Search for Well Architected Advice
< All Topics
Print

Enable people to perform actions at a distance

PostedNovember 28, 2024
UpdatedMarch 21, 2025
ByKevin McCaffrey

In today’s dynamic cloud environment, protecting compute resources requires implementing multiple layers of defense. By minimizing direct access to resources, organizations can significantly reduce the risk of human errors and misconfigurations, thereby enhancing security and compliance.

Best Practices

Implement Infrastructure as Code (IaC)

  • Utilize tools like AWS CloudFormation, AWS CDK, or Terraform to define and deploy your infrastructure programmatically. This minimizes manual configuration errors and ensures consistency across environments.
  • Regularly review and update your IaC templates to incorporate best practices and security policies, which helps keep your environment secure and up to date.

Use AWS Systems Manager for Remote Management

  • Leverage AWS Systems Manager to perform maintenance tasks on your EC2 instances and other compute resources remotely without the need for SSH access. This significantly reduces the exposure to potential threats and human error associated with direct access.
  • Configure Systems Manager to use IAM roles for secure access and ensure that only authorized users can execute commands or scripts on your compute resources.

Enforce Least Privilege Access

  • Define strict IAM policies that grant the minimum permissions necessary for users and applications to perform their tasks effectively. This limits the potential impact of compromised credentials.
  • Regularly audit IAM roles and policies to ensure they align with the principle of least privilege, reducing the attack surface of your compute resources.

Implement Monitoring and Logging

  • Enable AWS CloudTrail and Amazon CloudWatch to continuously monitor API calls and resource usage. This allows you to detect unauthorized access or anomalous behavior in real-time.
  • Set up alerts for unusual activity and create dashboards to visualize access patterns, helping you to proactively address potential security incidents before they escalate.

Questions to ask your team

  • Do you use AWS Systems Manager or similar tools to manage your compute resources instead of direct access?
  • Have you documented your infrastructure-as-code practices and ensured they are followed consistently?
  • How do you manage permissions and access controls for those performing actions on your compute resources remotely?
  • What processes do you have in place to monitor and audit actions taken on your resources through remote access?
  • Are you using version control for your infrastructure code to track changes and facilitate rollbacks if necessary?

Who should be doing this?

Cloud Security Architect

  • Design and implement multi-layered security strategies for compute resources.
  • Develop and enforce policies for remote access to EC2 instances using infrastructure-as-code practices.
  • Collaborate with development teams to ensure security best practices are integrated into CI/CD pipelines.
  • Evaluate and recommend security tools and services that enhance protection for compute resources.

DevOps Engineer

  • Automate deployment processes using infrastructure-as-code techniques.
  • Utilize AWS Systems Manager for maintenance and operational tasks to minimize direct access to compute resources.
  • Monitor and manage compute resources to ensure compliance with security policies.
  • Conduct regular assessments of deployment scripts for security vulnerabilities.

Security Analyst

  • Analyze security incidents related to compute resources and recommend remediation strategies.
  • Perform security assessments on infrastructure-as-code deployments for vulnerabilities or misconfigurations.
  • Maintain documentation on security processes and configurations for compute resources.
  • Collaborate with incident response teams to mitigate risks associated with human error.

What evidence shows this is happening in your organization?

  • Remote Access Policy: A policy outlining the restrictions on direct interactive access to compute resources, specifying which tasks must be performed via infrastructure-as-code and AWS Systems Manager.
  • Infrastructure-as-Code Deployment Template: A CloudFormation template that automates the setup of compute resources, ensuring consistent and repeatable deployments without direct access to EC2 instances.
  • Maintenance Runbook: A runbook detailing the processes for maintaining compute resources through AWS Systems Manager, eliminating the need for manual configurations.
  • IAM Roles and Policies Matrix: A matrix that defines the roles and permissions for users and services, ensuring that only necessary access is granted for performing tasks remotely.
  • Compliance Check Checklist: A checklist to ensure that all compute resource tasks are performed according to the established policy for remote operations, enhancing security and compliance.

Cloud Services

AWS

  • AWS Systems Manager: Provides operational data from multiple AWS services allowing you to automate tasks across AWS resources without needing direct access.
  • AWS CloudFormation: Helps you model and set up your Amazon Web Services resources so that you can spend less time managing those resources and more time focusing on your applications.
  • AWS Config: Enables you to assess, audit, and evaluate the configurations of your AWS resources. This helps to ensure compliance and security best practices.

Azure

  • Azure Automation: Allows you to automate manual, repetitive tasks, which supports management of your Azure resources without the need for direct login.
  • Azure Resource Manager: Provides a management layer that enables you to create, update, and delete resources in your Azure account through a declarative template.
  • Azure Policy: Enables you to define policies for your Azure resources, ensuring compliance and governance, and automating the enforcement of those policies.

Google Cloud Platform

Question: How do you protect your compute resources?
Pillar: Security (Code: SEC)

Table of Contents