Enterprises that adopt cloud computing seek the same benefits as all customers: increased agility, secure data and applications, and decreased costs. But, mature organizations often need to consider unique requirements for resource isolation and regulatory compliance. From retail to manufacturing, financial services to healthcare, AWS delivers the capabilities that enterprises require to deliver this type of private cloud experience.
Deploy Secure Private Environments on AWS
Get Started for FreeContact AWS Sales
AWS provides solutions for private networking, compute, and storage with versitile management and security tools.
Network isolation is important to maintain a secure environment and consistent user experience. By default, AWS creates your instances in a virtual private cloud to provide customers with a logically isolated section of the AWS Cloud. Within the VPC, you maintain complete control over the network configuration. Additionally, AWS provides the ability to acquire a dedicated, private connection between your datacenter and AWS. This can reduce costs, increase throughput, and provide a more consistent experience than Internet-based connections.
Amazon VPC lets you provision a logically isolated section of the Amazon Web Services (AWS) Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.
You can easily customize the network configuration for your Amazon VPC. For example, you can create a public-facing subnet for your webservers that has access to the Internet, and place your backend systems such as databases or application servers in a private-facing subnet with no Internet access. You can leverage multiple layers of security, including security groups and network access control lists, to help control access to Amazon EC2 instances in each subnet.
Additionally, you can create a Hardware Virtual Private Network (VPN) connection between your corporate datacenter and your VPC and leverage the AWS cloud as an extension of your corporate datacenter.
Using AWS Direct Connect, you can establish a dedicated network connection between AWS and your datacenter, office, or colocation environment. In many cases, this can provide both lower costs and a higher level of service than Internet-based connections.
With industry standard 802.1q VLANs, this dedicated connection can be partitioned into multiple virtual interfaces. This allows you to use the same connection to access public resources such as objects stored in Amazon S3 using public IP address space, and private resources such as Amazon EC2 instances running within an Amazon Virtual Private Cloud (VPC) using private IP space, while maintaining network separation between the public and private environments. Virtual interfaces can be reconfigured at any time to meet your changing needs.
AWS Direct Connect is compatible with all AWS services.
AWS allows you to implement fine-grained access roles and groups for every workload. Depending on your needs, stages of isolation can be achieved with a username and password, a software-defined network, and dedicated instances for isolation at the hardware level. With Amazon EC2 and AWS Identity & Access Management, you can be confident that you can build a scalable, secure, failure resilient, enterprise class application.
Amazon EC2 allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment. Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change. Compute on the AWS Cloud provides the tools to build failure resilient applications and isolate themselves from common failure scenarios.
You have complete control of your instances. With root access to each one, you can interact with them as you would any machine. You can also rely on Amazon EC2. The service runs within Amazon’s proven network infrastructure and datacenters, with a Service Level Agreement commitment of 99.95% availability for each Amazon EC2 Region.
Additionally, Amazon EC2 works in conjunction with Amazon VPC to provide security and robust networking functionality for your compute resources.
Dedicated Instances are Amazon EC2 instances launched within your Amazon Virtual Private Cloud (Amazon VPC) that run hardware dedicated to a single customer. Dedicated Instances let you take full advantage of the benefits of Amazon VPC and the AWS cloud – on-demand elastic provisioning; pay only for what you use; and a private, isolated virtual network, all while ensuring that your Amazon EC2 compute instances will be isolated at the hardware level.
You can easily create a VPC that contains dedicated instances only, providing physical isolation for all Amazon EC2 compute instances launched into that VPC, or you can choose to mix both dedicated instances and non-dedicated instances within the same VPC based on application-specific requirements.
Dedicated Instances support both Linux and Windows Server environments, and they are available in both on-demand and Reserved Instance pricing models.
Data security is fundamentally important for enterprise workloads, and AWS provides a wide assortment of private storage options. Amazon Simple Storage Service (Amazon S3) provides options for secure upload/download via SSL encrypted endpoints, as well as both client-side and server-side encryption options for data at rest. Additionally, Amazon Elastic Block Store (EBS) supports encrypted file systems for EC2 instances and can be made single-tenant with EC2 Dedicated Instances.
Data stored in Amazon S3 is secure by default; only bucket and object owners have access to the Amazon S3 resources they create. Amazon S3 supports multiple access control mechanisms, as well as encryption for both secure transit and secure storage on disk. With Amazon S3’s data protection features, you can protect your data from both logical and physical failures, guarding against data loss from unintended user actions, application errors, and infrastructure failures. For customers who must comply with regulatory standards such as PCI and HIPAA, Amazon S3’s data protection features can be used as part of an overall strategy to achieve compliance.
Designed for 99.999999999% durability and 99.99% availability of objects over a given year, Amazon S3 provides a highly durable storage infrastructure designed for mission-critical and primary data storage. Unlike traditional systems that can require laborious data verification and manual repair, Amazon S3 performs regular, systematic data integrity checks, and it is built to be automatically self-healing.
Amazon EBS provides persistent block level storage volumes for use with Amazon EC2 instances. Each Amazon EBS volume is automatically replicated within its Availability Zone to protect you from component failure, offering high availability and durability; as well as the consistent, low-latency performance needed to run enterprise workloads.
EBS supports encrypted file systems for EC2 instances, which can be used in conjunction with EC2 Dedicated Instances to provide greater isolation. Additionally, access to Amazon EBS volumes is integrated with AWS Identity and Access Management (IAM) to enable role-based access control.
Designed to be highly available and reliable, Amazon EBS volume data is replicated across multiple servers in an Availability Zone to prevent the loss of data from the failure of any single component at no additional charge to you.
Fine-grained control over access rights for data and resources is possible with AWS, including control over geographic segregation and regional replication of data. The tools AWS provides can manage users (federated and non-federated) and their access, as well as roles and permissions across most AWS services. If you already use a SAML 2.0 supported corporate directory, such as Microsoft Active Directory, AWS is able integrate with it and extend your existing directory into the cloud. In addition, AWS provides deep auditing support for granular security analysis, resource change tracking, and compliance auditing.
AWS IAM enables you to securely control access to AWS services and resources for your users. Using IAM, you can create and manage AWS users and groups and use permissions to allow and deny their access. IAM is secure by default; users have no access to AWS resources until permissions are explicitly granted.
In addition to defining access permissions directly to users and groups, IAM lets you create roles. Roles allow you to define a set of permissions and then let authenticated users or EC2 instances assume them, getting temporary access to the resources you define.
IAM also allows you to authenticate users in several ways, depending on how they want to use AWS services. You can assign a range of security credentials including passwords, key pairs, and X.509 certificates. You can also enforce multi-factor authentication (MFA) on users who access the AWS Management Console or use APIs.
If you have existing identity systems, AWS supports federation from corporate systems like Microsoft Active Directory, as well as external Web Identity Providers like Google and Facebook.
AWS CloudTrail is a fully managed service that enables granular security analysis, resource change tracking, operational troubleshooting, and compliance auditing. CloudTrail records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.
With CloudTrail, you can get a history of AWS API calls for your account, including API calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services (such as AWS CloudFormation). You can answer questions such as, what actions did a given user take over a given time period? For a given resource, which user has taken actions on it over a given time period? What is the source IP address of a given activity? Which activities failed due to inadequate permissions?
CloudTrail continuously transports events from AWS services using a highly available and fault tolerant processing pipeline. The service also uses Amazon S3 for log file storage and delivery, so log files are stored durably and inexpensively.
AWS offers multiple solutions for managing your organization's encryption keys.
AWS Key Management Service (KMS) is a managed service that you can use to control the encryption keys used by your applications and supported AWS services in multiple regions around the world from a single console. Centralized management of all your keys lets you easily enforce who can use your keys, when they get rotated, and who can manage them. Additionally, AWS KMS integration with AWS CloudTrail gives you the ability to audit the use of your keys to support your regulatory and compliance activities.
AWS CloudHSM provides you with a FIPS 140-2 Level 2 validated single-tenant dedicated hardware device, installed in your Amazon Virtual Private Cloud (VPC), to store and use your keys. You have total control over your keys and the application software that uses them with CloudHSM.
AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys.
AWS Key Management Service is integrated with Amazon S3, Amazon EBS, Amazon Redshift, and Amazon Elastic Transcoder. This means that it is easy to encrypt the data you store in these services with encryption keys you control. AWS KMS is also integrated with AWS CloudTrail to provide you with the ability to audit who used which keys, on which resources, and when. Additionally, AWS KMS enables developers to easily encrypt data, whether through 1-click encryption in the AWS Management Console, or using the AWS SDK to easily add encryption in their application code.
AWS Key Management Service is a managed service. As your usage of AWS KMS encryption keys grows, you do not have to buy additional key management hardware or software, or manage any infrastructure. AWS KMS automatically scales to meet your encryption key needs.
AWS KMS is designed to be highly durable. Multiple copies of encrypted versions of your keys are stored in systems that are designed for 99.999999999%. Moreover, the service is deployed in multiple availability zones within an AWS region to provide high availability for your encryption keys.
For enterprises with enhanced corporate, contractual, and regulatory compliance requirements, AWS CloudHSM can provide dedicated Hardware Security Module (HSM) appliances within the AWS Cloud.
The service allows you to protect your encryption keys within HSMs designed and validated to government standards for secure key management. You can securely generate, store, and manage the cryptographic keys used for data encryption such that they are accessible only by you. AWS CloudHSM helps you comply with strict key management requirements without sacrificing application performance.
CloudHSMs are provisioned inside your Amazon VPC with an IP address that you specify, providing simple and private network connectivity to your Amazon EC2 instances. AWS provides dedicated and exclusive access to CloudHSMs, isolated from other AWS customers.
Available in multiple Regions and Availability Zones, AWS CloudHSM allows you to add secure and durable key storage to your Amazon EC2 applications.
