Security and Compliance
Shared responsibility
AWS is responsible for security of the cloud (facilities, hardware, hypervisor, managed-service internals). You are responsible for security in the cloud (data, identity, guest OS patching on EC2, firewall configuration, encryption choices). For managed services the line moves: AWS patches RDS, but you still control its security groups, users, and data.
Identity and access
IAM users, groups, roles, and policies are exam staples. Policies are JSON and follow least privilege. Protect the root user with MFA and do not use it for daily work. For applications, attach an IAM role - never embed access keys in code. AWS Organizations service control policies (SCPs) set the maximum permissions for member accounts.
Detection, audit, and compliance
- CloudTrail - who made which API call, when, from where.
- CloudWatch - metrics, logs, alarms.
- AWS Config - records resource configuration history and evaluates rules.
- GuardDuty - threat detection; Inspector - vulnerability scanning; Macie - sensitive data discovery in S3; Security Hub - aggregated findings.
- Shield - DDoS; WAF - web application firewall rules.
- AWS Artifact - self-service access to AWS compliance reports (SOC, ISO, PCI).
- KMS - managed encryption keys.
Traps
Questions often assert that AWS patches your EC2 guest operating system (false) or that AWS Config produces audit reports you can hand to an auditor (use Artifact). CloudTrail is not a monitoring dashboard, and CloudWatch is not an API audit log. Enabling default encryption on S3 does not make data safe from a misconfigured bucket policy - that is a customer responsibility.
Worked example
A developer needs to read an S3 bucket from an EC2 instance. Correct answer: create an IAM role with a least-privilege S3 read policy and attach it to the instance profile. Storing an access key in the application config is the classic wrong answer, because keys are long-lived and leakable.
Rule of thumb: if an auditor asks "prove AWS is compliant," answer AWS Artifact. If they ask "prove what changed in my account," answer AWS Config. If they ask "who deleted the bucket," answer CloudTrail.