Sichere Netzwerke in der Cloud

Size: px

Start display at page:

Download "Sichere Netzwerke in der Cloud"

Kerry Harrison
6 years ago
Views:

2 What to expect from the session What is Amazon VPC VPC Toolkit Building your VPC Public vs Private Connectivity to your Data center Protecting your VPC Resources Moving Beyond a Single VPC Configuring logging and monitoring

3 AWS Global Infrastructure 12 Regions 33 Availability Zones 54 Edge Locations Region Edge Location

4 What is Amazon VPC

5 What is Amazon VPC? A private, isolated section of the AWS cloud A virtual network topology you can deploy and customize You have complete control of your networking Proven and well-understood networking concepts

6 Most simply put, it is a virtual data center you can build out and control on AWS!

7 VPC Toolbox

router VPC NAT gateway AWS Direct Connect Subnet

8 VPC components Amazon VPC customer gateway endpoints flow logs Route table Elastic IP Internet gateway router VPC NAT gateway AWS Direct Connect Subnet Elastic network interface VPN connection VPN gateway VPC peering

9 Building your VPC

10 VPCs span an entire region VPC CIDR: /16 Availability Zone A Availability Zone B

11 Subnets sit in a single Availability Zone VPC CIDR: /16 Subnet ( /24) Subnet ( /24) Availability Zone A Availability Zone B

networks Consider subnet design VPC can be /16 down to /28 CIDR

12 Plan your VPC IP space before creating it Consider future AWS region expansion Consider future connectivity to your internal networks Consider subnet design VPC can be /16 down to /28 CIDR cannot be modified after creation Overlapping IP spaces = future headache

13 Add an Internet Gateway VPC CIDR: /16 Web (public) Subnet ( /24) Subnet ( /24) Availability Zone A Availability Zone B

Add an Internet Gateway VPC CIDR: 10.1.0.0 /16 Route Table Destination Target 10.1.0.0/16 Local 0.0.0.0/0 Internet Gateway Web (public) Subnet (10.

14 Add an Internet Gateway VPC CIDR: /16 Route Table Destination Target /16 Local /0 Internet Gateway Web (public) Subnet ( /24) Subnet ( /24) Availability Zone A Availability Zone B

15 Add private subnets VPC CIDR: /16 PUBLIC PUBLIC Subnet ( /24) Subnet ( /24) PRIVATE PRIVATE Subnet ( /24) Subnet ( /24) Availability Zone A Availability Zone B

16 Add private subnets VPC CIDR: /16 Subnet ( /24) Web (public) Subnet ( /24) Web (public) Subnet ( /24) Database (private) Subnet ( /24) Database (private) Availability Zone A Availability Zone B

17 Add private subnets VPC CIDR: /16 Route Table Destination Target /16 Local /0 Web Subnet ( /24) (public) Internet Gateway Subnet ( /24) Web (public) Destination Route Table Target /16 Local Database Subnet ( /24) (private) Subnet ( /24) Database (private) Availability Zone A Availability Zone B

18 NAT Gateway VPC NAT gateway VPC CIDR: /16 Subnet ( /24) Web (public) Subnet ( /24) Web (public) Subnet ( /24) Database (private) Subnet ( /24) Database (private) Availability Zone A Availability Zone B

19 NAT Gateway VPC CIDR: /16 Route Table Destination Target /16 Local /0 Web Internet Gateway Subnet ( /24) (public) Subnet ( /24) Web (public) Route Table Destination Target /16 Local Database Subnet ( /24) /0 NAT Gateway (private) (ENI) Availability Zone A Subnet ( /24) Database (private) Availability Zone B

20 Connect to your data center Subnet ( /24) Subnet ( /24) /16 Subnet ( /24) Availability Zone A Subnet ( /24) Availability Zone B /16

21 Connect to your data center Subnet ( /24) Subnet ( /24) /16 Subnet ( /24) Availability Zone A Subnet ( /24) Availability Zone B /16 or

22 Connect to your data center Subnet ( /24) Subnet ( /24) Internal Server /16 Subnet ( /24) Availability Zone A Subnet ( /24) Availability Zone B /16 or

23 Connect to your data center Subnet ( /24) Subnet ( /24) Internal Server /16 Subnet ( /24) Availability Zone A Subnet ( /24) Availability Zone B /16 or

24 Connect to your data center Route Table Destination Target /16 Local /16 IGW Subnet ( /24) Subnet ( /24) Internal Server /16 Route Table Destination Target /16 Local /16 VPG Subnet ( /24) /0 NAT Gateway Availability Zone A or Subnet ( /24) Availability Zone B /16

25 Protecting your VPC resources

26 Protecting your VPC resources Network Linking Auditing VPN connection AWS Direct Connect VPC peering Endpoint Routing flow logs CloudTrail route table Public / Elastic IP Internet gateway endpoints

27 Protecting your VPC resources Network Linking Security Group Ingress/Egress Rules VPN connection AWS Direct Connect VPC peering Fleet 1 SG Fleet 2 SG Subnet ( /24) Endpoint Routing Network Access Control Lists App 1 SG App 2 SG route table Public / Elastic IP Internet gateway Subnet ( /24) Subnet ( /24)

28 Virtual Private Cloud Security Layers Availability Zone A Availability Zone B Lockdown at instance level Security Group Security Group Security Group Isolate network functions Subnet /24 Subnet /24 Lockdown at network level Network ACL Router Network ACL Route restrictively Routing Table Routing Table Virtual Private Gateway Internet Gateway

29 VPC Security Groups VPC (BuildABeer-VPC-1) HTTP GET Beer TCP(6) Port(80) NTP Buffer Overrun UDP(17) Port(123) security group (BuildABeer-SG-1)

30 Network ACL VPC (BuildABeer-VPC-1) HTTP GET Beer TCP(6) Port(80) HTTP GET Beer TCP(6) Port(80) srcip= security group (BuildABeer-SG-1)

31 Obfuscate - CloudFront VPC (BuildABeer-VPC-1) CloudFront Users Amazon Route 53

32 Hide n go seek ~>nslookup Server: Address: #53 Non-authoritative answer: canonical name = d3u9qbug2y23to.cloudfront.net. Name: d3u9qbug2y23to.cloudfront.net Address: <snip> Name: d3u9qbug2y23to.cloudfront.net Address:

33 Moving Beyond a Single VPC

34 Why have more than one? Application isolation Scope of audit containment (separate AWS Accounts) Risk level separation Separate production from non-production Multi-tenant isolation Business unit alignment

35 Growing your VPCs VPC A Web App VPC A Internal App VPC B Internal App VPC C Internal App VPC D Internal App VPC (N) Internal App HA Pair of VPN Endpoints

36 Connecting your VPCs (VPC Peering) Now, with VPC Peering, you can connect VPCs together within a Region without having to maintain all the VPN overhead. Peering creates a private network connection between any two VPCs in a region Including cross-account VPC Peering

37 Common Design Shared Services VPC Move shared services such as Active Directory, Logging and Monitoring to a shared services VPC VPC B /16 VPC C /16 VPC D /16 None of the other VPCs can send traffic directly to each other through VPC A (= app isolation) pcx-aaaabbbb pcx-aaaacccc VPC A /16 pcx-aaaadddd Only VPC A has direct network access to your data center via a VPN Security Groups and NACLs still apply /16

38 Common Design Shared Services VPC Route Table Route Tables Destination Target VPC A's route table /16 Local /16 pcx-aaaabbbb VPC B /16 VPC C /16 VPC D / /16 pcx-aaaacccc /16 pcx-aaaadddd pcx-aaaacccc /16 VPG1 VPC B's route table /16 Local /16 pcx-aaaabbbb VPC C's route table /16 Local pcx-aaaabbbb VPC A /16 pcx-aaaadddd /16 pcx-aaaacccc VPC D's route table /16 Local /16 pcx-aaaadddd /16

39 Simplify with AWS Direct Connect VPC B /16 VPC C /16 VPC D /16 VPC B /16 VPC C /16 VPC D /16 VPC B /16 VPC C /16 VPC D /16 pcx-aaaacccc pcx-aaaacccc pcx-aaaacccc pcx-aaaabbbb VPC A /16 pcx-aaaadddd pcx-aaaabbbb VPC A /16 pcx-aaaadddd pcx-aaaabbbb VPC A /16 pcx-aaaadddd AWS Direct Connect location Customer data center

40 Configuring logging and monitoring

41 Services AWS CloudTrail VPC Flow Logs

42 AWS CloudTrail

43 Introduction to AWS CloudTrail Amazon S3 bucket Store/ archive Amazon Elastic Block Store (Amazon EBS) Troubleshoot You are making API calls... On a growing set of AWS services around the world.. CloudTrail is continuously recording API calls Monitor and alarm

44 Use cases enabled by CloudTrail IT and security administrators can perform security analysis IT administrators and DevOps engineers can attribute changes on AWS resources to the identity, time and other critical details of who made the change DevOps engineers can troubleshoot operational issues IT auditors can use log files as a compliance aid See: Security at Scale: Logging in AWS White Paper

45 VPC Flow Logs

Dumping out the heavy hitter IP addresses #!/usr/bin/python3 import boto3 # Get the service resource logs = boto3.client( logs ) # Get the log groups groups = logs.

46 Dumping out the heavy hitter IP addresses #!/usr/bin/python3 import boto3 # Get the service resource logs = boto3.client( logs ) # Get the log groups groups = logs.describe_log_groups() for loggroup in groups[ loggroups ] : # Get the LogStream for each loggroup logstreamsdesc = logs.describe_log_streams(loggroupname=loggroup[ loggroupname ]) for logstream in logstreamsdesc[ logstreams ]: events_resp = logs.get_log_events(loggroupname=loggroup[ loggroupname ], logstreamname=logstream[ logstreamname ]) # Store each log entry by the src IP address ip_dict = {} for event in events_resp[ events ] : ip = event[cd message ].split()[4] if ip in ip_dict: ip_dict[ip] = ip_dict[ip] + 1 else : ip_dict[ip] = 1 for w in sorted(ip_dict, key=ip_dict.get, reverse=true): print ( {0:15} {1:8d}.format(w, ip_dict[w])) #Early exit exit()

47 Partners

48 Justin Bradley

Overview. AWS networking services including: VPC Extend your network into a virtual private cloud. EIP Elastic IP

Overview. AWS networking services including: VPC Extend your network into a virtual private cloud. EIP Elastic IP Networking in AWS 2017 Amazon Web Services, Inc. and its affiliates. All rights served. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon Web Services,