aws-security

AWS Security

General AWS Requirements

These apply to all AWS services (e.g., ElastiCache, RDS, MSK).

Logging and Auditing

• Enable AWS CloudTrail to log all API and user activity
• Ensure CloudTrail logs are stored in a protected S3 bucket with versioning and encryption

Network Security

• Deploy services in a VPC with security groups and network ACLs that restrict traffic to only required ports and sources
• Restrict security group rules to the minimum required ports and source IPs
• Use private subnets for services that do not need Internet-facing access

IAM

• Create individual IAM accounts for each person managing AWS resources; never use root credentials
• Grant each user the minimum set of permissions required for their duties
• Use IAM groups to manage permissions for multiple users
• Rotate IAM credentials regularly
• Never put sensitive identifying information (customer account numbers, PII) in free-form IAM fields such as Name

Amazon RDS Security

Encryption

• Encrypt data in transit using SSL/TLS connections
• Encrypt database storage and backups at rest using AWS KMS

Credential Management

• Do not use the master credentials created during instance setup; they use the public schema without fine-grained permissions
• Create application-specific database users with least-privilege grants
• Configure AWS Secrets Manager to automatically rotate database credentials

Patching and Access

• Use RDS versions that do not have known security vulnerabilities; apply patches promptly
• Restrict access using security groups that allow only specific IP addresses or EC2 instances
• Create individual IAM users for each person managing RDS; never use root

Amazon ElastiCache / Redis

For detailed Redis and ElastiCache security guidance (authentication, encryption, ACLs, network isolation), see the dedicated skill: redis-elasticache-security. Apply the General AWS Requirements above (IAM, VPC, CloudTrail) to all ElastiCache deployments.