How BBVA relies on Amazon AppStream to avoid data exfiltration
summary
BBVA implements a serverless, multi-account design that uses Amazon AppStream to prevent data exfiltration by exposing only encrypted pixels and tightly controlling session actions. A central gateway called Heimdal single sign-on issues streaming URLs, stores encrypted credentials in a DynamoDB table with 5-minute TTL protected by a dedicated KMS key, and issues one-time API tokens via Lambda authorizers; VPC endpoints and resource policies constrain origins. The recorded demo opens Athena through AppStream, proving the flow works at scale across 100+ fleets.
AI-written summary · about
chapters (13)
- 0:00Introduction to BBVA and AppStream
- 4:31Key Amazon AppStream concepts
- 7:08BBVA overview and AWS journey
- 17:00BBVA's data protection strategy
- 19:52BBVA's AWS networking model
- 23:29Challenges leading to AppStream
- 26:49Amazon AppStream as the solution
- 27:31AppStream challenges and Heimdal
- 31:51Heimdal architecture explained
- 36:07Heimdal Single Sign-On deep dive
- 45:43Demo of AppStream in action
- 49:01Protecting data within AppStream
- 51:37Future steps and next projects
related talks
26mVault in BBVA, Secrets in a Hybrid Architecture
53mFuture Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security
32mHow RBI strengthens network security with AWS(SEC303)
13mAPI Layer7 Security by Broadcom, A overview of Customer Use Cases.
18mSelf-service AWS Serverless Application Model
36mMulti-tenanted streams @Workday
03mCustomer Spotlight
40mBalancing agility and security: SBB’s journey to AWS(SEC204)