Transcription
Guidance for Trusted InternetConnection (TIC) Readiness onAWSFebruary 2016This paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapers
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016 2016, Amazon Web Services, Inc. or its affiliates. All rights reserved.NoticesThis document is provided for informational purposes only. It represents AWS’scurrent product offerings and practices as of the date of issue of this document,which are subject to change without notice. Customers are responsible formaking their own independent assessment of the information in this documentand any use of AWS’s products or services, each of which is provided “as is”without warranty of any kind, whether express or implied. This document doesnot create any warranties, representations, contractual commitments, conditionsor assurances from AWS, its affiliates, suppliers or licensors. The responsibilitiesand liabilities of AWS to its customers are controlled by AWS agreements, andthis document is not part of, nor does it modify, any agreement between AWSand its customers.This paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersPage 2 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016ContentsAbstract4Introduction4FedRAMP-TIC Overlay Pilot5Pilot Objectives, Process, and Methods7Pilot Results8Customer Implementation GuidanceConnection ScenariosAWS Capabilities and Features913Conclusion17Contributors17This paper has been archivedPage 3 of 579APPENDIX A:18Control Implementation Summary18For the latestAPPENDIXB:21technical content, refer to the AWSWhitepapers & Guides whitepapersAPPENDIXC:32TIC Capabilities Matrix32Notes5721
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016AbstractThe Trusted Internet Connection (TIC) Initiative1 is designed to reduce thenumber of United States Government (USG) network boundary connections,including Internet points of presence (POPs), to optimize federal networkservices, and improve cyber protection, detection, and response capabilities. Inthe face of an ever-increasing body of laws and regulations related to informationassurance, USG customers wanting to move to the cloud are confronted withsecurity policies, guidelines, and frameworks that assume on-premisesinfrastructure, and that do not align with cloud design principles. Today, TICcapabilities are not available “in the cloud.” This document serves as a guidancefor TIC readiness on the Amazon Web Services (AWS) cloud.IntroductionUSG agencies must route connections for the increasing number of mobile usersaccessing cloud services via smart phones and tablets through their agencynetwork.2 In alignment with this trend toward mobile use, USG employees andcontractors now want the ability to access cloud-based content anytime,anywhere,withtechnicalany device. Agencieswantreferto leveragecompliantFor the andlatestcontent,to theAWS cloudservice providers (CSPs) for agile development and rapid delivery of modern,Whitepapers & Guides page:scalable, and cost-optimized applications without compromising on either assurance posture or the capabilities of the cloud. In its currentform, a TIC-compliant architecture precludes direct access to applicationsrunning in the cloud. Users are required to access their compliant CSPs throughan agency TIC connection, either a TIC Access Provider (TICAP) or a ManagedTrusted IP Service (MTIPS) provider. This architecture often results inapplication latency and might strain existing government infrastructure. Inresponse to these challenges, the TIC program recently proposed a Draft FederalRisk and Authorization Management Program (FedRAMP)–TIC Overlay3 thatprovides a mapping of National Institute of Standards and Technology (NIST)800-53 security controls to the required TIC capabilities.This paper has been archivedFigure 1 below, shows the challenge mobile applications face with the currentstate of the TIC architecture; it also shows a proposed future state of thearchitecture contemplated by the Department of Homeland Security (DHS) TICProgram Office and General Services Administration (GSA) FedRAMP ProgramPage 4 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016Office. This new approach enables direct access to applications running in acompliant CSP. Through a pilot program, DHS and GSA sought to understandwhether the objectives of the TIC initiative could be achieved in a cloudenvironment.This paper has been archivedFigure 1: TIC Pilot ObjectiveFor the latest technical content, refer to the AWSWhitepapers& on.com/whitepapersIn May of 2015, GSA and DHS invited AWS to participate in a FedRAMP-TICOverlay pilot. The purpose of the pilot was to determine whether the proposedTIC overlay on the FedRAMP moderate security control baseline was achievable.In collaboration with GSA and DHS, AWS assessed how remote agency userscould use the TIC overlay to access cloud-based resources and whether existingAWS capabilities would allow an agency to enforce TIC capabilities.The scope of the pilot leveraged the existing AWS FedRAMP Moderateauthorization. Participants in the pilot included a USG customer, the DHS TICProgram Management Office (PMO), the GSA FedRAMP PMO, and AWS. Thealignment to FedRAMP and TIC control objectives was evaluated andadministered by an accredited FedRAMP third-party assessment organization(3PAO). Table 1, below, indicates the count of TIC capabilities included in theoverlay pilot. Appendix C provides the supporting data for Table 1.Page 5 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016TIC Capabilities GroupTotalDescriptionOriginal Capabilities74Total TIC v2.0 Reference Architecture CapabilitiesExcluded Capabilities4TIC Capabilities determined by DHS as excluded fromDraft FedRAMP – TIC Overlay. These capabilities are notapplicable to FedRAMP Cloud Service Providerenvironments and are not included in the FedRAMP – TICOverlay baseline.Mapped Capabilities70Original Capabilities less Excluded Capabilities. Thesedefine the baseline FedRAMP – TIC Overlay as defined inthe Draft FedRAMP – TIC Overlay Control Mapping.Deferred Capabilities13Mapped Capabilities determined to be specific to theagency (TIC Provider) and removed from the initial scopeof the assessment, as directed by DHS TIC and GSAFedRAMP PMO.Included Capabilities57Mapped Capabilities less Deferred Capabilities. Thesecapabilities represent the evaluation target of the pilot.This paper has been archivedTable 1: FedRAMP Associated TIC Capabilities EvaluatedFor the latest technical content, refer to the AWSWhitepapers & Guides page: CustomerAWS Management Consolehttps://aws.amazon.com/whitepapersThe following items were also included in the assessment scope: Customer services Amazon Simple Storage Service (Amazon S3) Amazon Elastic Compute Cloud (Amazon EC2) Amazon Elastic Block Store (Amazon EBS) Amazon Virtual Private Cloud (Amazon VPC) AWS Identity and Access Management (IAM)Page 6 of 57 Customer third-party tools and AWS ecosystem providers used to enforceTIC capabilities AWS supporting infrastructure Control responsibilities, shown in Table 2
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016Responsible PartyTotalDescriptionCustomer16TIC capabilities determined to be solely the responsibilityof the AWS customerShared36TIC capabilities determined to be a shared responsibilitybetween the customer and AWSAWS5TIC capabilities determined to be solely the responsibilityof AWSTIC Capabilities Evaluated57Total number of candidate capabilities evaluated as part ofthe pilotTable 2: Control ResponsibilitiesPilot Objectives, Process, and MethodsTo test the overlay, AWS worked with a FedRAMP-accredited 3PAO and a USGcustomer to produce results for the following testing objectives: This paper has been archivedIdentify whether and how agencies can use TIC overlay controls, viamapping to the FedRAMP Moderate control baseline, to provide remoteagency users access to AWS while enforcing TIC compliance.For the latest technical content, refer to the AWS Determine whether the required capabilities exist within AWS toWhitepapers & Guides page:implement and enforce TIC compliance.https://aws.amazon.com/whitepapers Determine the allocation of responsibility for implementing and enforcingTIC compliance.An initial analysis of the TIC overlay controls by AWS revealed that over 80percent of the TIC capability requirements map directly to one or more existingFedRAMP Moderate controls satisfied under the current AWS FedRAMPAuthority to Operate (ATO). With the control mapping in-hand and incollaboration with our 3PAO, AWS developed a TIC security requirementstraceability matrix (SRTM) that included control responsibilities. The resultsfrom this exercise, shown in Table 2 above, demonstrated that only 16 TICcapabilities would rest solely with the customer.Next, our 3PAO proceeded with the following testing process and methods:Page 7 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016 Leveraged previous write-ups, evidence, security documentation, andinterviews from the existing AWS FedRAMP Moderate ATO to determinethe satisfaction of security controls that were either the responsibility ofAWS or a shared responsibility. Developed a customer test plan for the controls that were either a customerresponsibility or a shared responsibility, using guidance provided by AWSCertified Solutions Architects. Tested the covered AWS services (IAM, Amazon EC2, Amazon S3, AmazonEBS, and Amazon VPC) and supporting infrastructure, including features,functionality, and underlying components that assist with enforcing TICcapabilities. Tested implementation of shared and customer responsibilities using aCustomer Test Plan and a TIC Pilot SRTM. Interviewed the USG customer on internal policies, procedures, andsecurity tools used to enforce TIC capabilities as defined by DHS. Collected evidence from the customer to complete assessment of thecustomer and shared responsibility controls.This paper has been archivedFor the latest technical content, refer to the AWSPilot ResultsWhitepapers & Guides page:After completion of the assessment phase of the pilot, roughly two dozen of theincludedhttps://aws.amazon.com/whitepapersTIC capabilities required additional discussion with the DHS TIC PMO.The outstanding items were reviewed sequentially, and final dispositions wererecorded based on DHS TIC PMO direction. Table 3 below summarizes theresults of the pilot assessment and final disposition discussion as synthesized byAWS.Page 8 of 57FedRAMP Associated TICCapabilities Version 2.0DispositionTotalDescriptionImplemented43TIC capability determined as satisfied or able to besatisfied on AWS.Gap1TIC capability determined to require further evaluation onAWS by FedRAMP PMO and DHS.
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016Not Assessed13TIC capability determined to be not applicable to a CSP ornot included in the customer environment.FedRAMP-TIC CapabilitiesEvaluated57Total number of candidate capabilities evaluated as part ofthe pilot.Table 3: Synthesized FedRAMP- TIC Associated Capability DispositionsCustomer Implementation GuidanceBased on the results of the pilot and lessons learned, AWS is providing guidanceon both relevant connection scenarios and the use of AWS capabilities andfeatures that align with the FedRAMP-TIC Overlay work described above.Following the conclusion of the overlay pilot, and pending official guidance fromthe FedRAMP PMO and TIC PMO, AWS designed the next sections to provideUSG agencies and contractors with information to assist in the development of“TIC Ready” architectures on AWS. As additional reference, Appendix A containsa Control Implementation Summary (CIS) showing TIC Capability to FedRAMPControl mappings and includes responsible party information. Appendix Bprovides per-control guidance for AWS and ecosystem capabilities that enablecustomer compliance with required TIC capabilities. Finally, Appendix CFor thea mappinglatest technicalcontent,referto the AWScontainsof TIC Capabilitiesto theirAWS-synthesizeddispositions.This paper has been archivedWhitepapers & Guides tepapersIn this section, we highlight common connection scenarios that relate to TICcompliance. For each scenario we provide a brief explanation and a high-levelarchitecture diagram.Public Web and Mobile Applications (Not Included in Pilot)This use case covers public, unauthenticated web and mobile applications. Theseapplications are accessible via the Internet, typically over HTTPS, by the generalpublic. Users access these web and mobile applications using their choice of webbrowser and device. They can access these web and mobile applications fromtheir home or any public Wi-Fi networks or via their mobile devices. Theseapplications are deployed in one or more AWS regions. Figure 2 below, illustratesthis connection scenario.Page 9 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016This paper has been archivedFigure 2: Public Web and Mobile Applications (Unauthenticated)For the latest technical content, refer to the AWSIn this architecture, an Internet Gateway (IGW) provides Internet connectivity toWhitepapers & Guides page:two or more customer-defined public subnets across two or more s (Multi-AZ)in the VPC. An Elastic Load Balancing (ELB) load balancer isplaced in these public subnets. A web tier is configured within an Auto Scalinggroup, leveraging the load balancer, to provide a continuously available web frontend. The web tier securely communicates with back end resources, such asdatabases and other persistent storage. The environment is completely containedwithin the cloud.Public Web and Mobile Applications Requiring Authentication: “All in”DeploymentsThis use case covers authenticated web and mobile application used in an “all incloud” deployment. These applications are accessible via the Internet, typicallyover HTTPS, by the agency users. They access these web and mobile applicationsfrom their home, any public Wi-Fi networks, or agency networks using eitherpersonal or agency-issued electronic devices. These applications are deployed inone or more AWS regions. These applications leverage role-based authenticationPage 10 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016to arbitrate access to application functionality. The following examples are publicwebsites with authentication requirements: System for Award Management (SAM) GSA Advantage OMB Max Portal Cloud-based software as a service (SaaS) offerings (e.g., email)Figure 3 below illustrates this connection scenario.This paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersFigure 3: Public Web and Mobile Applications - Authenticated, All InIn this architecture, an IGW provides Internet connectivity to two or morecustomer-defined public subnets across multiple Availability Zones in the VPC.An ELB load balancer is placed in these public subnets. A web-tier is configuredwithin an Auto Scaling group, leveraging the ELB load balancer to provide acontinuously available web front end. This web tier securely communicates withother backend resources, most notably the backend identity store used for rolebased authentication. The environment is completely contained within the cloud.Page 11 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016Public Web and Mobile Applications Requiring Authentication:“Hybrid” DeploymentsThis use case covers authenticated web and mobile application use where aportion of the environment resides within a customer datacenter. Theseapplications are accessible via Internet, typically over HTTPS, by the agencyusers. They access these web and mobile applications from their home, any publicWi-Fi networks, or agency networks using either personal or agency-issuedelectronic devices. These applications are deployed in one or more Amazon WebServices (AWS) regions and one or more customer datacenters. Theseapplications leverage role-based authentication to arbitrate access to applicationfunctionality.In the hybrid deployment scenario, a portion of the application architecture,typically the public web presence, resides in the cloud while another portion,typically sensitive data sources, reside in an agency datacenter. This scenario ismost commonly seen when an agency wishes to maintain its identity and/or datastores outside of the cloud environment. Connectivity between the in-cloudportions of the application and the controlled, on-premises components isachieved using AWS Direct Connect or VPN service in conjunction with a TICAPor MTIPS provider. In this way, data flow between the customer’s in-cloud andThis paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersPage 12 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016on-premises services are seen by the TIC. Figure 4 below, illustrates thisconnection scenario.This paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersFigure 4: Public Web and Mobile Applications - Authenticated, HybridAWS Capabilities and FeaturesIn order to achieve TIC compliance on AWS, we recommend using the followingAWS capabilities and features and following our published best practices tosecure the resources.AWS Identity and Access Management (IAM) is a web service that enablesIT organizations to manage multiple users, groups, roles, and permissions forAWS services such as Amazon EC2, Amazon Relational Database Service (RDS)and Amazon VPC. IT can centrally manage AWS Service related resourcesthrough IAM policies using security credentials such as Access Keys. These accesskeys can be applied to users, groups, and roles.Page 13 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016AWS CloudFormation is a web service that uses JSON templates within whichcustomers can describe their IT architecture as code. These templates can then beused to launch or create AWS resources that were defined within the template.This collection of resources is called a stack. CloudFormation templates allowagencies to programmatically implement controls for new and existingenvironments. These controls provide comprehensive rule sets that can besystematically enforced.AWS CloudTrail provides a log of all requests and a history of AWS API callsfor AWS resources. This includes calls made by using the AWS ManagementConsole, AWS SDKs, command-line tools (CLI), and higher-level AWS services.IT can identify which users and accounts called AWS for services that supportCloudTrail, the source IP address the calls were made from, and when the callswere made.Amazon CloudWatch is a monitoring service for AWS cloud resources and theapplications you run on AWS. You can use Amazon CloudWatch to collect andtrack metrics, collect and monitor log files, and set alarms. Amazon CloudWatchcan monitor AWS resources such as Amazon EC2 instances, Amazon DynamoDBtables, and Amazon RDS DB instances, as well as custom metrics generated byFor applicationsthe latestandtechnicalcontent,refero the AWSyourservices, andany log filesyour tapplicationsgenerate. Youcan use AmazonCloudWatchto gainsystem-widevisibility into resourceWhitepapers& Guidespage:utilization, application performance, and operational health. You can use thesehttps://aws.amazon.com/whitepapersinsights to react and keep your application running smoothly.This paper has been archivedCloudWatch Logs can be used to monitor your logs for specific phrases, values,or patterns. For example, you could set an alarm on the number of errors thatoccur in your system logs or view graphs of web request latencies from yourapplication logs. You can view the original log data to see the source of theproblem if needed. Log data can be stored and accessed for as long as you needusing highly durable, low-cost storage so you don’t have to worry about filling uphard drives.AWS Config is a managed service that provides an AWS resource inventory,configuration history, and configuration change notifications to enable securityand governance. With AWS Config, IT can discover existing AWS resources,export a complete inventory of AWS resources with all configuration details, anddetermine how a resource was configured at any point in time. This facilitatesPage 14 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016compliance auditing, security analysis, resource change tracking, andtroubleshooting. You can use AWS Config Rules to create custom rules used toevaluate controls applied to AWS resources. AWS also provides a list of standardrules that you can evaluate against your AWS resources, such as checking thatport 22 is not open in any production security group.Amazon S3 is storage for the Internet. Amazon S3 is a highly scalable, durable,and available distributed object store designed for mission-critical and primarydata storage. Amazon S3 stores objects redundantly on multiple devices acrossmultiple facilities within an AWS region. Amazon S3 is designed to protect dataand allow access to it even in the case of a failure of a data center. The versioningfeature in Amazon S3 allows the retention of prior versions of objects stored inAmazon S3 and also protects against accidental deletions initiated by staff orsoftware error. Versioning can be enabled on any Amazon S3 bucket.Amazon EC2 is a web service that provides resizable compute capacity in thecloud; it is essentially server instances used to build and host software systems.Amazon EC2 is designed to make web-scale computing easier for developers andcustomers to deploy virtual machines on demand. The simple web serviceinterface allows customers to obtain and configure capacity with minimalFor theit provideslatest technicalcontent,refer to resources.the AWSAmazon EC2friction;complete controlof their computingchanges the economicsof computingbecause itpage:allows enterprises to avoid largeWhitepapers& Guidescapital expenditures by paying only for capacity that is actually used.This paper has been archivedhttps://aws.amazon.com/whitepapersAmazon VPC enables the creation of a logically separate space within AWS thatcan house compute resources and storage resources that can be connected to acustomer’s existing infrastructure through a virtual private network (VPN), AWSDirect Connect, or the Internet. With Amazon VPC, it is possible to extendexisting management capabilities and security services such as DNS, LDAP,Active Directory, firewalls, and intrusion detection systems to include privateAWS resources, maintaining a consistent means of protecting informationwhether residing on internal IT resources or on AWS.Amazon Glacier is an extremely low-cost storage service that provides secure,durable, and flexible storage for data backup and archival. With Amazon Glacier,customers can reliably store their data for as little as 0.007 per gigabyte permonth. Amazon Glacier enables customers to offload the administrative burdensof operating and scaling storage to AWS, so that they don’t have to worry aboutPage 15 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016capacity planning, hardware provisioning, data replication, hardware failuredetection and repair, or time-consuming hardware migrationsAmazon VPC Flow Logs is a feature that enables you to capture informationabout the IP traffic going to and from network interfaces in your VPC. Flow logdata is stored using Amazon CloudWatch Logs. After you've created a flow log,you can view and retrieve its data in Amazon CloudWatch Logs. Flow logs canhelp you with a number of tasks; for example, you can troubleshoot why specifictraffic is not reaching an instance, which in turn can help you diagnose overlyrestrictive security group rules. You can also use flow logs as a security tool tomonitor the traffic that is reaching your instance.This paper has been archivedFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersPage 16 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016ConclusionAWS services, features, and our partner ecosystem deliver a suite of capabilitiesthat assist in delivering “TIC Ready” cloud architectures. Through collaborationwith a USG customer, the DHS TIC Program Management Office (PMO), the GSAFedRAMP PMO, and our accredited FedRAMP third-party assessmentorganization (3PAO), AWS has demonstrated how customers might enforce manyof the capabilities prescribed by TIC. While the FedRAMP TIC Overlay is beingfinalized, using the evidence resulting from our TIC Mobile assessment, USGcustomers can implement the TIC capabilities as part of their virtual perimeterprotection solution using functionality provided by AWS, with a clear definitionof the customer responsibility for implementation of the additional TICcapabilities.ContributorsThe following individuals and organizations contributed to this document:This paper has been archived Jennifer Gray, US Public Sector Compliance Architect, AWS SecurityFortechnicalcontent,refer Amazonto theWebAWS theAlan latestHalachmi,Principal SolutionsArchitect,ServicesWhitepapers & Guides page: Nandakumar Sreenivasan, Senior Solutions Architect, Amazon Webhttps://aws.amazon.com/whitepapersServicesPage 17 of 57
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016APPENDIX A:Control Implementation SummaryTIC v2.0AssociatedFedRAMPSecurityControlsFedRAMP ControlMappingIDIDTM.AU.01AC-6 (1)AC-6 (2)IA-1IA-2IA-2 (1)IA-2 (2)IA-2 (3)IA-2 (8)IA-2 (11)IA-2 (12)IA-3IA-4IA-4 (4)IA-5IA-5 (1)IA-5 (2)IA-5 (3)IA-5 (6)IA-5 (7)IA-5 /AAU-1N/AAU-8 (1)AU-3AU-11AU-11RESPONSIBILITYThis paper has been archivedSHAREDFor the latest technical content, refer to the AWSWhitepapers & Guides LOG.02TM.LOG.03TM.LOG.04Page 18 of SHAREDSHAREDSHARED
Amazon Web Services – Guidance for TIC Readiness on AWSTIC 9TO.MG.10TO.MG.11TO.MON.02FedRAMP ControlMappingFebruary 2016RESPONSIBILITYIDN/ACP-8CP-8 (1)CP-8 OMERSHAREDSHAREDSHAREDSHAREDSHAREDSHAREDSHAREDThis paper has been archivedAWSAWSAWSAWSSHAREDFor the latest technical content, refer to the AWSWhitepapers & Guides page:TO.MON.03 AU-6 .CF.04Page 19 of 57AU-1AU-2IR-3CA-7CA-7CA-7IR-6IR-8SI-2SC-5SC-7SC-7 (8)SC-7SC-7 (8)SC-7SC-7 REDSHAREDSHAREDSHAREDSHAREDSHAREDSHAREDCUSTOMER
Amazon Web Services – Guidance for TIC Readiness on AWSTIC S.01TS.PF.01TS.PF.03TS.PF.04TS.PF.06FedRAMP ControlMappingFebruary 2016RESPONSIBILITYIDSI-4SC-8 (1)SC-8 (1)SI-4IA-9IA-5AU-3 (1)SC-7SC-20SC-21SC-22AU-1AU-6AU-6 (1)SC-7AC-4SC-7SC-7SC-7AU-3 (1)AC-17AC-17 (2)IA-2 (2)SC-7 (7)AC-20CA-3CA-3 (3)CA-3 EDCUSTOMERCUSTOMERCUSTOMERThis paper has been archivedSHAREDSHAREDSHAREDFor the latest technical content, refer to the AWSTS.RA.01CUSTOMERWhitepapers & Guides RA.03Page 20 of 57CUSTOMERCUSTOMER
Amazon Web Services – Guidance for TIC Readiness on AWSFebruary 2016APPENDIX B:Implementation GuidanceTIC v2.0 Associated FedRAMPSecurity ControlsRESPONSIBILITYAWS Feature MappingTM.AU.01User AuthenticationSHAREDLeverage IAM and its multifactor authentication capabilities.TM.COM.02TIC and CustomerSHAREDLeverage IAM Policies to controland to restrict access to AWSresources.CUSTOMERLeverage AWS Marketplaceproviders for packet capture andanalysis. Leverage VPC FlowLogs to capture data flowmetadata. LeverageCloudWatch Logs withappropriate log retention for logaggregation. Enable logging withAWS services (e.g., S3 logs,ELB logs).This paper has been archivedTM.DS.01Storage CapacityFor the latest technical content, refer to the AWSWhitepapers & Guides page:https://aws.amazon.com/whitepapersPage 21 of 57TM.DS.02Back up DataCUSTOMERLeverage AWS CloudFormationto template the environment.Leverage EC2 AMI Copy, S3versioning, S3 cross-regionreplication, S3 MFA delete, andS3 life-cycle policies for backup.Leverage EC2 auto-scaling torecovery from transienthardware failures.TM.DS.03Data OwnershipSHAREDAdministrative control.
Amazon Web Services – Guidance for TIC Readiness on AWSTIC v2.0 Associated FedRAMPSecurity ControlsTM.DS.04Data Attribution &RetrievalFebruary 2016RESPONSIBILITYAWS Feature MappingSHAREDLeverage S3 buckets with IAMpolicies and S3 bucket policiesto segregate access to data.Configure services, such asCloudTrail, to log to theappropriate bucket. If needed,leverage S3 Events to initiatedata processing workflows.Leverage CloudWatch Logs withIAM policies to consolidate orsegregate agency data asre
an agency TIC connection, either a TIC Access Provider (TICAP) or a Managed Trusted IP Service (MTIPS) provider. This architecture often results in application latency and might strain existing government infrastructure. In response to these challenges, the TIC program recently proposed a Draft Federal -TIC Overlay 3 that
