securing your content and media workflows on aws
Post on 16-Jul-2015
149 Views
Preview:
TRANSCRIPT
Securing Media Content and Applications in the Cloud
Amazon Web Services
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shared Responsibility
Virtualization infrastructure
Network infrastructure
Physical infrastructure
Physical security
Facilities
Application
OS firewalls
Security groups
Operating system
Account management
Network configuration
Certifications and Compliances
Facilities
Physical security
Physical infrastructure
Network infrastructure
Virtualization infrastructure
Certifications
• SOC 1, SOC 2 & SOC 3 (SSAE16/ISAE 3402 audit)
• ISO 27001 certification
• PCI level 1 service provider
• FedRAMP (FISMA)
• AWS GovCloud (US)
• MPAA best practices alignment
Customer are running Sarbanes-Oxley (SOX), HIPAA (healthcare), FISMA (US federal government), DIACAP MAC III sensitive ATO, International Traffic in Arms Regulations (ITAR)
AWS Services Stack in a Media Workflow
AWS Direct Connect
Elastic LoadBalancing
AWS Import/
Export
Amazon
Simple
Storage
Service (S3)
AWS Storage
Gateway
Amazon
Elastic Block
Storage
(EBS)
Amazon CloudFront
Amazon CloudSearch
Amazon Simple Queue Service
(SQS)
Amazon Elastic Transcoder
Amazon EC2Amazon
Elastic Map Reduce (EMR)
Amazon Virtual Private
Cloud (VPC)
Ingest/Create Store
Amazon Relational Database Services
(RDS)
Amazon
ElastiCache Amazon Route 53
DeliverProcess
Amazon Elastic Compute
Cloud (EC2)
AWS Physical Infrastructure Security
AWS Security Controls
• Access points
• HTTP or HTTPS using SSL access
• Amazon VPC allows VPN access as well
• Redundant connection to more than one communication service at each Internet-facing edge
• API requests
• SOAP – must be signed (using X.509 certs with an RSA public key)
• Query – SHA1 and SHA-256 cryptographic hash signature
• SSH to Amazon EC2 instances – Require a public/private key pair or RDP certificate
• AWS multi-factor authentication (MFA)
• Key management and rotation
AWS Identity and Access Management (IAM)
Unique security credentials
• Access keys, login/password, MFA device
• Federated authentication (AWS Security Token Service STS)
Policies control access to AWS APIs
• API calls must be signed by either: X.509 certificate or secret key
Deep integration with other AWS services
• Amazon S3: policies on objects and buckets
• Amazon SimpleDB: domains
• Amazon EC2 resource permissions
Amazon EC2 Security Controls
EC2 (guest) operating system
• Controlled by YOU
• YOU have admin/root
• AWS has NO visibility
• YOU generate the key pairsSecurity Group
Availability Zone A
Instance
AWS Cloud
Security groups (stateful filters)
• YOU control the mandatory inbound firewall
• Default is deny all
• +Egress in the case of Amazon VPC
Signed API calls
Security Group Adobe_FMS Configuration
Protocol Port range Source
TCP 80 0.0.0.0/0
TCP 1111 0.0.0.0/0
TCP 1935 0.0.0.0/0
UDP 1935 0.0.0.0/0
SSH 22 192.168.0.41/10
Amazon Virtual Private Cloud (VPC)
Virtual Private Cloud
VPC Public Subnet
Instances
Security
Group
• Isolated environment
• Access via VPN
• Access via Direct Connect
• Optional Internet Access
• Ingress and egress filters
• Network ACLs
• Routing rulesVPC Private Subnet
Instances
Security
Group
VPN Gateway
Internet Gateway
VPN Connection
Corporate Data Center
Elastic IPDirect Connect
Amazon S3 Security Controls
• Bucket- and object-level permissions
• Owner only access (by default)
• Signed URLs/query string authentication
• IAM policies
• Versioning (MFA delete)
• Detailed access logging
✔S3 Logs
S3 Encryption
S3 Client Side Encryption
Client Master KeyAWS SDK for Java
Content
Envelope Key
Customer provided key
Encrypted Stored Key
101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010
Encrypted Stored Data
S3 Server Side Encryption
S3 Master Key
Amazon S3
(Media Storage)
Amazon CloudFront
Amazon CloudFront Security
End User
HTTP
• CloudFront’s private content featureOnly deliver content to securely signed requests
• HTTPS ONLY requests/delivery
• Signed URL verificationPolicy based on a timed URL or a CIDR block of the requestor
• HTTPS ONLY origin fetches
• Trusted signers
• Access logs
• CloudFront origin access identity
• Signed Cookies for Private Content (NEW)
• Include Signature in the cookie itself
Delivery EC2 Instances
Security Group
Signed Request
Amazon S3
(Logs Storage)
Reference Architecture – Key Management & Content Encryption
Key Management Service
Provide CPK for S3
encryption at rest
EC2, ETS can request
the data-key on behalf
of customer Store and deliver object
specific keys in Dynamo
S3 Ingest For Source, Renditions, Metadata Sidecar Files
Ingest
AWS Elastic
Beanstalk
Content Consumption
CloudFront
Distribution
Amazon
DynamoDB
Individual Key Storage
Other Media
processing on EC2Elastic
Transcoder
Processing
Authentication/
Authorization
Content owner provides
the master key
Edge Locations
Availability Zone
Region
Dallas (2)
St.Louis
Miami
JacksonvilleLos Angeles (2)
Seattle
Ashburn (3)
Newark
New York (3)
Dublin
London (2)
Amsterdam (2)
Stockholm
Frankfurt (2)Paris (2)
Singapore(2)
Hong Kong (2)
Tokyo (2)
Sao Paulo
South Bend
San JosePalo AltoHayward
OsakaMilan
Sydney
MadridSeoul
Mumbai
Chennai
Where is my Content !
You are making API calls...
On a growing set of services around the
world..
CloudTrail is continuously
recording API calls…
And delivering log files to you…
AWS CloudTrail (Log all your AWS API calls ever made)
Content Access | Transfer
Content Creation/Ingest
Process/Manage Distribution
Graphic Artist
workstation
Remote ServerAppstream
Archive
Storage
Internal Users
Vendors/Partners
Other On-Prem
Apps
Amazon CloudFront
Media Consumers
Direct Connect Workspaces
Encryption, Access, Recycle
• Encrypt– Client Side encryption via API– Use SSL– S3 Server Side Encryption– Manage your own keys– EBS Encryption– RDS (Database) Encryption– Use HTTPs on CloudFront
• IAM User Management and IAM Roles– Access Rights and Policies
• Automate and Recycle your infrastructure– Avoid Old, long running instances in your applications
Log, Monitor, Act Proactively
You are making API calls and accessing your content ...
On a growing set of services around the world accessing your content
CloudTrail is continuously recording API calls…
And delivering log files to you…
ELBAmazon S3 Amazon
Glacier
CloudFront
S3 /App
Logs
Access Logs
Feed Logs in Cloudwatch or monitor patterns on Logs
Act Fast or automate based on realtimenotifications and alerts
Path to MPAA Best Practices Alignment
Virtualization infrastructure
Network infrastructure
Physical infrastructure
Physical security
Facilities
SOC 1/2
ISO 27001
Application
Security groups
Operating system
Access management
Network configuration
Third-Party
Auditor
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved.
top related