Fine Grained Access Control (FGAC) gives a DynamoDB table owner a high degree of control over data in the table.
The table owner can indicate who (caller) can access which items or attributes of the table and perform what actions (read / write capability).
FGAC is used in concert with AWS IAM, which manages the security credentials and the associated permissions.
Using AssumeRoleWithWebIdentity API you can authenticate users using web identity providers such as Amazon, Google, Facebook or any other open-id compatible identity provider.
Following steps need to be completed first:
Go to IAM
Click on Create New Role
Select Role for identity provider access
Select grant access to identity providers
Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates are used to secure network communications and establish the identity of websites over the Internet.
AWS Certificate Manager is a service that lets you easily provision, manage, and deploy SSL/TLS certificates for use with AWS services.
AWS Certificate Manager removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates.
A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance. To decide whether to allow traffic to reach an instance, AWS evaluate all the rules from all the security groups that are associated with the instance.
Security groups are not just limited to EC2, but can be used with other services such as RDS.
S3 supports server side and client side Encryption. Two types of Encryption: In transit, At rest.
Encryption details can be specified while uploading file.
Encryption In Transit (SSL/TLS)
You can securely upload/download your data to Amazon S3 via SSL endpoints using the HTTPS protocol.
Encryption At Rest
Server Side Encryption
Amazon S3 is designed to be secure by default: All newly created buckets are private by default. Only the bucket and object owners originally have access to Amazon S3 resources they create.
Access Control to S3 Resources
Access control to your bucket can be setup using:
There are different types of security credentials based on how we interact with AWS - Management Console or tools such as CLI or SDKs.
Signon Credentials: Email and Password
Email and password created during signup are used to login to pages such as the AWS Management Console, AWS discussion forums, or AWS support center.