Establishing a Data Perimeter on AWS
summary
Shows a concrete data perimeter framework for AWS: three sub-perimeters (identity, resource, network) enforced with VPC endpoint policy, resource-based policy, and service control policy using AWS Organizations and Org ID condition keys. Demonstrates blocking S3 access with a single deny unless principal Org ID, stopping models from training on external buckets, and making Lambda credentials useless outside approved VPCs. Provides production-grade example policies in a public GitHub repo and recommends threat modeling plus staged testing before applying policies in production.
AI-written summary · about
chapters (9)
- 0:00Introduction to data security
- 1:59Defining modern perimeter gaps
- 4:21Agenda overview
- 4:40Transition to technical concepts
- 9:27Introduction to data perimeters
- 9:41AWS policy and frameworks
- 18:23Generative AI workload study
- 18:43Deep dive into security controls
- 35:54Lessons learned and conclusion
related talks
54mEstablishing a data perimeter on AWS
57mEstablishing a data perimeter on AWS
01h 02mWhy IAM is the new perimeter, and how to govern it
38mSecuring Amazon S3 with guardrails and fine-grained access controls
48mManaging Security on AWS
53mAchieving End-to-end Security on AWS
55mSteps toward a Zero Trust architecture on AWS
19mSecuring your AWS environment with automated DSPM