Hi, welcome to 'This is My Architecture'.
I'm TJ, and today we're joined by Mrunal from HBO Max.
-Hi, Mrunal. -Hi, TJ.
For those who don't already know about HBO Max, can you tell us a little bit about what it is?
Sure. HBO Max is a premium streaming service
for blockbuster movies, epic originals, and addictive series.
Can you tell us a little bit about this architecture and why you built it?
The challenge we have is the traditional security model is reactive,
wherein the vulnerabilities and cloud misconfigurations
get on the cloud before they're detected and remediated.
We wanted to flip the script and build automation that can prevent these things from happening.
So, we have detection in our architecture
and we have remediation in our architecture
connected by EventBridge, which connects the detection side and the remediation side.
Can you tell us a little bit about the detections that you're looking for?
Sure. We have different AWS services doing different things for us.
We have CloudTrail, which looks at real-time events
of infrastructure that is being built
and those events are funneled to EventBridge, where we check for different security issues.
We have GuardDuty which ingests DNS logs,
VPC flow logs, and CloudTrail logs.
The machine learning model identifies if there's any anomalies
and triggers an event if it detects one through EventBridge.
What are some of the types of anomalies that you're looking for?
What are the situations that you're trying to see your developers doing inside of AWS?
We're trying to prevent misconfigurations such as having publicly open S3 buckets,
or publicly open RDSs, or really wide-open security groups.
We're also trying to prevent EC2s speaking with malicious IPs.
We're using GuardDuty for detecting malicious activities
and we're using CloudTrail for all other types of real-time events.
So I see Inspector and AWS Config here. What do they feed into it?
So, we have Security Hub that is the main hub
where we source events from all the other AWS security services such as Inspector and Config.
On Config we can build more complicated detection rules
that don't necessarily have to be real time like the ones in CloudTrail,
and eventually we funnel those through Security Hub and into the EventBridge for remediation.
Got it. So these services are helping you identify
things that might be wrong in your environment.
-Correct. -So once you've identified it, how do you remediate that?
Once we identify an event where we're detecting misconfigurations,
the EventBridge sort of shoots off the events to the Lambdas
and the Lambdas go in and prevent that vulnerabilities from existing on the cloud
either by deleting it or by preventing it from being a misconfigured resource.
And sort of the way we build these Lambdas is we're using Cloud Custodian, which is an open source engine
which enables our security engineers to define the security rules in a YAML format
and push the custom security Lambdas to all the different regions and all the different accounts
in an automated fashion so that we have a multi-account governance.
That's really cool. So let's say there was a remediation that happened.
How would you get notified about that?
So the Lambda, once it takes action, it pushes what it did and when it did
to what resource in a Slack channel which is monitored by security engineers.
That notifies us that a specific event happened.
Lambda also pushes an event to Security Hub which we use for monitoring all our accounts
so we know at what time something was fixed.
So we have two ways of monitoring what action was taken and what was prevented in our environment.
So what would you say is the future of this workload?
The architecture as it stands is a single-step detection and remediation/prevention.
We're looking to evolve into a multi-step automation
which can detect, notify, wait for a little bit, and then take a few other actions.
So it would be a multi-step automation and we're looking at systems,
manager automations, and Step Functions to get there.
Great. Thank you very much, Mrunal.
-Thanks a lot. -And thank you for watching 'This is My Architecture.'