‫So let's summarize this section on security
‫and compliance and you have to agree, yes, this was a very,
‫very long section and I'm sorry about that.
‫You have to just remember a lot of things.
‫So the shared responsibility model on AWS,
‫we've seen it at length in this course.
‫So then you know about it
‫Shield is a way for you to get automatic DDoS protection
‫and then if you use Shield Advance, you get 24/7 support.
‫You get WAF web application firewall,
‫which is a firewall to filter incoming requests
‫based on specific rules.
‫KMS to manage your encryption keys on AWS.
‫CloudHSM to have hardware encryption.
‫And this time is not AWS that manages the keys,
‫it is ourselves that manages the encryption keys.
‫AWS will only manage the hardware behind it.
‫ACM, so AWS Certificate Manager is a way for you
‫to provision, manage, and deploy SSL and TLS certificates
‫and to get in-flight encryption.
‫Artifact is going to give you access to compliance reports
‫such as PCI, ISO, et cetera, et cetera.
‫GuardDuty is a way for you to find
‫malicious behavior automatically
‫by analyzing VPC logs, DNS logs, and CloudTrail logs.
‫And Inspector, you'll find software vulnerabilities
‫in EC2, ECR container images and Lambda functions.
‫Next, we have Config, which is allowing us
‫for compliance to track configuration changes
‫and also create rules to check compliance
‫of these resources configuration over time.
‫Macie is a way for us to find synthetic data, for example,
‫PII data, so personal information, in Amazon S3 buckets.
‫CloudTrail is a way for us to track API calls made
‫by users within the accounts.
‫Security Hub is a way
‫for us to gather all the security findings
‫from so many different services
‫from multiple AWS accounts into one place
‫and really act on these security findings directly
‫from there.
‫Detective is in case we have a security finding,
‫how do we get to the root cause very quickly?
‫And this is with Detective, which is going to link
‫up all these services together and help you with that.
‫The Abuse Team is a team that you report
‫to when you see abusive behavior
‫by using AWS resources for abusive or illegal purposes.
‫And you either have a form or you send them an email.
‫And then you have to remember, I think the four most
‫important things that a root user can do in your accounts;
‫it can change the account settings,
‫it can close your AWS accounts, it can change
‫or cancel your support plan, or it can register
‫as a seller in the Reserved Instances Marketplace.
‫And we have IAM Access Analyzer to figure
‫out which resources are shared externally
‫outside your zone of trust.
‫So that's it.
‫I hope you like this lecture
‫and I will see you in the next section.