AWS CloudTrail

-
1. Overview - AWS CloudTrail

-Track activity across teams, accoundts and organizations in one place, in a consistent format
-Explore acitivity using a single set of tools, and respond to activity in minutes.
-As AWS innovates, new services and features are covered automatically.

2. With CloudTrail you can ...

 a) Simplify compliance workflows

-Keep track of API usage in a single location, simplifying audit and compliance processes

 b) Enhance security analysis

-Perform security analysis and  detect user behavior patterns across services, users, and accounts

c) Monitor data exfiltration risks 

-Stay alert to data exfiltration risk by collecting activity data on Azmaon Simple Storage Service (Amazon S3) objects through object-level API events

 d) Perform operational troubleshooting

- Simplify root cause analysis using CloudTrail events, to reduce time to resolution

3. CloudTrails Events

- integrated with over 130 AWS services
-Automatically gather usage activity
-Record event details, such as operartion, principal, request and response attributes
-Deliver events to central locations

a) types of events

 Managment events
-Resource control actions, such as update and delete actions on an amazon Elastic Compute Cloud (Amazon EC2) instance
-Generally infrequent compared to data events
-available from nearly all services

Data events
-Fine-grained actions , such as reading from an object in Amazon S3
-Can be very high frequency events
-Available for Amazon S3 and Amazon AWS Lambda

b) Event delivery

-Delivery events to Amazon S3
-Optionally deliver events to Amazon CloudWatch Logs
-Central collection across accounts and regions if desired
-Delivery is typically <15 minutes at 99th percentile. some services have delivery times of 5 minutes at 99th percentile

4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.


Komentarze

Prześlij komentarz

Popularne posty z tego bloga

Kubernetes

-
Obraz
I. Introduction 1. Kubernetes Overview - Kubernetes = popular container orchestrator  * it lets you schedule containers on a cluster of machines  * you can run multiple containers on one machine  * you can run long running services (like web applications)  * Kubernetes will manage the state of those containers:    ** Can start the container on specific nodeskubectl create -f pod-demo.yml    ** Will restart a container when it gets killed    ** Can move containers from one dnode to another node - you can run Kubernetes anywhere:   *on-premise (own datacenter)   *public (Google cloud, AWS)   *hybrid: public & private -highly modular -open source -backed by google -Container Orchestration = Make many servers act like one -Released by Google in 2015, maintained by large community -Runs on top of Docker (usually) as a set of APIs in containers -Provides API/CLI to managed containers across server...
Czytaj więcej

Helm

-
 0. Overivew - Packet manager 1. Helm Provenance and Integrity - https://github.com/technosophos/k8s-helm/blob/master/docs/provenance.md - Helm has provenance tools which help chart users verify the integrity and origin of a package. Using industry-standard tools based on PKI, GnuPG, and well-respected package managers, Helm can generate and verify signature files. a) Overview   -  I ntegrity is established by comparing a chart to a provenance record. Provenance records are stored in   provenance files , which are stored alongside a packaged chart. For example, if a chart is named   myapp-1.2.3.tgz , its provenance file will be   myapp-1.2.3.tgz.prov .  -  Provenance files are generated at packaging time ( helm package --sign ... ), and can be checked by multiple commands, notable   helm install --verify . b) The workflow This section describes a potential workflow for using provenance data effectively. Prerequisites: A valid PGP keyp...
Czytaj więcej

Ansible Tower / AWX

-
- Ansible Tower provides a web server interface to ansible.  - System rewuierments are somewhat heavy.  - Tower is only free for minimal use. Working with more than a few system requires a paid lincense.  - The two keys benefots of Ansible Tower are user permissioning and the audit trail (only provided with license.  - Only touched on in EX4077  - How is ansible Tower installed on your system? Ansible Tower is provided in a tarball containing binaries, config files, and an installation script that must be ran.  - To populate an Ansible Tower project with source files can be used:        * file system of the Ansible Tower server        * git        * subversion  - features:        * an interface for running Ansible plays and playbooks against target hosts.       * Separate user accounts permissioned for selective access to Tower-managed ...
Czytaj więcej