ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø

As the 2023 ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø Cloud Transformation survey shows, organizations are rapidly moving application and IT workloads to cloud-hosted platforms such as Amazon Web Services (AWS). Compute services like Elastic Compute Cloud (EC2), Lamba, and Elastic Container Service (ECS) allow organizations to host a wide variety of workloads and processes in the cloud, while database and storage services like Simple Storage Service (S3), Relational Database Service (RDS), and DynamoDB offer flexible, scalable cloud storage solutions.

However, as enterprises reap the benefits of these services, we must work to ensure the unique risk points are being addressed that inherently come with leveraging cloud services. According to the 2023 ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø Cloud Transformation survey, in 87 percent of respondentsâ€� organizations, auditors or regulatory authorities identified at least two audit issues related to public cloud services in the last year. By considering key public cloud service risks and how they impact an organization’s environment, we can implement effective cloud controls to reduce compliance issues, auditor fees, and damages to business performance and reputation.

Challenge 2: Access & Session Management in the AWS Cloud

Identity and access management is a key area where SOX-related risks arise in the cloud. Organizations must be able to restrict and monitor access to its production Compute environments and critical Storage resources,Ìýwhich is often challenging given the highly configurable and dynamic nature of AWS resources.Ìý

A cloud access management program that leverages leading practices and technologies will facilitate the implementation of strong, proactive controls and reduce the burden on organizations to produce evidence for SOX auditors. To ensure scalability of the organization’s AWS cloud access controls, managing access centrally across the environment is essential. Integrating Compute and Storage resources with a Centralized Access Management (Ex: SailPoint, Okta, Oracle IM, etc.) and Privileged Session Manager (PSM) tools (Ex: CyberArk PSM, HashiCorp, StrongDM, etc.) will allow organizations to centrally manage many of the critical logical access domains, including access provisioning, revocation, user access reviews, secrets management, and more. Federating AWS IAM Roles to Active Directory enables thorough integration with a Centralized Access Management platform to centrally manage provisioning, revocation, and user access reviews.

Leveraging a PSM gives management the ability to govern and control session access to Compute and Storage resources and provides an automated solution for disabling local compute access, key management, and privileged account credential storage. Some PSM solutions can be integrated with the change ticketing system and require a valid Change Order or Incident Ticket be input before granting privileged session access to critical compute resources. Federating PSM access to Active Directory, with integration of those Active Directory groups in your Centralized Access Management platform, further enables centralized governance and compliance at scale.

AWS Cloud makes it simple to assign granular permissions (I.e. API Actions) at the IAM role/policy level for native Compute and Storage resources; however, if leveraging more traditional Infrastructure as a Service (IaaS) architecture (Ex: EC2, ECS with EC2, Oracle on EC2, SQL on EC2, etc.), the responsibility for configuring, securing, and maintaining the logical security of those infrastructure components does not differ from an on-prem environment. ÌýEven with native Compute or Storage resources governed through AWSâ€� native Identity and Access Management service, organizations must ensure there are appropriate controls to govern and restrict access permissions. For example, permission boundaries can be configured at the Organizational Root level through Service Control Policies (SCPs) which propagate to all child objects within the AWS Organization. IAM Roles/Policies should be configured to enforce least privilege, along with a mechanism to prevent or detect IAM Role/Policy “driftâ€� in which permissions for IAM Roles/Policies no longer align with the organization’s permission baselines. Depending on the maturity and capabilities of the respective organization, this can be achieved through automated means or through a more traditional and manual IAM Role/Policy periodic review.