7 AWS Security Best Practices with ParkMyCloud
Besides cost control, one of the biggest concerns from IT administrators is utilizing AWS security best practices to keep their infrastructure safe. While there are some great tools that specialize in cloud and information security, there are some security benefits of ParkMyCloud that are not often considered when hardening a cloud infrastructure.
1. Keep Instances Off When Not In Use
Scheduling your instances to be turned off on nights and weekends when you aren’t using them saves you a ton of money on your cloud bill, but also provides security and protection. Leaving servers and databases on 24/7 is just asking for someone to try to break in and connect to servers within your infrastructure, especially during off-hours when you don’t have as many IT staff keeping an eye on things. By aggressively scheduling your resources to be off as much as possible, you minimize the opportunity for outside attacks on those servers.
2. User Governance
Your users are trustworthy and need to access lots of servers to do their job, but why give them more access than necessary? Limiting what servers, databases, and auto scaling groups everyone can see to only what they need keeps accidents from happening and limits mistakes. ParkMyCloud lets you separate users into teams, with designated Team Leads to manage the individual Team Members and limits their control to just start / stop.
3. Single Sign On
In addition to governing user access to resources, ParkMyCloud integrates with all major SSO providers for SAML authentication for your users. This includes Okta, Ping Identity, OneLogin, Centrify, Azure AD, ADFS, and Google Apps. By using one of these providers, you can keep identity management centralized and offer multi-factor authentication through those SAML connections.
4. Audit Logs and Notifications
Every user action in ParkMyCloud is tracked in an Audit Log that is available to super admins. These audit logs can also be downloaded as a CSV if you want to import them into something like Splunk or Logstash for log management. Audit logs can help you see when schedules are snoozed or changed, policies are updated, or teams are created or changed.
In addition, those audit log entries can be sent as notifications to Slack channels, email addresses, or through webhooks to other tools. This lets you keep an eye on either specific teams or the entire organization within ParkMyCloud.
5. Minimal Connection Permissions
ParkMyCloud connects to AWS through an IAM Role (preferred) or an IAM User. The AWS policy that is required uses the bare minimum of necessary actions, which boils down to Describe, Start, and Stop for each resource type (EC2, ASG, and RDS). This means you don’t have to worry about ParkMyCloud doing something to your AWS account that you don’t intend. For Azure connections, ParkMyCloud requires a similarly-limited Limited Access Role, and the connection to Google Cloud requires a limited Service Account.
6. Restrict Scheduling Based on Names or Tags
The ParkMyCloud policy engine is a powerful way to automate your resource scheduling and team management, but it can also be used to prevent schedules from being applied to certain systems. For instance, if you have a prod database that you want to keep up 24/7, you can use a policy to never let any user apply a schedule (even if they wanted to). These policies can be applied based on tags, naming conventions, AWS regions, or account names.
7. Full Cloud Visibility
One great benefit of ParkMyCloud is the ability to see across all of your cloud providers (AWS, Microsoft Azure, and Google Cloud), cloud accounts, and regions within a cloud. This viewability not only provides management benefits, but helps with security by keeping all resources in one list. This prevents rogue instances from running in regions you don’t normally look at, and can help you identify resources that don’t need to be running or even stopped.
Conclusion
As you continue to strive to follow AWS security best practices, consider adding ParkMyCloud to your security toolkit. While you’re saving money for your team, you can also get these 7 benefits to help secure your infrastructure and sleep better at night. Start a free trial of ParkMyCloud today to start reaping the benefits!
Originally published at www.parkmycloud.com on September 28, 2017.
