AWS re:Invent 2024: Security Announcements for AWS Teams
Summary
AWS re:Invent announcements include organization-wide resource controls, security settings for EC2, VPC public-access blocking, and centrally managed root access, alongside other security-related cloud features.
Key points
- Resource Control Policies can apply organization-wide rules to resource policies, including restricting external sharing or access.
- Declarative Policies provide six organization-level EC2 settings, including enforcing IMDSv2 and controlling which accounts users can use AMIs from.
- Declarative Policies include auditing to identify affected resources and custom error messages to help troubleshoot disruptions.
- VPC Block Public Access is intended to make it easier to prevent EC2 resources from being made publicly accessible.
- Centrally managed root access allows tightly controlled root-user tasks, such as correcting an S3 bucket with a bad policy.
- Other security-related announcements include CloudFront VPC origins for privately subnetted resources and ALB header modification, including adding HSTS headers.
Article Details
- Event Type
- AWS re:Invent 2024 security-related product and feature announcements
- Impact
- AWS announced cloud security and administration capabilities, including organization-wide resource controls, EC2 security settings, VPC public-access restrictions, and centrally managed root access. Other announcements included private-subnet origins for CloudFront and ALB header modification. These features are intended to help security teams enforce controls and reduce exposure; the article reports no security incident or realized impact.
Vendors
Products
Aurora Serverless v2a new Incident Response service, a new multi-region serverless relational database called DSQL, Aurora Serverless v2 now supporting scaling to zero, and a way to make S3 more like a database via S3 Tables. CloudFront VPC originsCloudFront VPC origins so that EC2s, ALBs, and NLBs, can be fronted by CloudFront but kept in a private subnet. Declarative PoliciesAnother Organization level policy concept is the new Declarative Policies. These provide a set of 6 EC2 related settings that have security benefits. These include enforcing IMDSv2, specifying what accounts your usersDSQLmentioning are a new Incident Response service, a new multi-region serverless relational database called DSQL, Aurora Serverless v2 now supporting scaling to zero, and a way to make S3 more like a database via S3Incident ResponseSome other big announcements worth mentioning are a new Incident Response service, a new multi-region serverless relational database called DSQL, Aurora Serverless v2 now supporting scaling to zero, and a way to make S3S3 TablesAurora Serverless v2 now supporting scaling to zero, and a way to make S3 more like a database via S3 Tables. VPC Block Public Accessand then preventing modifications or additions to that network setup with SCPs. With the new VPC Block Public access feature this has become much easier and is already integrated into the aforementioned Declarative