Security in Amazon Step Functions
Cloud security at Amazon is the highest priority. As an Amazon customer, you benefit from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations.
Security is a shared responsibility between Amazon and you. The shared responsibility model
-
Security of the cloud – Amazon is responsible for protecting the infrastructure that runs Amazon services in the Amazon Cloud. Amazon also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the Amazon compliance programs
. To learn about the compliance programs that apply to Amazon Step Functions, see Amazon Services in Scope by Compliance Program . -
Security in the cloud – Your responsibility is determined by the Amazon service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations.
This documentation helps you understand how to apply the shared responsibility model when using Step Functions. The following topics show you how to configure Step Functions to meet your security and compliance objectives. You also learn how to use other Amazon services that help you to monitor and secure your Step Functions resources.
Step Functions uses IAM to control access to other Amazon services and resources. For an overview of how IAM works, see Overview of Access Management in the IAM User Guide. For an overview of security credentials, see Amazon Security Credentials in the Amazon Web Services General Reference.
Compliance validation for Step Functions
Third-party auditors assess the security and compliance of Amazon Step Functions as part of multiple Amazon compliance programs. These include SOC, PCI, FedRAMP, HIPAA, and others.
For a list of Amazon services in scope of specific compliance programs, see Amazon Services in
Scope by Compliance Program
You can download third-party audit reports using Amazon Artifact. For more
information, see Downloading Reports in Amazon Artifact
Your compliance responsibility when using Step Functions is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. Amazon provides the following resources to help with compliance:
-
Security and Compliance Quick Start Guides
Security and Compliance Quick Start Guides – These deployment guides discuss architectural considerations and provide steps for deploying security- and compliance-focused baseline environments on Amazon. -
Architecting for HIPAA Security and Compliance on Amazon Web Services – This whitepaper describes how companies can use Amazon to create HIPAA-compliant applications.
-
Amazon Compliance Resources
– This collection of workbooks and guides might apply to your industry and location. -
Evaluating Resources with Rules in the Amazon Config Developer Guide – The Amazon Config service assesses how well your resource configurations comply with internal practices, industry guidelines, and regulations.
-
Amazon Security Hub – This Amazon service provides a comprehensive view of your security state within Amazon that helps you check your compliance with security industry standards and best practices.
Resilience in Step Functions
The Amazon global infrastructure is built around Amazon Regions and Availability Zones. Amazon Regions provide multiple physically separated and isolated Availability Zones, which are connected with low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically fail over between zones without interruption. Availability Zones are more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures.
For more information about Amazon Regions and Availability Zones, see Amazon Global
Infrastructure
In addition to the Amazon global infrastructure, Step Functions offers several features to help support your data resiliency and backup needs.
Infrastructure security in Step Functions
As a managed service, Amazon Step Functions is protected by Amazon global network security. For information about Amazon security services and how Amazon protects infrastructure, see Amazon Cloud Security
You use Amazon published API calls to access Step Functions through the network. Clients must support the following:
-
Transport Layer Security (TLS). We require TLS 1.2 and recommend TLS 1.3.
-
Cipher suites with perfect forward secrecy (PFS) such as DHE (Ephemeral Diffie-Hellman) or ECDHE (Elliptic Curve Ephemeral Diffie-Hellman). Most modern systems such as Java 7 and later support these modes.
Additionally, requests must be signed by using an access key ID and a secret access key that is associated with an IAM principal. Or you can use the Amazon Security Token Service (Amazon STS) to generate temporary security credentials to sign requests.
You can call the Amazon API operations from any network location, but Step Functions doesn't support resource-based access policies, which can include restrictions based on the source IP address. You can also use Step Functions policies to control access from specific Amazon Virtual Private Cloud (Amazon VPC) endpoints or specific VPCs. Effectively, this isolates network access to a given Step Functions resource from only the specific VPC within the Amazon network.