Mô hình trách nhiệm chung (Shared Responsibility Model) - Nền tảng của AWS Security
AWS bảo mật "Security OF the Cloud" (hạ tầng vật lý, network, hypervisor, managed services control plane). Khách hàng chịu trách nhiệm "Security IN the Cloud" (data, identity, application, OS guest, network config, encryption keys).
| AWS Responsibility (Security OF Cloud) | Customer Responsibility (Security IN Cloud) |
|---|
| Vật lý: Data center, power, cooling, network backbone | Dữ liệu: Phân loại, mã hóa, lifecycle, backup |
| Hardware: Server, storage, network device | Identity: IAM policies, MFA, IAM Roles Anywhere, Identity Center |
| Virtualization: Hypervisor (Nitro), host OS | Application: Code, dependencies, container image, serverless function |
| Managed Services Control Plane: RDS, S3, Lambda, EKS control plane | OS Guest (EC2): Patch, hardening, agent, endpoint protection |
| Global Network: Backbone, Edge locations, DDoS mitigation (Shield) | Network Config: VPC, Subnet, SG, NACL, Route Table, TGW, Firewall Manager |
| Compliance: SOC, ISO, PCI, FedRAMP, IRAP (cấp infra) | Compliance: Cấu hình service tuân thủ (cấp ứng dụng/dữ liệu) |
Kiến trúc mạng an toàn AWS (Network Security Architecture)
1. VPC (Virtual Private Cloud) - Đơn vị cô lập mạng cơ bản
- CIDR block private (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Subnet: Public (có route đến IGW), Private (route đến NAT GW), Isolated (chỉ internal)
- Multi-AZ: Mỗi tier (Web, App, DB) có subnet ở ≥ 2 AZ cho HA
2. Kiểm soát truy cập mạng
| Cơ chế | Cấp độ | Stateful | Mặc định | Dùng cho |
|---|
| Security Group (SG) | Instance/ENI (L3/L4) | Có | Deny all inbound, Allow all outbound | Whitelist port/IP cho EC2, RDS, ELB, Lambda |
| Network ACL (NACL) | Subnet (L3/L4) | Không (Stateless) | Allow all both directions | Stateless filter, block IP range, defense in depth |
| AWS Network Firewall | VPC (L3-L7) | Có | - | Stateful inspection, IPS, domain list, Suricata rules, TLS inspection |
| AWS WAF | L7 (ALB, API Gateway, CloudFront, AppSync) | - | - | OWASP Top 10, Rate limit, Bot control, Custom regex |
3. Kết nối an toàn Hybrid & Multi-cloud
- Site-to-Site VPN: IPsec tunnel, BGP, 1.25 Gbps/tunnel, HA 2 tunnels
- AWS Direct Connect (DX): Dedicated 1/10/100 Gbps, private VIF/public VIF/transit VIF, không đi Internet
- Transit Gateway (TGW): Hub-and-spoke kết nối hàng nghìn VPC + on-prem + DX Gateway
- Cloud WAN: Managed global network, policy-based routing, segment isolation
4. DDoS Protection
- AWS Shield Standard: Miễn phí, bảo vệ L3/L4 (SYN flood, UDP reflection) cho tất cả AWS resources
- AWS Shield Advanced: $3,000/tháng + 15-month commitment. Bảo vệ L7, 24/7 DRT (DDoS Response Team), cost protection (credit cho cost spike do DDoS), WAF integration
5. Phân đoạn & Zero Trust Network
- VPC Endpoints (Interface/Gateway): Truy cập S3, DynamoDB, Systems Manager, ECR... không qua NAT/IGW (PrivateLink)
- Security Groups referencing SG: sg-web allow from sg-alb (không cần IP)
- AWS Verified Access: Zero Trust access cho ứng dụng on-prem/cloud không cần VPN
- AWS Network Firewall: Stateful L3-L7, Suricata compatible, domain list, TLS inspection, centralized management qua Firewall Manager
Dịch vụ bảo mật mạng AWS chủ chốt
| Dịch vụ | Chức năng | Use Case |
|---|
| VPC Flow Logs | Ghi log metadata traffic (src/dst IP, port, protocol, action accept/reject) | Forensics, anomaly detection, compliance, Athena/QuickSight query |
| Traffic Mirroring | Copy traffic ENI → target (NLB/ENI) cho IDS/IPS (Zeek, Suricata, ExtraHop) | Deep packet inspection, threat hunting, NDR |
| AWS Network Firewall | Managed stateful firewall + IPS cho VPC | Perimeter VPC, inspection east-west, egress control |
| AWS Firewall Manager | Central policy management multi-account (AWS Organizations) | Baseline SG, WAF, Network Firewall, Shield Advanced across accounts |
| Gateway Load Balancer (GWLB) | Deploy/Scale 3rd party virtual appliances (Palo Alto, FortiGate, Check Point) | Insert firewall/IDS vào traffic path không đổi architecture |
| Amazon GuardDuty | Threat detection: VPC Flow Logs, DNS Logs, CloudTrail, EKS Audit, S3 Data Events | Crypto mining, credential exfil, reconnaissance, anomaly |
| AWS PrivateLink | Private connectivity đến SaaS/Partner services không qua Internet | Connect to Datadog, Snowflake, ServiceNow, partner APIs securely |
Mã hóa mạng (Encryption in Transit)
- TLS 1.2/1.3: Mặc định cho tất cả AWS API endpoints, ALB, CloudFront, API Gateway
- ACM (Certificate Manager): Public/Private CA, auto-renewal, tích hợp ALB/CloudFront
- VPN/DX: IPsec (AES-256, SHA-256), MACsec (100Gbps DX)
- Service-to-Service: mTLS (App Mesh, ECS Service Connect, EKS sidecar)
Giám sát & Tuân thủ mạng
- AWS Config Rules: restricted-ssh, restricted-common-ports, vpc-flow-logs-enabled, s3-bucket-ssl-requests-only
- Security Hub: Tập trung finding từ GuardDuty, Inspector, Config, IAM Access Analyzer, Firewall Manager
- Network Analyzer (VPC Reachability Analyzer): Debug connectivity, verify security group/NACL/route table
- CloudTrail Data Events: Audit S3 object-level, Lambda invoke, DynamoDB
Case Study: Kiến trúc Reference (Well-Architected Security Pillar)
Internet
│
▼
[CloudFront + WAF + Shield Advanced] ──→ [ALB (WAF attached)] ──→ [Public Subnet: ALB only]
│ │
▼ ▼
[AWS WAF Bot Control] [Private Subnet: App Tier (ASG/ECS/EKS)]
│
▼
[Private Subnet: Data Tier (RDS/Aurora/ElastiCache)]
│
┌──────────────────────────┼──────────────────────────┐
▼ ▼ ▼
[TGW] ←── [DX Gateway] ←── [On-prem DC] [VPC Endpoints: S3, Systems Manager, ECR, CloudWatch]
│
▼
[Central Inspection VPC]
[Network Firewall / GWLB + 3rd party FW]
[GuardDuty, Flow Logs → Security Hub]
Kết luận
AWS cung cấp full-stack network security primitives (VPC, SG, NACL, Network Firewall, WAF, Shield, GWLB, PrivateLink, GuardDuty, Firewall Manager) cho phép xây dựng kiến trúc Zero Trust, Defense-in-Depth tại cloud. Thành công phụ thuộc vào: hiểu mô hình trách nhiệm chung, thiết kế VPC multi-tier multi-AZ, least-privilege SG/NACL, encrypt everywhere, centralized logging/monitoring, automation via IaC.
