Infrastructure security

Edge security strategy

Choose controls from the threat:

Put CloudFront in front of origins to absorb attacks at the edge, terminate TLS, and apply WAF and Shield at edge locations.

Edge protection details

CloudFront

• Origin access control (OAC) restricts an S3 origin to CloudFront (replaces origin access identity; supports SSE-KMS and all Regions). The bucket policy trusts cloudfront.amazonaws.com conditioned on the distribution ARN. For custom origins use a secret custom header, or VPC origins to keep ALB/EC2 private.
• Viewer protocol policy: redirect HTTP to HTTPS or HTTPS only. Origin protocol policy controls the back end. Pick a minimum TLS security policy. Use ACM certificates in us-east-1 for CloudFront.
• Field-level encryption encrypts chosen form fields at the edge so only the application with the private key can read them.
• Response headers policies add HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and CORS headers.
• Signed URLs for one file, signed cookies for many files; use key groups (not root account key pairs).
• Geo restriction is country-level allow/deny. For finer rules (and logging, and IP lists), use WAF.
• Lambda@Edge and CloudFront Functions can add auth logic or rewrite headers.

AWS WAF

• Web ACL attached to CloudFront, ALB, API Gateway REST, AppSync, Cognito user pool, App Runner, Verified Access. Regional ACLs for regional resources; CloudFront ACLs created in us-east-1.
• Rule types: regular (match statements: IP set, geo, string, regex, size, SQLi, XSS), rate-based (per source IP or aggregation key, in a time window), rule groups (AWS managed, Marketplace, your own).
• AWS managed rule groups: Core rule set (OWASP-style), Known bad inputs, SQL database, Admin protection, IP reputation, Anonymous IP list, Linux/PHP/WordPress OS rules, Bot Control, Account takeover prevention (ATP), Account creation fraud prevention (ACFP), and DDoS managed rules.
• Actions: Allow, Block, Count, CAPTCHA, Challenge. Use Count first to test a new rule without blocking traffic. Rule labels let later rules act on earlier matches.
• Client fingerprinting: JA3/JA4 TLS fingerprint matches identify a client library regardless of IP, useful against botnets.
• Request inspection limits: WAF inspects only the first part of the body (8 KB for ALB/AppSync, 16 KB default for CloudFront and API Gateway, configurable up to 64 KB for some). Oversize handling is configurable.
• Logging: to S3, CloudWatch Logs or Firehose, with redacted fields; names start with aws-waf-logs-.
• AWS Firewall Manager applies WAF, Shield Advanced, security group, Network Firewall and DNS Firewall policies across an organization (see governance).

AWS Shield

Protected resource types are CloudFront, Route 53, Global Accelerator, ALB, CLB, NLB and Elastic IPs (including on EC2).

S3 CORS

CORS is a browser control, not a server authorisation. The bucket’s CORS configuration lists allowed origins, methods and headers. The browser sends an Origin header, S3 answers with Access-Control-Allow-Origin when it matches. A wildcard origin on a private API with credentials is a mistake; list exact origins. CORS errors don’t mean IAM is broken.

AWS IoT policies

IoT Core authorises devices with IoT policies attached to X.509 certificates (or Cognito identities). They allow iot:Connect, iot:Publish, iot:Subscribe, iot:Receive on specific topics, using policy variables like ${iot:Connection.Thing.ThingName} so one policy serves every device. Least privilege means each device can only use its own topics. Mutual TLS authenticates both sides; fleet provisioning and just-in-time registration automate certificate onboarding.

Third-party integrations at the edge

• Third-party WAF rule groups from the AWS Marketplace (Fortinet, F5, Imperva, and others) plug into a web ACL.
• WAF and CloudFront logs can flow to Security Lake (OCSF) or a SIEM through Firehose.
• Other partners ingest findings through Security Hub or OCSF-formatted data.

Hardened compute

AMIs and container images

• EC2 Image Builder automates building, hardening, testing and distributing AMIs and container images with pipelines: a recipe (base image plus components), infrastructure configuration, tests, and distribution to Regions and accounts. Use AWS-provided hardening components (for example CIS or STIG hardening), and rebuild on a schedule or when the parent image or Inspector finds something.
• Use Systems Manager to maintain the agent, run commands, State Manager associations, and Parameter Store to publish the latest approved AMI ID (launch templates read it). Golden AMIs can be shared with RAM/launch permissions and encrypted with a shared customer managed key.
• Allowed AMIs (an EC2 account-level setting) restricts launching to approved AMI providers. Block public access for AMIs and EBS snapshots prevent accidental sharing.
• Containers: minimal base images, no root user, no secrets in images, ECR image scanning (enhanced scanning uses Inspector), immutable tags, lifecycle policies, signed images (AWS Signer / Notation), private repositories with VPC endpoints.
• Code signing for Lambda (AWS Signer) enforces that only signed code is deployed.
• Nitro instances isolate the hypervisor and encrypt memory-to-device paths; Nitro Enclaves provide isolated compute for sensitive processing with KMS attestation.

Instance profiles, service roles and execution roles

Never use access keys on compute. Scope roles per workload and don’t share a broad instance role across many apps.

Vulnerability scanning

Amazon Inspector continuously scans:

• EC2 (agent via Systems Manager, or agentless snapshot-based scanning), ECR images (on push and continuously), Lambda functions (standard: package dependencies; code scanning: code vulnerabilities), plus CIS benchmark scans of instances and network reachability findings.
• Results include a risk-adjusted Inspector score (CVSS plus exploitability and network exposure) and an SBOM export. Findings go to Security Hub and EventBridge. Organization-wide with a delegated admin and auto-enable.
• Inspector doesn’t patch. Combine with Patch Manager.

GuardDuty Runtime Monitoring watches running behaviour: processes, file access, network connections inside EC2, ECS/Fargate and EKS. It’s detection of active threats; Inspector is detection of known vulnerabilities. Don’t mix them.

Patching

Systems Manager Patch Manager uses patch baselines (rules: classification, severity, auto-approval delay; approved/rejected lists), patch groups via tags, and maintenance windows to scan and install on schedule. Operations are Scan or Scan and install. Compliance reports go to Security Hub/Config. Use the AWS-RunPatchBaseline document; State Manager keeps patching enforced. For Auto Scaling, patch the AMI and use instance refresh rather than patching live. Inspector validates continuously afterwards that vulnerabilities closed. Patch policies in Quick Setup centralise this across an organization. Hotpatching exists for some Windows Server instances to avoid reboots.

Secure administrative access

Pick Session Manager when the question says “no open inbound ports”, “auditable” or “no key management”.

Security in the build pipeline

• Amazon Q Developer (security scans and code review inside the IDE or pipeline) and Amazon CodeGuru Security detect code vulnerabilities (injection, hard-coded secrets, weak crypto) and suggest fixes; they plug into CI/CD.
• Amazon Inspector scans images at push and Lambda code; CodeBuild runs SAST/dependency scans; CodeArtifact controls dependencies. Secrets detection (CodeGuru, Q Developer) catches credentials in code.
• Gate the pipeline: fail the build or block promotion on critical findings, sign artifacts, and use least-privilege deployment roles.
• Software supply chain: pin dependency sources via CodeArtifact, generate SBOMs, verify signatures.

Generative AI guardrails

The OWASP Top 10 for LLM applications includes prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain, sensitive information disclosure, insecure plugin design, excessive agency, overreliance and model theft. On AWS:

• Amazon Bedrock Guardrails: content filters (hate, violence, prompt attacks), denied topics, word filters, sensitive information filters (PII masking/blocking), contextual grounding checks against hallucination, and automated reasoning checks. Work on inputs and outputs, and with any model through the ApplyGuardrail API.
• IAM least privilege on model access and on agent tools (limits excessive agency); VPC endpoints (PrivateLink) to Bedrock and SageMaker AI; KMS for model customisation data; CloudTrail logging of invocations; model invocation logging to S3/CloudWatch; Macie for sensitive training data; WAF in front of AI endpoints for rate limits; output validation before it reaches downstream systems.
• AI service opt-out policies (Organizations) stop AWS AI services storing your content to improve services.

Network security controls

Security groups vs NACLs vs Network Firewall

• Security groups can reference other security groups, which is how tiers talk to each other without IPs. Use managed prefix lists to keep rule sets consistent.
• A NACL deny is the way to block a specific bad IP (security groups can’t deny).
• AWS Network Firewall: place in an inspection VPC behind a transit gateway (centralised) or distribute per VPC. Use for egress filtering by domain (SNI/HTTP host), IPS signatures, and layer 3-7 stateful inspection. It sees traffic outside what security groups can express. Route tables must send traffic through the firewall endpoint, in a symmetric path.
• Route 53 Resolver DNS Firewall controls DNS names; the VPC DNS and Resolver endpoints for hybrid DNS.
• Gateway Load Balancer inserts third-party appliances transparently (GENEVE).

Hybrid and multi-cloud connectivity

For multi-cloud links, use IPsec VPNs (or partner interconnects) with BGP and keep encryption at every hop that leaves AWS’s network.

Network segmentation

• North/south (in and out of the environment): internet gateway, NAT, Network Firewall, WAF, VPN. East/west (between workloads): security group references, per-VPC separation, TGW route tables, isolated subnets with no route to an internet gateway or NAT, and PrivateLink.
• Layered pattern: public subnets hold load balancers only; private subnets hold applications; isolated subnets hold databases. Egress for private subnets through NAT or a firewall.
• VPC endpoints: gateway endpoints (S3 and DynamoDB, free, route-table entries; endpoint policies) and interface endpoints (PrivateLink ENIs, per-hour cost; endpoint policies and security groups). Use aws:SourceVpce or aws:SourceVpc in bucket policies to require them.
• Separate accounts and VPCs for different data sensitivity; share subnets with RAM where useful.

Finding unnecessary access

Common traps

• Security groups are stateful and allow-only; NACLs are stateless and need return-traffic rules.
• Shield Standard doesn’t protect layer 7 on its own; WAF does that.
• CloudFront geo restriction is country level and blocks everything for that country; WAF can scope by path or other conditions.
• Session Manager still needs a route to the SSM endpoints.
• Direct Connect alone is private but not encrypted.
• WAF can’t be attached to an NLB or EC2 directly.
• Reachability Analyzer is troubleshooting; Network Access Analyzer is for finding unwanted paths.
• Inspector scans for vulnerabilities; GuardDuty Runtime Monitoring watches behaviour.