AWS Zero Vulnerability Architecture

 

Introduction

 

Enterprise Customers often rely on hundreds of accounts and VPCs to segment their workloads and expand. This level of scale often creates greater challenges around resource sharing, connectivity and more prone to a vulnerable attack. In this whitepaper, we are providing an approach to Build up a Zero Vulnerability Architecture where we have utilized the AWS inbuilt features and AWS products in building up a Secure Architecture with Zero Vulnerability.

The approach we have taken to achieve this are:

·       Multi-Account Strategy.

·       Dedicated centralized Network account.

·       AWS Transit Gateway.

·       VPC Endpoints.

                                                                       

Multi-Account Strategy

In the real world, most of the AWS customers begin by building all the resources in a single AWS account with multiple VPC. However, as the customer’s organization grows, granular segmentation of services becomes necessary to provide easier environmental management, monitor costs, and control access. A multi-account strategy solution solves these issues by providing specific accounts for IT services and users within an organization.

As cloud usage grows for the customer, the number of users, business units, applications, and Regions that a customer interacts with multiply, leading to the creation of new accounts/VPCs where we can effectively use this Multi-Account Strategy.

AWS provides several tools to manage and configure this infrastructure including AWS Landing Zone, AWS Control Tower & AWS Organization.

We can manage all the accounts using the AWS Master account and can divide & organize the accounts in the AWS organization as Core Accounts and Application Accounts and map the created AWS Accounts to it.

 All the centralized and reusable accounts (Auditing, Log Archive, Network, DevOps related ) will come under the Core Accounts and Application specific AWS accounts will be mapped under the Application Accounts.

Dedicated centralized Network account for centralized ingress & egress

 

In this section, we would like to introduce a dedicated Network Services account that manages your traffic ingress and egress for the entire AWS infrastructure. The networking services and the network infrastructure for the account are shared by all the accounts and VPCs in a centralized fashion.

This design enables better manageability and control of traffic making sure that all the Security checks are in place and security vulnerabilities can be centrally managed and reports can be seen using the AWS Security Hub, AWS Guard Duty, and AWS Config.

In this solution, only the Network account will be allowed to talk to the internet/On-Premises network. All the linked accounts like Dev, QA, UAT, and Prod will have to talk to Network accounts for their egress flow to the internet or the On-Premises network.

Adding to this network level segregation, to provide more security on the network account we can have the “Network Firewall” installed and configured for the Layer 4 attack and the “Application Level Firewall” for the Level 7 attack.

Examples of Network Firewall are AWS Network Firewall, Barracuda Firewall, FortiGate, and Check Point Next Generation Firewall.

Examples of Application Level Firewalls are AWS WAF, Forti Web, and Cloud flare WAF.

AWS Transit Gateway

 

AWS Transit Gateway provides a hub and spoke design for connecting VPCs and on-premises networks. It controls how traffic is routed among all the connected spoke networks using route tables. This hub and spoke model simplifies the management. It is a Regional resource and can connect thousands of VPCs within the same AWS Region. If you want cross-region peering, then now we can achieve that also using the Transit Gateway Peering Concept.

We can create the Transit Gateway in the Network account and share that transit gateway to the linked accounts using the Resource Access Manager and stick up the network traffic for the egress and ingress traffic flow.

VPC Endpoints

 

A VPC endpoint enables private connections between your VPC and supported AWS services. VPC endpoint services powered by AWS Private Link.

AWS Private Link is a technology that enables you to privately access services by using private IP addresses. Traffic between your VPC and the other service does not leave the Amazon network. A VPC endpoint does not require an internet gateway, virtual private gateway, NAT device, VPN connection, or AWS Direct Connect connection.

 

We have 2 types of VPC Endpoints:

·       Interface Endpoints: AWS Service which supports Interface Endpoints.

·       Gateway Endpoints: Presently under Gateway Endpoint we have only AWS S3 and DynamoDB products.

 

Enabling the VPC Endpoints not only secures the traffic but also improves the Performance.