</>Học Dev
Bài học

Tuần 7 - Ngày 3: Security Advanced

Tuần 7 – Ngày 3

Tuần 7 - Ngày 3: Security Advanced

1. AWS Security Services Overview

┌─────────────────────────────────────────────────────────┐│SECURITYSERVICES││││DETECTION:││├──GuardDuty(Threatdetection)││├──SecurityHub(Aggregatedfindings)││├──Inspector(Vulnerabilityscanning)││├──Macie(Sensitivedatadiscovery)││└──Detective(Securityinvestigation)││││PROTECTION:││├──WAF(WebApplicationFirewall)││├──Shield(DDoSprotection)││├──FirewallManager(Centralizedrules)││└──NetworkFirewall(VPC-levelfirewall)││││IDENTITY:││├──IAM(Users,Roles,Policies)││├──IAMIdentityCenter(SSO)││├──Cognito(Appauthentication)││└──DirectoryService(AD)││││DATAPROTECTION:││├──KMS(KeyManagement)││├──CloudHSM(HardwareSecurity)││├──SecretsManager(Secretsrotation)││└──CertificateManager(SSL/TLS)│└─────────────────────────────────────────────────────────┘

2. AWS KMS Deep Dive

┌─────────────────────────────────────────────────────────┐│AWSKMS││││KeyTypes:││├──AWSManagedKeys(aws/service-name)│││└──Automaticrotationyearly││├──CustomerManagedKeys(CMK)│││└──Optionalrotation(yearly)││└──AWSOwnedKeys││└──UsedinternallybyAWS││││KeyMaterialOrigin:││├──AWS_KMS(generatedinKMS)││├──EXTERNAL(importyourown)││└──AWS_CLOUDHSM(CloudHSMcluster)││││Multi-RegionKeys:││-Samekeymaterialinmultipleregions││-Simplifiescross-regionencryption││-Primary+Replicakeys│└─────────────────────────────────────────────────────────┘

3. Network Security Layers

┌─────────────────────────────────────────────────────────┐│DEFENSEINDEPTH││││Layer1:Edge││├──CloudFront+WAF││└──Shield(DDoS)││││Layer2:VPCPerimeter││├──NetworkFirewall││└──NATGateway││││Layer3:Subnet││└──NACL(stateless)││││Layer4:Instance││└──SecurityGroups(stateful)││││Layer5:Application││├──IAMRoles││└──Encryption│└─────────────────────────────────────────────────────────┘

4. AWS Network Firewall

┌─────────────────────────────────────────────────────────┐│AWSNETWORKFIREWALL││││Features:││-Statefulinspection││-IntrusionPrevention(IPS)││-Webfiltering││-Protocoldetection││││Integration:││┌───────────────────────────────────────────────────┐│││Internet│││││││││▼││││┌──────────────────┐│││││NetworkFirewall││││││(FirewallSubnet)│││││└────────┬─────────┘││││▼││││┌────────────────┐│││││NATGateway│││││└────────┬───────┘││││▼││││┌────────────────┐│││││PrivateSubnets│││││└────────────────┘│││└───────────────────────────────────────────────────┘│└─────────────────────────────────────────────────────────┘

5. Security Best Practices

1. Enable CloudTrail in all regions
2. Enable Config rules
3. Enable GuardDuty
4. Use Security Hub for aggregation
5. Encrypt everything (at rest and in transit)
6. Use IAM roles (not users) for applications
7. Enable MFA everywhere
8. Regular security assessments
9. Implement least privilege
10. Monitor and alert on security events

Tài liệu tham khảo chính thức

Ngày tiếp theo: Encryption và Compliance