Aws Security

AWS Security

General AWS Requirements

These apply to all AWS services (e.g., ElastiCache, RDS, MSK).

Logging and Auditing

• Enable AWS CloudTrail to log all API and user activity
• Ensure CloudTrail logs are stored in a protected S3 bucket with versioning and encryption

Network Security

• Deploy services in a VPC with security groups and network ACLs that restrict traffic to only required ports and sources
• Restrict security group rules to the minimum required ports and source IPs
• Use private subnets for services that do not need Internet-facing access

IAM

• Create individual IAM accounts for each person managing AWS resources; never use root credentials
• Grant each user the minimum set of permissions required for their duties
• Use IAM groups to manage permissions for multiple users
• Rotate IAM credentials regularly
• Never put sensitive identifying information (customer account numbers, PII) in free-form IAM fields such as Name

Amazon RDS Security

Encryption

• Encrypt data in transit using SSL/TLS connections
• Encrypt database storage and backups at rest using AWS KMS

Credential Management

• Do not use the master credentials created during instance setup; they use the public schema without fine-grained permissions
• Create application-specific database users with least-privilege grants
• Configure AWS Secrets Manager to automatically rotate database credentials

Patching and Access

• Use RDS versions that do not have known security vulnerabilities; apply patches promptly
• Restrict access using security groups that allow only specific IP addresses or EC2 instances
• Create individual IAM users for each person managing RDS; never use root

Amazon ElastiCache / Redis

For detailed Redis and ElastiCache security guidance (authentication, encryption, ACLs, network isolation), see the dedicated skill: [redis-elasticache-security](../redis-elasticache-security/SKILL.md). Apply the General AWS Requirements above (IAM, VPC, CloudTrail) to all ElastiCache deployments.

Implementation Checklist

• [ ] CloudTrail is enabled and logging to a protected S3 bucket
• [ ] All services are deployed in a VPC with security groups and NACLs
• [ ] Individual IAM users are created; root credentials are not used
• [ ] IAM permissions follow least privilege; IAM groups are used
• [ ] IAM credentials are rotated on a schedule
• [ ] RDS connections use SSL/TLS
• [ ] RDS storage and backups are encrypted with KMS
• [ ] Application-specific DB users are created (master credentials not used by apps)
• [ ] AWS Secrets Manager rotates database credentials
• [ ] RDS versions are patched and current
• [ ] No sensitive data in free-form IAM fields

References

• Security best practices for Amazon RDS
• Amazon RDS Security

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: RedHatProductSecurity
• Source: RedHatProductSecurity/prodsec-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.