AWS Security Blog

Category: Advanced (300)

Automatically replicate your card payment keys across AWS Regions

In this blog post, I dive into a cross-Region replication (CRR) solution for card payment keys, with a specific focus on the powerful capabilities of AWS Payment Cryptography, showing how your card payment keys can be securely transported and stored. In today’s digital landscape, where online transactions have become an integral part of our daily […]

Making sense of secrets management on Amazon EKS for regulated institutions

Amazon Web Services (AWS) customers operating in a regulated industry, such as the financial services industry (FSI) or healthcare, are required to meet their regulatory and compliance obligations, such as the Payment Card Industry Data Security Standard (PCI DSS) or Health Insurance Portability and Accountability Act (HIPPA). AWS offers regulated customers tools, guidance and third-party audit reports […]

Announcing AWS KMS Elliptic Curve Diffie-Hellman (ECDH) support

When using cryptography to protect data, protocol designers often prefer symmetric keys and algorithms for their speed and efficiency. However, when data is exchanged across an untrusted network such as the internet, it becomes difficult to ensure that only the exchanging parties can know the same key. Asymmetric key pairs and algorithms help to solve […]

AWS Secret Manager

How to centrally manage secrets with AWS Secrets Manager

In today’s digital landscape, managing secrets, such as passwords, API keys, tokens, and other credentials, has become a critical task for organizations. For some Amazon Web Services (AWS) customers, centralized management of secrets can be a robust and efficient solution to address this challenge. In this post, we delve into using AWS data protection services […]

Amazon Bedrock logo

Hardening the RAG chatbot architecture powered by Amazon Bedrock: Blueprint for secure design and anti-pattern mitigation

Mitigate risks like data exposure, model exploits, and ethical lapses when deploying Amazon Bedrock chatbots. Implement guardrails, encryption, access controls, and governance frameworks.

Example architecture configured in the previous blog post

Accelerate incident response with Amazon Security Lake – Part 2

This blog post is the second of a two-part series where we show you how to respond to a specific incident by using Amazon Security Lake as the primary data source to accelerate incident response workflow. The workflow is described in the Unintended Data Access in Amazon S3 incident response playbook, published in the AWS […]

Patterns for consuming custom log sources in Amazon Security Lake

As security best practices have evolved over the years, so has the range of security telemetry options. Customers face the challenge of navigating through security-relevant telemetry and log data produced by multiple tools, technologies, and vendors while trying to monitor, detect, respond to, and mitigate new and existing security issues. In this post, we provide […]

AWS Firewall Manager logo

Centrally manage VPC network ACL rules to block unwanted traffic using AWS Firewall Manager

Amazon Virtual Private Cloud (Amazon VPC) provides two options for controlling network traffic: network access control lists (ACLs) and security groups. A network ACL defines inbound and outbound rules that allow or deny traffic based on protocol, IP address range, and port range. Security groups determine which inbound and outbound traffic is allowed on a […]

AWS IAM Identity Center

Access AWS services programmatically using trusted identity propagation

March 7, 2025: This post was republished to update the code, architecture, and narrative introducing the launch of Single Sign-on and trusted identity propagation support for Amazon Redshift Data API with AWS IAM Identity Center. With the introduction of trusted identity propagation, applications can now propagate a user’s workforce identity from their identity provider (IdP) […]

Example multi-tenant SaaS application

SaaS tenant isolation with ABAC using AWS STS support for tags in JWT

As independent software vendors (ISVs) shift to a multi-tenant software-as-a-service (SaaS) model, they commonly adopt a shared infrastructure model to achieve cost and operational efficiency. The more ISVs move into a multi-tenant model, the more concern they may have about the potential for one tenant to access the resources of another tenant. SaaS systems include […]