Network Protection Guidance

Network protection consists of tools, rules, and configurations that are designed to protect the confidentiality, integrity, and accessibility of data. Internet-connected devices face potential attacks. Strong network protection protocols and policies protect your devices and network from unnecessary or malicious network traffic.

The Amazon Data Protection Policy requires solution providers to create a secure environment to reduce data loss risks and related vulnerabilities. Solution providers accept Amazon's Data Protection Policy and Acceptable Use Policy during the registration process.

Amazon conducts Data Security Assessments to verify solution provider compliance. Solution providers must maintain consistent network infrastructure protection protocols. This guide outlines network protection techniques and controls that satisfy Amazon's Data Protection Policy and Acceptable Use Policy requirements.

Amazon Data Protection Policy requirements

The Data Protection Policy under 1.1 Network Protection requires solution providers to implement network firewalls, network access control lists (ACLs), identity-based access controls, and equivalent mechanisms that deny access to unauthorized entities. Solution providers must also implement network segmentation to isolate sensitive environments and limit lateral movement, intrusion detection and prevention capabilities (IDS/IPS or equivalent) to detect and block malicious network activity, application-layer protections for all public or internet-facing endpoints, malware protection on all systems that access, process, or store information, and endpoint protection controls on all devices that access, process, or store information. Solution providers must maintain documentation of these controls, and must implement controls that prevent employees from disabling endpoint protection software. Separately, under 1.2.4 Approved User Requirements, system access is restricted to Approved Users, defined as personnel including employees, contractors, and other third parties who have a documented business need and who have completed the required data protection and IT security awareness training.

Network segmentation and firewall filtering

Network segmentation splits large networks into smaller sub-networks to enhance access controls and security. IT administrators use network segregation and segmentation to control traffic flow within defined security perimeters and protect against intrusion. Network segregation creates divisions based on roles and functionality, while segmentation establishes boundaries between network components.

Network segmentation limits the spread of security breaches and reduces risk during attacks. Network firewalls establish perimeter-based segmentation by creating network boundaries and routing all traffic through controlled checkpoints. Solution providers must implement these best practices to comply with the following requirements:

• Define strong network firewall policies based on a comprehensive risk analysis.
• Segment networks with Virtual Local Area Networks (VLAN) or subnets.
• Isolate guest access to networks through micro-segmentation.
• Restrict user access within the company between perimeters.

Solution providers must implement the following enhanced defense-in-depth methods to complement firewall rulesets:

• Implement IDS/IPS signature pattern-based detection mechanisms.
• Use multiple layers of security controls.
• Establish enhanced network segmentation with clear separation between security zones.
• Implement strict access controls between segments.

The AWS Network Firewall provides a managed network firewall that monitors active connections and includes intrusion detection and prevention services for Amazon Virtual Private Cloud (Amazon VPC) environments.

AWS Firewall Manager centralizes configuration and management of Network Firewalls across multiple accounts and applications. Administrators define firewall policies that specify rules for filtering VPC traffic. These policies apply consistently across the organization's AWS infrastructure.

AWS offers a suite of complementary security services. AWS WAF filters malicious web traffic, AWS Shield defends against Distributed Denial of Service (DDoS) attacks, and AWS Firewall Manager streamlines security policy enforcement. Together, these services provide comprehensive protection for AWS-hosted applications and resources.

Application-layer protection

The Data Protection Policy requires solution providers to implement application-layer protections, such as a Web Application Firewall (WAF) or equivalent controls, to monitor, filter, and block malicious API traffic for all public or internet-facing endpoints, regardless of protocol (for example, HTTP/S, gRPC, GraphQL, WebSockets, or similar application-layer interfaces).

• Deploy a WAF or equivalent control in front of all public or internet-facing endpoints.
• Apply protection consistently across all application-layer protocols, not only HTTP/S.
• Monitor, filter, and block malicious API traffic at the application layer.

Network access controls

Network access control tools allow businesses to check devices for compliance and prevent unauthorized devices from accessing corporate networks. As more employees use personal devices for work, organizations need network access control tools to maintain security.

Solution providers must protect both cloud services and on-premise networks. Network Access Controls and Access Control Lists (ACLs) serve different security functions. Network Access Controls authenticate user identities and trusted devices at network nodes, while ACLs filter traffic at the router level.

Amazon's Data Protection Policy requires identity and access management tools to control permissions by department, job, role, and team. These role-based controls track user actions and link system events to specific users. Solution providers must implement authorization and restriction processes for both on-premise and cloud devices to manage network access.

Access control requirements include:

• Implement account lockout after 10 or fewer unsuccessful login attempts.
• Use enhanced authentication monitoring to detect suspicious patterns.
• Configure automated responses for suspicious activities.
• Enforce multi-factor authentication for all user accounts without exception.
• Regularly audit access patterns and automate alerting for unusual behavior.

Endpoint protection

The Data Protection Policy requires endpoint protection controls on all devices that access, process, or store information. Solution providers must:

• Enforce storage encryption, removable media restrictions, and controlled administrative access on all endpoints.
• Configure a screen lock with automatic timeout after a maximum of 15 minutes of inactivity.
• Restrict access to Information from personal or unmanaged devices unless they are managed through endpoint security controls such as Mobile Device Management (MDM), Unified Endpoint Management (UEM), or equivalent that enforce organizational security policies.

Anti-malware

Internet-connected devices are vulnerable to malware, malicious code that infects host computers. Viruses, a type of malware, attach to programs and spread through emails, removable storage devices, and contaminated networks. Malware can delete or encrypt files, modify applications, or disable system functions.

Organizations must develop and implement effective malware incident prevention approaches based on prevalent attack vectors. Policies should address malware incident prevention and threat mitigation to contain malware incidents.

Antivirus software serves as the primary malware threat mitigation control. This software scans devices, identifies viruses, and removes them. Regular antivirus application updates protect against current threats. Enterprise Endpoint Security protection suits larger corporations with diverse endpoints. Advanced Endpoint Protection Platforms (EPP) provide firewall capabilities and heuristics with machine learning and containment.

Amazon's Data Protection Policy requires SP-API users to protect endpoints. All systems with user data access must have antivirus and anti-malware installed. Systems must run regular full system scans, not relying solely on on-access scans.

Solution providers may use Endpoint Detection and Response (EDR) or equivalent cloud-native protections in place of traditional antivirus, provided the controls cover all systems that access, process, or store information. Where automatic updates are not supported, apply updates manually at least monthly.

Solution providers must implement the following controls to prevent antivirus software disablement:

• Configure antivirus software settings to prevent end-user disablement.
• Require administrative privileges for antivirus configuration changes.
• Configure automated alerts for IT teams when protection disablement is attempted.
• Implement real-time monitoring and automated response procedures for malware detection.

Disable controls that turn off antivirus scans. Keep antivirus definitions up-to-date. Enable antivirus logging and alerting. Notify the IT team and initiate follow-up processes if antivirus is disabled.

Network-based intrusion detection systems and network intrusion prevention systems

Network-based intrusion detection systems (NIDS) monitor traffic patterns and detect malicious activity by analyzing network packets. Network intrusion prevention systems (NIPS) prevent attacks by ending TCP connections or blocking suspicious network activity through firewall commands. Solution providers must install NIDS and NIPS on network and endpoint devices. NIDS and NIPS that are properly implemented can detect threats in advance and stall powerful network assaults that conventional security controls cannot detect.

Amazon GuardDuty, a cloud-native NIDS service, uses VPC Flow Logs traffic data to detect threat behaviors. You can use Amazon GuardDuty to detect problematic traffic, get valuable insights, and solve access and security issues. Amazon GuardDuty can notify personnel of suspected compromises via email or SMS to facilitate threat reaction and mitigation.

Documentation requirements

Solution providers must maintain documentation for network and endpoint protection controls, including network architecture diagrams and evidence of the deployment and management of security controls such as firewalls, WAF or equivalent, IDS/IPS, and endpoint protection.

Key takeaways and next steps

• Implement comprehensive network and application protection measures as outlined in this document to comply with Amazon's Data Protection Policy.
• Regularly review and update your security controls to address evolving threats and policy requirements.
• Consult the latest version of the Data Protection Policy for the most up-to-date compliance requirements.

Notices

Amazon sellers and solution providers are responsible for independently assessing the information in this document. This document: (a) serves informational purposes only, (b) represents current practices subject to change, and (c) creates no commitments or assurances from Amazon.com Services LLC (Amazon) and its affiliates, suppliers or licensors. Amazon provides Amazon Services API products or services "as is" without warranties, representations, or conditions. This document neither forms part of nor modifies any agreement between Amazon and any party.