The AWS Shared Security Responsibility Model in Practice

Editor's Notes

1. 12 regions as of today, 5 more on the way Ohio (USA), Montreal (Canada), UK, China, and India
2. geographically isolated and can help customers meet Data Locality requirements
3. 29 availability zones
4. AZs consist of 1 or more DCs clustered to make up an AZ Within a Region AZs are isolated on and highly available with multiple ISP/Power connections per AZ Typcially 2-3 AZs per region
5. 64 edge locations today
6. We define an “active customer” as non-Amazon customers who have account usage activity within the past month Scale and capacity matter. Every day, we add enough new server capacity to support Amazon.com when it was a $7B global enterprise.
7. AWS recognises that there are legal and regulatory directives around the location of data.
8. We look after the security OF the cloud, and you look after your security IN the cloud. Talk about: AWS Global Infrastructure – mention Environmental/Physical controls Foundational Services – logical controls Customers responsible for Operating System and Applications – however not every service provides the customer with visibility to the O.S or App Layer
9. We look after the security OF the cloud, and you look after your security IN the cloud.
10. Mention: O.S App development Protecting Data – Encryption Rest/Transit Customer IAM – local or corporate identity management system
11. Change in IAM RDS as an example Customer manages DB – DB Users etc AWS manages OS, Engine
12. Change in IAM S3 example Customers are responsible for controlling access to their data on S3 via AWS IAM Also responsible for creating/deleting the content
13. Talk about Customer Key Management
14. Quick re-cap on SRM
15. Refer to AWS part of Shared Responsibility Model On Prem: Audits usually done by an in-house team Typically done once a year Tend to be workload specific compliance checks Must keep pace and invest in security innovation On AWS: You start with a base of accredited services Audits are performed by 3rd party experts Accountable to everone Security Innovation drives broad compliance Leads into Audit rights discussion: ------------------------------------ (FINRA – example on-prem vs aws) Anonymize finra
16. Own your own accreditation Own your own certifications Own your own external audits Essentially – just because AWS is certified against PCI-DSS, customers still need to work with a QSA to ensure that from the 12 requirements of PCI – which the customer is still responsible for based on the shared responsibility models to assist the customer in becoming accredited in running PCI workloads on top of AWS
17. This leads into a program called GoldBase Talk about Launch Constraints – Leveraging an IAM Role to perform Launch for User Talk about Template Constraints – limiting VPCs, Instance Types etc
18. Talk about packages being developed