Security and Compliance
Core Security Concepts
A candidate must know AWS Identity and Access Management (IAM): users, groups, roles, policies, and the principle of least privilege. Understand the difference between identity-based policies (attached to users/roles) and resource-based policies (attached to resources like S3 buckets). Know that IAM roles are preferred for EC2 instances and cross-account access because they provide temporary credentials. AWS Organizations with Service Control Policies (SCPs) can restrict what member accounts can do, but SCPs do not grant permissions. AWS Key Management Service (KMS) manages encryption keys; AWS CloudHSM provides dedicated hardware security modules for compliance requirements. AWS Shield protects against DDoS; AWS WAF filters web traffic; Amazon GuardDuty detects threats; Amazon Inspector assesses vulnerabilities; AWS Config tracks resource configuration changes; AWS CloudTrail logs API activity. AWS Artifact provides compliance reports.
Traps to Watch
A common trap is confusing CloudTrail (API audit logs) with CloudWatch (metrics and logs) and AWS Config (configuration history). Another is assuming SCPs apply to the management account: they do not. Also, security groups are stateful and allow-only; network ACLs are stateless and allow/deny. Do not confuse KMS (shared, multi-tenant key management) with CloudHSM (single-tenant hardware). Finally, encryption at rest vs. in transit: S3 default encryption is at rest; TLS is in transit.
Worked Example / Rule of Thumb
A company needs to prove compliance to auditors and get AWS's SOC reports. The answer is AWS Artifact, not CloudTrail. Rule of thumb: if the question asks "who did what and when" in AWS APIs, choose CloudTrail; if it asks "what is the configuration now," choose AWS Config; if it asks "is there a threat," choose GuardDuty.
Key Takeaways
- IAM roles provide temporary credentials; prefer them over long-term access keys.
- SCPs restrict permissions but do not grant them; they do not affect the management account.
- CloudTrail = API audit; CloudWatch = metrics/logs; Config = configuration compliance.
- Security groups are stateful; NACLs are stateless.
- KMS for managed keys; CloudHSM for dedicated hardware compliance.