Security and Identity Management
Identity and access
RAM (Resource Access Management) is the identity service. Understand users, groups, roles, and policies. Policies are JSON documents granting or denying actions on resources; least privilege is the guiding principle. STS (Security Token Service) issues temporary credentials for roles - used by ECS instance roles and cross-account access. Traps: using the root account for daily work (never), embedding long-term AccessKeys in code (use roles/STS), and confusing identity-based policies with resource-based bucket policies.
Network and data protection
Security groups and network ACLs control traffic. KMS manages encryption keys for data at rest; SSL/TLS protects data in transit. WAF protects web apps from injection and other attacks; Anti-DDoS absorbs volumetric attacks. Cloud Firewall centralizes perimeter control.
Auditing and compliance
ActionTrail records API calls for audit. Cloud Config tracks resource configuration and compliance. Security Center provides threat detection and vulnerability management.
Worked rule of thumb
For an application on ECS that must read OSS without stored secrets: attach a RAM role to the instance, grant a least-privilege policy scoped to the specific bucket, and let the SDK fetch STS credentials automatically. Rotate and avoid long-term AccessKeys entirely.
Exam framing
When a question mentions credentials, ask: temporary or permanent? Prefer temporary (STS/roles). When it mentions access scope, prefer the narrowest policy that satisfies the requirement.