AWS - Security

Reference

https://youtu.be/u6BCVkXkPnM

AWS re:Inforce 2019: Security Best Practices the Well-Architected Way (SDD318)

Incident response

https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf

Playbook vs Runbook: run book have more details

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html

• predefined query against cloudwatch event

IAM

• SSO
  https://aws.amazon.com/blogs/security/how-to-establish-federated-access-to-your-aws-resources-by-using-active-directory-user-attributes/

• Permission boundaries

• Automation

• Role from Account 1 to assume role from Account 2 (hands on)

Management

Detective Control