In partnership with

Good day. It's Tuesday, Sep. 17, and in this issue, we're covering:

• AWS Security Architecture Crash Course

• Prometheus 3.0 Beta Released

• Terraform Publishes Plan Analyzer - Summarize Terraform plan output in human friendly language

• Getting Started With DevSecOps

• Kubectl Config Set-Context Command [Tutorial & Examples]

• Kubernetes Failure Stories compilation to learn from others and reduce the unknowns

👋 We partnered with 1440 to bring you this FREE offering.

Looking for unbiased, fact-based news? Join 1440 today.

Upgrade your news intake with 1440! Dive into a daily newsletter trusted by millions for its comprehensive, 5-minute snapshot of the world's happenings. We navigate through over 100 sources to bring you fact-based news on politics, business, and culture—minus the bias and absolutely free.

Subscribe to 1440 today.

Use Case

AWS Security Architecture Crash Course

In AWS, security view starts with how accounts are managed. AWS uses a multi-account setup to keep services and workloads separated, making it easier to manage resources safely.

• Organization: A way to manage multiple AWS accounts together from one place.

• Account: An isolated space within an organization, with its own resources, billing, and permissions, helping to separate different tasks and responsibilities.

When building an efficient AWS organization, it's important to understand the role of each account type and how they work together.

Here's a detailed walkthrough of each account and the practical insights into managing them effectively.

1. Org Management Account

The Org Management Account is the core control point for managing permissions, roles, and security at the organizational level. With services like AWS Control Tower and IAM Identity Center, this account provides a consolidated way to manage all AWS environments.

Actionable Insight: Use AWS Control Tower’s guardrails to automatically enforce security and compliance standards across multiple accounts. Additionally, enable IAM Access Analyzer to scan for any cross-account permissions that could expose sensitive data, ensuring your roles are appropriately restricted.

2. Security Tooling Account

The Security Tooling Account centralizes security monitoring services like AWS CloudTrail, AWS Config, Amazon Inspector, and GuardDuty. This is where all security operations take place, ensuring continuous monitoring and auditing.

Actionable Insight: Enable centralized logging for AWS Config and CloudTrail, and integrate with Amazon EventBridge to trigger real-time alerts for configuration changes or security violations. Automate responses to GuardDuty findings by using AWS Lambda to isolate suspicious instances or revoke compromised credentials immediately.

3. Log Archive Account

In the Log Archive Account, logs from across the organization are aggregated into Amazon Security Lake. This provides a central hub for access logs, flow logs, and DNS logs, ensuring all data is securely stored for audits or troubleshooting.

Actionable Insight: Enable automated lifecycle policies in Amazon S3 to transition older logs to Amazon S3 Glacier, reducing storage costs. For forensic analysis, integrate AWS CloudWatch with Security Lake to run quick queries on DNS or access logs when investigating incidents.

4. Application Account

The Application Account is where the business workloads are hosted. EC2 instances, Amazon Aurora databases, and application load balancers form the backbone of this account. Sensitive configurations and credentials are managed by AWS Secrets Manager.

Actionable Insight: Utilize Systems Manager Parameter Store for managing configuration data across environments without hardcoding values. Also, configure AWS Auto Scaling for EC2 instances to optimize cost and performance based on demand. To improve application security, integrate AWS WAF with your load balancer to block common attack patterns like SQL injection and XSS.

5. Network Account

The Network Account controls all inbound and outbound traffic using VPCs, AWS Route 53, and AWS Network Firewall. It manages the traffic flow while providing essential protection through services like AWS Shield and Amazon VPC Lattice.

Actionable Insight: Set up AWS Global Accelerator to improve the availability and performance of your applications, ensuring low-latency routes to your users globally. Also, configure AWS Network Firewall with IDS/IPS to detect and block suspicious traffic in real time, and enforce stricter control over outbound traffic using NAT gateways combined with VPC Flow Logs.

6. Shared Services Account

The Shared Services Account hosts identity and directory management services, such as AWS IAM Identity Center and Microsoft AD. This is where user access is centrally managed, ensuring that permissions are consistent across the organization.

Actionable Insight: Leverage AWS IAM Identity Center to enforce multi-factor authentication (MFA) for users accessing multiple accounts. Also, use AWS Directory Service to integrate with on-premises Microsoft AD for seamless user management across hybrid environments, reducing the need for managing multiple identity sources.

Final Thoughts:

Each AWS account serves a specific operational and security purpose. By separating responsibilities across these accounts, it's easier to implement strong security controls, automate governance, and maintain a clear operational structure.

👋 Want Your Question Answered?

Before we move ahead, I wanted to share this with you.

I get a lot of questions via DMs and emails, but my answer only helps one person - the person getting the DM / email back. So I want to start answering more questions from readers here, so we can help more than one person.

Use this page to ask your question about technical / personal / career advise, content creation, entrepreneurship etc...and who knows, you might get featured here with the answer :)

2024 is 71.31% complete. Start the idea you’ve been holding.

Tool Of The Day

lnav  - A log file viewer for the terminal. Merge, tail, search, filter, and query log files with ease. No server. No setup. Still featureful.

Try it out !

Trends & Updates

Resources & Tutorials

Picture Of The Day

Did someone forward this email to you? Sign up here