Skip to content

Latest commit

 

History

History
37 lines (32 loc) · 1.42 KB

data-protection.md

File metadata and controls

37 lines (32 loc) · 1.42 KB

AWS Data Protection

  • TLS for in transit encryption
  • ACM to manage SSL/TLS certificates
  • Load Balancers to assign certificates:
    • ALB and NLB provide SSL termination
    • Possible to have multiple SSL certificates per ALB
    • Optional SSL/TLS encryption between ALB and EC2 instances
  • CloudFront with SSL
  • All AWS services expose HTTP endpoints
  • It is possible to send data through HTTP to S3 (we probably should not do this!)

At Rest Encryption

  • S3 encryption:
    • SSE-S3
    • SSE-KMS
    • SSE-C
    • Client side encryption
    • Possibility to enable default encryption
    • Possibility to enforce encryption through S3 bucket policies (x-amz-server-side-encryption)
    • Data in Glacier is encryption by default
  • EBS, EFS, RDS, ElastiCache, DynamoDB encryption:
    • Usually uses either encryption key of our own
  • Category of data:
    • PHI: protected health information
    • PII: personally-identifying information

AWS Network Protection

  • Direct Connect: private, direct connection between site and AWS
  • Public internet: use a VPN
    • Site-to-Site VPN supports Internet Protocol security (IPSec) VPN connections (for linking on-premise to the cloud)
  • Network ACL: stateless firewall at the VPC level
  • WAF (Web Application Firewall): web security rules against exploits
  • Security Groups: stateful firewall on the instance's underlying hypervisor
  • System Firewalls: install own firewall on EC2 instances