advanced identity management solutions with services like Cognito and external providers.
Prepare effectively for the AWS Certified Security - Specialty exam by mastering key topics.

Author(s)

Heartin Kanikathottu, the author of this book, is an experienced cloud security professional and an expert in designing secure applications on AWS. With a strong technical background and a deep understanding of AWS services, Heartin shares practical knowledge and industry-standard practices to help readers navigate the intricacies of AWS security confidently.

Who is it for?

This book is perfect for IT security professionals, cloud architects, and application developers focusing on cloud security. If your goal is to manage secure deployments in AWS or gain the AWS Security certification, this book provides the expertise you need. A basic understanding of AWS and cloud computing concepts is recommended.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781835081891

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills