Back to Course

Introduction to AWS Security

0% Complete
0/0 Steps
  1. Introduction

    About the course and authors
  2. AWS cloud architecture
  3. Security concerns with our architecture
  4. Regions and Availability Zones (AZs)
  5. Shared responsibility in the cloud
  6. [Cheat Sheet] AWS Security Services
  7. [LAB] Create a billing alert to avoid surprise bills
  8. Infrastructure Security
    VPC networks
  9. Default VPCs
  10. [DEMO] Creating VPCs and Subnets
  11. How many VPCs should you use?
  12. [DEMO] Subnet, Route Table, and Gateway Configurations
  13. [LAB] [Challenge] Create a VPC with public and private subnets
  14. [DEMO] Security Groups (SGs)
  15. Security Groups Best Practices
  16. [DEMO] Network Access Control Lists (NACLs)
  17. [Cheat Sheet] SGs vs. NACLs
  18. [LAB] [Challenge] Configure security groups and NACLs to specific requirements
  19. Elastic Load Balancers
  20. [DEMO] AWS WAF
  21. [LAB] [Challenge] Deploy AWS WAF ACL for Application Load Balancer
  22. [DEMO] AWS Network Firewall - Part 1
  23. [DEMO] AWS Network Firewall - Part 2
  24. AWS Shield for DDoS Protection
  25. AWS Firewall Manager
  26. Identity and Access Management (IAM)
    Key Concepts of IAM in AWS
  27. [DEMO] Getting started with IAM in AWS
  28. [DEMO] Creating our first admin user
  29. Assigning permissions with policies
  30. [Cheat Sheet] Anatomy of an AWS IAM Policy
  31. [DEMO] Using Identity Center AWS SSO
  32. IAM Roles
  33. [DEMO] Creating a role for EC2 instances to access S3 buckets
  34. End-User Management with Amazon Cognito
  35. Data Protection
    Data protection in the cloud
  36. EBS Data Protection and Encryption
  37. Amazon RDS Data Protection and Encryption
  38. Key Management with AWS KMS
  39. [DEMO] Creating a Symmetric Encryption KMS Key
  40. Amazon S3 Bucket Protection
    Understanding Bucket Ownership
  41. Managing Access to Buckets
  42. [Cheat Sheet] S3 Bucket Policies vs. ACLs vs. IAM Policies
  43. [LAB] [Challenge] Create an IAM role for secure access to S3 based on a scenario
  44. Using Signed URLs
  45. Encrypting S3 Data
  46. [DEMO] Enable S3 Object Versioning
  47. [Cheat Sheet] Amazon S3 Protection Summary
  48. [Cheat Sheet] Create a least privilege S3 bucket policy
  49. Logging, Monitoring, and Incident Response
    AWS Log Types and Auditing Options
  50. [DEMO] Enable S3 Server Access Logs
  51. AWS CloudTrail
  52. Amazon CloudWatch
  53. [DEMO] CloudTrail Security Automation with CloudWatch Logs and SNS
  54. [DEMO] Amazon VPC Flow Logs
  55. Proper Logging and Monitoring
  56. Amazon GuardDuty
  57. [LAB] [DEMO] Enable Threat Detection with GuardDuty
  58. [DEMO] Amazon EventBridge
  59. AWS Config
  60. AWS Systems Manager
  61. [DEMO] AWS Config Automated Remediation with SSM
  62. Amazon Detective
  63. [LAB] [DEMO] Amazon Inspector
  64. [DEMO] Amazon Macie
  65. [DEMO] AWS Security Hub
  66. [DEMO] Must-have AWS monitoring and alerting with SSK
  67. Multi-Account Security
    [DEMO] AWS Organizations
  68. [DEMO] AWS SCPs and Management Policies
  69. AWS Control Tower
  70. Wrap-up and Key Takeaways
    What now?
Lesson 2 of 70
In Progress

AWS cloud architecture

Christophe October 18, 2022

Access the interactive diagram for this lesson here. (It may ask you to create a free account in order to view. You do not need paid features to view this course’s content so you can ignore that!)

Let’s take a look at what a typical AWS cloud architecture would look like.

Here we have the AWS cloud represented as a rectangle. Think of this as the space where we can launch AWS resources from within our own AWS accounts.

The main building block of AWS is called the Virtual Private Cloud, or VPC, which we’ll show as this big green rectangle in our diagram.

When you first create an AWS account and log in, AWS creates what’s called a “Default VPC” on your behalf. They do this to make it easier for everyone to create resources without having to spend a lot of time and effort into creating their own custom VPCs.

However, Default VPCs have very limited uses and most users will quickly grow out of them, which is why it’s important to understand how VPC networks work, and that’s going to be our first technical topic that we cover in this course.

Within a VPC, we can launch all kinds of resources. Not all AWS resources get launched in VPCs as we’ll see shortly, but many do.

For example, if we want to launch a cloud instance, known as an EC2 instance, we would launch that instance within our VPC.

However, to be able to do that, we first have to create sub networks, or subnets, within our VPC.

These subnets are multi-purpose, but overall, they help create logical network segmentation — this is similar to if you were to take network switches and create multiple separate networks with those switches. Segmentation like this is super helpful for a number of reasons:

  1. They provide a level of security — we can place private resources in private subnets that can’t be accessed from the open Internet, and completely control what traffic is allowed to flow in and out of these private subnets
  2. They help organize resources — by creating multiple different subnets, we can designate subnets to have specific purposes. For example, we could have a subnet dedicated to hosting databases, another subnet dedicated to hosting application servers, and another for web servers

There can also be resources that we can launch within our VPCs but that don’t need to be within one specific subnet, such as Amazon EFS which provides shared storage, Amazon ElastiCache which provides caching for applications, or even something like an Elastic Load Balancer, or ELB, which distributes traffic and load between instances.

Then, we can also create resources that don’t reside within a VPC, but that still live within the AWS cloud.

For example, we may need to have a storage service like Amazon S3 to store static files and backups.

We may need a Content Distribution Network, or CDN, such as Amazon CloudFront to sit in front of our web applications.

We may also want to deploy firewalls in front of our VPC and instances, such as the AWS WAF, or Web Application Firewall, and a DDoS protection service called AWS Shield.

Finally, we need a way of routing requests to and from the open Internet, which means we may want to use Amazon Route 53, which is their DNS service.

I’m sure this seems like a lot, especially if you’re new to AWS, but don’t let it overwhelm you. The reason we are starting out by showing a diagram and architecture like this is because this course is going to cover security aspects that cover each and every one of these layers, but we’re going to take it one step at a time.

By the time we are done with this course, you’ll be able to come back to this diagram and not only understand what’s going on, but also how to look at this from a security perspective, and how to apply it to your own architecture and environments.

Speaking of, let’s complete this lesson, and let’s move on to the next where we’ll talk about security concerns with this architecture.


Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.