When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared model can reduce your operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. For more information about security on AWS, visit the AWS Security Center.

AWS Identity and Access Management (IAM) roles enable customers to assign granular access policies and permissions to services and users on AWS. This solution creates several IAM roles, including roles that grant the solution’s AWS Lambda functions access to the other AWS services used in this solution.

Amazon Cognito is used for managing access to the web user interface and the API. For more information, consult Accessing the application.

Amazon Cognito offers an option to enable Multi-Factor Authentication (MFA). Follow the instructions found here to your deployment. Do not make any changes, other than the MFA setting, to the User Pool as changes other than this may cause problems when upgrading or updating the solution in the future.

This solution deploys a static website hosted in an Amazon S3 bucket. To help reduce latency and improve security, this solution includes an Amazon CloudFront distribution with an origin access identity, which is a special CloudFront user that helps restrict access to the solution’s website bucket contents. For more information, see Restricting Access to Amazon S3 Content by Using an Origin Access Identity.

If you wish to increase the security of the web user interface or the API, we recommend considering integrating AWS WAF, which gives you control over how traffic reaches your applications by enabling you to create security rules such as filtering out specific traffic patterns you define.