- Now let's review a few other security services
such as Amazon Macie,
Amazon Guard Duty
and Amazon Inspector.
Now Amazon Macie is a service
that can automatically discover, classify and protect
sensitive data within AWS.
This data could be things such as
personally identifiable information, PII.
Could be protected health information, PHI.
Could be intellectual property or
other types of sensitive information.
And Amazon Macie leverages machine learning
to automatically learn what types of information
are deemed to be sensitive
and learns the type of patterns that
are happening within your account.
Amazon Macie will then proactively inform you
as to where that data is stored
and how that data is being used.
And so
Amazon Macie
is really useful in those cases
where perhaps you do have a larger organization.
You have a lot of people using AWS resources
and maybe you have a number of S3 Buckets
and a lot of data moving around.
And as we've seen over the years,
we've seen plenty of articles
where companies have sort of gotten in trouble
because they made sensitive data publicly available.
Or they made sensitive data,
if not publicly available,
they made it available to people
who should not have had access to it.
And so Amazon Macie is a service
that can help us discover those kinds of things.
Perhaps we inadvertently made a misconfiguration
in our policies that allowed sensitive information
to be accessed by unauthorized parties.
And so again, Amazon Macie is an ideal service to turn on,
to inform us as to whether or not we do have
sensitive information that's being accessed inappropriately.
And so Amazon Macie can again proactively alert us
to suspicious activity
and it's worth noting that,
as of the time of this video recording,
Amazon Macie currently supports Amazon S3.
But according to Amazon's website and documentation,
other data stores are being worked on,
and so I do expect that Amazon Macie
will support other data stores
such as DynamoDB or Redshift or so on
in the future.
But as of the time of this video
we don't have a date on that.
Another thing worth noting about Amazon Macie is that
it does leverage natural language processing.
And it is currently optimized for English.
It does support a number of languages
but it's optimized for English,
and so I also suspect
that other languages will be optimized in the future.
But again, as of the time of this video
it's currently optimized only for English.
Now with Amazon GuardDuty we have a fully managed
threat detection service.
GuardDuty will continuously monitor our environment
for malicious or unauthorized behavior,
such as
attempts to gain access
to the API-using credentials, compromised credentials,
or gaining access to EC2 instances over the network.
And so Amazon GuardDuty
can automatically continuously analyze
billions of events from a number of different sources,
such as CloudTrail.
Remember that CloudTrail is the service
that records API calls.
And so, if GuardDuty is seeing
a number of API calls
that are outside of a normal pattern,
then that might indicate some type of malicious activity.
It might see that
certain credentials are being used
for things that they are not normally used for.
Or that a certain set of credentials
are trying different things.
One attack may be just to try different things
to see what's gonna be found.
So those kinds of patterns can be detected by GuardDuty.
GuardDuty can also analyze VPC flow logs.
VPC flow logs are logs that record metadata
about network traffic flowing through our VPCs.
And so VPC flow logs will contain things like
source and destination IPs and ports.
It will contain whether or not the protocol
whether it's TCP or UDP, things like that.
So GuardDuty can look at VPC flow logs
to try to indentify
some type of malicious
or unauthorized network traffic.
GuardDuty will also look at DNS logs.
And so we can look at DNS logs from route 53
to determine, to see if perhaps someone is trying
to find sub domains that they shouldn't be accessing,
just as one example.
And so Amazon GuardDuty can aggregate
this kind of threat detection across multiple accounts.
We don't necessarily have to turn this on
for every account.
We can turn it on for our organization
and GuardDuty can look at all of our accounts.
Another nice things about GuardDuty is that
there is no software to install.
There's no agent that needs to be put in place.
There's no servers that need to be running.
We simply turn GuardDuty on as a service.
GuardDuty can also trigger AWS Lambda.
So if GuardDuty finds something
and it alerts us as to something going on.
We can also use that alert to trigger Lambda
and we can pass metadata
about that particular incident to Lambda.
And then we can use that to programmatically mitigate
that particular incident.
Perhaps GuardDuty found something in the network
that suggested an EC2 instance is compromised.
And so,
as an example,
we could use that event to trigger Lambda
and Lambda could then perhaps
either remove that EC2 instance
or contain that instance on the network
by removing security groups
so that it is no longer accessible.
Now finally moving on to Amazon Inspector.
We have another automated security assessment service
that automatically scans applications for vulnerabilities.
And so if we have applications that are deployed to AWS,
especially those that are deployed directly to EC2,
then Amazon Inspector
is an agent based, API-driven service.
We do require an agent
running on the EC2 instance,
and that agent can regularly scan
software that's installed on that instance
and compare that software
and compare the configuration of that instance
against databases of known vulnerabilities.
And so, when those assessments occur,
Amazon Inspector can give us a detailed list of findings.
It can show us that perhaps
we are leveraging a library that is known to have
some type of a vulnerability.
And it will also prioritize those.
Some could be critical.
Some could be high or medium.
And so on.
And so we get a dashboard of all of those findings
and from there we can go and mitigate those.
Perhaps that would mean that we need to
simply make a patch
to open SSL or something like that.
And so, because it is automated,
because it is
running right there alongside our applications,
we can essentially build that
into existing DevOps processes.
So perhaps we, not only are we looking to improve
features and performance of our application,
but we're also looking to improve security.
So perhaps we take findings of Amazon Inspector
and we add those requirements to our sprints,
so that the next release of that software
would include patches and updates
to existing or dependent libraries.
And so again, we can use Amazon Inspector
to enforce security standards.
Now keep in mind that
many of these kinds of services
include free trials.
Some of them include,
or require
subscriptions,
others are pay as you go,
according to what's actually being done.
So I will refer you to the Amazon website
to get details about the pricing because that changes.
By the time this video was published
it could be very different.
So as you can see throughout this module
we've talked about a number of
really powerful security features
that can help us keep our Amazon accounts
and applications and infrastructures highly secure.