View a markdown version of this page

Theme 2: Manage immutable infrastructure through secure pipelines - AWS Prescriptive Guidance
Related best practices in the AWS Well-Architected FrameworkImplementing this themeMonitoring this theme

Theme 2: Manage immutable infrastructure through secure pipelines

Essential Eight strategies covered: Application control, patch applications, patch operating systems

For immutable infrastructure, you must secure deployment pipelines for system changes. AWS Distinguished Engineer, Colm MacCárthaigh, explained this principle in the Zero-Privilege Operations: Running Services Without Access to Data (YouTube video) presentation at the 2022 AWS re:Invent conference.

By restricting direct access to configure AWS resources, you can require that all resources are deployed or changed through approved, secured, and automated pipelines. Usually, you create AWS Identity and Access Management (IAM) policies that allow users to access only the account that hosts the deployment pipeline. You also configure IAM policies that allow break-glass access for a limited number of users. To prevent manual changes, you can use security groups to block SSH and Windows remote desktop protocol (RDP) access to servers. Session Manager, a capability of AWS Systems Manager, can provide access to instances without the need to open inbound ports or maintain bastion hosts.

Amazon Machine Images (AMIs) and container images must be built securely and repeatably. For Amazon EC2 instances, you can use EC2 Image Builder to build AMIs that have built-in security features, such as instance discovery, application control, and logging. For more information about application control, see Implementing Application Control on the ACSC website. You can also use Image Builder to build container images, and you can use Amazon Elastic Container Registry (Amazon ECR) to share those images across accounts. A central security team can approve the automated process to build these AMIs and container images so that any resulting AMI or container image is approved for use by the application teams.

Applications must be defined in infrastructure as code (IaC), by using services such as AWS CloudFormation or AWS Cloud Development Kit (AWS CDK). Code analysis tools, such as AWS CloudFormation Guard, cfn-nag, or cdk-nag, can automatically test code against security best practices in your approved pipeline.

As with Theme 1: Use managed services, Amazon Inspector can report vulnerabilities across your AWS accounts. Centralised cloud and security teams can use this information to verify that the application team is meeting security and compliance requirements.

To monitor and report on compliance, perform ongoing reviews of IAM resources and logs. Use AWS Config rules to make sure that only approved AMIs are used, and make sure that Amazon Inspector is configured to scan Amazon ECR resources for vulnerabilities.

Related best practices in the AWS Well-Architected Framework

Implementing this theme

Implement AMI and container build pipelines

Implement secure application build pipelines

Implement vulnerability scanning

Monitoring this theme

Monitor IAM and logs on an ongoing basis

  • Periodically review your IAM policies to make sure that:

    • Only deployment pipelines have direct access to resources

    • Only approved services have direct access to data

    • Users don't have direct access to resources or data

  • Monitor AWS CloudTrail logs to confirm that users are modifying resources through pipelines and aren't directly modifying resources or accessing data

  • Periodically review IAM Access Analyzer findings

  • Set up an alert to notify you if the root user credentials for an AWS account are used

Implement the following AWS Config rules

  • APPROVED_AMIS_BY_ID

  • APPROVED_AMIS_BY_TAG

  • ECR_PRIVATE_IMAGE_SCANNING_ENABLED