Security, Identity, and Compliance
What to know
RAM (Resource Access Management) is the identity service: users, groups, and roles with policies granting least privilege. Roles are preferred for services and cross-account access over long-term access keys. Multi-factor authentication and key rotation reduce credential risk. Know ActionTrail for API audit logging and Cloud Config-style resource compliance checking, plus encryption at rest (KMS) and in transit (TLS). Security groups and WAF protect network and application layers. Compliance frameworks map controls to shared-responsibility boundaries: the provider attests to infrastructure controls, you must evidence your own configurations.
Traps
Questions test roles vs. access keys: roles issue temporary credentials and avoid embedded secrets. Policy evaluation follows explicit allow/deny - an explicit deny overrides any allow. Least privilege means scoping actions and resources, not granting wildcard *. Another trap: assuming the provider's compliance certification covers your application's data handling - it does not. Also, disabling or ignoring ActionTrail leaves no audit trail for investigations.
Rule of thumb
Default to roles with temporary credentials and least-privilege policies; grant wildcards only with documented justification. Enable ActionTrail and MFA everywhere.
Worked example
An application on ECS must read from OSS without storing keys. Attach a RAM role to the instance with a policy allowing only the needed OSS read actions on the specific bucket - no access keys in code.