In this video, you'll see how you can implement AWS best practices
for security and compliance in AWS Control Tower.
You’ll see how to use IAM Analyzer to review resource access,
monitor malicious activity with GuardDuty, and view compliance status with Security Hub.
We’re going to feature three services that enhance visibility into compliance and security
across AWS accounts in Control Tower.
These services are: IAM Access Analyzer, Amazon GuardDuty, and Security Hub.
To get started, let’s log into our AWS Single Sign-On (SSO) user portal and open our management account.
Let’s navigate to Control Tower,
where you can see our landing zone has already been configured and is ready to use.
The first service we want to enable is AWS IAM Access Analyzer,
which will allow us to monitor access to resources belonging to an organization or AWS account.
Before we can enable this service, we need to add a delegated administrator.
We’ll set up our organizational Audit account as the delegated administrator.
Note that we need the account ID in order to set this up.
Next, let’s go to CloudFormation to create a template that deploys Access Analyzer across
all our regions in our AWS account.
To do this, we’ll create a CloudFormation StackSet.
We’ll upload a template file for the deployment.
Let’s name our StackSet and move on to the configuration options.
In this case, we want to use self-service permissions
so we can create the execution roles for our target accounts.
The IAM execution role we will be using is AWSControlTowerStackSetRole.
Next, we’ll enter the account ID for our Access Analyzer delegated administrator.
Let’s choose to analyze access findings across all of the default regions.
Note that the Asia Pacific (Hong Kong) region is disabled by default
for all AWS accounts and must be enabled manually.
For our purposes, we are not using this region, so let’s remove it.
Submit the template.
Once the StackSet has successfully deployed,
we can sign in to the delegated Access Analyzer administrator account.
Let’s go to IAM and verify that the Access Analyzer is enabled.
Access Analyzer is enabled and has already gathered a few findings.
By looking at the Resource Owner Account column,
we can tell which account in our organization each finding pertains to.
Let’s select one of them.
The details show which resource was involved, the access level that was used,
and which external principal or federated user triggered this specific finding.
Everything checks out, so let’s archive this finding.
Now let’s go back to our management account to set up a second service:
Amazon GuardDuty intelligent threat protection.
We’ll return to CloudFormation to create the stack.
Let’s upload our template file.
Name the stack.
Specify the same delegated administrator account ID used to enable Access Analyzer.
Next, enter your organization ID for Control Tower,
which you can find in the AWS Organizations service.
If you want to tag this stack you can do so here.
Let’s move on and create the stack.
After the stack finishes deploying, let’s navigate to GuardDuty
and verify that the delegated administrator is authorized to manage the service.
Go to Settings.
The Delegated Administrator Account ID matches our Audit organization account,
and the Organization ID matches our AWS organization.
Let’s sign out here and sign back in to our Audit account.
Let’s go to GuardDuty to review its functionality.
GuardDuty uses machine learning, anomaly detection,
and integrated threat intelligence to continually identify and prioritize potential threats.
The dashboard shows prior findings for our Audit account.
Let’s view one of these findings.
GuardDuty analyzes tens of billions of events across multiple AWS data sources,
such as AWS CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs.
Let's sign out here and sign back in to our management account to deploy one more service:
AWS Security Hub.
Return to CloudFormation.
We’ll create a stack with new resources.
Upload the Security Hub template.
Name the stack.
Provide the delegated administrator and Organization IDs, and then create the stack.
One this stack finishes deploying,
let’s sign out here and sign in to our Audit account one more time.
Let’s navigate to Security Hub.
Security Hub has been populated with the findings from GuardDuty and Access Analyzer.
Let’s take a quick look at the findings for each.
Security Hub gives you a comprehensive view of your high-priority security alerts
and security posture across your AWS accounts.
It continuously aggregates and prioritizes findings from AWS and partner security services.
You’ve just seen how you can implement best practices for
security and compliance in AWS Control Tower.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it’s your turn to try.