December 2017
Intermediate to advanced
410 pages
11h 5m
English
Tracking firewall configuration changes with associated alarms is important. Many times the system administrator inserts the rule of 0.0.0.0/0 to make things work the easy way.
This is the reason why reviewing firewall configuration changes every three months is necessary. Many times, in a span of three months, you might find a lot of newly added rules, and no one knows how they came into the firewall.
AWS allows you to track changes made to its environment, including that of security groups via its auditing service CloudTrail. This is a sample rule to monitor any changes to the security group:
{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName ...Read now
Unlock full access