前言
文章主要記錄對(duì)AWS中的服務(wù)安全，主要是對(duì)IAM的認(rèn)識(shí)與實(shí)踐。注意的是文章并不提供Step-by-Step的基礎(chǔ)性介紹，更多地關(guān)注怎么用架構(gòu)師的思維來(lái)認(rèn)識(shí)、學(xué)習(xí)和運(yùn)用相關(guān)的服務(wù)。
AWS Shared Security Responsibility Model
AWS遵循共享安全責(zé)任模型，也就是如下圖所示，AWS負(fù)責(zé)底層基礎(chǔ)設(shè)施的安全，用戶則負(fù)責(zé)他所部署在AWS上的應(yīng)用與數(shù)據(jù)的安全。
AWS的服務(wù): 安全
值得注意的是，AWS的安全控制并不僅僅依靠IAM，如下圖所示：
AWS中安全的四個(gè)組成部分：
1. 數(shù)據(jù)保護(hù)（Data protection）
SEC 1. How are you encrypting and protecting your data at rest?
SEC 2. How are you encrypting and protecting your data in transit?
2. 權(quán)限管理（Privilege management）
SEC 3. How are you protecting access to and use of the AWS root account credentials?
SEC 4. How are you defining roles and responsibilities of system users to control human access to the AWS Management Console and APIs?
SEC 5. How are you limiting automated access (such as from applications, scripts, or third-party tools or services) to AWS resources?
SEC 6. How are you managing keys and credentials?
3. 基礎(chǔ)設(shè)施保護(hù)（Infrastructure protection）
SEC 7. How are you enforcing network and host-level boundary protection?
SEC 8. How are you enforcing AWS service level protection?
SEC 9. How are you protecting the integrity of the operating systems on your Amazon EC2 instances?
4. 偵查性控制（Detective controls）
SEC 10. How are you capturing and analyzing AWS logs?
重要的資源鏈接：
https://aws.amazon.com/documentation/
http://aws.amazon.com/faqs/
http://aws.amazon.com/whitepapers/
http://aws.amazon.com/architecture/
https://aws.amazon.com/security/
