Lecture 225: Introduction to AWS Network Security Services
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：13:28
- 来源：Udemy Lecture 28622836
- Slide 数量：15
- 画面切换：01:38、02:09、02:51、03:39、04:22、04:52、05:54、06:23、07:22、08:13、09:21、10:35、11:45、12:29
扫描说明
逐条读取了 Udemy 页面中的 298 条英文 Transcript cue，并按时间轴扫描全长约 13:28 的视频。依据 Preventive/Detective 分类、各安全服务的演进，以及服务在典型 Internet-facing VPC 架构中的落位，划分为 15 个小节。15 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS Network Security Portfolio：Preventive 与 Detective 两类控制
时间范围：00:00–01:38
总结 / Summary
中文
AWS 有大量与 Security 相关的 Service，本节只聚焦 Network Security：限制 Traffic、识别 Attack、保护 Network Connection。讲师把能力分为两大类：Preventive Control 在流量到达 Workload 前或路径中直接 Allow/Block；Detective Control 则分析 Log、Metric、API Activity 与 Traffic Pattern，发现 Malicious 或 Unauthorized Behavior。成熟架构通常同时使用两类控制，而不是只依赖单一 Firewall。
English
AWS offers many security services, but this section focuses on network security: restricting traffic, identifying attacks, and protecting network connections. The lecture groups capabilities into preventive controls, which allow or block traffic before or along its path, and detective controls, which analyze logs, metrics, API activity, and traffic patterns for malicious or unauthorized behavior. A mature architecture uses both categories rather than relying on one firewall.
Transcript
00:00 Hello, and welcome to this section,
00:03 AWS Network Security.
00:06 Now, if you talk about the security in AWS,
00:08 then I guess there are more than 50 AWS services
00:10 which are related to the security.
00:13 But in this section, we will primarily focus
00:16 That means the services which can help you
00:18 maybe restrict some traffic, or identify some attacks,
00:22 or secure your network connection.
00:25 So all those services we'll cover in this section.
00:28 Now, if you look at the AWS Network Security services,
00:32 then there is a journey to this, right?
00:34 When AWS first launched EC2 machines,
00:37 after a while, AWS launched security groups, right?
00:40 That's the full service AWS launched.
00:43 But over the time, over these 12 years,
00:45 AWS has then launched many other services
00:49 to solve a particular problem, right?
00:51 Because security is a broader thing,
00:53 it's not just about restricting certain IP addresses, right?
00:57 It is much more than that,
00:58 and we'll learn about that as we go through this section.
01:01 But broadly, there are two kinds of security services,
01:04 one which you call preventive services,
01:07 another, you can call it detective services.
01:09 Now, preventive services,
01:11 which you can protect your infrastructure
01:13 at the network layer,
01:14 and detective means it can detect
01:16 by analyzing the traffic which is flowing through.
01:19 It can detect certain patterns
01:21 and can see if it is a malicious user
01:25 trying to access something
01:26 or somebody's attacking your system.
01:28 Now that will fall into the detective services.
01:31 So first let's look at which all AWS services
01:34 falls into these categories
01:36 and understand purpose of those services.
2. Security Group 控制 ENI/Instance，Network ACL 控制 Subnet
时间范围：01:38–02:09
总结 / Summary
中文
Security Group 附着在 EC2/ENI 层，只定义允许的 Source、Protocol 与 Port，属于 Stateful 防护。Network ACL 应用于 Subnet Boundary，可同时配置 Allow/Deny，并以 Stateless 方式处理双向 Traffic。两者是 VPC 最基础的 Layer 3/4 Preventive Control：Security Group 细化到 Resource，NACL 为整个 Subnet 提供额外边界。
English
Security groups attach to EC2 resources or ENIs and define allowed sources, protocols, and ports as a stateful control. Network ACLs apply at the subnet boundary, support both allow and deny rules, and evaluate traffic statelessly in each direction. Together they form the basic VPC Layer 3/4 preventive controls: security groups protect individual resources while NACLs add a subnet-wide boundary.
Transcript
01:38 Okay, so it all started with security group.
01:41 As you know, security groups are attached
01:43 to the EC2 machines,
01:44 and then you can define the allow rules
01:47 where you can say the traffic is only allowed
01:50 from certain IP ranges and for certain ports.
01:53 Later, AWS launched network access control list,
01:56 which are applied at the sub-net level,
01:59 and there is a fundamental difference
02:00 between how security group and network ACL works.
02:03 We have already covered that,
02:05 and we'll revisit that again shortly after this lecture.
3. AWS WAF 在 Layer 7 阻止 Web Application Attack
时间范围：02:09–02:51
总结 / Summary
中文
AWS WAF 是 Web Application Firewall，工作在 Layer 7，针对 HTTP(S) Request 中的 Cross-Site Scripting、SQL Injection 与常见 Web Vulnerability 进行匹配和阻断。Web ACL 可关联 CloudFront、Application Load Balancer、API Gateway 与 AppSync 等受支持资源。它保护的是 Application Request，而不是替代 Security Group、NACL 或 Network Firewall 的 Network-layer Control。
English
AWS WAF is a Layer 7 web application firewall that matches and blocks HTTP(S) attacks such as cross-site scripting, SQL injection, and common web vulnerabilities. Web ACLs can be associated with supported resources including CloudFront, Application Load Balancer, API Gateway, and AppSync. WAF protects application requests; it does not replace network-layer controls such as security groups, NACLs, or Network Firewall.
Transcript
02:09 Then AWS WAF was launched in 2015.
02:12 WAF is a web application firewall.
02:14 As the name suggests, it protects your application.
02:17 So typically it works at layer seven,
02:20 and then it can prevent you from the attacks
02:22 like cross-site scripting,
02:24 or SQL injections, or top OS vulnerabilities.
02:29 Now, what is OS vulnerabilities?
02:31 It is like defined set of vulnerabilities,
02:34 which your application should always be protected from.
02:37 Now, WAF can be applied to different AWS services,
02:41 including load balancers, CloudFront, API gateways,
02:44 or if you're heard about Absinthe,
02:46 which is a GraphQL APIs again.
02:49 So WAF works at application layer.
4. AWS Certificate Manager 为 TLS 提供 X.509 Certificate
时间范围：02:51–03:39
总结 / Summary
中文
AWS Certificate Manager（ACM）负责 Provision、Manage 与 Deploy SSL/TLS X.509 Certificate。Client 建立 TLS Connection 时验证 Certificate Chain 与 Certification Authority，从而确认 Server Identity 并加密传输。可以让 ACM 签发 Public Certificate，也可以导入自己的 Certificate，再部署到 Elastic Load Balancing、CloudFront、API Gateway 等集成服务。
English
AWS Certificate Manager provisions, manages, and deploys SSL/TLS X.509 certificates. During a TLS connection, the client validates the certificate chain and certification authority to authenticate the server and encrypt the session. ACM can issue public certificates or accept imported certificates, which can then be deployed to integrated services such as Elastic Load Balancing, CloudFront, and API Gateway.
Transcript
02:51 And then, in 2016 around, AWS launched ACM.
02:56 ACM is Amazon Certificate Manager.
02:58 Now, if you heard about SSL and TLS connection,
03:01 you have to make sure your server
03:03 has the X.509 certificate,
03:05 and then client gets the certificate,
03:08 it validates that certificate has been signed
03:10 by the right certification authority,
03:13 so AWS itself is a certification authority,
03:15 which gives you this certificate,
03:17 which you can apply to different AWS services,
03:19 again, like a load balancer,
03:21 or API gateways, or CloudFront, right?
03:23 And then your connection is TLS enabled, right?
03:27 So either you can import your own certificate,
03:30 or you can get this certificate from the ACM,
03:33 and we'll learn more about what all things
03:35 is employed shortly in this section.
5. AWS Shield 缓解 Layer 3/4 DDoS，Advanced 扩展保护与支持
时间范围：03:39–04:22
总结 / Summary
中文
WAF 主要处理 Layer 7 Web Attack；AWS Shield 则面向 Network/Transport Layer DDoS。DDoS 通过海量 Request 或 Packet 压垮容量，使 Legitimate User 无法访问。Shield Standard 默认保护多项 AWS Edge Service；Shield Advanced 提供更广的 Resource Coverage、Enhanced Detection、DDoS Response Team 支持与 Cost Protection 等高级能力，场景题需要根据风险和预算选择。
English
WAF primarily handles Layer 7 web attacks, while AWS Shield mitigates network and transport-layer DDoS. Such attacks overwhelm capacity with requests or packets and prevent legitimate access. Shield Standard automatically protects several AWS edge services; Shield Advanced adds broader resource coverage, enhanced detection, DDoS Response Team support, and cost-protection benefits. Exam scenarios distinguish them according to risk and budget.
Transcript
03:39 Then in 2017, AWS launched AWS Shield.
03:42 Now, as I said, WAF works at application layer, layer seven,
03:46 but then it doesn't protect you
03:48 from the layer three, layer four attacks.
03:50 And typically these attacks are DDoS attacks, right?
03:53 Distributed denial-of-service attacks.
03:56 That means attackers will overwhelm your servers
03:59 with so many requests that the legitimate users
04:01 won't be able to access your system.
04:03 Now in order to protect your servers or infrastructure
04:07 from these kinds of attacks,
04:09 AWS Shield service is there,
04:11 which comes again in two flavors,
04:12 Shield Standard and Shield Advanced,
04:15 and there are advantages using Shield Advanced,
04:18 and we'll see what those are in this section as well.
6. AWS Firewall Manager 跨 Account 集中下发 Security Policy
时间范围：04:22–04:52
总结 / Summary
中文
AWS Firewall Manager 本身不是 Packet-processing Firewall，而是 Central Policy Management Service。它可在 AWS Organizations 的多个 Account/Resource 上统一配置和审计 AWS WAF、Shield Advanced、Security Group、Network Firewall 等 Policy。价值在于用一个 Console 与一致规则治理组织规模的环境，并自动发现或修复不符合 Policy 的资源。
English
AWS Firewall Manager is not itself a packet-processing firewall; it is a central policy-management service. Across AWS Organizations accounts and resources, it can govern services such as AWS WAF, Shield Advanced, security groups, and Network Firewall. Its value is consistent organization-wide policy from one console, including identification or remediation of noncompliant resources.
Transcript
04:22 Then in 2018 around, AWS launched AWS Firewall Manager.
04:28 Now Firewall Manager itself is not a firewall service
04:31 or a preventive service,
04:32 but it can manage other AWS security services.
04:36 For example, you can manage AWS WAF rules,
04:40 or Shield Advanced, or Security Group, or Network Firewall,
04:44 which AWS launched recently.
04:46 So basically you can apply all these rules
04:49 from a single console across your AWS account.
7. Gateway Load Balancer 横向扩展第三方 IPS/IDS Appliance
时间范围：04:52–05:54
总结 / Summary
中文
许多组织仍依赖 Third-party IPS、IDS 或 Network Monitoring Appliance。若手工把所有 VPC Traffic 引到单一 VM，会产生 Scaling、High Availability 与 Routing 难题。Gateway Load Balancer（GWLB）把 Appliance Fleet 作为透明的 Traffic Inspection Service，提供 Load Balancing、Health Check 与横向扩展，并通过统一 Entry/Exit Path 把流量送入多个 Security Appliance。
English
Many organizations still rely on third-party IPS, IDS, or network-monitoring appliances. Sending all VPC traffic through one manually managed VM creates scaling, availability, and routing problems. Gateway Load Balancer treats an appliance fleet as a transparent traffic-inspection service, adding load balancing, health checks, and horizontal scale while steering traffic through a consistent entry and exit path.
Transcript
04:52 Later on in 2020, AWS launched Gateway Load Balancer.
04:57 Now, Gateway Load Balancer has a special reason
05:00 because a lot of AWS customer still use the third party IPS
05:06 and IDS and network monitoring tool.
05:08 And there was a problem.
05:09 If you want to monitor every packet
05:12 that goes in or out of your VPC,
05:14 you had an option to land this traffic to one machine,
05:19 and from there, you have to send it
05:21 to the right destination,
05:23 but then you had a problem scaling that infrastructure
05:25 as well as the traffic increases.
05:28 Now, Gateway Load Balancer solves that problem, right?
05:31 And we'll learn more about that in a separate section
05:33 of Gateway Load Balancer,
05:34 because this is also an important AWS service
05:38 for your networking exam.
05:40 So with Gateway Load Balancer,
05:41 you can put IPS ideas as well
05:43 as network monitoring appliances.
05:46 And then all the traffic will be routed
05:49 through a single entry and exit point
05:52 via this Gateway Load Balancer.
8. AWS Network Firewall 提供 Managed Stateful/Stateless Inspection
时间范围：05:54–06:23
总结 / Summary
中文
AWS Network Firewall 是 AWS Managed Network Firewall，可在 VPC 路径中执行 Stateless 与 Stateful Rule，并支持 Suricata-compatible Stateful Rule Language。它整合 IDS/IPS-style Deep Inspection，而 AWS 负责 Firewall Infrastructure 的 Availability 与 Scale。需要 AWS-native Managed Control 时选 Network Firewall；必须运行 Vendor Appliance 时更适合 GWLB。
English
AWS Network Firewall is a managed network firewall that applies stateless and stateful rules in VPC traffic paths and supports Suricata-compatible stateful rule syntax. It provides IDS/IPS-style deep inspection while AWS manages firewall availability and scale. Network Firewall fits AWS-native managed enforcement, whereas Gateway Load Balancer is appropriate when vendor appliances must run in the path.
Transcript
05:54 And towards the end of 2020,
05:57 AWS launched AWS Network Firewall.
05:58 Now it is an advanced intrusion prevention system
06:01 and intrusion detection system
06:03 where you can write Suricata compatible tools.
06:06 And we'll learn about all those rules, what you can write,
06:09 but this is really, really, you know,
06:11 a deep, intelligent network firewall that AWS launched.
06:15 And we'll have a dedicated section,
06:17 which will cover AWS Network Firewall
06:19 as well as the hands-on exercises around that.
9. DNSSEC 为 DNS Response 提供 Authenticity 与 Integrity
时间范围：06:23–07:22
总结 / Summary
中文
DNSSEC 用数字签名让 Resolver/Client 验证 DNS Data 的 Authenticity 与 Integrity，确认 Answer 来自已签名的可信 DNS Chain 且未被篡改。Route 53 支持 DNSSEC Signing 与 Validation，能够降低 DNS Spoofing/Cache Poisoning 把用户导向错误 IP 的风险。它保护 DNS Answer，不提供 Confidentiality，也不能替代 DDoS、WAF 或 Network Firewall。
English
DNSSEC uses digital signatures so resolvers or clients can validate the authenticity and integrity of DNS data, confirming that an answer belongs to a signed chain of trust and has not been modified. Route 53 supports DNSSEC signing and validation, reducing the risk of spoofing or cache poisoning that redirects users to an attacker-controlled IP. It protects DNS answers, not confidentiality, and does not replace DDoS, WAF, or network-firewall controls.
Transcript
06:23 And finally, there is something called DNSSEC validation
06:27 at Route 53, so earlier, whatever Route 53 request
06:31 and response was there, it wasn't really signed.
06:34 Now with DNSSEC validation,
06:36 the client can verify that the response is legitimate
06:41 and it is coming from the AWS Route 53 service.
06:44 So Route 53 will sign the response
06:46 so that client is sure that whatever DNS response
06:51 I'm getting is from the legitimate AWS service.
06:54 And this prevents you from the attacks like DNS poisoning,
06:57 in which case the attacker may send you the wrong IP address
07:03 for the DNS that you have asked for
07:06 and then ultimately will hit the wrong IP address.
07:09 So signing the DNS requests will save you
07:12 from these kinds of attacks.
07:14 So these are all the AWS security services
07:17 which are preventive services.
07:19 And we'll talk about all those in this section.
10. CloudWatch 观察 Metric/Log，CloudTrail 审计 API Activity
时间范围：07:22–08:13
总结 / Summary
中文
Detective Service 从 Telemetry 开始。CloudWatch 收集 Service Metric 与 Log，可建立 Dashboard、Alarm 和 Notification 来发现异常状态。CloudTrail 记录 AWS API Activity，帮助回答 Who did What, When and From Where；例如 Security Group 被修改时，可追溯对应 API Call、Principal 与时间。两者分别偏 Operational Observability 与 Control-plane Audit。
English
Detective services begin with telemetry. CloudWatch collects service metrics and logs and supports dashboards, alarms, and notifications for abnormal conditions. CloudTrail records AWS API activity and answers who did what, when, and from where; for example, a security-group change can be traced to its API call, principal, and timestamp. They emphasize operational observability and control-plane auditing respectively.
Transcript
07:22 And now if you go down to the detective services,
07:25 you know the CloudWatch, right,
07:27 most of the AWS services will emit the logs,
07:30 which can capture by the CloudWatch.
07:33 And then you can monitor these logs.
07:36 You can also create alerts
07:38 and you can also monitor the metrics,
07:41 and then, you know what I'm saying, the notifications.
07:43 Right?
07:44 Then CloudTrail,
07:45 which captures all your API activities in AWS.
07:49 So whatever you do in AWS,
07:53 that API layer is captured through CloudTrail,
07:55 so you can monitor, right?
07:56 If somebody has modified say a security group,
07:59 that API call will be captured in CloudTrail.
08:01 So you can again take that CloudTrail logs
08:05 and you can find out who did what at what time.
08:08 So these are, again, the detective services
08:10 in case something goes wrong.
11. VPC Flow Logs 提供 Metadata，GuardDuty 用 ML 与 Threat Intel 检测威胁
时间范围：08:13–09:21
总结 / Summary
中文
VPC Flow Logs 记录 ENI/VPC Traffic Metadata，可分析 Source/Destination、Port、Protocol 与 Accept/Reject，但不保存完整 Packet Payload。Amazon GuardDuty 进一步分析 VPC Flow Logs、CloudTrail Management/S3 Data Event、DNS Log 等信号，结合 Threat Intelligence 与 Machine Learning 发现异常、Unauthorized 或 Malicious Activity，并生成 Finding。它是 Managed Threat Detection，不是 Inline Blocking Firewall。
English
VPC Flow Logs record ENI and VPC traffic metadata such as source, destination, ports, protocol, and accept or reject status, but not complete packet payloads. Amazon GuardDuty analyzes signals including VPC Flow Logs, CloudTrail management and S3 data events, and DNS logs, combining threat intelligence with machine learning to identify anomalous, unauthorized, or malicious activity and generate findings. It is managed threat detection, not an inline blocking firewall.
Transcript
08:13 Then VPC Flow Logs, as you know,
08:15 whatever traffic flows inside and outside VPCs
08:18 can be captured using VPC Flow Logs.
08:21 We have already covered what flow logs are.
08:23 So you can, again, analyze these VPC flow logs,
08:26 and you can find out where the traffic coming from
08:28 or where the traffic is going to.
08:31 Then GuardDuty, now GuardDuty is an interesting service
08:35 because it's a machine learning based service.
08:38 What it does is it analyzes your VPC flow log,
08:42 your CloudTrail management event logs,
08:44 or CloudTrail for S3 data events or DNS logs.
08:49 And it uses the threat intelligence such as list
08:52 of malicious IP addresses or domains,
08:55 and also applies machine learning to identify unexpected
08:59 and potentially unauthorized and malicious activities
09:01 within your AWS account.
09:03 And we'll learn more
09:04 about what kind of jigs GuardDuty perform.
09:07 There are 70 plus jigs that that duty does,
09:11 and then it applies machine learning
09:14 to find out those behaviors.
09:15 So that's, again,
09:17 a very intelligent threat detection service.
12. Traffic Mirroring 复制 Packet；Resolver Query Logging 记录 DNS Query
时间范围：09:21–10:35
总结 / Summary
中文
VPC Traffic Mirroring 把选定 ENI 的 Network Packet 副本发送到 Monitoring/Security Appliance，适合需要 Payload-level Packet Analysis 的 IDS、Forensics 或 Troubleshooting。Route 53 Resolver Query Logging 则记录来自 VPC 的 DNS Query，包括 Domain、发起 Resource/IP 等 Context，并可交付到 CloudWatch Logs、S3 或 Kinesis Data Firehose。前者看 Packet，后者专门补足 DNS Visibility。
English
VPC Traffic Mirroring copies packets from selected ENIs to monitoring or security appliances for payload-level IDS, forensics, or troubleshooting. Route 53 Resolver query logging records DNS queries originating in VPCs, including domains and resource or IP context, and can deliver them to CloudWatch Logs, S3, or Kinesis Data Firehose. The former exposes packets; the latter adds focused DNS visibility.
Transcript
09:21 Then comes the traffic mirroring.
09:22 If you want to capture all the traffic
09:25 and then analyze it separately,
09:27 you can always do that with a traffic mirroring feature.
09:31 And we already covered that in the last section.
09:34 And then finally we have Route 53 resolver query logs.
09:37 So far, whatever Route 53 resolves the domain name
09:42 to IP addresses, the logs were not getting captured,
09:45 but now with this new feature,
09:48 all these logs can be captured.
09:49 So Route 53 query log lets you log the DNS queries
09:52 that originate in your VPCs.
09:56 Now with this query logging enabled,
09:57 you can see which domain names have been created.
10:00 Right?
10:02 And the AWS resources
10:03 from which the queries have been originated,
10:05 including, the IP address and instance IDs.
10:08 Accordingly, you can see, you know,
10:11 what's really happening in your AWS account
10:14 and inside your VPC.
10:16 So these are what the query logs can enable you,
10:19 and these logs you can store to S3 or CloudWatch
10:21 or Kinesis Firehose.
10:24 So overall, this is a portfolio of services,
10:28 which secure AWS network.
10:31 And then we will now see all these services in action.
13. 典型 Internet-facing VPC：Edge、DNS、Subnet 与 Instance 分层防护
时间范围：10:35–11:45
总结 / Summary
中文
典型 Application 由 Internet User 经 Route 53、CloudFront、Internet Gateway 到达 VPC 内的 Load Balancer 与 EC2。CloudFront 同时提供 CDN 与 Edge Layer，Route 53 负责 DNS；Network ACL 保护 Subnet Boundary，Security Group 限制 Load Balancer/EC2 的入站和出站 Port。分层设计让每个控制点承担明确范围，减少把全部责任压在单一 Resource 上。
English
A typical application flows from Internet users through Route 53, CloudFront, and an Internet gateway to load balancers and EC2 resources inside a VPC. CloudFront supplies the CDN and an edge layer, Route 53 provides DNS, network ACLs protect subnet boundaries, and security groups restrict load-balancer or EC2 ports. Layering gives each control a defined scope instead of placing all responsibility on one resource.
Transcript
10:35 Now, if you talk about any architecture
10:37 and where the services fit, then let's try to imagine that.
10:41 So this is a VPC and you have a simple application
10:44 with EC2 machines and load balancing in front
10:47 and internet users will access over the internet
10:50 through internet gateway, right?
10:52 These are very familiar architecture to you.
10:54 Now, if you want to apply some additional AWS services
10:58 to maybe optimize the performance or to secure it,
11:02 then you can always use CloudFront, which is a CDN service,
11:06 as you know, right, so that the content can be cached
11:09 and locations can be used.
11:11 And CloudFront itself brings some additional security layer
11:15 on top of your existing application.
11:18 Then for domain name to IP addresses,
11:22 you would use Route 53 and then DNS squared
11:26 is really called to the Route 53.
11:27 So this is kind of simple architecture, I would say.
11:30 Now if you want to secure your EC2 machines,
11:33 you'll apply the security group at the EC2 instance level.
11:35 And in order to protect your application sub-net,
11:39 you will apply the network ACLs.
11:41 Right?
11:42 And you will maybe only allow certain ports there.
14. 选择 AWS Network Firewall 或 GWLB Appliance 建立 Inspection Path
时间范围：11:45–12:29
总结 / Summary
中文
若需要更深的 Network Inspection，可把 VPC Entry/Exit Traffic 引入 AWS Network Firewall，并组合 Stateless 与 Suricata-compatible Stateful Rule。若组织要求 Vendor-specific IPS/IDS，则通过 Gateway Load Balancer 把 Third-party Appliance Fleet 插入路径。两者都需要正确 Routing 才能确保所有目标流量经过 Inspection Point；核心选择是 AWS-managed Rule Engine 还是自管/第三方 Appliance。
English
For deeper network inspection, VPC ingress and egress traffic can traverse AWS Network Firewall with stateless and Suricata-compatible stateful rules. If the organization requires vendor-specific IPS or IDS, Gateway Load Balancer inserts a third-party appliance fleet into the path. Both approaches require routing that forces the intended traffic through the inspection point; the key choice is an AWS-managed rule engine versus self-managed or vendor appliances.
Transcript
11:45 Then if you want to apply the additional firewall rules,
11:50 then you can use network firewall.
11:52 As I said, it includes the Suricata based rules
11:55 you can write into the network firewall.
11:57 There are stateful and stateless rules,
12:00 which we'll cover in a different section.
12:01 But then now this becomes your entry and exit point
12:04 for all the traffic inside your VPC.
12:07 Now, if you want to use your own third party appliances,
12:11 rather than using AWS Network Firewall,
12:13 then you can always use Gateway Load Balancer
12:16 and your own network appliances
12:17 and third party IPS and IDS systems.
12:19 But in that case, your entry and exit point
12:22 will be the Gateway Load Balancer.
12:24 Okay, so far so good.
12:25 You understand where these services are used.
15. WAF、Shield 与 DNSSEC 保护 Application Edge
时间范围：12:29–13:28
总结 / Summary
中文
在 Application Edge，AWS WAF 关联 CloudFront 或 ALB，阻止 XSS、SQL Injection 等 Layer 7 Attack；AWS Shield 缓解 DDoS，Standard 原生覆盖 CloudFront、Route 53 等服务，Advanced 扩展到更多受保护资源和高级响应能力；Route 53 DNSSEC 则保护 DNS Answer 的可信性。三者分别覆盖 Web Request、Availability Attack 与 DNS Integrity，需要组合而非互相替代。
English
At the application edge, AWS WAF associates with CloudFront or an ALB to block Layer 7 attacks such as XSS and SQL injection. AWS Shield mitigates DDoS; Standard protects services such as CloudFront and Route 53, while Advanced expands protected resources and response capabilities. Route 53 DNSSEC protects the trustworthiness of DNS answers. These controls cover web requests, availability attacks, and DNS integrity respectively and should be combined rather than treated as substitutes.
Transcript
12:29 Now, if I talk about application level security,
12:32 I had talked about AWS WAF,
12:34 which can protect your CloudFront
12:36 as well as application load balancer.
12:38 Right?
12:38 And any attacks like cross-site scripting,
12:40 SQL injections can be protected with AWS WAF service.
12:44 And finally, if you want to protect
12:45 your complete infrastructure
12:47 from the distributed denial-of-service attack,
12:50 that is a DDoS attack, you will put AWS Shield.
12:53 Now Shield natively protects a lot of AWS services
12:56 like CloudFront and Route 53.
12:58 But if you want to protect other AWS resources
13:00 like your EC2 machines as well,
13:03 then you can use AWS Shield Advanced.
13:05 And that we'll cover more in a specific lecture
13:08 about AWS Shield.
13:10 So overall, this is how your architecture looks like
13:14 if you want to integrate AWS security services
13:16 into your architecture.
13:17 So with that, we'll stop here.
13:19 And now we'll get into every service
13:21 that we just talked about.
13:23 So I hope that it's clear, and let's move forward.
13:26 Thanks for watching.
整讲总结 / Overall Summary
中文
本讲建立 AWS Network Security 全景：Preventive Control 包括 Security Group、NACL、WAF、ACM、Shield、Firewall Manager、GWLB、Network Firewall 与 DNSSEC；Detective Control 包括 CloudWatch、CloudTrail、VPC Flow Logs、GuardDuty、Traffic Mirroring 与 Resolver Query Logging。架构设计应按 Edge、DNS、Subnet、Resource、Inspection Path 与 Telemetry 分层组合这些 Service，并明确每项能力保护的 OSI Layer、是否 Inline、是否 Managed 以及跨 Account 治理范围。
English
This lecture maps the AWS network-security portfolio. Preventive controls include security groups, NACLs, WAF, ACM, Shield, Firewall Manager, Gateway Load Balancer, Network Firewall, and DNSSEC. Detective controls include CloudWatch, CloudTrail, VPC Flow Logs, GuardDuty, Traffic Mirroring, and Resolver query logging. Architecture should layer them across the edge, DNS, subnets, resources, inspection paths, and telemetry, while distinguishing each service's OSI layer, inline behavior, management model, and cross-account governance scope.
返回顶部 ↑