Understanding configuration management with Vanta and AWS

This blog is part of a series about how to use Vanta and AWS to simplify your organization’s cloud security. To learn more about how to use Vanta and AWS, watch our Coffee and Compliance on-demand webinar.

‍

Amazon Web Services, or AWS, is one of the most popular cloud providers for organizations today — providing one of the most flexible and secure cloud environments available. When it comes to security, AWS has what’s called a Shared Responsibility Model meaning that AWS handles the security of the cloud itself while its customers are responsible for securing what they deploy to their cloud environment. 

‍

In this model, AWS secures the physical infrastructure, the facilities, computing control plane, and the building blocks while customers must secure the workloads and applications that they deploy to the cloud. This is where the AWS integration with Vanta makes a huge difference in how you secure and manage your cloud deployments. 

‍

In this blog series, we’ll show you how to use Vanta to secure the portions of your cloud environment that AWS customers are responsible for. We’ll cover where configuration management falls on the AWS shared responsibility model and where Vanta can help.

‍

Using Amazon Linux for configuration management 

Configuration management is the process of controlling and managing changes to software or hardware system configurations to maintain their integrity over time. To get started you’ll want to define the images that you start building from. One option is to start from the images provided by your cloud hosting provider. AWS has images available and suggests using the latest version of Amazon Linux, which is currently Amazon Linux 2023. 

‍

They offer a new major release every two years and it comes with five years of long-term support. During the standard two-year support phase, the release receives quarterly minor version updates that are communicated to customers with security updates, bug fixes, and new features. It's based on Fedora, which gives customers access to a wide variety of modern software packages. If you want to take advantage of these automatic updates, you’ll need to define a process for updating the base images on a regular basis.

‍

Amazon Linux 2023 includes pre-configured security policies that make it easy for customers to implement common industry guidelines. These policies can be configured at launch time or runtime. Amazon Linux 2023 gives customers control over how and when they choose updates and enables them to lock major and minor versions as well as specific versions of your Linux repository to help you maintain the appropriate configurations. This enables consistency of package versions and updates across your environment. 

‍

AWS represents that many hardened features are enabled by default, including secure boot-related features such as kernel module signing and kernel lockdown. It includes kernel live-patching functionality which enables you to patch critical and important security vulnerabilities into Linux kernel without reboot or downtime.

‍

Where Vanta can help with configuration management 

Vanta integrates with various AWS products to help you automate the cloud security. Some of these areas include:

• Identity and access management
• Vulnerability assessment
• Continuous monitoring of the environment
• Remediation alerts
• Compliance reports for common standards

‍

When it comes to configuration management, Vanta can help you bolster your security here by enabling you to test and get alerts on your configurations, integrate with vulnerability scanners, and ticket remediation workflows.

‍

• Test and alert on configurations: Vanta can ensure your systems are running on the most up-to-date configurations and alert you if one of your configurations needs to be updated or falls out of compliance with one of the frameworks you’ve committed to. 
• Vulnerability scanner integrations: Vanta has more than 300 out-of-the-box integrations that you can connect to the platform to test your source code, infrastructure, and configurations for potential vulnerabilities. 
• Ticket system integrations: Vanta integrates with multiple ticket systems and task trackers allowing you to schedule and track remediation activities directly from the application.
• Policy templates: Vanta’s policy templates allow you to start with an established base for your configuration policies rather than creating them from scratch — offering a foundation that can save you hours of time.

‍

To learn more about how to use Vanta and AWS, watch our Coffee and Compliance webinar recording.