Security and Compliance
What to know
Security and compliance covers IAM (policies, roles, permission boundaries, SCPs), KMS, secrets management, and audit. Know IAM policy types (identity vs. resource), policy evaluation logic (explicit deny > allow > implicit deny), and when to use permission boundaries vs. SCPs (boundaries limit a principal; SCPs limit accounts in an Organization). Understand KMS: customer managed vs. AWS managed keys, key policies, grants, envelope encryption, and cross-account access via key policy. Know Secrets Manager (rotation via Lambda) vs. SSM Parameter Store SecureString. Understand encryption at rest/in transit, S3 bucket policies and Block Public Access, and least privilege. Compliance tooling: AWS Config rules, Security Hub standards, and CloudTrail for audit.
Traps
- An explicit Deny anywhere overrides any Allow - including SCPs and boundaries.
- SCPs don't grant permissions; they only limit the maximum.
- KMS cross-account access requires the key policy to allow the external principal, not just the IAM policy.
- Secrets Manager rotation needs a Lambda rotation function and permissions to the secret.
Rule of thumb
"Restrict what an account can do org-wide" → SCP. "Cap a single role's max permissions" → permission boundary. "Share an encrypted resource cross-account" → update the KMS key policy AND the resource policy.
Worked example
A developer role must never exceed a defined permission set even if an admin attaches broader policies: attach a permissions boundary to the role; effective permissions are the intersection of identity policy and boundary.