Establishing a data perimeter on AWS
summary
USAA implements an AWS data perimeter by codifying trust with VPC endpoint policies for S3 and applying them automatically across 100+ accounts; telemetry enrichment in DynamoDB reveals 85% of cross‑org API calls hit S3 and of those 70% go to AWS-owned buckets vs 30% to vendors. Event-driven automation (Lambda, EventBridge, CI/CD) pushes approved policies in minutes, reverts out‑of‑band changes, and integrates IAM Access Analyzer, AWS Config and GuardDuty to detect, prevent and correct misconfigurations at scale.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:16Enabling security and agility
- 6:52Part of your access management strategy
- 7:58Establishing a data perimeter
- 10:37Data perimeter consideration #1
- 12:18Data perimeter consideration #2
- 15:15Data perimeter consideration #4
- 16:42Mitigating security risks with data perimeters
- 18:45Defining your trust boundary
- 20:25Understanding data perimeter controls Perimeter Control Objective
- 23:10Monitoring and continuous enforcement
- 24:52United Services Automobile Association (USAA)
- 25:50The traditional on-premises data perimeter
- 28:31Automating security controls across the organization
- 30:03Developer empowerment and self service
- 36:31Chosen starting point - VPC endpoint policy for Amazon S3
- 38:41VPC endpoint policy for Amazon S3 - defense in depth
- 40:28Logging enrichment
- 42:05Custom policy example
- 42:54Baseline policy example
- 44:47Policy creation and inventory
- 50:27Lessons learned
- 53:32Next steps-data perimeter for resources
related talks
38mEstablishing a Data Perimeter on AWS
54mEstablishing a data perimeter on AWS
27mProactively identifying threats & protecting sensitive data in S3
32mAdvanced threat detection and response on AWS
19mSecuring your AWS environment with automated DSPM
01h 02mWhy IAM is the new perimeter, and how to govern it
18mHow AWS Partners use observability to strengthen customer security
38mSecuring Amazon S3 with guardrails and fine-grained access controls