Amazon GuardDuty
A threat-detection service for your AWS account using machine learning that continuously monitors for malicious activity and unauthorized behavior.
Internet Gateway
Bridge for connecting your subnet to the Internet. Subnets are isolated from the internet by default. The Internet Gateway must be explicitly configured. (Used for public subnets.)
IAM Policy
A document that defines which resources can be accessed and the level of access to each resource.
Encryption of data in Transit
The concept of encrypting data while it is moving across the network – either between internal resources like an EC2 and a database or between the client and the web server. This encryption protects the data from eavesdroppers during the transmission.
Actions that can only be completed by the AWS account root user.
1) Updating the account root user password
2) Changing the AWS account email address.
3) Closing the AWS account.
4) Changing the AWS Support plan
5) Restoring an IAM user’s permissions
6) Changing account settings (for example, contact information, allowed Regions)
Amazon Route 53
Amazon’s Domain Name System (DNS) web service (resolves DNS names to IP addresses).
AWS Site-to-Site VPN
A service that connects your on-premises network (like your company’s data center or office network) to your AWS Virtual Private Cloud (VPC) over an encrypted VPN connection using the public internet.
Amazon Macie
A security service that uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3s. Amazon Macie recognizes sensitive data such as personally identifiable information (PII) or intellectual property.
AWS Service Catalog
Enables organizations to create and manage catalogs of IT services that are approved for use. (In this way, you can control what AWS resources your company’s employees have access to – can be controlled by region)
AWS Certificate Manager
A service that provisions, manages, and automatically renews SSL/TLS certificates to secure your websites and applications.
IAM Group
A collection of IAM users that are granted identical authorization. Users can be in multiple groups. Groups do not nest. There are no default groups; a user needs to be explicitly added to each group they need to be added to.
AWS Shield Standard
Provides DDOS protection for CloudFront, Route 53, and Global Accelerator. Enabled at no additional cost.
IAM Role
Useful mechanism to grant a set of permissions for making AWS service requests. Useful for an EC2 to assume a role that grants it permission to access a particular S3. In this way, user credentials don’t need to be stored on the server.
VPC Peering
A networking connection between two VPCs that allows them to communicate with each other as if they were part of the same network. (A typical use case is connecting different AWS Regions or accounts.)
Security Groups
Applied to instances to allow/deny traffic to that instance.
SCP
Service Control Policies - AWS Organizations integrate with IAM with service control policies which can restrict which accounts have access to which services and API actions. SCPs essentially limit the permissions that are available in an account that is part of an organization. SCPs can be assigned to individual accounts or to Organizational Units (OUs) which are the interior nodes of the AWS Organizations tree.
AWS Shield Advanced
Provides DDOS protection for many services, including EC2s and Elastic IPs. Protects against large, sophisticated attacks. Optional paid service.
Elastic Network Interface (ENI)
Is a virtual network card for EC2 instances, specifies the IP address(es) for that instance
AWS KMS
AWS Key Management Service - Enables you to create and manage encryption keys. Enables you to control the use of encryption across AWS services and in your applications.
Encryption of data at Rest
The concept of encrypting stored data (in a database or in files on a disk) so that if the storage is breached, the thief cannot read the data. Configuring encryption at rest is the responsibility of the customer. Encryption key management is provided by AWS KMS.
Amazon Inspector
An automated security assessment service that helps improve the security and compliance of applications that are deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.
AWS Artifact
A service that provides on-demand access to AWS compliance reports and security and privacy documentation.
IAM User
A person or application that can authenticate with an AWS account.
AWS Direct Connect
An alternative to Site-to-Site VPN that instead uses a dedicated, private network connection between your network and AWS. Can provide faster, more consistent performance than sending traffic across the public internet.
