Turning up Security on Security Services Part 2

This lesson surveys AWS security services you can use to protect data in transit, manage certificates, store secrets, and provide network- and perimeter-level protection. It focuses on what each service does, how they integrate, and the typical configuration choices you make when you need to “turn up” security (for example: encryption, rotation, logging, and IAM controls).

​

Certificate Manager (ACM) and AWS Private CA

AWS Certificate Manager (ACM) handles TLS/SSL certificate lifecycle for workloads that require secure transport. ACM can:

• Provision public certificates for internet-facing endpoints.
• Import third-party certificates when you manage your own CA.
• Distribute certificates to integrated AWS services (Elastic Load Balancing, CloudFront, API Gateway, etc.).
• Automatically renew certificates it issues.

ACM is especially helpful for web applications hosted on AWS because it removes much of the operational overhead of provisioning and renewing certificates. Integrate ACM certificates with your load balancers, edge services, and API endpoints so TLS termination and certificate rotation are automated. AWS Private Certificate Authority (AWS Private CA) is part of ACM and lets you run a private CA hierarchy without building your own PKI. Typical uses include issuing internal TLS certificates for microservices, IoT devices, or secure internal APIs and establishing structured certificate hierarchies for organizational units. Because ACM and AWS Private CA are managed security services, there are relatively few low-level knobs to tune. The main decisions are:

• Choosing certificate type: public vs. private.
• Integrating certificates with target services (ELB, CloudFront, API Gateway, Lambda@Edge).
• Applying IAM policies and roles so only authorized principals can request or use certificates.
• Enabling monitoring and alerting (CloudWatch, EventBridge) for certificate expiration or issuance events.

​

Secrets Manager vs Systems Manager Parameter Store

AWS offers two primary options for storing sensitive configuration data: AWS Secrets Manager and Systems Manager Parameter Store (SecureString). Choosing between them depends on features required, cost, and operational needs. Authentication and authorization to access secrets rely on IAM. Apply least-privilege IAM policies and roles to any principal that retrieves secrets. Also enable CloudTrail logging for auditing secret retrieval and changes.

​

Network-level Controls: Security Groups and NACLs

Security groups and Network ACLs (NACLs) are foundational network security controls in AWS:

• Security groups are stateful virtual firewalls attached to ENIs (network interfaces). They control inbound and outbound traffic at the instance or resource level. Use security groups to granularly allow traffic to EC2 instances, load balancers, and interface endpoints.
• Network ACLs are stateless, ordered, subnet-level firewalls. Each rule is evaluated by priority; both allow and deny rules are supported. NACLs are useful for coarse-grained subnet-level filtering or where ordered deny/allow evaluation is required.

Key guidance:

• Prefer security groups for most instance-level protections because they are stateful and simpler to manage.
• Use NACLs for subnet-wide, ordered rules or for explicit deny rules that need to be enforced before traffic reaches instances.
• Remember that many AWS resources (ENIs for load balancers, PrivateLink endpoints, etc.) are protected by security groups.

​

Security Lake — Centralized Security Data

AWS Security Lake centralizes and normalizes security telemetry and findings from multiple sources (GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Config, CloudTrail, and more). Centralizing telemetry enables forensic analysis and large-scale analytics using tools such as Athena, OpenSearch, or third-party SIEMs. Security Lake uses Amazon S3 as the underlying storage. While Security Lake is secure by design, ensure you configure:

• S3 encryption (SSE-KMS) and correct bucket policies.
• Least-privilege IAM policies for access.
• Logging and monitoring (CloudTrail, CloudWatch) for access events.
• Event routing using EventBridge for flexible ingestion and processing.

Security Lake is recommended when you need centralized telemetry from multiple accounts/regions for deep analysis, hunting, or compliance reporting.

​

Web Application Firewall (WAF)

AWS WAF is a Layer 7 (application-layer) web application firewall that protects web apps from common attacks such as SQL injection (SQLi) and cross-site scripting (XSS). WAF integrates with CloudFront, API Gateway, and Application Load Balancer and supports:

• Managed rules (AWS or third-party rule groups).
• Custom rules and rate-based rules.
• IP sets for allow/block lists.
• Logging to Kinesis Data Firehose, S3, or CloudWatch.

WAF is typically deployed at the edge (CloudFront) or at application endpoints (ALB, API Gateway) so it can inspect and block malicious HTTP(s) requests before they reach your application. For WAF to inspect plaintext HTTP requests, ensure TLS/SSL termination is configured at the point where WAF inspects traffic (for example, in CloudFront or ALB where you attach an ACM certificate).

​

DDoS Protection — AWS Shield and Shield Advanced

AWS Shield provides DDoS protection in two tiers: Turning up DDoS protection typically involves enabling Shield Advanced and pairing it with WAF and Firewall Manager to:

• Protect critical resources (ALBs, CloudFront distributions, Global Accelerator, Elastic IPs).
• Use protection groups for coordinated mitigation.
• Access near real-time diagnostics and attack attribution.
• Optionally receive cost-protection for scaling charges during an attack.

​

Network Firewall

AWS Network Firewall provides stateful and stateless inspection for VPC traffic. Deploy Network Firewall at VPC perimeters (for example, in a centralized inspection VPC or at transit gateways) to apply enterprise-grade filtering:

• Stateful inspection and stateless rules.
• Intrusion-prevention-style detection, domain and URL filtering, and SNI-based filtering.
• Centralized policies across VPCs and integration with logging for SIEMs and Security Lake.

Network Firewall is appropriate when you require deep packet inspection, protocol validation, or consistent centralized firewall policies across an environment — similar to a traditional on-premises firewall model.

​

Firewall Manager

AWS Firewall Manager centralizes firewall policy management across accounts in an AWS Organization. It can administer and enforce rules for:

• AWS WAF (rule groups and web ACLs)
• AWS Network Firewall policies
• Route 53 Resolver DNS Firewall rules
• Security group policies and supported third-party firewalls

Firewall Manager is especially useful for organizations that need to enforce consistent firewall posture and compliance across many accounts. Use it to distribute and enforce WAF rules, Network Firewall policies, and DNS firewall rules from a central administrator account.

​

Summary and Operational Recommendations

• ACM & AWS Private CA: Automate certificate issuance and renewal for TLS/SSL; use Private CA for internal PKI requirements.
• Secrets Storage: Use Secrets Manager for automated credential rotation; use Parameter Store SecureString for lower-cost, simpler secret storage.
• Network Controls: Use security groups for stateful, instance-level firewalling and NACLs for stateless, subnet-level, ordered rules.
• Telemetry: Centralize security logs and findings in Security Lake for forensic and analytic use cases.
• Application Protection: Deploy AWS WAF at the edge or application endpoints to mitigate Layer 7 attacks.
• DDoS: Leverage Shield Standard for baseline protection; enable Shield Advanced when you need tailored mitigations and 24/7 DDoS support.
• Perimeter & Inspection: Use AWS Network Firewall for deep inspection and centralized VPC perimeter controls.
• Policy Management: Use Firewall Manager to enforce and scale consistent policies across accounts.

Most AWS security services are secure by design. “Turning up” security means enabling and configuring additional features such as encryption (SSE-KMS), logging (CloudWatch/CloudTrail), automated rotation, monitoring, and properly scoped IAM policies. Integrate security services with Security Hub, Security Lake, CloudWatch, CloudTrail, and AWS Config for consolidated visibility, detection, and audit trails. Recommended further reading and references:

• AWS Certificate Manager Documentation
• AWS Private CA Overview
• AWS Secrets Manager Documentation
• AWS Systems Manager Parameter Store
• AWS WAF Documentation
• AWS Shield Documentation
• AWS Network Firewall
• AWS Firewall Manager
• AWS Security Lake

This concludes the primary design/security section. The following sections cover reliability, performance, and cost-management topics, which are generally more concise. Take a breath — the rest gets progressively easier.