Security and Compliance: Shared Responsibility and Identity
The shared responsibility model
This is the most tested idea in the domain. AWS is responsible for security of the cloud: physical facilities, hardware, the hypervisor, and the managed service layer. The customer is responsible for security in the cloud: data, identity and access configuration, guest operating systems on EC2, network configuration such as security groups, and client-side encryption choices. The split moves with the service: on EC2 you patch the OS; on a managed database service AWS patches the engine but you still control access and data. Trap: questions implying AWS patches your EC2 guest OS, or that AWS classifies your data for you.
Identity and access
Understand IAM users, groups, roles, and policies. Prefer roles and temporary credentials over long-lived access keys. Apply least privilege and use IAM policies plus resource-based policies where relevant. Know that root account access keys should not exist, and that multi-factor authentication on root is a baseline control. For multiple AWS accounts, AWS Organizations with service control policies provides guardrails.
Detective and protective controls
Be able to name the purpose of each: security groups (stateful, instance-level allow rules), network ACLs (stateless, subnet-level allow and deny), AWS WAF (web application layer filtering), AWS Shield (DDoS), GuardDuty (threat detection from logs), Inspector (vulnerability assessment), Macie (sensitive data discovery), CloudTrail (API activity audit), and Config (resource configuration compliance). Trap: confusing CloudTrail with Config, or GuardDuty with Inspector.
Compliance and data protection
Compliance artifacts live in AWS Artifact; the Customer Compliance Center explains how to build a program. Encryption at rest and in transit is expected by default, with AWS Key Management Service for key control. Rule of thumb: if a question asks who is responsible for a control, ask whose layer is it in - infrastructure, managed service, or customer workload.