Automated Security Controls

What it is

A security control is a rule that keeps resources in a safe state. At scale, controls must be automated and applied by default, because manual review cannot keep up with hundreds of accounts and thousands of deployments.

Controls fall into three groups. Preventive controls stop a bad action, detective controls notice a bad state, and corrective controls fix it. A strong design uses all three at different points.

How it works

Preventive controls

An SCP can force a secure setting. This one denies launching instances that do not require IMDSv2, the token based version of the instance metadata service.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "RequireImdsV2",
    "Effect": "Deny",
    "Action": "ec2:RunInstances",
    "Resource": "arn:aws:ec2:*:*:instance/*",
    "Condition": {"StringNotEquals": {"ec2:MetadataHttpTokens": "required"}}
  }]
}

Other typical SCPs deny leaving the organization, deny disabling CloudTrail, GuardDuty or Config, deny use of unapproved Regions, and deny actions by the root user.

Policy as code in the pipeline

CloudFormation Guard is a rule language that checks structured data, such as templates, before deployment. Put it in a CodeBuild step so a noncompliant template fails the pipeline.

let buckets = Resources.*[ Type == 'AWS::S3::Bucket' ]
rule s3_encrypted when %buckets !empty {
    %buckets.Properties.BucketEncryption exists
}

cfn-guard validate -d template.yaml -r rules.guard

The earlier check catches a problem in a pull request. A CloudFormation Hook acts at deploy time inside the account, so it also catches templates that skipped the pipeline.

Detective controls with AWS Config

Config rules evaluate the state of resources. Deploy them as conformance packs, which are collections of rules and remediations in one template, and as organization conformance packs, so every account in an OU receives them.

aws configservice put-organization-conformance-pack \
  --organization-conformance-pack-name baseline \
  --template-s3-uri s3://my-config-templates/baseline.yaml \
  --delivery-s3-bucket awsconfigconforms-central

Pack rules evaluate encryption, public access, logging, tagging, and open ports. Findings flow to AWS Security Hub and to EventBridge for action.

Corrective controls

Attach automatic remediation to a Config rule, or run an EventBridge rule that calls Systems Manager Automation. Fix the cause too: update the template or module that created the bad resource.

Network and edge controls at scale

AWS Firewall Manager applies security policies to every account in an organization from one administrator account. It requires Organizations and AWS Config.

New accounts and new resources that match a policy receive it automatically, which is the main reason to choose Firewall Manager over manual WAF setup.

Vulnerability and patch automation

• Patch Manager applies patch baselines to tagged instances in maintenance windows, and reports compliance.
• Amazon Inspector scans EC2 instances, container images in ECR and Lambda functions for known vulnerabilities continuously.
• EC2 Image Builder rebuilds hardened AMIs on a schedule, so replacing instances beats patching them in place.
• Immutable infrastructure means you replace instances through the pipeline and avoid manual changes, which reduces drift.

Securing the pipeline itself

Give pipeline roles least privilege, require approval for production, scan code, dependencies and images, keep secrets out of source control, and log all pipeline activity. A pipeline with broad admin rights is an attack path into every account it deploys to.