Auditing Network Security Configurations

This guide focuses on the mechanisms and tools used to validate, monitor, and audit network security within an AWS environment, specifically targeting requirements for the AWS Certified Advanced Networking Specialty (ANS-C01).

Learning Objectives

After studying this guide, you should be able to:

• Differentiate between resource-level security (Security Groups) and centralized management (Firewall Manager).
• Identify the specific auditing capabilities of AWS Config, Trusted Advisor, and AWS Security Hub.
• Explain how to automate compliance checks for network configurations across multiple accounts.
• Design a strategy for historical configuration tracking and threat detection using CloudTrail and GuardDuty.

Key Terms & Glossary

• Stateful Inspection: A firewall feature where the return traffic for allowed inbound traffic is automatically allowed, regardless of outbound rules (and vice-versa). Security Groups are stateful.
• Compliance Drift: When a resource's configuration changes over time to a state that no longer meets security or regulatory requirements.
• Policy Enforcement: The process of automatically applying and maintaining a set of security rules across multiple resources or accounts using tools like AWS Firewall Manager.
• Least Privilege: The security principle of providing only the minimum necessary access required to perform a task.

The "Big Idea"

In traditional networking, auditing was often a manual, point-in-time snapshot of firewall rules. In AWS, the "Big Idea" is Continuous Automated Auditing. By treats infrastructure as code and using services that monitor state changes (AWS Config) and centralized policies (Firewall Manager), organizations can achieve a "real-time" audit posture where non-compliant network configurations are detected and remediated within minutes, rather than months.

Formula / Concept Box

Hierarchical Outline

1. Resource-Level Auditing
   • Security Groups: Stateful virtual firewalls; auditing involves checking for over-permissive rules (e.g., 0.0.0.0/0 on port 22).
   • Network ACLs: Stateless subnet-level protection; audit for conflicting allow/deny rules.
2. Compliance and Configuration Tracking
   • AWS Config: Records configuration history and snapshots; uses Config Rules for automated compliance.
   • AWS Trusted Advisor: Provides a dashboard for high-level security health checks.
3. Centralized Governance
   • AWS Firewall Manager: Requires AWS Organizations; pushes mandatory security policies and identifies non-compliant resources.
   • AWS Security Hub: Aggregates alerts from GuardDuty, Inspector, and Config into a single pane of glass.
4. Threat Detection & Logging
   • Amazon GuardDuty: Analyzes VPC Flow Logs and DNS logs for malicious patterns (e.g., RDP Brute Force).
   • VPC Flow Logs: The raw data of "allow" vs "reject" traffic for audit forensic analysis.

Visual Anchors

The Auditing Hierarchy

Automated Compliance Flow

Definition-Example Pairs

• Config Rule: A predefined or custom logic that evaluates whether an AWS resource is compliant.
  • Example: A rule that triggers an alert if any Security Group is created with an inbound rule allowing port 3389 (RDP) from 0.0.0.0/0.
• Aggregator: A feature in AWS Config that collects configuration data from multiple accounts and regions.
  • Example: A central Security Account using an aggregator to view the compliance status of Security Groups across 50 different member accounts.
• Resource Tags: Metadata assigned to resources to categorize them for auditing.
  • Example: Applying a Compliance: PCI tag to a VPC, which allows Firewall Manager to apply specific strict firewall policies only to those tagged resources.

Worked Examples

Scenario: Auditing Over-Permissive Security Groups

Problem: A security audit reveals that several developers have opened Port 22 (SSH) to the entire internet to facilitate remote work, violating company policy.

Step-by-Step Solution using AWS Tools:

1. Detection: Use AWS Trusted Advisor to quickly identify all Security Groups with "Unrestricted Access" (0.0.0.0/0) on specific ports.
2. Inventory/History: Query AWS Config to see when the change was made and what the previous configuration was.
3. Accountability: Check AWS CloudTrail for the AuthorizeSecurityGroupIngress API call to identify the IAM user who added the rule.
4. Prevention: Implement an AWS Firewall Manager policy that automatically identifies and remediates (removes) rules that allow unrestricted SSH access across the entire AWS Organization.

Checkpoint Questions

1. Which service is best suited for viewing a historical timeline of how a Security Group's rules changed over the last 6 months?
2. True or False: AWS Firewall Manager can manage security policies for accounts that are NOT part of an AWS Organization.
3. What is the primary difference between the findings in Trusted Advisor and the findings in Amazon GuardDuty?
4. How does AWS Config differ from CloudTrail in the context of a security audit?

▶Click to see answers

1. AWS Config (It provides a configuration timeline).
2. False (Firewall Manager requires AWS Organizations).
3. Trusted Advisor looks at configuration settings (static gaps), while GuardDuty looks at behavior and traffic patterns (active threats).
4. AWS Config tells you what the resource looks like (state); CloudTrail tells you who performed the action to get it there (event).

Muddy Points & Cross-Refs

• Config vs. Firewall Manager: It is often confusing which to use. Use Config for recording and individual resource compliance logic. Use Firewall Manager for active enforcement and scaling rules across many accounts.
• Security Groups vs. Network ACLs: Remember that auditing Security Groups is usually more critical because they are the first line of defense at the instance level and are frequently changed by developers. NACLs are broader and more static.
• Cross-Ref: For more on traffic analysis, see the guide on VPC Flow Logs and Traffic Mirroring.

Comparison Tables

Auditing vs. Monitoring Tools

[!IMPORTANT] For the ANS-C01 exam, remember that Firewall Manager is the answer for "Centralized Management" across "Multiple Accounts," while AWS Config is the answer for "Configuration History" and "Compliance Tracking."