DOCSEARCHbyAlgolia
Submit Docs

AWS Security Reference Architecture Examples

repository·main·Indexed 22 days ago

https://github.com/aws-samples/aws-security-reference-architecture-examples

Code and patterns for deploying AWS security-related services in multi-account environments using AWS Organizations or AWS Control Tower. This repository provides the AWS SRA Easy Setup for streamlined deployment of security components via CloudFormation StackSets, including solutions for GuardDuty, Config Management, Security Hub, and Account Alternate Contacts.

Tokens
104K
Snippets
161
Records
397
Agent score
75%

What's inside aws-security-reference-architecture-examples

  1. Overview of the SRA Patch Manager Solution

    main

    The SRA Patch Manager Solution automates patch management across multiple AWS accounts. It uses a central Lambda function in the Management Account to assume roles in member accounts, enabling or disabling functionality.

    Key Capabilities:

    • Automated Maintenance Windows: Creates three distinct windows for SSM Agent updates, Windows security patching, and Linux security patching.
    • Automated Deployment: Configures AWS Systems Manager (SSM) Default Host Configuration to automatically detect and deploy the solution to new AWS accounts.
    • Centralized Control: Allows disabling the entire solution across all accounts and regions via a single CloudFormation parameter update.
    • Event-Driven: Uses AWS Control Tower lifecycle events and AWS Organizations events to trigger configuration updates when accounts are added, removed, or modified.

  2. Overview of AMI Bakery Organization

    main

    The AMI Bakery Organization solution automates the creation of standardized, hardened Amazon Machine Images (AMIs) that comply with security benchmarks like STIG (Security Technical Implementation Guide) and CIS (Center of Internet Security).

    It automates the lifecycle of images using EC2 Image Builder, CodeCommit, and CodePipeline. The solution is designed to be shared across multiple accounts in an AWS Organization, reducing the need to re-create images when moving between accounts.

    Supported Hardened Images:

    • Amazon Linux 2023 STIG hardened image
    • Ubuntu Pro CIS Level 1 hardened image
    • Microsoft Windows Server 2022 Base STIG hardened image
    • Windows CIS Level 1 (Work in progress)

  3. Overview of the AWS SRA Easy Setup Deployment Process

    main
    The AWS SRA Easy Setup provides a streamlined method for deploying the AWS Security Reference Architecture (SRA) components. The process typically involves enabling trusted access in AWS Organizations for StackSets, followed by deploying CloudFormation templates to establish the security foundation across your accounts.

  4. Overview of S3 Block Account Public Access solution

    main

    The S3 Block Account Public Access solution automates the enforcement of S3 account-level block public access settings across all existing and future AWS accounts within an AWS Organization.

    Key Features:

    • Applies settings to the management account and all member accounts.
    • Automatically triggers when new accounts are added, account tags are updated, or account status changes (e.g., from suspended to active).
    • Supports account exclusion via specific account tags.

    This solution ensures that even if users attempt to modify bucket policies or object permissions to allow public access, the account-level settings will override those permissions to maintain security boundaries.

  5. Overview of the SRA Bedrock Organizations Solution

    main
    The SRA Bedrock Organizations Solution is an automated framework designed to deploy Bedrock organizational safeguards using AWS CloudFormation. It uses a central Lambda function to configure and deploy AWS Config rules, CloudWatch metrics, and other governance resources across multiple AWS accounts and regions within an organization. This ensures centralized monitoring and enforcement of security policies for Amazon Bedrock.

  6. Overview of Security Hub Organization solution

    main

    The Security Hub Organization solution automates the enablement and configuration of AWS Security Hub across an entire AWS Organization. It is designed to delegate administration to a specific account (such as an Audit or Security Tooling account) and ensures that all existing and future member accounts are automatically configured to align with the delegated administrator's standards.

    Key capabilities:

    • Delegated Administration: Automatically delegates Security Hub management to a designated account (e.g., Audit account).
    • Automated Member Onboarding: Adds all existing accounts (including the management account) and any future accounts created in the organization as members.
    • Regional Aggregation: Configures a region aggregator within a specified Home region to centralize findings.
    • Standard Alignment: Assumes roles in member accounts to enable or disable specific Security Hub standards to match the delegated administrator.
    • Lifecycle Management: Provides the ability to disable Security Hub across all accounts and regions via a CloudFormation parameter update.

  7. Overview of EC2 Default EBS Encryption solution

    main

    The EC2 default EBS encryption solution automates the enablement of account-level default EBS encryption settings across all existing and future AWS accounts and specified regions within an AWS Organization.

    Key Features:

    • Configures default encryption for all existing accounts and provided regions, including the management account.
    • Automatically triggers when new accounts are added to the Organization, when account tags are updated, or when account status changes.
    • Supports account exclusion via specific account tags.

    Important Considerations:

    • Region-Specific: Encryption by default is a per-region setting. Once enabled in a region, you cannot disable it for individual volumes or snapshots in that region.
    • Instance Compatibility: When enabled, you can only launch instances that support EBS encryption.
    • Storage Costs: Copying a snapshot and encrypting it with a new KMS key creates a complete (non-incremental) copy, which incurs additional storage costs.
    • Migration Warning: Do not enable this when migrating servers using AWS Server Migration Service (SMS). If experiencing delta replication failures, turn off encryption by default and instead enable AMI encryption during the replication job.

  8. Overview of the Security Lake Organization solution

    main

    The AWS SRA Security Lake solution automates the enablement of Amazon Security Lake across an AWS Organization. It delegates administration to a designated Log Archive account (within the Security OU) and configures Security Lake for all existing and future member accounts.

    Key Capabilities:

    • Delegates Security Lake administration to the Log Archive account.
    • Creates required IAM roles for Security Lake.
    • Configures ingestion for AWS logs and event sources across all accounts.
    • Enables automatic Security Lake activation for new member accounts via Organization configuration.
    • Optional Features:
      • Creates an Audit account (Security Tooling) subscriber with data access.
      • Creates an Audit account (Security Tooling) subscriber with query access.
      • Creates resource links to shared tables in the Audit account.

  9. Overview of SRA Bedrock Guardrails Solution

    main

    The SRA Bedrock Guardrails solution is an automated framework for deploying and managing Amazon Bedrock Guardrails across multiple AWS accounts and regions within an organization. It uses a central Lambda function to deploy and encrypt guardrails using a customer-managed KMS key.

    Supported guardrail policies include:

    • Content filters: Blocks harmful content categories (Hate, Insults, Sexual, Violence, Misconduct, and Prompt Attack).
    • Denied topics: Blocks undesirable topics defined by the user.
    • Word filters: Blocks specific words, phrases, or profanity via exact match.
    • Sensitive information filters: Blocks or masks PII (e.g., SSN, Date of Birth) or custom regex patterns.
    • Contextual grounding check: Detects and filters hallucinations by checking grounding and relevance.

    Security Note: Because this solution uses a customer-managed KMS key, you must manually update KMS key policies to grant access to guardrail users/administrators and modify IAM role policies for users who need to invoke or manage guardrails.

  10. Shield Advanced solution features and resource details

    main

    The Shield Advanced solution automates the enablement and configuration of AWS Shield Advanced across an AWS Organization.

    Key Capabilities

    • Account Coverage: Deploys to specific accounts or all existing/future accounts in an AWS Organization.
    • Resource Protection: Configures up to 5 Protection Groups.
    • S3 Automation: Dynamically identifies S3 buckets configured for each account.
    • DRT Access: Configures DDoS Response Team (DRT) access for applicable accounts and buckets.
    • Support & Contacts: Configures emergency contacts and enables Proactive Support.
    • Lifecycle Management: Can disable Shield across all accounts and regions via a parameter update.

    Core Components (Management Account)

    • CloudFormation: Uses StackSet and Stack Instance for multi-account deployment.
    • Lambda Function: Contains the logic to enable and configure Shield. It assumes a Configuration IAM Role to perform actions.
    • Event Rules: An Organization Compliance Scheduled Event Rule triggers the Lambda to handle account status updates (e.g., moving from suspended to active).
    • Observability: Logs are sent to a CloudWatch Log Group (/aws/lambda/<LambdaFunctionName>). A Dead Letter Queue (SQS) and an SNS Topic are used to handle and notify about failed Lambda events.

  12. Overview of Config Organization architecture and resources

    main

    The Config Organization solution automates AWS Config setup across an AWS Organization. It uses a Lambda function to enable Config in all existing and future member accounts and centralizes data.

    Resource Distribution by Account

    1.0 Organization Management Account

    • AWS Lambda Function: Contains logic to enable and configure AWS Config in accounts and regions.
    • IAM Roles: Includes a Lambda Execution IAM Role and a Configuration IAM Role used by the Lambda function.
    • Event Rules:
      • Organization Compliance Scheduled Event Rule: Triggers Lambda on a schedule to capture status updates.
      • AWS Organizations Event Rule: Triggers Lambda when accounts are added to the Organization.
      • Global Event Rule: Forwards events from us-east-1 to the Home Region.
    • Observability: Uses a CloudWatch Log Group (/aws/lambda/<LambdaFunctionName>), an SQS Dead Letter Queue (DLQ), and an SNS Topic for DLQ notifications.

    2.0 Log Archive Account

    • AWS Config Delivery S3 Bucket: Centralized storage for configuration snapshots from all accounts/regions.

    3.0 Audit Account (Security Tooling)

    • AWS Config Aggregator: Configured in the delegated administrator account to collect configuration and compliance data.
    • AWS Config Delivery KMS Key: Encrypts configuration snapshots.
    • Notification SNS Topic: Receives AWS Config notifications (encrypted with a customer-managed KMS key).
    • AWS Config Aggregator IAM Role: Allows AWS Config to access AWS Organizations APIs.

    4.0 Member Accounts

    • AWS Config: Automatically enabled for all existing and future accounts/regions.