Miguel Ángel Muñoz Sánchez 🇪🇸

Cloud Architect, AWS Ambassador & AWS Community Builder

Bio

I’m a Cloud Architect with over 19+ years of IT experience. I was a Unix administrator with a strong background in Onprem technologies (HP-UX, Solaris, AIX, Storage Cabinets, Networking, etc.). I moved to cloud technologies 6 years ago. Now, I am trying to combine my old background with my cloud expertise to advocate why I prefer serverless or other managed cloud services to solve many project challenges.

Sessions

SESSION-04
How to use an Event Architecture to solve compliance and security issues
Room: | Time: 12:00
In this session, we will talk about how to use the events of cloudtrail to create an events architecture that can solve security and compliance issues in seconds. The main idea of the session is to demonstrate how to add a new layer of security to respond to any event on our platform. We can use EventBridge to catch some events of cloudtrail and trigger Lambdas to check if the actions comply with our our rules; it is beneficial to forbid some ports on our EC2, launch automatizations when we create any resource on AWS, add some configurations like WAF to our resources by default, add encryption for our resources or delete some resources that can be exposure to bad actors. We commonly use Security policies based on IAM, SCP, and Permission Boundaries on AWS to permit only minimal access, which is usually our first layer of security. Also, it is common to add another layer of security with IaC policies, Terraform modules or CDK constructs, and security libraries on CI/CD pipelines to permit only some configurations that are approved by the security team. It is a good approach but can only succeed if someone can break these layers or if the use of IaC or best practices is low. This extra layer is good for preventing wrong configurations or actions when they happen and is cheaper to implement than using other services like AWS Config or third-party tools.
Miguel Ángel Muñoz Sánchez 🇪🇸
Cloud Architect, AWS Ambassador & AWS Community Builder