Cloud Security and Compliance
Core concepts
Security questions test identity, network, data, and audit controls. Know RAM for identity and access management (users, roles, policies, STS temporary credentials), and the principle of least privilege. Understand VPC security groups and network ACLs, and how they differ in scope and statefulness. Know KMS for key management and encryption at rest, and SSL/TLS for data in transit.
Compliance and audit
Familiarize yourself with ActionTrail for API-level auditing, Log Service for retention, and the concept of resource tagging for governance and cost allocation. Understand data residency: data stored in a Region stays in that Region unless you replicate it.
Traps
A frequent trap is granting broad permissions (e.g., an ECS instance role with admin rights) when a scoped policy suffices. Another is confusing security groups (instance-level, stateful, allow-only) with network ACLs (subnet-level, stateless, allow and deny). Watch for questions that assume encryption at rest is on by default - verify rather than assume. Also be careful with cross-account access: roles and STS, not shared credentials.
Rule of thumb
Apply defense in depth and least privilege: authenticate with RAM roles, authorize with scoped policies, isolate with VPC and security groups, encrypt with KMS, and audit with ActionTrail. If a question offers a broad-permission shortcut, it is almost always the wrong answer.