In this session, you’ll learn how to enable governance compliance and undertake operational and risk auditing of your AWS account through a combination of continuous monitoring auditing and evaluation of your AWS resources. With AWS management tools you can see a history of AWS API calls for your account, review changes in configurations and relationships among AWS resources, and dive into detailed resource configuration histories. You can determine your overall compliance with the configurations specified in your internal guidelines and you can give developers and systems administrators a secure and compliant means to create and manage AWS resources.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shahbaz Alam
Senior Practice Manager, Amazon Web Services Professional Services
shahbaza@amazon.com
Enabling Governance, Compliance,
Operational, and Risk Auditing with
AWS Management Tools

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What’s in your AWS account?
Availability Zone #1
www.example.com
Elastic Load
Balancing
DatabaseEC2 instance
web app
server
Autoscaling Group #1

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
As you expand and change, entropy increases…
CloudFront
Siemens
Customers
Internet
Route
53
On-Premises
Media
Sources
AWS Direct Connect
SQS
S3 Bucket
2
1
Availability Zone B
ELB
Processing Layer
EC2 App
Servers
EC2 App
Servers
Customer App
Layer
EC2 Web
Servers
EC2 Web
Servers
Web Layer
ProcessedMedia
Processed Data /
Meta-data
DynamoDB
Availability Zone A
4
G2
GPU-Optimized
Instances
G2
GPU-Optimized
Instances
ELB
3
5
6
Static Content
Unprocessed Media
Unprocessed Media
DynamicContent

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Becoming more complex with each new workload…
AWS Cloud
Route
53
Users
CloudFront
S3
Bucket
Availability Zone
Auto scaling
Groups
Elastic Load Balancing
RDS
MySQL DB
RDS
MSSQL DB
RDS MySQL
DB
(Standby)
RDS MSSQL
DB
(Standby)
Web-
Servers
Private Subnet Private Subnet
Private Subnet Private Subnet
Dynamic
Websites
Static
Websites
.Net Stack LAMP Stack
SPS
Stack
Shared
Services
WAF WAF
Availability Zone
.Net
Stack
LAMP Stack
SPS
Stack
Shared
Services
Virtual Private
Cloud
Auto scaling
Groups
CloudFront
Siemens
Customer
s
Internet
Route
53
On-
Premise
s
Media
Sources
AWS Direct
Connect
SQS
S3
Bucket
2
1
Availability
Zone B
ELB
Processing
Layer
EC2 App
Servers
EC2 App
Servers
Customer
App Layer
EC2 Web
Servers
EC2 Web
Servers
Web Layer
ProcessedMedia
Processed Data
/ Meta-data
DynamoDB
Availability Zone A
4
G2
GPU-
Optimized
Instances
G2
GPU-
Optimized
Instances
ELB
3
5
6
Static Content
Unprocessed
Media
Unprocessed Media
Dynamic
Content
Availability Zone A Availability Zone B
Public Subnet Public Subnet
Private Subnet Private Subnet
Instance A
10.1.1.11 /24
Instance B
10.1.2.22 /24
Instance C
10.1.3.33 /24
Instance D
10.1.4.44 /24
10.1.1.0/16
10.1.2.0/16
10.1.3.0/16
Public Subnet

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why do so many think it’s harder in the cloud…?
CostScale Reliability/Repeatability
Skills shortageSignal to noiseLarge datasets

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Because humans and data don’t mix well…

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How do I govern my environment to
ensure it is secure and compliant?

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Some definitions
Governance: oversight role and process by which companies
manage and mitigate business risks.
Compliance: process and internal controls to meet the
requirements imposed by a governing body.

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Implementing a governance and compliance program…
What is IT
doing?
When changes
occur and/or IT
resources become
“non-compliant”
What IT
resources exist?
What is IT
supposed to do?
Define Discover
MonitorRespond

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security engineering…then and now

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The challenge
Governance
Speed
• Define
• Discover
• Monitor
• Respond
• Manage
• Report
• Agility
• Innovation
• Scale

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS allows you to do both J
With AWS you can programmatically:
• Define how to provision and configure resources
• Discover new resources and changes to existing resources
• Monitor resources and operations for compliance
• Respond to (and report on) changes to your resources

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Security, Risk, Compliance, and Automation
Toolbox
Audit Visibility Protection Automation
AWS
CloudTrail
Amazon
CloudWatch
AWS Systems
Manager
AWS
Config
AWS
CodePipeline
AWS
WAF
AWS
KMS
AWS Trusted
Advisor
AWS
CloudFormation
AWS
Organizations
AWS
Lambda
Amazon
Inspector
AWS
Service Catalog
Amazon
Macie
AWS
Shield
AWS
Config Rules

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How do I ensure that my developers
provision AWS resources in an orderly
and predictable fashion?

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudFormation
JSON/YAML formatted file
Parameter definition
Resource creation
Configuration actions
Framework
Stack creation
Stack updates
Error detection and rollback
Configured AWS resources
Comprehensive service support
Service event aware
Customizable
Template CloudFormation Stack + Stack Sets

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudFormation Template
Infrastructure as code Declarative and flexible
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
MyEC2Instance: #An inline comment
Type: "AWS::EC2::Instance"
Properties:
ImageId: "ami-2f726546" #Another comment -- This is a Linux AMI
InstanceType: t1.micro
KeyName: testkey
BlockDeviceMappings:
-
DeviceName: /dev/sdm
Ebs:
VolumeType: io1
Iops: 200
DeleteOnTermination: false
VolumeSize: 20

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How do I enable self-service for my
business units so that they can quickly
deploy approved IT services?

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Service Catalog
• Allows organizations to create and manage catalogs of IT
services.
• Enables users to quickly deploy approved IT services in a
self-service manner without access to the underlying
services in AWS.
Organizations Developers
Control
Standardization
Governance
Agility
Self-service
Time to market

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Service Catalog
Enable
• 11 User API methods
• 40+ Admin API methods
• Share products across Portfolios
and AWS accounts
Orchestrate
• Version products
• Limit console access
• Provide various levels of user
access
Automate
• Launch constraints
• Template constraints

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can I view what activity occurred in
my AWS account?

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudTrail
Provides a history of your AWS account activity, including
actions taken through the AWS Management Console, AWS
SDKs, command-line tools, and other AWS services.
You make API
calls
On a set of AWS
services around the
world
CloudTrail
continuously
records API calls
AWS
CloudTrail
Store or archive
logs in an S3
bucket
AWS Management
Console
IAM AWS CLI

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can I easily discover what AWS
resources exist and detect if AWS
resources are compliant with rules I
defined?

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Config and Config Rules
Enables you to assess, audit, and evaluate the configurations
of your AWS resources.
Changing resources
History
Notifications
API Access
Normalized
AWS
Config
AWS
Config Rules

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can I monitor the specific state of
a resource and discover what software
is running on my AWS instances?
How can I centrally define, control, and
manage configuration data and secure
parameters without hardcoding?

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems Manager
Provides visibility and control of your infrastructure on AWS.
You can view operational data from multiple AWS services
and automate operational tasks across your AWS resources
Run command State manager Inventory Maintenance
window
Patch manager Automation Parameter store Documents

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can I create visualizations to help
monitor my AWS environment and alert
on high value events or activity?

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon CloudWatch
• CloudWatch Events delivers a near real-time stream of
system events
• Create rules to match events and route them to one or
more target functions or streams
Monitor
Amazon
EC2
Monitor
Other AWS
Resources
Monitor
Custom
Metrics
Monitor
and Store
Logs
Set
Alarms
View Graphs
and Statistics

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How can I take action when an event
occurs?

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Lambda
AWS Lambda allows you to run code in response to an event
Function Services (Anything)
Changes in
data state
Requests to
endpoints
Changes in
resource state
• Node
• Python
• Java
• C#
Event Source

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
General remediation pattern
Amazon
CloudWatch
AWS
CloudTrail
VPC Flow
Logs
Lambda
function
AWS APIs
AWS WAF
Team
collaboration
(Slack etc.)
• Define/Create
• Discover/Detect
• Monitor/Alert
• Respond/Remediate
• Define counter
measures
• Conduct forensics
Amazon
GuardDuty
AWS
Config

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Remediating an Amazon EC2 Instance…
• Asynchronously execute
commands
• No need to SSH/RDP
• Commands and output
logged
AWS
Lambda
function
Amazon EC2 Systems Manager -
Run Command
Amazon EC2
Instances

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Lambda + AWS Systems Manager + AWS
CloudWatch
AWS Systems
Manager
Documents
Amazon
CloudWatch
Rule
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS volume
Amazon
EBS
snapshot

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Putting it all together…

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automate at every stage
Developers Customers
ReleaseTestBuild
Plan Monitor
Delivery pipeline
Feedback loop
Security

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Foundational DevSecOps pipeline
AWS
Lambda
(or AWS
CodeBuild)
AWS
CodeCommit
(or S3/GitHub)
AWS
CodePipeline
AWS
CodePipeline
Developer commits
AWS
CloudFormation
Policy fail
PASS
Developers
Stack

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mature DevSecOps pipeline
https://aws.amazon.com/answers/devops/aws-cloudformation-validation-pipeline/
AWS
CodePipelineDevOps
Push/Pull
AWS
CodeCommit
Pre-create
Pre-create AWS Lambda
AWS CodeBuild / cfn-nag
Stack creation
Create stacks
AWS CloudFormation
Post-create
Post-create AWS Lambda
Amazon SNS notification
Deploy
Deploy AWS Lambda
Amazon S3 bucket
Manual Approval

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Use AWS Management Tools and AWS Managed
Services to…
Standardize Governance
Improve Security
Enforce Policies Automatically
Continuous Monitoring
Enable Self Service
Scale to Multiple
Environments
Remediate Issues
Automatically

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
Please complete the session survey in
the summit mobile app.