Let’s Architect! Architecting for Security
AWS Architecture BlogLet’s Architect! Architecting for Securityby Luca Mezzalira, Laura Hyatt, Vittorio Denti, and Zamira Jaupaj | on23 FEB 2022| inArchitecture,Security, Identity, & Compliance|Permalink|ShareAt AWS, security is “job zero” for every employee—it’s even more important than any number one priority. In thisLet’s Architect!post, we’ve collected security content to help you protect data, manage access, protect networks and applications, detect and monitor threats, and ensure privacy and compliance.Managing temporary elevated access to your AWS environmentOne challenge many organizations face is maintaining a solid security governance across AWS accounts.ThisSecurity Blogpost provides a practical approach to temporarily elevate access for specific users. For example, imagine a developer wants to access a resource in the production environment. With elevated access, you won’t have to provide them an account that has access to the production environment. You would just elevate their access for a short period of time. The following diagram shows the few steps needed to temporarily elevate access to a user.This diagram shows the few steps needed for to temporarily elevate access to a userSecurity should start left: The problem with shift leftYou already know security is job zero at AWS. But it’s not just a technology challenge. The gaps between security, operations, and development cycles are widening. To close these gaps, teams must have real-time visibility and control over their tools, processes, and practices to prevent security breaches.This re:Invent session shows how establishing relationships, empathy, and understanding between development and operations teams early in the development process helps you maintain the visibility and control you need to keep your applications secure.Empowering developers means shifting security left and presenting security issues as early as possible in your processAWS Security Reference Architecture: Visualize your securitySecuring a workload in the cloud can be tough; almost every workload is unique and has different requirements. This re:Invent video shows you how AWS can simplify the security of your workloads, no matter their complexity.You’ll learn how various services work together and how you can deploy them to meet your security needs. You’ll also see how theAWS Security Reference Architecturecan automate common security tasks and expand your security practices for the future. The following diagram shows how AWS Security Reference Architecture provides guidelines for securing your workloads in multiple AWS Regions and accounts.The AWS Security Reference Architecture provides guidelines for securing your workloads in multiple AWS Regions and accountsNetwork security for serverless workloadsServerless technologies can improve your security posture. You can build layers of control and security with AWS managed and abstracted services, meaning that you don’t have to do as much security work and can focus on building your system.This video from re:Invent provides serverless strategies to consider to gain greater control of networking security. You will learn patterns to implement security at the edge, as well as options for controlling anAWS Lambdafunction’s network traffic. These strategies are designed to securely access resources (for example, databases) placed in a virtual private cloud (VPC), as well as resources outside of a VPC. The following screenshot shows howLambda functions can run in a VPC and connect to services likeAmazon DynamoDBusing VPC gateway endpoints.Lambda functions can run in a VPC and connect to services like Amazon DynamoDB using VPC gateway endpointsSee you next time!Thanks for reading! If you’re looking for more ways to architect your workload for security, check outBest Practices for Security, Identity, & Compliancein theAWS Architecture Center.See you in a couple of weeks when we discuss the best tools offered by AWS for software architects!Other posts in this seriesLet’s Architect! Architecting for SustainabilityLet’s Architect! Architecting for Machine LearningLet’s Architect! Tools for Cloud ArchitectsLet’s Architect! Architecting for BlockchainTAGS:Cloud Security,Let's ArchitectLuca MezzaliraLuca is Principal Solutions Architect based in London. He has authored several books and is an international speaker. He lent his expertise predominantly in the solution architecture field. Luca has gained accolades for revolutionizing the scalability of front-end architectures with micro-frontends, from increasing the efficiency of workflows, to delivering quality in products.Laura HyattLaura Hyatt is a Solutions Architect for AWS Public Sector and helps Education customers in the UK. Laura helps customers not only architect and develop scalable solutions but also think big on innovative solutions facing the education sector at present. Laura's specialty is IoT, and she is also the Alexa SME for Education across EMEA.Vittorio DentiVittorio Denti is a Machine Learning Engineer at Amazon based in London. After completing his M.Sc. in Computer Science and Engineering at Politecnico di Milano (Milan) and the KTH Royal Institute of Technology (Stockholm), he joined AWS. Vittorio has a background in distributed systems and machine learning. He's especially passionate about software engineering and the latest innovations in machine learning science.Zamira JaupajZamira is an Enterprise Solutions Architect based in the Netherlands. She is highly passionate IT professional with over 10 years of multi-national experience in designing and implementing critical and complex solutions with containers, serverless, and data analytics for small and enterprise companies.
At AWS, security is “job zero” for every employee—it’s even more important than any number one priority. In this Let’s Architect! post, we’ve collected security content to help you protect data, manage access, protect networks and applications, detect and monitor threats, and ensure privacy and compliance. Managing temporary elevated access to your AWS environment One […]
Luca Mezzalira
Architecture Security, Identity, & Compliance