Skip to main content

Infrastructure security

The account, network and server controls under every product: people's access, detection, the WAF, network segmentation and admin tools. Read it when you set up an environment or review one.

How it works​

How to build it​

People​

  • Everyone signs in through SSO with MFA. No IAM users for people, no long-lived keys.
  • Production access is a separate, smaller group. Developers get read and logs in prod, not admin.
  • The root user has MFA, no access keys, and is not used.

Detection​

  • Organisation-wide CloudTrail, GuardDuty in every region you use plus us-east-1, high severity findings sent to the team channel.
  • Load balancer access logs on every load balancer.
  • A weekly log review using saved queries. See CloudWatch and account security.

WAF and load balancer​

  • WAF managed rules in Block mode, plus a rate rule. Count mode is for a few days of tuning, with a date to switch.
  • Rules scoped to hosts miss traffic sent to the raw load balancer address. Add a rate rule without a host condition, and make the load balancer's default action a fixed 404.

Network​

  • Databases and admin tools only in private subnets.
  • Segment networks: an app server compromise must not reach directory servers, other databases or office networks.
  • Temporary bastions get a tag with an end date and an alarm if they outlive it.

Servers we run ourselves (VPS, on-premise)​

  • No management consoles reachable from outside (application server managers, database tools). Bind them to localhost or a management network.
  • The application never runs as an OS admin, and its database user is not a superuser.
  • Keep server, framework and OS patches current; one patched domain controller stopped an attack that everything else let through.

Rules​

Rule

Detection is on before the first user: CloudTrail, GuardDuty, access logs. Our first production account ran for months with none of them.

Rule

After a compromise, containment means closing every way in, not changing one password. Isolate, then fix each weakness, then rotate everything, then watch.

Mistakes we made​

  • Production had several admin IAM users and none had MFA. SSO was set up afterwards.
  • No CloudTrail, GuardDuty or Security Hub until a review found it.
  • The WAF blocked nothing for weeks because every rule was left in count mode.
  • No load balancer access logs, so early incidents could not be traced.
  • A forgotten bastion with secret-reading permissions ran for a month.

Checklist​

  • SSO with MFA for everyone; no human IAM users; root unused.
  • CloudTrail, GuardDuty, access logs on; findings reach a channel.
  • WAF in Block mode; load balancer default action 404.
  • Databases and admin tools private.
  • Networks segmented.
  • Temporary access has an end date.
Last updated on