Amazon S3 File Gateway documentation has been moved to What is Amazon S3 File Gateway?
Volume Gateway documentation has been moved to What is Volume Gateway?
Tape Gateway documentation has been moved to What is Tape Gateway?
Security in Amazon Storage Gateway
Cloud security at Amazon is the highest priority. As an Amazon customer, you benefit from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations.
Security is a shared responsibility between Amazon and you. The shared responsibility model
-
Security of the cloud – Amazon is responsible for protecting the infrastructure that runs Amazon services in the Amazon Cloud. Amazon also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the Amazon Compliance Programs
. To learn about the compliance programs that apply to Amazon Storage Gateway, see Amazon Services in Scope by Compliance Program . -
Security in the cloud – Your responsibility is determined by the Amazon service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations.
This documentation helps you understand how to apply the shared responsibility model when using Storage Gateway. The following topics show you how to configure Storage Gateway to meet your security and compliance objectives. You also learn how to use other Amazon services that help you to monitor and secure your Storage Gateway resources.
Compliance validation for Amazon Storage Gateway
Third-party auditors assess the security and compliance of Amazon Storage Gateway as part of multiple Amazon compliance programs. These include SOC, PCI, ISO, FedRAMP, HIPAA, MTCS, C5, K-ISMS, ENS High, OSPAR, and HITRUST CSF.
For a list of Amazon services in scope of specific compliance programs, see Amazon Services
in Scope by Compliance Program
You can download third-party audit reports using Amazon Artifact. For more information, see Downloading Reports in Amazon Artifact.
Your compliance responsibility when using Storage Gateway is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. Amazon provides the following resources to help with compliance:
-
Security and Compliance Quick Start Guides
Security and Compliance Quick Start Guides – These deployment guides discuss architectural considerations and provide steps for deploying security- and compliance-focused baseline environments on Amazon. -
Architecting for HIPAA Security and Compliance Whitepaper
– This whitepaper describes how companies can use Amazon to create HIPAA-compliant applications. -
Amazon Compliance Resources
– This collection of workbooks and guides might apply to your industry and location. -
Evaluating resources with rules in the Amazon Config Developer Guide – The Amazon Config service assesses how well your resource configurations comply with internal practices, industry guidelines, and regulations.
-
Amazon Security Hub – This Amazon service provides a comprehensive view of your security state within Amazon that helps you check your compliance with security industry standards and best practices.
Resilience in Amazon Storage Gateway
The Amazon global infrastructure is built around Amazon Web Services Regions and Availability Zones.
An Amazon Web Services Region is a physical location around the world where data centers are clustered. Each group of logical data centers is called an Availability Zone (AZ). Each Amazon Web Services Region consists of a minimum of three isolated and physically separate AZs within a geographic area. Unlike other cloud providers, who often define a region as a single data center, the multiple AZ design of every Amazon Web Services Region offers distinct advantages. Each AZ has independent power, cooling, and physical security and is connected via redundant, ultra-low-latency networks. If your deployment requires a focus on high availability, you can configure services and resources to in multiple AZs to achieve greater fault-tolerance.
Amazon Web Services Regions meet the highest levels of infrastructure security, compliance, and data protection. All traffic between AZs is encrypted. The network performance is sufficient to accomplish synchronous replication between AZs. AZs make partitioning services and resources for high availability easy. If your deployment is partitioned across AZs, your resources are better isolated and protected from issues such as power outages, lightning strikes, tornadoes, earthquakes, and more. AZs are physically separated by a meaningful distance from any other AZ, although all are within 100 km (60 miles) of each other.
For more information about Amazon Web Services Regions and Availability Zones, see Amazon Global
Infrastructure
In addition to the Amazon global infrastructure, Storage Gateway supports VMware vSphere High Availability (VMware HA) to help protect storage workloads against hardware, hypervisor, or network failures. For more information, see Using VMware vSphere High Availability with Storage Gateway.
Infrastructure security in Amazon Storage Gateway
As a managed service, Amazon Storage Gateway is protected by the Amazon global network security
procedures that are described in Security Pillar - Amazon Well-Architected Framework
You use Amazon published API calls to access Storage Gateway through the network. Clients must support Transport Layer Security (TLS) 1.2. Clients must also support cipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes.
Additionally, requests must be signed by using an access key ID and a secret access key that is associated with an IAM principal. Or you can use the Amazon Security Token Service (Amazon STS) to generate temporary security credentials to sign requests.
Note
You should treat the Amazon Storage Gateway appliance as a managed virtual machine, and should not attempt to access or modify its installation in any way. Attempting to install scanning software or update any software packages using methods other than the normal gateway update mechanism, may cause the gateway to malfunction and could impact our ability to support or fix the gateway.
Amazon reviews, analyzes, and remediates CVEs on a regular basis. We incorporate fixes for these issues into Storage Gateway as part of our normal software release cycle. These fixes are typically applied as part of the normal gateway update process during scheduled maintenance windows. For more information about gateway updates, see .
Amazon Security Best Practices
Amazon provides a number of security features to consider as you develop and implement your
own security policies. These best practices are general guidelines and don’t represent a
complete security solution. Because these practices might not be appropriate or sufficient
for your environment, treat them as helpful considerations rather than prescriptions. For
more information, see Amazon Security Best Practices
Using Amazon CloudTrail for logging and monitoring in Amazon Storage Gateway
Storage Gateway is integrated with Amazon CloudTrail, a service that provides a record of actions taken by a user, role, or an Amazon service in Storage Gateway. CloudTrail captures all API calls for Storage Gateway as events. The calls captured include calls from the Storage Gateway console and code calls to the Storage Gateway API operations. If you create a trail, you can turn on continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Storage Gateway. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine the request that was made to Storage Gateway, the IP address from which the request was made, who made the request, when it was made, and additional details.
To learn more about CloudTrail, see the Amazon CloudTrail User Guide.
Storage Gateway information in CloudTrail
CloudTrail is activated on your Amazon account when you create the account. When activity occurs in Storage Gateway, that activity is recorded in a CloudTrail event along with other Amazon service events in Event history. You can view, search, and download recent events in your Amazon account. For more information, see Viewing Events with CloudTrail Event History.
For an ongoing record of events in your Amazon account, including events for Storage Gateway, create a trail. A trail allows CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all Amazon Regions. The trail logs events from all Regions in the Amazon partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other Amazon services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:
All of the Storage Gateway actions are logged and are documented in the Actions topic. For example, calls
to the ActivateGateway, ListGateways, and
ShutdownGateway actions generate entries in the CloudTrail log files.
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
-
Whether the request was made with root or Amazon Identity and Access Management (IAM) user credentials.
-
Whether the request was made with temporary security credentials for a role or federated user.
-
Whether the request was made by another Amazon service.
For more information, see the CloudTrail userIdentity Element.
Understanding Storage Gateway log file entries
A trail is a configuration that allows delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following example shows a CloudTrail log entry that demonstrates the action.
{ "Records": [{ "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "AIDAII5AUEPBH2M7JTNVC", "arn": "arn:aws:iam::111122223333:user/StorageGateway-team/JohnDoe", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "JohnDoe" }, "eventTime": "2014-12-04T16:19:00Z", "eventSource": "storagegateway.amazonaws.com", "eventName": "ActivateGateway", "awsRegion": "us-east-2", "sourceIPAddress": "192.0.2.0", "userAgent": "aws-cli/1.6.2 Python/2.7.6 Linux/2.6.18-164.el5", "requestParameters": { "gatewayTimezone": "GMT-5:00", "gatewayName": "cloudtrailgatewayvtl", "gatewayRegion": "us-east-2", "activationKey": "EHFBX-1NDD0-P0IVU-PI259-DHK88", "gatewayType": "VTL" }, "responseElements": { "gatewayARN": "arn:aws:storagegateway:us-east-2:111122223333:gateway/cloudtrailgatewayvtl" }, "requestID": "54BTFGNQI71987UJD2IHTCT8NF1Q8GLLE1QEU3KPGG6F0KSTAUU0", "eventID": "635f2ea2-7e42-45f0-bed1-8b17d7b74265", "eventType": "AwsApiCall", "apiVersion": "20130630", "recipientAccountId": "444455556666" }] }
The following example shows a CloudTrail log entry that demonstrates the ListGateways action.
{ "Records": [{ "eventVersion": "1.02", "userIdentity": { "type": "IAMUser", "principalId": "AIDAII5AUEPBH2M7JTNVC", "arn": "arn:aws:iam::111122223333:user/StorageGateway-team/JohnDoe", "accountId:" 111122223333", " accessKeyId ":" AKIAIOSFODNN7EXAMPLE", " userName ":" JohnDoe " }, " eventTime ":" 2014 - 12 - 03T19: 41: 53Z ", " eventSource ":" storagegateway.amazonaws.com ", " eventName ":" ListGateways ", " awsRegion ":" us-east-2 ", " sourceIPAddress ":" 192.0.2.0 ", " userAgent ":" aws - cli / 1.6.2 Python / 2.7.6 Linux / 2.6.18 - 164.el5 ", " requestParameters ":null, " responseElements ":null, "requestID ":" 6U2N42CU37KAO8BG6V1I23FRSJ1Q8GLLE1QEU3KPGG6F0KSTAUU0 ", " eventID ":" f76e5919 - 9362 - 48ff - a7c4 - d203a189ec8d ", " eventType ":" AwsApiCall ", " apiVersion ":" 20130630 ", " recipientAccountId ":" 444455556666" }] }