Forem: Rajani Ekunde

Enhancing AWS Security: A Guide to IAM User Deletion Notifications

Rajani Ekunde — Wed, 17 Jan 2024 08:09:17 +0000

Introduction

In the dynamic realm of AWS, safeguarding your environment is a continuous journey. In this detailed guide, we’ll delve into a crucial aspect of security where we will be configuring notifications for IAM user deletions.

This hands-on approach adds a layer to your defense strategy, ensuring you’re not only aware but also well-prepared to respond promptly to potential security threats.

Why is the need to configure these notifications?

IAM users have considerable control over your AWS resources. Any unauthorized access or accidental deletion of these accounts poses a significant security risk.

By configuring IAM user deletion notifications, you gain insights into these crucial events, allowing for swift responses and mitigation of potential security breaches.

AWS Cloud-Trail

AWS CloudTrail is like your AWS superhero sidekick, ensuring your cloud journey is secure, compliant, and well-documented. Imagine it as a record keeper, noting down every move in your AWS account to keep you in the loop.

AWS CloudTrail is your behind-the-scenes assistant from Amazon Web Services (AWS). It’s here to help with governance, compliance, and auditing kind of like your cloud guardian angel. This service creates a detailed play-by-play of every API call made in your AWS account. Whether it’s you, your team, or other users making the call, CloudTrail captures it all.

Configuring AWS CloudTrail

Activate AWS CloudTrail:

Initiate the process by enabling AWS CloudTrail in your AWS account. This service provides a comprehensive log of AWS API calls, including IAM actions.

#aws cloudtrail create-trail — name MyCloudTrail — s3-bucket-name MyS3Bucket

2. Tailor CloudTrail for IAM Events

Customize CloudTrail to capture specific IAM events in your logs.

#aws cloudtrail put-event-selectors --trail-name MyCloudTrail --event-selectors '[{"ReadWriteType": "WriteOnly","IncludeManagementEvents":true,"DataResources":[{"Type":"AWS::IAM::User"}]}]'

AWS CloudWatch

Amazon CloudWatch is like your personal cloud watchdog, keeping a vigilant eye on your Amazon Web Services (AWS) resources. It’s a monitoring and observability service designed to help you track, collect, and visualize data from various AWS resources in real time.

In simpler terms, it’s the tool you turn to when you want to keep tabs on what’s happening within your AWS environment.

Setting Up Amazon CloudWatch Events

Craft CloudWatch Event Rule

Leverage CloudWatch Events to trigger notifications based on CloudTrail events.

#aws events put-rule --name IAMUserDeletionRule --event-pattern '{"source": ["aws.iam"],"detail-type": ["AWS API Call via CloudTrail"],"detail": {"eventSource": ["iam.amazonaws.com"],"eventName": ["DeleteUser"]}}'

2. Specify Rule Target

Define where CloudWatch Events should send notifications, such as an SNS topic.

#aws events put-targets --rule IAMUserDeletionRule --targets '{"Id": "1","Arn": "arn:aws:sns:us-east-1:123456789012:MySNSTopic"}'

AWS IAM & IAM Policies

IAM, which stands for Identity and Access Management, is a crucial service provided by Amazon Web Services (AWS) that allows you to securely control access to your AWS resources.

It serves as the gatekeeper, enabling you to manage users, groups, and roles within your AWS environment, and define who (or what) can do what across your resources

**IAM policies **are the backbone of AWS security. They are JSON documents that define permissions and are attached to users, groups, or roles.

Implementing IAM Policy for Notifications

Create IAM Policy

Develop a policy that grants necessary permissions for CloudWatch Events and SNS.

{
  "Version": "2024-01-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["events:PutTargets", "events:PutRule", "events:DescribeRule"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["sns:Publish"],
      "Resource": "arn:aws:sns:us-east-1:123456789012:MySNSTopic"
    }
  ]
}

2. Attach IAM Policy to User/Role

Associate the IAM policy with the relevant IAM user or role to grant necessary permissions.

#aws iam put-user-policy --user-name MyIAMUser --policy-name IAMUserDeletionPolicy --policy-document file://IAMUserDeletionPolicy.json

Testing the Setup

Simulate IAM User Deletion

Validate your setup by simulating the deletion of an IAM user.

#aws iam delete-user --user-name TestUser

2. Verify Notification

Check your designated notification channel (ex SNS topic) for the alert triggered by the IAM user deletion event.

Conclusion:

Proactively configuring IAM user deletion notifications isn’t just a best practice it’s a critical step in strengthening your AWS security.

By seamlessly integrating AWS CloudTrail, CloudWatch Events, and IAM policies, you establish a robust system that keeps you informed about potential security risks in real time.

AWS Community Builders Program-All you need to know!!🌻

Rajani Ekunde — Thu, 08 Jun 2023 09:38:00 +0000

✨ What is AWS Community Builders program? ✨

The AWS Community Builders program is a global initiative by Amazon Web Services (AWS) that aims to encourage technical enthusiasts and emerging thought leaders to share knowledge and connect to the technical community by providing education, networking opportunities, and technical resources.

In the article I will be explaining about all the things that one should know before applying for the AWS Community Builders Program.

✨ We will be talking about : ✨

✔ Who can apply for the program?
✔ Prerequisites needed for the program.
✔ AWS Community Builder Categories
✔ Why should you join the AWS Community Builders Program?
✔ How to Get Accepted ?
✔ How to apply ?
✔ Perks of being AWS Community Builder
✔ AWS Swags

✨ Who can apply for the program? ✨

✔ You must be at least 18 years old.
✔ Open to everyone worldwide (with the exception of nations that are subject to US embargo)
✔ Twice a year, applications are examined and accepted.
old membership Eligible for all technical levels: Level 100 (Beginner), Level 200 (Intermediate), Level 300 (Advanced), Level 400 (Expert) Technical accuracy and community engagement can be more important than technical depth.
✔ Membership lasts for a year, and you must re-apply every year to renew membership.

✨ Prerequisites needed for the program ✨

✔ AWS Knowledge and Experience
It’s essential to have a thorough knowledge of Amazon Web Services (AWS) and practical experience with AWS services.
Knowledge of numerous AWS products, architectures, best practises, and implementation scenarios are included in this.

✔ Community Engagement
Engagement with the AWS community and active participation in technical categories are highly regarded.

✔ Content Creation
The program’s key component is the creation and dissemination of instructional content. This can be accomplished through publishing blog entries, producing videos or tutorials, giving talks, or participating in open-source initiatives.

✨ AWS Community Builder Categories ✨

AWS Community Builders are assigned to a very specific AWS topic or category, but they are not constrained to it.

The following categories:

Networking and Content Delivery
Storage
Containers
Machine Learning
Serverless
Gravitron / Arm Development
Data (Databases, Analytics, Blockchain)
Developer Tools
Game Tech
Mobile and Web Apps
Management, Governance and Migration
Security, Identity & Compliance
Cloud Operations

You can choose either of the track as per your area of interest.

✨ Why should you join the AWS Community Builders Program? ✨

For those who are enthusiastic about AWS and the cloud community, joining the AWS Community Builders Programme can provide a number of advantages and opportunities.

Here are some benefits you might think about participating in the programme:

✔ Recognition and Visibility

It will raise your professional profile and increase your exposure within the AWS community to be recognised as an AWS Community Builder, which is what the programme offers.

✔ Networking Opportunities

You will have access to a network of like-minded professionals, AWS specialists, and other community builders when you sign up to become an AWS Community Builder. This network can offer beneficial contacts, opportunities for working together, and learning and development opportunities.

✔ Learning and Skill Development

You will be exposed to a variety of AWS technologies, best practises, and use cases by participating in the programme. You may increase your technical proficiency, broaden your knowledge, and keep up with emerging trends and breakthroughs in the AWS ecosystem.

✔ Collaboration and Collaboration Opportunities

The programme promotes teamwork among its participants, allowing you to work together on initiatives, projects, and community-focused events.

✨ How to Get Accepted ? ✨

✔ Engage in the Community
Participate more frequently in the AWS community. Participate in user organizations, meetups, online forums, and social media channels devoted to AWS. Attend AWS events.

✔ Create Unique & Valuable Content
While applying you have to provide 2 links of your original content created either 2 video content, 2 blogs or 1 video 1 blog. Make sure your content revolves around AWS and having no plagiarism.

✔ Prepare Your Application Questions properly
You should write all the answers in the Application very properly because this is one of the most important filtration point. Review the AWS Community Builders program’s application specifications and rules. Pay close attention to the particular questions or prompts given and answer them completely.

✨ How to apply ? ✨

You can go to the below link for applying. You need to check first if the application window is open or not.

Once a year they do open their application. You need to check if they have started accepting the applications of the same or not.

If they have not started the application window you can simply go and add your name to the waitlist. So that when they will start accepting the applications they will inform you about the same via mail.

https://aws.amazon.com/developer/community/community-builders/?AWSreferralQ12021

✨ What should you do once you are into the Program ? ✨

✔ Engage in Virtual Calls .
✔ Take advantage of mentoring possibilities.
✔ Continue to share or create technical information.
✔ Interact with the AWS community, and contribute to its growth.
✔ Show a persistent desire to learn more about AWS.

✨ Perks of being AWS Community Builder ✨

✔ Exclusive multiple sessions where they share their expertise and educate you how to create content.
✔ AWS credit of 500$
✔ 50% off AWS re:Invent tickets
✔ One year of CloudAcademy access
✔ One free certification voucher each year

✨ AWS Swags ✨

These are the swags you will receive if you are being ACB for the first year. They do have some other swags for 2nd year of the Program.

✨ My post on Linkedin About being ACB : ✨

https://www.linkedin.com/posts/rajani103_aws-awscommunity-awscommunitybuilders-activity-7065938581516652544-N03z?utm_source=share&utm_medium=member_desktop

That should give you a good overview of the AWS community Builders programme, and I look forward to meeting you there.🌻

Please feel free to contact me on LinkedIn if you are unsure about anything or are having trouble understanding anything about the programme.

Thank you for reading🌻
Rajani!!

AWS CloudWatch ☁🕜 : CMAA | Metric | Alarms | Namespaces | Events

Rajani Ekunde — Wed, 26 Apr 2023 13:21:50 +0000

When an application is designed, we don’t have an idea of how the application is going to perform in the future, what impact it will create, how many people will engage with the application.

Considering global deployment of the application it is little tough to manage the crashing of the application. Hence the users may start facing problems with the application as the traffic on eth application increases. This happens because of short-sightedness and sometimes because of lack of the budget.

Considering microservices architecture for such application with thousands of APIs which works in tandem with each other. In this case there could be failure related to the API on the service, the authentication can fail and also sometimes it can be the issue of CPU utilization and memory consumption which makes the application to crash.

If this problem would have been identified on a timely basis or at an early time then the mess or the whole crash of application would have been restricted by taking necessary steps at the early crash stage.

For that we need a service that can help us collect the data points or logs. This can help us monitor the current state or the state over a period of time and help us create action items to mitigate the issue and the same way lets us analyze the data we have in order to avoid such issues in the future and that’s where cloud watch comes into the picture.

AWS CloudWatch gives us a proper logging mechanism and monitoring mechanism. It allows to to collect the data points, monitor them act on them automatically and this will help us avoid the problems that may occur with the application in the coming future.

What is Amazon CloudWatch?

Amazon CloudWatch is a monitoring service provided by Amazon Web Services (AWS) that provides data and operational insights for various AWS resources. It helps you monitor your resources, applications and services running on the AWS cloud, so you can troubleshoot issues and ensure high availability.

CloudWatch collects monitoring and operational data in the form of logs metrics and events and visualizes it using automated dashboards so you can get a unified view of your AWS resources applications and services that run in AWS and on-premise.

It works on the Principal Collect, Monitor, Act, Analyze(CMAA).

Working of AWS CloudWatch :

**1. Collect: **
The first step is to collect data from various sources, such as logs, metrics, and events, in order to get a complete picture of the behavior and performance of your IT systems and infrastructure.

**2. Monitor: **
Once data is collected, the next step is to monitor it in real-time in order to identify any potential issues or problems. This includes setting up alerts and notifications to proactively notify you when certain conditions are met.

**3. Analyze: **
The third step is to analyze the data in order to gain insights into the performance and behavior of your systems. This includes looking at trends, identifying patterns, and performing root cause analysis to determine the underlying cause of any issues.

**4. Act: **
The final step is to take action based on the insights gained from the analysis. One can automate actions based on specific events or conditions. This includes making changes to your systems, such as optimizing settings or deploying new software updates, in order to improve performance and reliability.

The CMAA methodology is a continuous process that allows you to proactively manage and monitor your IT systems and infrastructure in real-time, ensuring that any potential issues are quickly identified and resolved. By using this framework, you can improve the availability, performance, and security of your systems, and ultimately deliver a better user experience.

AWS CloudWatch :

This is a basic flow of the AWS CloudWatch. As you can see in the diagram the very first step here is the Application Monitoring.

Application Monitoring

AWS CloudWatch collects all the data points and logs from the application for which we are using the AWS CloudWatch system. And helps us to get an idea of the application, its performance and monitor them act on them automatically and this will help us avoid the problems that may occur with the application in the coming future.
**
System-wide Visibility**

In AWS CloudWatch you an exposure to monitor and get data and about all the tiers of the application so that we won’t miss out any services that we have been using in the various tiers of the application.

Resource Optimization

In resource optimization Auto-Scaling comes into the picture. When there is peak CPU utilization then we can increase the number of instances and reduce as the CPU utilization comes down.

Unified Operational Health

And all these things helps the system to have an Unified Operational Health.

Here are some key concepts related to Amazon CloudWatch:

Metrics:
Metrics are data points that measure the behavior and performance of AWS resources. Examples of metrics include CPU utilization, disk read/write operations, and network traffic.

So the basic idea here is that if we want to judge the current state of an instance or resource we need a benchmark isn’t it for example if we consider the CPU utilization of the instance goes above 85 percent then I want to scale a new resource so what we will say then the benchmark here is CPU utilization and the threshold value that I have here is 85 percent.

If the CPU utilization of the instance goes above 85 percent then we want to scale a new resource so 85 percent becomes the threshold and the benchmark on which we are trying to judge the resource state i.e. CPU utilization.

Alarms:
Alarms are used to trigger actions based on the value of a metric. For example, you can create an alarm that sends an email notification when the CPU utilization of an EC2 instance exceeds a certain threshold.

We can use alarms to automatically initiate actions on your behalf for any certain actions that has occurred.

Alarms keep focus on a single metric over a period of time. Once the action is occurred we can notify the same to SNS topic or to an Auto-scaling group to take certain necessary actions.

When you create the CloudWatch alarm, you need to set the 3 settings:

Time Period: It is the length of time to evaluate the metric or expression to create each individual data point for an alarm.

Evaluation period: The number of the most recent periods, or data points, to evaluate when determining alarm state.

Data-points to Alarm: The number of data points within the Evaluation Period that must be breaching to cause the alarm to go to the alarm state.

Namespaces :
A namespace is a container for CloudWatch metrics.

A metric is a set of data points that are recorded over time and represent a specific aspect of a system or application. A namespace is used to organize metrics and to ensure that metrics with the same name do not overlap.

CloudWatch provides several default namespaces for AWS services, such as Amazon EC2, Amazon S3, and Amazon RDS. However, you can also create custom namespaces for your own applications and services.

When you create a custom namespace, you must choose a name that is unique within your AWS account. You can then use the CloudWatch API to publish metrics to your namespace, or you can use CloudWatch agents or integrations to automatically collect and publish metrics from your applications and services.

Once you have created a namespace and published metrics to it, you can use CloudWatch to create alarms, dashboards, and other visualizations based on the data in the metrics. This can help you monitor the health and performance of your systems and applications and quickly identify and respond to issues.

Example : myapplication-cpu-utils, myapplication-cpu-memory

Events:
Events are a way to react to changes in your AWS environment, such as the creation or termination of an EC2 instance. You can use CloudWatch Events to automate your responses to events.

Events are used to monitor and respond to changes in your AWS resources and applications. CloudWatch Events allows you to track changes in your AWS resources, such as when an EC2 instance is launched or terminated, or when a new object is added to an S3 bucket. You can also create rules to trigger events based on application-level events, such as when a file is added to a specific folder on a server.

CloudWatch Events are made up of two main components: rules and targets. A rule defines the event pattern to match, and a target defines the action to take when the rule matches an event. Targets can include Lambda functions, SNS topics, SQS queues, and other AWS services.

When a CloudWatch Event matches a rule, the associated target is triggered, which can then perform a variety of actions, such as sending a notification or invoking a Lambda function to perform additional processing.

CloudWatch Events can be used for a variety of use cases, such as triggering automated workflows, sending notifications, or responding to security threats.

Logs:
Logs are records of events that have occurred in your AWS environment. CloudWatch Logs allows you to store, search, and visualize logs from multiple AWS resources in a central place.

Dashboards:
Dashboards are customizable views that allow you to display metrics, logs, and alarms in a single place. You can create multiple dashboards and share them with other users.

Billing Alarms:
Billing alarms are used to monitor your AWS costs and usage. You can set an alarm to notify you when your monthly costs exceed a certain threshold.

Insights:
CloudWatch Insights is a search and analysis tool that allows you to quickly search and visualize CloudWatch logs.

In summary, CloudWatch helps you monitor and manage your AWS resources and applications by collecting and analyzing data from various sources and providing tools to help you take actions based on that data.

Please, feel free to drop any questions in the comments below. I would be happy to answer them.

If this post was helpful, please do follow and click the clap 👏 button below to show your support 😄

_Thank you for reading💚

_Rajani 🌻✨

gh

Rajani Ekunde — Tue, 18 Apr 2023 10:29:21 +0000

mbed rich content such as

AWS CloudWatch ☁🕜 : CMAA | Metric | Alarms | Namespaces | Events

Rajani Ekunde — Tue, 18 Apr 2023 10:10:13 +0000

When an application is designed, we don’t have an idea of how the application is going to perform in the future, what impact it will create, how many people will engage with the application.

What is Amazon CloudWatch?

It works on the Principal Collect, Monitor, Act, Analyze(CMAA).

Working of AWS CloudWatch :

*1. Collect: *
The first step is to collect data from various sources, such as logs, metrics, and events, in order to get a complete picture of the behavior and performance of your IT systems and infrastructure.

*2. Monitor: *
Once data is collected, the next step is to monitor it in real-time in order to identify any potential issues or problems. This includes setting up alerts and notifications to proactively notify you when certain conditions are met.

*3. Analyze: *
The third step is to analyze the data in order to gain insights into the performance and behavior of your systems. This includes looking at trends, identifying patterns, and performing root cause analysis to determine the underlying cause of any issues.

*4. Act: *
The final step is to take action based on the insights gained from the analysis. One can automate actions based on specific events or conditions. This includes making changes to your systems, such as optimizing settings or deploying new software updates, in order to improve performance and reliability.

AWS CloudWatch :

This is a basic flow of the AWS CloudWatch. As you can see in the diagram the very first step here is the Application Monitoring.

Application Monitoring

System-wide Visibility
In AWS CloudWatch you an exposure to monitor and get data and about all the tiers of the application so that we won’t miss out any services that we have been using in the various tiers of the application.

Resource Optimization
In resource optimization Auto-Scaling comes into the picture. When there is peak CPU utilization then we can increase the number of instances and reduce as the CPU utilization comes down.

Unified Operational Health
And all these things helps the system to have an Unified Operational Health.

Here are some key concepts related to Amazon CloudWatch:

Metrics:
Metrics are data points that measure the behavior and performance of AWS resources. Examples of metrics include CPU utilization, disk read/write operations, and network traffic.

We can use alarms to automatically initiate actions on your behalf for any certain actions that has occurred.

Alarms keep focus on a single metric over a period of time. Once the action is occurred we can notify the same to SNS topic or to an Auto-scaling group to take certain necessary actions.

When you create the CloudWatch alarm, you need to set the 3 settings:

Time Period: It is the length of time to evaluate the metric or expression to create each individual data point for an alarm.
Evaluation period: The number of the most recent periods, or data points, to evaluate when determining alarm state.
Data-points to Alarm: The number of data points within the Evaluation Period that must be breaching to cause the alarm to go to the alarm state.