AWS HIPAA合规架构与安全最佳实践白皮书

需积分: 0 8 浏览量更新于2024-07-15 收藏 510KB PDF 举报

AWS_HIPAA_Compliance_Whitepaper是一份专门为AWS用户提供关于如何在Amazon Web Services (AWS)上构建符合Health Insurance Portability and Accountability Act (HIPAA)法规的安全性和合规性的指导文档。该白皮书发布于2020年5月，旨在帮助用户设计出满足HIPAA要求的安全架构，确保数据隐私和保护。 HIPAA是一部美国联邦法律，规定了医疗保健提供者、保险公司和其他涉及个人健康信息（PHI）的组织必须遵循的安全和隐私标准。这份白皮书的重要知识点包括： 1. **AWS Key Management Service (KMS)**：AWS KMS用于加密和管理密钥，确保在存储和传输 PHI 时使用强加密措施，符合HIPAA对数据保护的要求。 2. **Amazon Elastic Compute Cloud (EC2)**：用户需要配置EC2实例以遵循HIPAA合规性，这可能涉及到使用专用的虚拟私有云（VPC）、安全组和网络策略，以限制对PHI的访问。 3. **AWS Systems Manager**：作为自动化和管理工具，需确保其配置和策略与HIPAA兼容，如配置管理工具可用来自动执行安全最佳实践。 4. **Amazon Virtual Private Cloud (VPC)**：使用VPC隔离PHI数据，实施子网、安全组和网络访问控制列表，以保护数据免受未经授权的访问。 5. **Amazon Elastic Block Store (EBS)**：存储在EBS上的数据也需要加密，同时备份和恢复过程也需遵循HIPAA规定，以防止数据泄露。 6. **Amazon Redshift**：对于处理大量敏感数据的数据库服务，应确保红移的架构和安全设置满足HIPAA的严格要求，如数据加密和审计跟踪。 7. **Amazon S3**：存储在S3中的PHI需使用服务器端加密，且用户应配置合规的存储类别，例如S3 One Zone-Infrequent Access (S3 Glacier Deep Archive)。 8. **Amazon S3 Transfer Acceleration**：当传输PHI数据时，应启用加密并遵守适当的数据传输策略，确保数据在传输过程中的安全。 9. **Amazon Simple Notification Service (SNS) 和 Amazon Simple Queue Service (SQS)**：用于消息传递和队列服务的配置也应遵循HIPAA，确保敏感信息在这些服务中的安全流转。 10. **Amazon S3 Glacier**：长期存储的数据需进行加密，并且存取策略需符合HIPAA的保留期和访问控制规定。 11. **Amazon RDS for MySQL/MariaDB**：数据库服务提供商需确保RDS实例的加密、备份和恢复策略符合HIPAA合规性。这份白皮书强调，用户在使用AWS服务时，负有自行评估文档信息的责任，同时AWS本身并不为此文档做出任何承诺或担保，用户应参考AWS合同条款，并确保其所有操作都符合AWS的服务条款以及HIPAA的具体要求。

Amazon Web Services Architecting for HIPAA Security and Compliance on Amazon Web Services

Guidance. Internal to an Amazon Virtual Private Cloud (VPC) for data traveling between

Amazon EC2 instances, network traffic containing PHI must also be encrypted; most

applications support TLS or other protocols providing in transit encryption that can be

configured to be consistent with the Guidance. For applications and protocols that do not

support encryption, sessions transmitting PHI can be sent through encrypted tunnels

using IPsec or similar implementations between instances.

AWS Systems Manager

AWS Systems Manager Console and Resource Groups are not in scope for the HIPAA

BAA. AWS Systems Manager (previously Amazon EC2 Systems Manager) is a unified

interface that allows customers to easily centralize operational data, automate tasks

across their AWS resources, and shortens the time to detect and resolve operational

problems in their infrastructure. Systems Manager provides a complete view of a

customer’s infrastructure performance and configuration, simplifies resource and

application management, and makes it easy to operate and manage their infrastructure

at scale.

When outputting data that may contain PHI to other services, such as Amazon S3,

customers must follow the receiving service’s guidance for storing PHI. Customers should

not include PHI in metadata or identifiers, such as document names and parameter

names. Additionally, customers should not use Resource Groups or the AWS Systems

Manager console, although they may use the EC2 Systems Manager console.

Amazon Virtual Private Cloud

Amazon Virtual Private Cloud (Amazon VPC) offers a set of network security features

well-aligned to architecting for HIPAA compliance. Features such as stateless network

access control lists and dynamic reassignment of instances into stateful security groups

afford flexibility in protecting the instances from unauthorized network access.

Amazon VPC also allows customers to extend their own network address space into

AWS, as well as providing a number of ways to connect their data centers to AWS. VPC

Flow Logs provide an audit trail of accepted and rejected connections to instances

processing, transmitting, or storing PHI. For more information on Amazon VPC, see

Amazon Virtual Private Cloud.

Amazon Web Services Architecting for HIPAA Security and Compliance on Amazon Web Services

Amazon Elastic Block Store

Amazon EBS encryption at-rest is consistent with the Guidance that is in effect at the time

of publication of this whitepaper. Because the Guidance might be updated, customers

should continue to evaluate and determine whether Amazon EBS encryption satisfies

their compliance and regulatory requirements. With Amazon EBS encryption, a unique

volume encryption key is generated for each EBS volume. Customers have the flexibility

to choose which master key from the AWS Key Management Service is used to encrypt

each volume key. For more information, see Amazon EBS encryption.

Amazon Redshift

Amazon Redshift provides database encryption for its clusters to help protect data at rest.

When customers enable encryption for a cluster, Amazon Redshift encrypts all data,

including backups, by using hardware-accelerated Advanced Encryption Standard (AES)-

256 symmetric keys. Amazon Redshift uses a four-tier, key-based architecture for

encryption. These keys consist of data encryption keys, a database key, a cluster key,

and a master key.

The cluster key encrypts the database key for the Amazon Redshift cluster. Customers

can use either AWS KMS or an AWS CloudHSM (Hardware Security Module) to manage

the cluster key. Amazon Redshift encryption at-rest is consistent with the Guidance that

is in effect at the time of publication of this whitepaper. Because the Guidance might be

updated, customers should continue to evaluate and determine whether Amazon Redshift

encryption satisfies their compliance and regulatory requirements. For more information,

see Amazon Redshift database encryption.

Connections to Amazon Redshift containing PHI must use transport encryption and

customers should evaluate the configuration for consistency with the Guidance. For more

information, see Configuring security options for connections. Amazon Redshift Spectrum

enables customers to run Amazon Redshift SQL queries against exabytes of data in

Amazon S3. Redshift Spectrum is a feature of Amazon Redshift, and thus is also in scope

for the HIPAA BAA.

Amazon S3

Customers have several options for encryption of data at rest when using Amazon S3,

including both server-side and client-side encryption, and several methods of managing

keys. For more information, see Protecting data using encryption.

Amazon Web Services Architecting for HIPAA Security and Compliance on Amazon Web Services

Connections to Amazon S3 containing PHI must use endpoints that accept encrypted

transport (HTTPS). For a list of regional endpoints, see AWS service endpoints.

Do not use PHI in bucket names, object names, or metadata because this data is not

encrypted using S3 server-side encryption and is not generally encrypted in client-side

encryption architectures.

Amazon S3 Transfer Acceleration

Amazon S3 Transfer Acceleration (S3TA) enables fast, easy, and secure transfers of files

over long distances between a customer’s client and an S3 bucket. Transfer Acceleration

takes advantage of Amazon CloudFront’s globally distributed edge locations. As the data

arrives at an edge location, data is routed to Amazon S3 over an optimized network path.

Customers should ensure that any data containing PHI transferred using AWS S3TA is

encrypted in transit and at-rest. Refer to the Guidance for Amazon S3 to understand the

available encryption options.

Amazon SNS

Customers should understand the following key encryption requirement in order to use

Amazon Simple Notification Service (SNS) with Protected Health Information (PHI).

Customers must use the HTTPS API endpoint that SNS provides in each AWS Region.

The HTTPS endpoint leverages encrypted connections, and protects the privacy and

integrity of the data sent to AWS. For a list of all HTTPS API endpoints, see AWS service

endpoints.

Additionally, Amazon SNS uses CloudTrail, a service that captures API calls made by or

on behalf of Amazon SNS in the customer’s AWS account and delivers the log files to an

Amazon S3 bucket that they specify. CloudTrail captures API calls made from the

Amazon SNS console or from the Amazon SNS API. Using the information collected by

CloudTrail, customers can determine what request was made to Amazon SNS, the source

IP address from which the request was made, who made the request, and when it was

made. For more information on logging SNS operations, see Logging Amazon SNS API

calls using CloudTrail.

Amazon SQS

Customers should understand the following key encryption requirements in order to use

Amazon SQS with PHI.

剩余55页未读，继续阅读

SecurityAI

粉丝: 64
资源: 21

AWS HIPAA合规架构与安全最佳实践白皮书

whitepaper

AWS_Security_Whitepaper(AWS云安全白皮书2020版).pdf

terraform-ebs-attachmentizer：将aws_instance资源中的ebs_block_device块转换为aws_ebs_volume和aws_volume_attachment资源

aws_vpc_module:自定义aws_vpc_module

AWS_cert：AWS_cert

Python AWS CDK库aws_cdk.aws_s3_assets最新版本介绍

AWS CDK Python 库 aws_cdk.aws_securityhub 下载

下载 aws_cdk.aws_s3_deployment Python库文件

Python AWS CDK资源包aws_cdk.aws_s3_assets-1.16.3发布

AWS CDK Python库 aws_cdk.aws_codeguruprofiler 新版发布

最新资源