AWS Security Blog

Category: Advanced (300)

Solution architecture to automate the review and validation of permissions for users and groups in AWS IAM Identity Center

How to automate the review and validation of permissions for users and groups in AWS IAM Identity Center

AWS IAM Identity Center (successor to AWS Single Sign-On) is widely used by organizations to centrally manage federated access to their Amazon Web Services (AWS) environment. As organizations grow, it’s crucial that they maintain control of access to their environment and conduct regular reviews of existing granted permissions to maintain a good security posture. With […]

Cost considerations and common options for AWS Network Firewall log management

Cost considerations and common options for AWS Network Firewall log management

When you’re designing a security strategy for your organization, firewalls provide the first line of defense against threats. Amazon Web Services (AWS) offers AWS Network Firewall, a stateful, managed network firewall that includes intrusion detection and prevention (IDP) for your Amazon Virtual Private Cloud (VPC). Logging plays a vital role in any firewall policy, as […]

Migrating your secrets to AWS Secrets Manager, Part 2: Implementation

Migrating your secrets to AWS Secrets Manager, Part 2: Implementation

In Part 1 of this series, we provided guidance on how to discover and classify secrets and design a migration solution for customers who plan to migrate secrets to AWS Secrets Manager. We also mentioned steps that you can take to enable preventative and detective controls for Secrets Manager. In this post, we discuss how […]

Migrating your secrets to AWS Secrets Manager, Part I: Discovery and design

Migrating your secrets to AWS Secrets Manager, Part I: Discovery and design

“An ounce of prevention is worth a pound of cure.” – Benjamin Franklin A secret can be defined as sensitive information that is not intended to be known or disclosed to unauthorized individuals, entities, or processes. Secrets like API keys, passwords, and SSH keys provide access to confidential systems and resources, but it can be […]

Example of CodeGuru Security integration with deployment pipeline

How Amazon CodeGuru Security helps you effectively balance security and velocity

Software development is a well-established process—developers write code, review it, build artifacts, and deploy the application. They then monitor the application using data to improve the code. This process is often repeated many times over. As Amazon Web Services (AWS) customers embrace modern software development practices, they sometimes face challenges with the use of third-party […]

AWS Config for AWS Security Hub

Optimize AWS Config for AWS Security Hub to effectively manage your cloud security posture

AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates security findings from Amazon Web Services (AWS) and third-party security services, and enables automated remediation. Most of the checks Security Hub performs on AWS resources happen as soon as there is a configuration change, giving you nearly immediate […]

An organization using TEAM alongside IAM Identity Center

Temporary elevated access management with IAM Identity Center

AWS recommends using automation where possible to keep people away from systems—yet not every action can be automated in practice, and some operations might require access by human users. Depending on their scope and potential impact, some human operations might require special treatment. One such treatment is temporary elevated access, also known as just-in-time access. […]

Detect threats to your data stored in RDS databases by using GuardDuty

With Amazon Relational Database Service (Amazon RDS), you can set up, operate, and scale a relational database in the AWS Cloud. Amazon RDS provides cost-efficient, resizable capacity for an industry-standard relational database and manages common database administration tasks. If you use Amazon RDS for your workloads, you can now use Amazon GuardDuty RDS Protection to […]

Simplify web app authentication: A guide to AD FS federation with Amazon Cognito user pools

September 8, 2023: It’s important to know that if you activate user sign-up in your user pool, anyone on the internet can sign up for an account and sign in to your apps. Don’t enable self-registration in your user pool unless you want to open your app to allow users to sign up. August 13, […]

How to use Amazon GuardDuty and AWS WAF v2 to automatically block suspicious hosts

In this post, we’ll share an automation pattern that you can use to automatically detect and block suspicious hosts that are attempting to access your Amazon Web Services (AWS) resources. The automation will rely on Amazon GuardDuty to generate findings about the suspicious hosts, and then you can respond to those findings by programmatically updating […]