CloudTrakris in the Cloud Infrastructure Industry

CloudTrakr

In the world of cloud computing, AWS CloudTrail has risen as an essential service for businesses utilizing (AWS). CloudTrail significantly improves security, compliance, and resource management with its robust ability to document and monitor activity. This article aims at uncovering the importance of AWS CloudTrail in overseeing and logging AWS environments, emphasizing its features and recommended practices for successful implementation. Amazon Web Services API What is AWS CloudTrail? AWS CloudTrail, a web service from Amazon, logs and monitors all API activity within an AWS account. It captures intricate details of every action executed through the AWS Management Console, SDKs, command-line tools, and other AWS services. This gathered data is housed in an Amazon S3 bucket or sent to AWS CloudWatch Logs for analysis and monitoring. The Value of AWS CloudTrail in Monitoring Security and Compliance CloudTrail bolsters security by maintaining an exhaustive record of all API interactions in the AWS setting. This activity trail proves instrumental in pinpointing and examining security incidents, unauthorized access attempts, and potential weak spots. Additionally, it supports compliance needs by offering an audit trail for regulatory objectives. Resource and User Activity Tracking CloudTrail equips administrators with crucial insights about resource usage and user conduct. It assists in discerning which resources see frequent access or remain underutilized, thus enabling superior resource distribution and cost optimization. Troubleshooting and Root Cause Analysis When faced with unexpected behavior or errors, logs from CloudTrail become indispensable for troubleshooting and pinpointing the root cause. The detailed API interaction data permits administrators to backtrack and comprehend what led to the problem. The Functionality of AWS CloudTrail Event Logging Whenever a user or resource acts AWS, CloudTrail logs the event. This logged data includes details such as the identity of the actor, the specific action, the occurrence time, and any resources involved. Data Storage The logged event information finds storage in a designated S3 bucket. This data is readily accessible and can be analyzed using various third-party AWS services or tools. Real-time Monitoring Integration of CloudTrail with CloudWatch Logs offers immediate insights into AWS API activity. This allows administrators to act swiftly when faced with security threats or questionable activities. Utilizing AWS CloudTrail for Logging Initiating CloudTrail Start your journey with by heading to the AWS Management Console, opting for the CloudTrail service, and creating a trail. Select the S3 bucket designated for log storage and, if needed, set up CloudWatch Logs integration. CloudTrail Determining Data Events You can configure CloudTrail to monitor data events beyond API activity. These events document particular activities related to data resources, such as accessing a specific S3 bucket or altering security groups. Combining with CloudWatch Integration of CloudTrail and CloudWatch Logs allows users to establish real-time monitoring, alarms, and notifications for specific API activities or potential security risks. Leverage CloudTrail logs to optimize costs💡 Routinely analyzing the CloudTrail activity trail can uncover trends and usage patterns that reveal opportunities to reduce cloud spend. For example, logs may show certain EC2 instance types or S3 storage classes being underutilized, indicating potential areas to downsize resources, and cut costs. Also, monitoring API calls via CloudTrail can detect abnormal activity indicative of configuration changes that drive up usage and expenses. Keeping a close eye on CloudTrail data is a valuable way to manage your cloud costs. Conclusion AWS CloudTrail is an essential instrument for overseeing and logging AWS API activity. It offers precise and exhaustive event records, improving security, streamlining compliance, and facilitating superior resource management. Using AWS CloudTrail and other AWS services like CloudWatch empowers organizations to construct a robust monitoring and logging system. It fosters a secure and productive cloud computing environment. Adhering to best practices and routine analysis of CloudTrail logs aids organizations in staying ahead in identifying and managing potential security threats, guaranteeing the uninterrupted functioning of their AWS infrastructure.

How AWS CloudTrail Enhances Monitoring, Compliance, and Cost Management

Engineering teams that build, scale, and manage cloud-based applications on know that at some point in time, their applications and infrastructure will be under attack. But as applications expand and new features are added, securing workloads in AWS becomes an increasingly complex task. AWS To add visibility and audibility, tracks the who, what, where, and when of activity that occurs in your AWS environment and records this activity in the form of audit logs. Accordingly, CloudTrail audit logs contain information that is key to monitoring the actions performed across your AWS accounts, identifying possible malicious behavior, and surfacing parts of your infrastructure that might not be configured properly. AWS CloudTrail It's crucial to safeguard CloudTrail logs and enhance the security of them, to meet compliance regulatory requirements and internal business needs. In this post, I'll show what I did to achieve a better level of security in the way I store, process, and analyze audit logs in AWS. Centralize logging in S3 Having one bucket for each account it's a nail on the shoe. I need to manage multiple data storage, and I don't have a way to set up alerts for all accounts (and many other problems too). So, I decided to use one S3 bucket for all cloud trail logs. It's just a central place where I store and manage all data that comes from different accounts. Manage all logging data in one place, in terms of security, it's the best approach. I have more control over who has access to logs, and what they can do (permissions). Also, if I need to do some data transformation or aggregation, I can do it, in just one place. Fortunately, CloudTrail has a way to configure logging to let us centralize data. I need to set up in every trail, the destination storage where I'd like to send logs; in this case, the storage will be an S3 bucket, in another central account. Also, I have to allow cloudtrail service to put data on the bucket. I've used this tutorial to create a bucket policy for multiple account setups. I've just created a bucket policy and add all accounts that I manage, simple as that. Store logs in an isolated security-only account A separate AWS account gave me the possibility to restrict and isolate the access to the logs, keeping them in secure storage where only security people could access them, and nobody else in the company. I created individual IAM users for people and applications, that strictly need access to logs for their daily tasks. Each user has his/her own policy that allows them to access the logs. If you need to comply with a security standard, like PCI-DSS for example, it's easiest to show the auditors that you store all security-related logs in a separate account, and only the people and applications that need to consume the logs, have users in security account. Fewer users to audit === Easiest for the auditor to give the approval. Use Organizations to set up CloudTrail Most companies use multiple AWS accounts to delegate and separate teams, business units, or whatever they want to segregate. In the past, configure each account to set up logging trails was a waste of time; I usually did the configuration setup using or to automate all account setup security tasks. With the help of , I don't need to do that anymore. I can create an , that every account that belongs to my organization will have. It runs automatically every time I add a new account, without needed to deploy anything. From a security perspective, it has special features that make them very attractive and sexy (Blue team members will understand). cloudformation Terraform Organizations Organization trail Account users will not have permissions to modify, delete or stop the logging activity. Pretty good right? This is the best way to assure that all accounts, in every region, will log all the activity to my S3 bucket, without taking care of malicious users trying to stop logging or deleting the trail. It means that I don't need to implement something to take care of compliance of logs, because Organizations will do this task for me. Store logs for years There are various standards in the IT industry that enforces every company must keep logging data for X number of years. In these circumstances, you need a way to ensure all of your data will be backed up in some storage layer. My first question was... Glacier comes to the rescue. It's a super cheap storage service, that lets me store any kind of object at a very low cost for many years. But it isn't so cheap... Glacier will charge me a lot when I need to recover the data, but this only happens in case of security incidents, and of course, the cost of not having data at all will be greater than recovery costs. So Glacier is a good choice for me because I don't plan to recover the logs frequently. I could set up policies in my S3 bucket to move data to infrequent access (to reduce costs) and finally move it to Glacier after some time. In this way, I reduce a lot the costs of storing millions of logs. This is a good question. It depends on business needs, budget, and amount of data. In my particular case, I've decided to keep fresh data (logs that can be queried) for six months in S3, and after that, I move to S3-IA (infrequent access) for another 3 months. Finally, after 9 months, I move logs to Glacier to permanently store them, for years. Glacier vaults have a special security feature: . You can use lock policies to set up a specific control that no one could remove after it was configured. No matter if I use the root user, nobody could remove that control. As you can see, this is very useful to enforce compliance regulatory requirements, like PCI-DSS or HIPAA. For example, I could set up a policy that prevents anyone from deleting an object in 10 years or set up a policy to force WORM (write once, read many). I can do whatever policies let me do, and enforce it so nobody could bypass that control. How much will cost store logs for years? How much time should I keep the logs available in S3? lock policies Server-Side Encryption By default, CloudTrail logs are encrypted with the S3 encryption key. But I want another layer of protection, so I decided to use a CMK (Customer Master Key) in KMS, to manage the encryption key. I have more control over who could decrypt logs, and I added another layer of protection; users/apps that want to read logs, will need S3 permissions (like before) and KMS permissions to use the decryption key. The decryption process is seamless through S3. When authorized users of the key read CloudTrail log files, S3 manages the decryption, and the authorized users can read log files in unencrypted form. So, I don't need to take care of encryption/decryption of log files, because AWS will do that for me. Logfile validation How can I make sure that nobody has modified my logs? Fortunately, CloudTrail provides us with Log Validation. Every one hour, CloudTrail creates a file per region in my S3 bucket with all the hashes of the files inserted in my bucket in the past hour. Also, CloudTrail signs the Digest with the RSA algorithm, using a private key, and puts the sign inside the metadata of the Digest file itself. Digest With this mechanism, if I want, I could validate 2 important things about my log files: . I have the hashes of all files. I could generate my own hashes of files and compare them with hashes in the . Log files weren't modified by someone else Digest file . is singed with a private RSA key, that only the CloudTrail service has access to. Log files were generated by CloudTrail Digest file I don't need to validate on my own (I could if I want), it's easiest to use AWS CLI to perform the validation, using this command: aws cloudtrail validate-logs --trail-arn <trailARN> --start-time <start-time> [--end-time <end-time>] [--s3-bucket <bucket-name>] [--s3-prefix <prefix>] [--verbose] I also could use this command as proof for compliance standards auditions. In new trails created by CloudTrail, log validation is enabled by default, so you don't need to do anything. But in old trails, maybe you need to activate this feature in the console or via API. The digest files are put into a folder separate from the log files. This separation of digest files and log files enables you to enforce granular security policies. A very important point that I've done is separate permission of logs from permissions of Digest files. I don't want anybody could touch these files because if someone would delete them, I wouldn't validate any log files in the bucket. So, I decided to enforce this control on bucket policy. I've denied all users to delete Digest files, and limited bucket policy edit permission to just one user in the account. Apart from that, I enabled protection on Digest objects to prevent accidental deletion or malicious activity from a compromised user. MFA delete Take care of sensitive data PII is a good example of sensitive data that could end up inside logs. Suppose that you are tagging resources with employee's information, like full name and email address. When something happens, cloudtrail will log all the activity, including the tags that are associated with your resources, and the PII data that it includes with them. If this is your case, and you have to make sure that nothing ends up inside logs, you could send logging data to kinesis for stripping high sensitive information from logs. Cloudtrail doesn't support native kinesis integration, but you can configure a lambda trigger inside the S3 bucket for every object inserted and Lambda will send it to kinesis for further processing. Why are you sending logs to kinesis and not processing directly from Lambda? Simply, because if something happens with lambda, and it stops processing my logs, I wouldn't know where to start again. But if I send data to kinesis, the Lambda function that sends the data has a simpler logic and is faster. After that, I could strip, aggregate, or transform my logs with a more complex Lambda function that is integrated into the kinesis flow. Alerts with CloudWatch With rule matching, I can get alerts of activity in my environment and I can react very fast to respond to incidents and stop them. Cloudtrail has a feature to send logs directly to Cloudwatch, I just need to specify the Cloudwatch log group inside trail configuration. After that, inside Cloudwatch, I can set up rule matching patterns for logs inside the log group, like detecting root activity usage, or launching instances in a region that my company doesn't allow. It's the simplest way to set up alerts, but I should take care of storage costs for Cloudwatch. It could be very expensive if I store logs there for a long period. So, to avoid thousands of dollars in the bill (and probably get fired for that), I decided to delete logs after a short period of time. The reason is that I only need logs in Cloudwatch just for the alerts, if nothing matches, I could delete them (because I have a copy of the logs stored in S3). Query logs with SQL Is that possible? Are you kidding? Millions of logs won't fit in a relational DB. Yes, you're right, too much volume for a relational DB. But... with Athena, I am not using a relational DB, I am using s3 as my storage, and using a presto-as-a-service (Athena) to query logs stored in s3. If I centralize logs in one bucket and divide the data in such a way that I could separate data (for example, using accounts as tables), I could query millions of logs in a matter of minutes. Athena let me run multiple queries in parallel, it's useful when you are running playbooks for incident response, and at the same time, a lambda function for detecting anomalous activity is running their queries. I consider this alternative as the best fit for incident response, and also for alerts when you have millions of logs, and you can't manage them with Cloudwatch. In the future I'll publish an entire article dedicated to this topic, it's fascinating and it has a lot of complexity itself. Prevent log deletion S3 has an interesting feature that is . It prevents that object could be deleted from your bucket, even if you have the right permissions to execute the delete action. It works at the version object level, this means that I can only lock a specific version of the object. object locking There are two modes of locking, governance, and compliance. The main difference between them is that the compliance mode is stricter than governance. In compliance mode, . nobody could deactivate or bypass the locking, even the root account I could enable object locking as a bucket default configuration, which means that each new object put on the bucket will have a locking, no matter who executed it. It's a good weapon to prevent log tampering in your environment. It's so common that malicious actors modify or delete your logs to hide their activity, but with this feature, you are securing your logs to prevent deletion. Final thoughts I hope that you've learned something new with my post, and if this is your case I encourage you to become a member of my awesome telegram channel.

10 Things I Did To Increase CloudTrail Logs Security

In this article, I’m will talk about how you can build a application using (SAM) to perform Log Analytics on AWS data using . The Serverless Application will help you analyze CloudTrail Logs using Amazon Elasticsearch Service. The application creates CloudTrail trail, sets the log delivery to an s3 bucket that it creates and configures SNS delivery whenever the CloudTrail log file has been written to s3. The app alsocreates an Amazon Elasticsearch Domain and creates an Amazon Lambda Function which gets triggered by the SNS message, get the s3 file location, read the contents from the s3 file and write the data to Elasticsearch for analytics. Serverless AWS Serverless Application Model CloudTrail Amazon Elasticsearch Service AWS AWS Let’s learn about what is AWS CloudTrail, Elasticsearch, Amazon Elasticsearch Service, AWS Lambda and AWS SAM. What is AWS CloudTrail? AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line , and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. tools _AWS CloudTrail allows you track and automatically respond to account activity threatening the security of your AWS…_aws.amazon.com AWS CloudTrail What is Elasticsearch? Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected. _Distributed, open source search and analytics engine designed for horizontal scalability, reliability, and easy…_www.elastic.co Elasticsearch: RESTful, Distributed Search & Analytics | Elastic What is Amazon Elasticsearch Service? Amazon Elasticsearch Service makes it easy to deploy, secure, operate, and scale Elasticsearch for log analytics, full text search, application monitoring, and more. Amazon Elasticsearch Service is a fully managed service that delivers Elasticsearch’s easy-to-use APIs and real-time analytics capabilities alongside the availability, scalability, and security that production workloads require. _Use Amazon Elasticsearch Service to easily deploy, operate and scale Elasticsearch on AWS. Launch your Amazon…_aws.amazon.com Amazon Elasticsearch Service — Amazon Web Services (AWS) What is AWS Lambda? AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume — there is no charge when your code is not running. With Lambda, you can run code for virtually any type of application or backend service — all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app. _AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume._aws.amazon.com AWS Lambda — Serverless Compute — Amazon Web Services What is AWS Serverless Application Model? AWS Serverless Application Model (AWS SAM) prescribes rules for expressing Serverless applications on AWS. The goal of AWS SAM is to define a standard application model for Serverless applications. _serverless-application-model — AWS Serverless Application Model (AWS SAM) prescribes rules for expressing Serverless…_github.com awslabs/serverless-application-model Now let’s look at how we can build a Serverless App to perform Log Analytics on AWS CloudTrail data using Amazon Elasticsearch Service. This is the architecture of the CloudTrail Log Analytics Serverless Application: Architecture for Serverless Application: CloudTrail Log Analytics using Elasticsearch AWS Serverless Application Model is a AWS template. Before we look at the code for SAM template, let’s work on packaging our AWS Lambda. Cloudformation On your workstation, create a working folder for building the Serverless Application. Create a file called index.py for the AWS Lambda: """ This module reads the SNS message to get the S3 file location for cloudtraillog and stores into Elasticsearch. """ from __future__ import print_functionimport jsonimport boto3import loggingimport datetimeimport gzipimport urllibimport osimport traceback from StringIO import StringIOfrom exceptions import * # from awses.connection import AWSConnectionfrom elasticsearch import Elasticsearch, RequestsHttpConnectionfrom requests_aws4auth import AWS4Auth logger = logging.getLogger()logger.setLevel(logging.INFO) s3 = boto3.client('s3', region_name=os.environ['AWS_REGION']) awsauth = AWS4Auth(os.environ['AWS_ACCESS_KEY_ID'], os.environ['AWS_SECRET_ACCESS_KEY'], os.environ['AWS_REGION'], 'es', session_token=os.environ['AWS_SESSION_TOKEN'])es = Elasticsearch(hosts=[{'host': os.environ['es_host'], 'port': 443}],http_auth=awsauth,use_ssl=True,verify_certs=True,connection_class=RequestsHttpConnection) def handler(event, context):logger.info('Event: ' + json.dumps(event, indent=2)) s3Bucket = json.loads(event\['Records'\]\[0\]\['Sns'\]\['Message'\])\['s3Bucket'\].encode('utf8')  
s3ObjectKey = urllib.unquote\_plus(json.loads(event\['Records'\]\[0\]\['Sns'\]\['Message'\])\['s3ObjectKey'\]\[0\].encode('utf8'))

logger.info('S3 Bucket: ' + s3Bucket)  
logger.info('S3 Object Key: ' + s3ObjectKey)

try:  
    response = s3.get\_object(Bucket=s3Bucket, Key=s3ObjectKey)  
    content = gzip.GzipFile(fileobj=StringIO(response\['Body'\].read())).read()

    for record in json.loads(content)\['Records'\]:  
        recordJson = json.dumps(record)  
        logger.info(recordJson)  
        indexName = 'ct-' + datetime.datetime.now().strftime("%Y-%m-%d")  
        res = es.index(index=indexName, doc\_type='record', id=record\['eventID'\], body=recordJson)  
        logger.info(res)  
    return True  
except Exception as e:  
    logger.error('Something went wrong: ' + str(e))  
    traceback.print\_exc()  
    return False Create a file called requirements for the python packages that are needed: elasticsearch>=5.0.0,<6.0.0requests-aws4auth With the above requirements file created in your workspace, run the below command to install the required packages: python -m pip install -r requirements.txt -t ./ Create a file called template.yaml that will store the code for AWS SAM: AWSTemplateFormatVersion: '2010-09-09'Transform: 'AWS::Serverless-2016-10-31'Description: > This SAM example creates the following resources:

  S3 Bucket: S3 Bucket to hold the CloudTrail Logs  
  CloudTrail: Create CloudTrail trail for all regions and configures it to delivery logs to the above S3 Bucket  
  SNS Topic: Configure SNS topic to receive notifications when the CloudTrail log file is created in s3  
  Elasticsearch Domain: Create Elasticsearch Domain to hold the CloudTrail logs for advanced analytics  
  IAM Role: Create IAM Role for Lambda Execution and assigns Read Only S3 permission  
  Lambda Function:  Create Function which get's triggered when SNS receives notification, reads the contents from s3 and stores them in Elasticsearch Domain Outputs: S3Bucket:  
  Description: "S3 Bucket Name where CloudTrail Logs are delivered"  
  Value: !Ref S3Bucket  
LambdaFunction:  
  Description: "Lambda Function that reads CloudTrail logs and stores them into Elasticsearch Domain"  
  Value: !GetAtt Function.Arn  
ElasticsearchUrl:  
  Description: "Elasticsearch Domain Endpoint that you can use to access the CloudTrail logs and analyze them"  
  Value: !GetAtt ElasticsearchDomain.DomainEndpoint Resources:SNSTopic:Type: AWS::SNS::TopicSNSTopicPolicy:Type: "AWS::SNS::TopicPolicy"Properties:Topics:- Ref: "SNSTopic"PolicyDocument:Version: "2008-10-17"Statement:-Sid: "AWSCloudTrailSNSPolicy"Effect: "Allow"Principal:Service: "cloudtrail.amazonaws.com"Resource: "*"Action: "SNS:Publish"S3Bucket:Type: AWS::S3::BucketS3BucketPolicy:Type: "AWS::S3::BucketPolicy"Properties:Bucket:Ref: S3BucketPolicyDocument:Version: "2012-10-17"Statement:-Sid: "AWSCloudTrailAclCheck"Effect: "Allow"Principal:Service: "cloudtrail.amazonaws.com"Action: "s3:GetBucketAcl"Resource:!Sub |-arn:aws:s3:::${S3Bucket}-Sid: "AWSCloudTrailWrite"Effect: "Allow"Principal:Service: "cloudtrail.amazonaws.com"Action: "s3:PutObject"Resource:!Sub |-arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*Condition:StringEquals:s3:x-amz-acl: "bucket-owner-full-control"CloudTrail:Type: AWS::CloudTrail::TrailDependsOn:- SNSTopicPolicy- S3BucketPolicyProperties:S3BucketName:Ref: S3BucketSnsTopicName:Fn::GetAtt:- SNSTopic- TopicNameIsLogging: trueEnableLogFileValidation: trueIncludeGlobalServiceEvents: trueIsMultiRegionTrail: trueFunctionIAMRole:Type: "AWS::IAM::Role"Properties:Path: "/"ManagedPolicyArns:- "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"- "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"AssumeRolePolicyDocument:Version: "2012-10-17"Statement:-Sid: "AllowLambdaServiceToAssumeRole"Effect: "Allow"Action:- "sts:AssumeRole"Principal:Service:- "lambda.amazonaws.com"ElasticsearchDomain:Type: AWS::Elasticsearch::DomainDependsOn:- FunctionIAMRoleProperties:DomainName: "cloudtrail-log-analytics"ElasticsearchClusterConfig:InstanceCount: "2"EBSOptions:EBSEnabled: trueIops: 0VolumeSize: 20VolumeType: "gp2"AccessPolicies:Version: "2012-10-17"Statement:-Sid: "AllowFunctionIAMRoleESHTTPFullAccess"Effect: "Allow"Principal:AWS: !GetAtt FunctionIAMRole.ArnAction: "es:ESHttp*"Resource:!Sub |-arn:aws🇪🇸${AWS::Region}:${AWS::AccountId}:domain/cloudtrail-log-analytics/*-Sid: "AllowFullAccesstoKibanaForEveryone"Effect: "Allow"Principal:AWS: "*"Action: "es:*"Resource:!Sub |-arn:aws🇪🇸${AWS::Region}:${AWS::AccountId}:domain/cloudtrail-log-analytics/_plugin/kibanaElasticsearchVersion: "5.5"Function:Type: 'AWS::Serverless::Function'DependsOn:- ElasticsearchDomain- FunctionIAMRoleProperties:Handler: index.handlerRuntime: python2.7CodeUri: ./Role: !GetAtt FunctionIAMRole.ArnEvents:SNSEvent:Type: SNSProperties:Topic: !Ref SNSTopicEnvironment:Variables:es_host:Fn::GetAtt:- ElasticsearchDomain- DomainEndpoint Packing Artifacts and uploading them to s3: Run the following command to upload your artifacts to S3 and output a packaged template that can be readily deployed to CloudFormation. aws cloudformation package \--template-file template.yaml \--s3-bucket bucket-name \--output-template-file serverless-output.yaml Deploying this AWS SAM to AWS CloudFormation: You can use CLI command to deploy the SAM template. Under-the-hood it creates and executes a changeset and waits until the deployment completes. It also prints debugging hints when the deployment fails. Run the following command to deploy the packaged template to a stack called : aws cloudformation deploy cloudtrail-log-analytics aws cloudformation deploy \--template-file serverless-output.yaml \--stack-name cloudtrail-log-analytics \--capabilities CAPABILITY_IAM Refer to the for more details. documentation I recommend reading about Elasticsearch Service Access Policies using the and modify the Access policy of the Elasticsearch domain to further fine tune the access policy. documentation Once the Serverless application is deployed in your AWS account, It will automatically store the AWS CloudTrail data into Amazon Elasticsearch Service as soon as the log is delivered to s3. With the data in Elasticsearch, you can use Kibana to visualize the data in Elasticsearch and create the dashboards that you need on the AWS CloudTrail data. The above Serverless Application Model app is available at the below Github repo: _cloudtrail-log-analytics — Cloudtrail Log Analytics using Amazon Elasticsearch Service — AWS Serverless Application_github.com ExpediaDotCom/cloudtrail-log-analytics

Serverless App: AWS CloudTrail Log Analytics using Amazon Elasticsearch Service

Let's learn about via these 60 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Compliance /Learn Repo 1. Promoting Reliable Decentralized Finance: An Interview with 2 Experts Ever since Bitcoin first came into play in 2008, the cryptocurrency space has never been deprived of concerns. 2. Bye-bye Google Fonts: German Court Rules That Google Fonts Is Not in Compliance with GDPR Google Fonts is a data privacy concern. Learn why you should care. 3. Astra Protocol Brings Decentralized Compliance to Sandbox's Metaverse by Setting up Compliance Hub Astra Protocol, a cutting-edge legal and compliance layer that provides unparalleled security to public blockchains, announced the launch of a Compliance Hub. 4. ‘It’s Never Too Late To Learn a New Language’: Yair Solow, CEO of Centraleyes Startup interview with Yair Solow, founder and CEO of Centraleyes. Learn more about the company and different solutions. 5. Blockchain Regulations Must Empower Those Outside the Traditional Banking System Banking and finance instruments have slowly evolved from being exclusively accessible to the fortunate few to becoming widely accessible to the masses, who are now able to transact with relative ease and accumulate wealth. 6. Worried About Your Crypto's Custody? Outsource Everything Except Key Management A year into my stint at the Bank of France, I was still struggling to understand why they employ cryptographers. One day, I saw them huddled around a white board for a few hours and struck up a conversation. They walked me through their highly sophisticated key management solution that included everything from certificate signing mechanisms to deep traffic inspection contraptions. Baffled by the complexity of it all, I resorted to my go-to cryptographer question - "So, where are the keys?". The key storage, as it turned out, was outsourced to "a cool startup here in Paris.” 7. The Pros And Cons Of Outsourcing Your Cybersecurity Compliance Whether they know it or not, any business with an internet-exposed edge has to take cybersecurity seriously. 8. Why We Need Regulatory Compliance in Web3 A conversation with Sakhib Waseem of Astra Protocol on why regulatory compliance is both needed and a positive development for the Web3 space as a whole. 9. How to Build a DevOps Culture Within Engineering Teams 10. Report: 10% of Crypto Exchanges have 'Good' Cybersecurity in Place 11. Conquer GDPR Article 32: Locking Down Data Segregation and Identity-Based Access Understand the importance and tools of implementation for data segregation through access control GDPR compliance to address Article 32. 12. Faster is Safer: How Software Physics Beats Human Psychology The idea that we make software safer by releasing it slower is an illusion. Here's why. 13. How Cloud Provider Compliance Affects Your Application Compliance Cloud is evolving fast and already becoming a significant part of the software ecosystems. With this growth, becoming compliant on standards such as ISO, PCI-DSS, HIPPA, builds confidence for you to trust the cloud in terms of security. 14. A Guide to HIPAA Compliance in 2021 & Its Benefits Following HIPAA laws provides a higher level of safety for your corporation and its leaders. 15. The Massive Uber Hack: Technical and Legal Implications In this article, I analyze the technical and legal implications of post-data breach, the risks & possible exonerations in the eyes of extent laws & regulations. 16. Concordium Blockchain valued at $4.45 Billion in its Last Private Sale is now Live Concordium is a public, layer-1, proof-of-stake blockchain with a unique ID layer at the protocol level to assist with regulatory compliance. 17. 3 Solutions for Sharing and Managing Your Zoom Recordings Recorded a Zoom meeting, now what? How do I efficiently share it with people around my organization? How do I restrict access to such a recording? I want my marketing team to only view this recording so how do I segregate access? 18. Providing Proof in an Untrusting World Dragonchain's hybrid platform provides blockchain-based measurable proof  for selective transparency, accountability, and regulatory compliance. 19. Compliance is Not a Guarantee Against Data Breach When it comes to combating the ever-growing threat posed by data breaches, most organizations believe that compliance is key. With cybercriminals targeting governments, small businesses, and other essential infrastructure- the need to minimize the impact of these attacks is at an all-time high. 20. 10 Factors to Prepare for CCPA (California Consumer Privacy Act) Be ready for CCPA with these top 10 critical factors 21. Readable Legal Documents Are No Longer a "Nice-to-Have" By writing your company’s privacy policy in a clear and structured way, you influence how privacy policies are written and designed in huge organizations. 22. Cloud Compliance And Regulation Resources Customers and Cloud Service Provider (CSP) share the responsibility of security and compliance. Thus, the organization would have the freedom to have architect their security and compliance needs, according to the services they utilize from the CSP and the services they intend to achieve. CSP has the responsibility to provide services securely and to provide physical security of the cloud. If, however, a customer opts for Software-as-a-service, then the CSP provides standard compliance. Still, the organization has to check if it meets its regulations and compliance levels to strive to achieve. All Cloud services (such ad different forms of databases) are not created equal. Policies and procedures should be agreed upon between CSP and client for all security requirements and operations responsibility. 23. How to Optimize Your Salesforce Security Companies implementing Salesforce’s internal security solutions may find their customizations limit visibility into the risks that can impact other processes. 24. How Website Accessibility Affects Your Tech Brand’s Reputation and Success If your website isn't easily accessible by readers with disabilities, you aren't only losing revenue opportunities, but you’re at risk of legal problems. 25. Data Leak Prevention with Databunker We hear the horror stories of data leaks almost every day. Some require a sophisticated attack to gain shell access to the servers. Some happen over the web using the SQL injections in the web apps. As a result of this attack, your customer data can be dumped and personal data leaked. 26. How does IT Process Automation Help in Improving Business Productivity Discover how IT process automation help in improving business productivity. 27. 8 Cloud Compliance Frameworks and Why Cloud-based Organizations Need Them Cloud compliance frameworks help an organization to keep its database secure and private. In this article, you will eight such frameworks that can guide you. 28. Your CI System is a Terrible Compliance System of Record - Here are 5 Reasons Why Jenkins, GitLab, Travis, Circle CI are great for DevOps but not so great for your compliance records - here's why. 29. Establish Your Data Team Early Using These Tools and Techniques Start building your data strategy team and architecture as soon as you can. A one-person data team can make a massive difference to your success as you grow. 30. The deal requires Twitter to be compliant with Musk's request. But not with "past practice" Twitter v. Elon Musk Court Filing is part of our Legal PDF series. Part 10 of 31.FACTUAL ALLEGATIONS-The Final, Agreed-upon Term-Ordinary Course Covenant 31. New Data Privacy Laws Are an Opportunity, Not a Threat The New York Times declared the 2010s as “The Decade Tech Lost Its Way.” And it’s easy to agree when you look back at the Cambridge Analytica scandal, tech companies who consistently got off easy after privacy violations and the rise of sweeping new regulations to protect personal data. 32. How a Data Privacy API Abstracts and Simplifies Privacy and Compliance Data privacy and compliance are hard! Let a data privacy API help. 33. SOC 2 for Startups: Save Time and Money In The Long Run There is no better time for startups to undergo a SOC 2 Examination. See the top reasons how a SOC 2 audit can boost your startup. 34. FTC Mandates for Direct-Selling and Ecommerce Industries Ensuring legal compliance is crucial for direct selling companies to avoid legal issues and maintain the trust of their customers and distributors. 35. An Overview of Legal Compliance as a Service How to automate compliance with legal software. 36. Multi-Cloud Environment and Hurdles of Incorporating IAM Understand the aspects of deploying IAM in multi-cloud environments and how businesses can ensure maximum security and privacy while moving to the cloud. 37. How to Ensure your SaaS is Compliant - For Developers This article reviews what kinds of compliance certifications and regulations exist, what they mean for developers, and how to begin the certification process. 38. "Hackers Need To Get Lucky Only Once" - Excerpts on Fighting Crypto Hacks, Theft and Fraud What do trust & safety leaders expect in 2022 with the rise of blockchain and crypto? Find out why next year is the year for compliance, regtech, trust & safety 39. How Compliance Management System Tools Are Changing the Compliance Landscape Compliance management system tools are changing the compliance landscape. 40. 5 Things You Need to Know About CCPA Compliance The California Consumer Privacy Act (CCPA) is meant for those companies to comply with which have customers in the Golden State. The statute “represents a shift in perspective” for data. The state legislature has certain aspects that must be taken seriously by compliance practitioners if their companies are to be in compliance with it. 41. CCPA: Compliance Issue and Major Fraud Risk The California Consumer Privacy Act (CCPA) signals a major step in online privacy rights for California consumers and will likely make its way onto the national scene in the near future. In fact, research shows that 80 percent of businesses predict that CCPA will become national law at some point in the next five years. 42. How a Data Privacy Vault Protects PHI for Healthtech Users With healthcare apps and wearables that gather customer PHI, healthtech companies need a data privacy vault to ensure HIPAA compliance and build customer trust. 43. International Tech Sanctions: A Summary for Startup Founders In this article I'll give you a quick overview of the concept of international sanctions, how they work and how it may impact a FinTech company, especially from the standpoint of technical implementation and tools. 44. 10 Things I Did To Increase CloudTrail Logs Security It's crucial to safeguard CloudTrail logs and enhance the security of them, to meet compliance regulatory requirements and internal business needs. 45. Crypto's Value Is Not Relevant To Investigators, Criminals Are The UN estimates $2 trillion annually is involved in money laundering, and a small but significant percentage is done with crypto. Despite the crypto winter... 46. An In-depth Look at Shadow IT How should IT departments respond to shadow IT? Is it realistic, or even practical, to track 100% of all IT resources? Should there be a more managed approach? 47. 3 Ways to Share and Manage Zoom Recordings Recorded a Zoom meeting, now what? How do I efficiently share it with people around my organization? How do I restrict access to such a recording? I want my marketing team to only view this recording so how do I segregate access? 48. People, Not Systems, are the Real Vulnerabilities in the Workplace Why companies need to reevaluate cybersecurity to reduce risks within the flow of work. Remote work and SaaS apps make securing people more important than ever. 49. Why Websites Need To Be ADA Compliant Did you know when a company website is not ADA Compliant, a lawsuit can be filed? 50. How to Build a Compliance Culture by Improving Employee Engagement in Your Company Creating a culture of compliance means that the organization understands that compliance is critical. 51. Understanding The Importance of SOC2 Compliance for Data Centers Businesses rely on Data Center SOC2 Audit Reports for critical business decisions concerning outsourcing services. It helps customers build a sense of trust. 52. Ethereum High Transaction Fees Discourages New Participants From Entering the Ecosystem This article talks about blockchain, FATF and NFTs. 53. 10 Important 409a Valuation Compliances to Know In this article, we will discuss some of the important considerations in the 409A valuation in order to comply with the law. 54. What Makes Zero Trust Better And Different From Traditional Security Traditional vs zero trust? Learn how zero trust outperforms the traditional model by delivering improved security, flexibility and reduced complexity. 55. LCX Announces Venture Program To Invest Up To $2.5M In Compliant Token Sales At the core of LCX’s infrastructure is their native LCX Token, aiming to elevate the platform to greater heights. 56. 5 Tips for Integrating Security into Development: Part 2 In this second part of our series, we explain five additional tips to help you code more securely, from leveraging existing frameworks to protecting data. 57. Regulatory compliance needs to become mandatory for all cryptocurrency exchanges Regulatory compliance needs to become mandatory for all cryptocurrency exchanges 58. How Novel Technology Boosts Compliance in Pharma Compliance programs aim to promote transparency, safety, and efficacy in the industry. However, achieving compliance in pharma can be complex and costly. 59. Newsflash - "People with AWS Console Access Tend to Change Things" This blog post is a written transcript of the FOSDEM Talk: “Infrastructure drifts aren’t like Pokemon, you can’t catch ’em all”, by Stephane Jourdan – CTO and founder 60. Building a MongoDB NoSQL E-Commerce Data Model MongoDB supports ACID transactions, and its cloud offering is PCI DSS compliant. It's one of the best NoSQL options for e-commerce. Thank you for checking out the 60 most read stories about Compliance on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

60 Stories To Learn About Compliance

Let's learn about via these 44 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Logging /Learn Repo 1. Five Guidelines for Robust Logging This article describes best practices for standardized logging from the point of view of performance, debuggability, and security. 2. How to Remove Console Statements From Production Build in 3 Easy Ways Console statements create performance or security issues if you mishandle them. This article explains three ways to remove them from your production build. 3. Logging in Observability - Part 2 In this article, I want to describe how to work with logs, analyze them in the command line, and we will consider new modern tools to visualize logs. 4. Top Debugging Methods for Quicker Deployment in Python In this article, I will cover most debugging methods, basic and modern ones, introduce some hands-on tools and show some basic configurations and instructions. 5. Bugsnag's Diagnostics Tools Benefits Eventbrite As Eventbrite neared the release of their rewritten platform in React.js, they knew observability on the frontend was a problem they needed to solve. 6. Logging Everything in JSON Format Logging and monitoring are like Tony Stark and his Iron Man suit, the two will go together. Similarly, logging and monitoring work best together because they complement each other well. 7. Dead Letter Queue no Elastic Stack Melhore a obsevabilidade da sua Stack Elastic, baseado em fatos reais 8. Sending Events and Logs to Discord via Python How to Send your Events and Logs to Discord via Python 9. Getting Started Debugging Spring Transactions in Production We use annotations to denote transactional behavior in modern Spring so we have no code, no failure, no debugging... But is it really? 10. About History and Irony of Logging (in) The story of event logging begins at sea and is related to navigation. One of the important aspects of navigation is <a href="https://en.wikipedia.org/wiki/Dead_reckoning" target="_blank">dead reckoning</a>: estimating your current position based on course, speed and time from a known, observed point. In the end of 15th century, speed at sea was measured with a small wooden log. A so-called ‘Dutchman’s Log’ was dropped overboard from the bow of the ship and the navigator measured the time elapsing before it passed the stern. 11. Let's Build a Telegram Bot in Rust. Part 1 Building telegram bot using Rust. 12. Logging in Observability - Part 1 rsyslog vs journald vs filebeat 13. Small-scale Logs Processing and Analysis Occasionally you need to process some HTTP server logs and extract analytical data from them. 14. Tail logs from multiple Kubernetes pods the simple way Kubernetes (a.k.a K8s) is the de-facto standard of container orchestration software backed by Google and one of the most active open source projects. If you are using Docker it is very likely that you are using Kubernetes or at least have heard about it. 15. Microservice.add(observability) != Microservice.add(monitoring) You are reading this content, which means that you are not novice to the microservices field. So let me just  scratch the surface of it before moving to Observable Microservices.  Once upon a time Monolith Application was now transformed into Microservices based application. 16. Logging Without Tears Learn standard practices you should take advantage of when dealing with logging. Make the logging great again. 17. What is Production Blindness? Cloud rose to fame on the banner of cutting costs but with its tremendous growth the spend is rocketing. Learn how you can cut down overspend. 18. 5 Tips to Effectively Monitor Heroku Applications Heroku differentiates itself from other cloud providers, by offering a complete, cohesive environment. Where AWS and GCP present a decoupled toolkit, Heroku strives for a seamless, UI-driven experience for the user. This philosophy is clearly embodied in its metrics functionality, which is often a single click or basic configuration file away. 19. Top 6 Golang Logging Best Practices Let’s discuss a few rules of thumb for logging in Go, as well as some features you may not have heard of that can make debugging easier. 20. A Brief Introduction to Commit Logs Logs are everywhere in software development. Without them there’d be no relational databases, git version control, or most analytics platforms. 21. How to Power Up Your Logging in JavaScript Power up your logging and build good developer habits. As your codebase grows you'll need to debug it more easily and one tool is logging. 22. Get Started With Sidekick Open Source Live Debugger in 5 Mins Sidekick is a live application debugger that lets you troubleshoot your applications while they keep on running. Here is how you can start using it in 5 minutes 23. How to Archive Web Chat Messages with Amazon IVS Chat Logging In our last post, we looked at how to auto-record Amazon Interactive Video Service (Amazon IVS) live streams to an Amazon Simple Storage Service bucket. 24. The 10 Best Node.js Logging Libraries 10 of the best Node.js logging libraries + how to get up and running with them. 1. Pino, 2. Winston, 3. Bunyan... 25. Power Up Your Logging in Node.js Power up your logging and build good developer habits. As your codebase grows you'll need to debug it more easily and one tool is logging. 26. Custom Log Processor Integration – Fluentd vs Vector.dev By writing your tool, you gain more customization options, versatility, and other enhanced capabilities that can enrich your processing. 27. Observability vs Monitoring: What's the Difference? Monitoring has been a basic system to track the health of servers for years. Now it is not enough. 28. Logging Vs. Monitoring: Best Practices for Logging [Part 2] Logging and Monitoring… this I tell you, brother. You can't have one without the other. 29. To Log Or Not To Log, Is The (Eternal) Question An alternative logging strategy to make loggers your friends, not enemies 30. What VPN services aren’t telling you about data logging Can you think of any popular VPN service out there that doesn’t have a big “NO LOGGING” tag attached right on front of it? 31. Let's Export Cloudwatch Logs to ELK Cloudwatch is an AWS service that allows storage and monitoring of your application logs from an array of AWS services. This can be really useful for creating alerts to notify developers when a certain threshold of errors has been hit, but sometimes we might need to deeply analyse our logs, not only to spot errors but to find insights into our application and improve performance. This is where an ELK (Elasticsearch, Logstash, Kibana) stack can really outperform Cloudwatch. ELK allows us to collate data from any source, in any format, and to analyse, search and visualise the data in real time. 32. How To Find Your Docker Logs There’s a short answer, and a long answer. The short answer, that will satisfy your needs in the vast majority of cases, is: 33. Instrumention and Monitoring API in Node.js The concept of instrumentation often refers to tracing where events happen in an application. Many application performance monitoring (APM) tools use it to provide metrics on the inner workings of your application. But sometimes, all you really need are details about API calls. 34. Top 6 Factors to Consider When Designing Automated Test Architecture The beginning of automated tests in a project is easy and difficult at the same time. You can start smoothly, using base architecture, simple tests and more. 35. 10 Things I Did To Increase CloudTrail Logs Security It's crucial to safeguard CloudTrail logs and enhance the security of them, to meet compliance regulatory requirements and internal business needs. 36. Microservice Observability Patterns [Part 1] Logging is one of the most important parts of software systems. Whether you have just started working on a new piece of software, or your system is running in a large scale production environment, you’ll always find yourself seeking help from log files. Logs are the first thing people look for when something goes wrong, or something doesn’t work as expected. 37. Fixing Logging Issues In ASP.NET: TelemetryClient Vs. ILogger TelemetryClient vs ILogger or how to improve logging experience in C# ASP.NET for Application Insights 38. Logging Vs. Monitoring: An Introduction [Part 1] Logging and Monitoring… this I tell you, brother. You can't have one without the other. 39. 5 Tips for Integrating Security into Development: Part 2 In this second part of our series, we explain five additional tips to help you code more securely, from leveraging existing frameworks to protecting data. 40. The Essential Guide to Logging With PHP In this tutorial, we will look at PHP logging. Specifically, we will learn how to configure logs, how to show logs, and how to employ best logging practices. 41. The Best Solution Ever For Application Monitoring Just because we do something one way, doesn’t always mean it is the right way … or even the best way. 42. Why NPM and Yarn f*cking suck Opinion piece: What we can learn about documentation and logging 43. Object-Oriented Design: Refactoring a REST Connector In this story we will try to see how to improve a simple REST connector that places a request on an external service through an HTTP POST call and returns the result back from the remote server.
The full example can be found here.
Following is the source code for our connector (Connector1): 44. Standardization of Performance Monitoring, Logging, & Exception Handling via a .NET Runtime Wrapper Several years ago, I wanted to have my own performance monitoring solution, so I could monitor all enterprise applications. Few enterprises implement this core cross-cutting application task across the enterprise in the same way. By the phrases “core” and “cross-cutting” I mean a feature or functionality set that touches all application development; it’s not specific to a single application. I think some functionality that is repeated across the enterprise should be done the same standard way. Thank you for checking out the 44 most read stories about Logging on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

44 Stories To Learn About Logging

AWS Best Practices for SOC 2 Compliance Strengthening Your AWS Cloud Environment Organizations are increasingly leveraging cloud services to store, process, and manage their sensitive data. As a result, adhering to industry-standard or reporting frameworks like Service Organization Control (SOC) 2 has become paramount. Service Organization Control 2 (SOC 2) is an essential auditing framework that ensures cloud service providers adhere to stringent security measures. compliance Maintaining a secure and compliant infrastructure is crucial to building trust with your customers and safeguarding your organization’s reputation. In this article, we will explore AWS security best practices for SOC 2 compliance, helping you protect your data, systems, and applications in the cloud. AWS Security Best Practices for SOC 2 1. Understand the SOC 2 Framework To effectively implement AWS Security Best Practices for SOC 2, organizations must first understand the SOC 2 framework. There are five Trust Services Categories (TSC) that SOC 2 covers: : Ensuring that information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems. Security : Ensuring that information and systems are available for operation and use. Availability : Ensuring that system processing is complete, valid, accurate, timely, and authorized. Processing Integrity : Ensuring that information designated as confidential is protected as agreed upon. Confidentiality : Ensuring that personal information is collected, used, retained, disclosed, and disposed of to meet the entity’s objectives. Privacy 2. Implementing the Shared Responsibility Model AWS follows a shared responsibility model, where AWS is responsible for the security of the cloud, and the customer is responsible for security in the cloud. In the context of SOC 2 compliance, customers should ensure that they are adequately managing their part of the shared responsibility model by implementing proper security controls. 3. Implement AWS Identity and Access Management (IAM) Best Practices One of the essential AWS security best practices for SOC 2 is enforcing the principle of least privilege. Use AWS IAM to create roles, groups, and policies that grant users and applications the minimum necessary permissions to perform their tasks. Enable multi-factor authentication (MFA) for all IAM users, especially those with elevated permissions, and implement role-based access control (RBAC) using IAM roles. Regularly review and update these policies to ensure they remain appropriate for your organization’s needs. Also implement account password policies, such as minimum password length, complexity, and expiration requirements. 4. Encrypt Data at Rest and in Transit Protecting your data’s confidentiality and integrity is crucial for SOC 2 compliance. Use AWS services like Key Management Service (KMS), AWS CloudHSM, and Server-Side Encryption (SSE) to encrypt data at rest with Amazon S3, and ensure encryption is enabled for data in transit between services, applications, and end-users, using SSL/TLS. Regularly rotate encryption keys and store them securely, either in AWS KMS or AWS CloudHSM. Use AWS PrivateLink to establish private connections between your AWS resources, reducing the risk of data exposure over the public internet. 5. Centralize Logging and Monitoring with AWS CloudTrail and Amazon CloudWatch Maintaining visibility into your AWS environment is essential for SOC 2 compliance, detecting potential security incidents and continuously assessing the security, availability, and performance of your services. Centralize logging and monitoring using AWS CloudTrail, which records AWS API calls, and Amazon CloudWatch, which collects metrics, logs, and events from your AWS resources. These services provide you with the necessary insights to ensure SOC 2 compliance and enable a proactive response to potential security threats. 6. Secure Your Amazon S3 Buckets Amazon Simple Storage Service (S3) is a widely used storage solution for many organizations. Securing your S3 buckets is vital for SOC 2 compliance. Implement proper access controls, enable encryption, and regularly review your bucket policies to ensure that only authorized users can access your data. Additionally, use Amazon S3 Block Public Access to prevent accidental exposure of your data to the public internet. 7. Protect Your Web Applications with AWS WAF Web applications can be a prime target for cyberattacks. One of the AWS security best practices for SOC 2 is using AWS Web Application Firewall (WAF) to create custom rules that define and enforce security policies. AWS WAF helps protect your applications from common web exploits like SQL injection, cross-site scripting (XSS), and distributed denial of service (DDoS) attacks. Regularly review and update your WAF rules to stay ahead of emerging threats. 8. Automate Infrastructure Management with AWS CloudFormation Automating your infrastructure management is a vital AWS security best practice for SOC 2 compliance. Use AWS CloudFormation to define and manage your infrastructure as code, ensuring consistency, repeatability, and adherence to your organization’s policies and requirements. This approach simplifies change management, reduces human error, and enables easy rollback to previous configurations if needed. 9. Regularly Perform Vulnerability Assessments and Penetration Testing Conduct regular vulnerability assessments and penetration tests to identify and remediate potential security risks in your AWS environment. Use AWS services like Amazon Inspector and Amazon GuardDuty to monitor your infrastructure continuously for potential vulnerabilities and threats, and configure AWS Config to track resource configurations and compliance. 10. Ensure Network Segmentation with Amazon VPC Create isolated and secure network environments using Amazon Virtual Private Cloud (VPC). Implement security groups and network access control lists (ACLs) to control inbound and outbound traffic. This helps prevent unauthorized access and limits the potential impact of security incidents. Implement data classification and labeling policies to identify and protect sensitive information. 11. Establish an Incident Response and Recovery Plan Create an incident response playbook outlining roles, responsibilities, and procedures. Regularly test and update your plan, and leverage AWS services like AWS Lambda, Amazon SNS, and Amazon SQS for automated incident response. Use Amazon RDS snapshots and Amazon EBS snapshots for data backup and recovery. 12. Use AWS Organizations for Multi-Account Management Leverage AWS Organizations to create a multi-account structure, segregating environments and workloads, and enhancing security through separation of duties. 13. Implement AWS Shield for DDoS Protection Employ AWS Shield to protect your infrastructure from Distributed Denial of Service (DDoS) attacks, ensuring the availability and performance of your applications. 14. Leverage Availability Zones Leverage AWS’s global infrastructure by deploying your applications and data across multiple Availability Zones and Regions. 15. Implement Centralized Security Management Take advantage of AWS Security Hub to gain a centralized view of security alerts, compliance status, and actionable insights across your AWS accounts. 16. Regularly Review and Update Security Policies Continuously evaluate and update your AWS security policies and permissions, removing unnecessary access and ensuring compliance with the latest AWS Security Best Practices for SOC 2. Implementing these AWS security best practices for SOC 2 compliance will help you maintain a secure and compliant cloud environment. By following these recommendations, you can effectively manage risks and protect your organization’s sensitive data, systems, and applications hosted on AWS. Always remember that achieving SOC 2 compliance requires a comprehensive approach, encompassing not only technical controls but also organizational policies, procedures, and practices. Please if you would like to learn more about how Audit Peak can assist you with your SOC 2 compliance or for a free consultation. reach out The featured image for this article was generated with Kadinsky v2 Prompt: Illustrate Cloud Security Also published here.

Best Practices for SOC 2 Compliance on AWS

Prácticas recomendadas para el cumplimiento de SOC 2 en AWS

Meilleures pratiques pour la conformité SOC 2 sur AWS

एडब्ल्यूएस पर एसओसी 2 अनुपालन के लिए सर्वोत्तम अभ्यास

AWS での SOC 2 コンプライアンスのベストプラクティス

Práticas recomendadas para conformidade com SOC 2 na AWS

Các phương pháp hay nhất để tuân thủ SOC 2 trên AWS

AWS 上 SOC 2 合规性的最佳实践

Every SaaS provider goes through the review process before the integration phase with a large or medium-scale business. This is especially important for American corporations but is also widely accepted worldwide. had its own experience with the SOC2 certification while working with . WebLab Technology Shaman BV Why not ISO 27001? ISO 27001 is a standard for ensuring proper management of digital assets such as financial information, intellectual property, employee details, or information entrusted by third parties. SOC 2 is more widely accepted and is usually preferred by US and Canadian companies. Also, I find it helpful that SOC is split into SOC 1 and SOC 2. First stands for financial control. So, SaaS Providers could focus only on SOC 2. During a SOC 2 certification, a company is evaluated against a set of trust service categories that provide the backbone of the assessment: . Systems and the data stored are protected against unauthorized access and disclosure. Security . Information and systems are available for operation and use. Availability . Confidential information is protected. Confidentiality System processing is complete, valid, accurate, timely, and authorized. Customer data remains correct throughout data processing. Processing integrity. . Personal information is collected, used, retained, disclosed, and disposed of by pre-stated policies. Privacy SOC 2 Technical Components It’s important to understand that SOC 2 is not only about security. Data managed by SaaS providers could be crucial for businesses as a whole. Depending on the integration depth, even a short-term outage might lead to considerable financial or reputational losses. That’s why it is essential to ensure that a SaaS provider maintains best practices. SOC 2 consists of numerous control points, for example: Host-based vulnerability scans are performed at least quarterly on all external-facing systems. Critical and high vulnerabilities are tracked to remediation. The company utilizes a log management tool to identify events that may potentially impact the company’s ability to achieve its security objectives. The company’s penetration testing is performed at least annually. A remediation plan is developed, and changes are implemented to remediate vulnerabilities in accordance with SLAs. And so on. In total, at the moment, there are 235 similar technical control points. Control point statuses should be regularly updated and maintained. SOC 2 Type 1 & 2 SOC 2 is represented in Type 1 and Type 2. Type 1 stands for a point-in-time audit on a date chosen with the audit request. It is reasonable to plan for at least six months to prepare for Type 1. Type 2 shows how controls operate over a period of time, usually 6–12 months after Type 1. During this process, the auditor goes through all control points in the historical view. However, suppose there are misses for control points for a substantial period. Then, even if it successfully passes control points at this very moment, it is possible that the auditor would request an additional 6–12 months. Consistency is required. SOC 2 is not about technical points SOC 2 has numerous administrative principles: Management: The entity identifies risks. The entity internally communicates information, including objectives and responsibilities for internal control. The entity communicates with external parties, including clear risk identification. Board of directors: The board of directors demonstrates independence from management. Management establishes, with board oversight, structures and reporting lines. HR: The entity demonstrates a commitment to attracting, developing, and retaining competent individuals in alignment with its objectives. The entity holds individuals accountable for their internal control responsibilities. The list of principles is not complete. These principles reduce to numerous more concrete control points. Apart from a strong team, you need tooling and processes. It is not one-time work — it is constant maintenance. We should ensure that change and control are not just something that is only talked about. There is an excellent quote from. We had to introduce dozens of policies, improve architecture and introduce numerous monitoring solutions like , , , and . Trendmicro Conformity Wazuh Sentry DataDog We prefer to work with AWS, so we have also been using a dozen of their tools, like , , , , , etc. AWS Inspector AWS WAF AWS KMS AWS Secrets Manager AWS CloudTrail But the biggest game changer is . They provided us with a better preparation framework and continuous monitoring of security and compliance. Vanta We also find the a good starting point, even if SOC2 is not yet required. Operational, Security, Reliability, and Sustainability pillars heavily overlap with what is expected in SOC2. AWS Well-Architected Framework And finally — how to set up for success? Like with many other things, you need Team, Approach, and Process. Hire a skilled R&D team with DevOps and SysOps. A subteam should be allocated to be responsible for preparing for SOC 2 with clear leadership. Get a security consultant. It is better to choose an external consultant or a company. For most SaaS companies, having a full-time security specialist on the team is overkill. Have clear timelines. Expect 6–12 months for Type 1 and another 6–12 months for Type 2. Start early, especially with documentation, policies, and architectural changes. Request Penetration testing early. Integrate frameworks and compliance monitoring tools. Audit time SOC auditors are independent certified public accountants (CPA) who work with the SOC suite to evaluate and report on the controls at a service organization. It is worth looking at , , . We in WebLab had been working with the first one. Sensiba San Filippo Seiler Hood & Strong There are numerous CPAs on the market. Suggested selection criteria: . It is wise to have a meeting with CPAs while choosing one. Even if they are highly professional, communication with some CPAs is smoother than with others. Communication . Some CPAs might not be available during the period you need. Timelines . If integration happens based on the request received from the client, they might also have some expectations. Client preference An audit for Type 1 takes a few weeks, usually up to 5. Good luck! About the author __ __is a Solution Architect and open-source believer with a big passion for Software Development. Oleksandr Knyga Oleksandr lives the life of a digital nomad. When not tapping on the keyboard, he can be found hiking, snowboarding, fishing, and exploring the city. Oleksandr has an MBA and a Computer Science Master’s degree. Also published . here

CLOUDTRAKR

cloudtrakr.com

-- employees

Since n.d.

COMPANY RANKING

CLOUDTRAKR

EVERGREEN INDEX #3534

Representing this company? Click here to claim and customize this page!

CloudTrakr WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

CLOUDTRAKR

cloudtrakr.com

-- employees

Since n.d.

COMPANY RANKING

CLOUDTRAKR

EVERGREEN INDEX #3534

RELATED COMPANIESRANK

STORIES ABOUT CLOUDTRAKR

Representing this company? Click here to claim and customize this page!

CloudTrakr WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!