Logo Teamwork

AWS Audit: A Practical Guide

Published on
Authors
Version audio
Chargement...
Audit: Practical Guide

Introduction

In this article, we will look at how a security and architecture audit on AWS is conducted.

We will base this on a practical case: a company that migrated to AWS a few years ago and wants to audit its infrastructure to ensure everything is properly configured and that best practices are followed.

Preparation

Before starting the audit, it is important to prepare the groundwork. You need to define the audit scope, objectives, and the means to be deployed.

Scope

The audit scope is defined by the AWS services used by the company. In our case, the company uses the following services:

  • Amazon Elastic Compute Cloud (EC2)
  • Amazon Relational Database Service (RDS)
  • Amazon Simple Storage Service (S3)
  • Amazon CloudFront
  • Amazon Route 53
  • AWS Identity and Access Management (IAM)
  • Amazon CloudWatch
  • AWS CloudTrail
  • AWS Config

Objectives

The audit objectives are as follows:

  • Verify that security best practices are followed
  • Verify that the architecture is well designed
  • Verify that costs are optimized
  • Verify that performance is optimal
  • Verify that availability is ensured

Tools

To carry out this audit, we will use the following tools:

  • AWS Trusted Advisor
  • AWS Config
  • AWS CloudTrail
  • AWS CloudWatch
  • AWS Cost Explorer
  • AWS Security Hub

Conducting the Audit

IT Audit

IT Audit

Security

The first step of the audit is to verify that security best practices are followed. For this, we will use AWS Trusted Advisor and AWS Security Hub.

AWS Trusted Advisor

AWS Trusted Advisor is a service that checks whether best practices are being followed. It provides recommendations in the following areas:

  • Cost optimization
  • Performance
  • Security
  • Fault tolerance
  • Service limits

In our case, we will focus on security recommendations. Here are the points we will check:

  • Are security groups properly configured?
  • Are network ACLs properly configured?
  • Are access keys properly managed?
  • Are IAM users properly configured?
  • Are S3 buckets properly configured?
  • Are SSL certificates properly managed?

AWS Security Hub

AWS Security Hub is a service that centralizes security alerts and verifies that best practices are followed. It provides recommendations based on the following standards:

  • CIS AWS Foundations Benchmark
  • AWS Foundational Security Best Practices
  • PCI DSS

In our case, we will focus on CIS AWS Foundations Benchmark recommendations. Here are the points we will check:

  • Are IAM users properly configured?
  • Are password policies properly configured?
  • Are access keys properly managed?
  • Are audit logs properly configured?
  • Are security alerts properly configured?

Architecture

The second step of the audit is to verify that the architecture is well designed. For this, we will use AWS Config and AWS Well-Architected Tool.

AWS Config

AWS Config is a service that verifies whether AWS resources are properly configured. It offers predefined rules and allows creating custom rules.

In our case, we will use the following predefined rules:

  • Are EC2 instances properly configured?
  • Are RDS databases properly configured?
  • Are S3 buckets properly configured?
  • Are security groups properly configured?
  • Are network ACLs properly configured?

AWS Well-Architected Tool

AWS Well-Architected Tool is a service that verifies whether the architecture is well designed. It provides recommendations based on the following pillars:

  • Operational Excellence
  • Security
  • Reliability
  • Performance Efficiency
  • Cost Optimization

In our case, we will focus on security and reliability recommendations. Here are the points we will check:

  • Are EC2 instances properly configured?
  • Are RDS databases properly configured?
  • Are S3 buckets properly configured?
  • Are security groups properly configured?
  • Are network ACLs properly configured?
  • Are backups properly configured?
  • Is high availability properly configured?

Costs

The third step of the audit is to verify that costs are optimized. For this, we will use AWS Cost Explorer and AWS Trusted Advisor.

AWS Cost Explorer

AWS Cost Explorer is a service that allows you to visualize and analyze AWS costs. It provides charts and reports that help understand costs and optimize them.

In our case, we will use the following reports:

  • Costs by service
  • Costs by region
  • Costs by tag
  • Costs by EC2 instance
  • Costs by RDS database
  • Costs by S3 bucket

AWS Trusted Advisor

AWS Trusted Advisor also provides recommendations for cost optimization. Here are the points we will check:

  • Are EC2 instances properly sized?
  • Are Amazon Elastic Block Store (EBS) volumes properly sized?
  • Are RDS instances properly sized?
  • Are Reserved Instances being used effectively?
  • Are Spot Instances being used effectively?
  • Are unused resources being removed?

Performance

The fourth step of the audit is to verify that performance is optimal. For this, we will use AWS CloudWatch and AWS Trusted Advisor.

AWS CloudWatch

AWS CloudWatch is a service that monitors AWS resources. It provides metrics and alarms that help understand performance and optimize it.

In our case, we will use the following metrics:

  • EC2 instance CPU utilization
  • EC2 instance memory utilization
  • EC2 instance disk utilization
  • EC2 instance network utilization
  • RDS instance CPU utilization
  • RDS instance memory utilization
  • RDS instance disk utilization
  • RDS instance network utilization
  • S3 request latency
  • CloudFront request latency

AWS Trusted Advisor

AWS Trusted Advisor also provides recommendations for performance optimization. Here are the points we will check:

  • Are EC2 instances properly sized?
  • Are EBS volumes properly sized?
  • Are RDS instances properly sized?
  • Are S3 buckets properly configured?
  • Are CloudFront distributions properly configured?

Availability

The fifth step of the audit is to verify that availability is ensured. For this, we will use AWS CloudWatch and AWS Trusted Advisor.

AWS CloudWatch

AWS CloudWatch also monitors the availability of AWS resources. It provides metrics and alarms that help understand availability and optimize it.

In our case, we will use the following metrics:

  • EC2 instance availability
  • RDS instance availability
  • S3 bucket availability
  • CloudFront distribution availability
  • Route 53 hosted zone availability

AWS Trusted Advisor

AWS Trusted Advisor also provides recommendations for availability optimization. Here are the points we will check:

  • Are EC2 instances distributed across multiple Availability Zones?
  • Are RDS instances distributed across multiple Availability Zones?
  • Are S3 buckets replicated?
  • Are CloudFront distributions properly configured?
  • Are Route 53 hosted zones properly configured?

Conclusion

Cloud Audit

Cloud Audit

A security and architecture audit on AWS is an important step to ensure everything is properly configured and that best practices are followed. It helps detect security, architecture, cost, performance, and availability issues.

In our case, we used the following tools:

  • AWS Trusted Advisor
  • AWS Config
  • AWS CloudTrail
  • AWS CloudWatch
  • AWS Cost Explorer
  • AWS Security Hub
  • AWS Well-Architected Tool

These tools allowed us to verify that best practices are followed and to detect issues that need to be fixed.

The next step is to fix the detected issues and implement a continuous improvement process to ensure that best practices are always followed.