Security and Identity: RAM, Security Center, WAF, Anti-DDoS
Identity first
RAM (Resource Access Management) controls who can do what. Users, groups, and roles are granted policies (system or custom) that allow or deny actions on resources. Best practices: no long-lived AccessKeys on root, use STS temporary credentials and roles for applications and cross-account access, enforce MFA, and apply least privilege. The root account should be locked down and used only for billing and break-glass tasks.
Threat protection layers
- Security Center - host and workload protection: vulnerability detection, baseline checks, anomaly and malware detection.
- WAF (Web Application Firewall) - protects HTTP/HTTPS against injection, XSS, and other Layer 7 attacks; sits in front of the application.
- Anti-DDoS - mitigates volumetric and protocol attacks at the network edge (Basic, Pro, and Scrubbing Center tiers).
- Cloud Firewall - centralized north-south and east-west traffic control.
Traps
- Confusing WAF (Layer 7 application attacks) with Anti-DDoS (Layer 3/4 volumetric floods) - questions often describe the attack type and expect the matching product.
- Assuming Security Center blocks attacks - it primarily detects and alerts; blocking is a separate capability.
- Granting
*:*policies "to make it work" - the exam rewards least privilege. - Forgetting that RAM roles, not embedded AccessKeys, are the correct pattern for ECS-hosted apps.
Rule of thumb
Layer defenses: Anti-DDoS at the edge, WAF for application traffic, security groups for network segmentation, Security Center for host posture, RAM for identity. Match the product to the layer of the attack.
Worked example
A public web app is hit by a SYN flood and SQL injection attempts. Anti-DDoS absorbs the volumetric flood; WAF blocks the injection; Security Center flags an unpatched host; RAM roles give the app scoped OSS access without static keys.