Web security and VPN implementation over AWS
Budget: ₹12,500 – ₹37,500 INR
The scope is the implementation of RA VPN, Security Group, Auto Snapshot and Lifecycle, IAM Roles and NAT Gateway.
The requirement is to deploy the VPN solution over AWS. So the Employees can use VPN to access the AWS resources. User from Office or Home will connect the VPN with VPN server (Open VPN) deployed in AWS to establish secure communication, from where all the AWS EC2 instances will be accessible.
Security Group
Create the custom security groups for every EC2 Instance and only specific sources over required Ports will be allowed to communicate:
Such as:
• VPN Traffic to access the EC2 over SSH
• Public traffic to HTTP, HTTPs
• Access to critical server from specific IP
Amazon EBS snapshot lifecycle (it is implemented partially)
Use the Amazon Data Lifecycle Manager to automate the creation, retention, and deletion of snapshots based on the requirement the retention and the snapshot creation frequency will be decided
• Snapshot: Daily
• Retention: Count/ Age
Hence devise a operational VPC plan.
IAM Role based access
Create the AWS Identity and Access Management (IAM) custom role for users to access securely AWS resources and IAM user role will control the access based on who is authenticated (signed in) and authorized (has permissions) to use resources.
Role based access:
• AmazonVPCFullAccess
• AmazonVPCReadOnlyAccess
• AmazonS3FullAccess
• AmazonS3ReadOnlyAccess
• AmazonEC2FullAccess
• AmazonEC2ReadOnlyAccess
NAT Gateway Deployment
Use network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances. Databases are in the private subnet and will use the NAT gateway (one way communication) to reach the internet but no one from the internet can initiate the traffic towards the Databases because of the NAT gateway.
The requirement is to deploy the VPN solution over AWS. So the Employees can use VPN to access the AWS resources. User from Office or Home will connect the VPN with VPN server (Open VPN) deployed in AWS to establish secure communication, from where all the AWS EC2 instances will be accessible.
Security Group
Create the custom security groups for every EC2 Instance and only specific sources over required Ports will be allowed to communicate:
Such as:
• VPN Traffic to access the EC2 over SSH
• Public traffic to HTTP, HTTPs
• Access to critical server from specific IP
Amazon EBS snapshot lifecycle (it is implemented partially)
Use the Amazon Data Lifecycle Manager to automate the creation, retention, and deletion of snapshots based on the requirement the retention and the snapshot creation frequency will be decided
• Snapshot: Daily
• Retention: Count/ Age
Hence devise a operational VPC plan.
IAM Role based access
Create the AWS Identity and Access Management (IAM) custom role for users to access securely AWS resources and IAM user role will control the access based on who is authenticated (signed in) and authorized (has permissions) to use resources.
Role based access:
• AmazonVPCFullAccess
• AmazonVPCReadOnlyAccess
• AmazonS3FullAccess
• AmazonS3ReadOnlyAccess
• AmazonEC2FullAccess
• AmazonEC2ReadOnlyAccess
NAT Gateway Deployment
Use network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances. Databases are in the private subnet and will use the NAT gateway (one way communication) to reach the internet but no one from the internet can initiate the traffic towards the Databases because of the NAT gateway.