Security and Compliance
Identity and access
IAM evaluates in this order: an explicit deny anywhere wins, then an explicit allow in an identity or resource policy, otherwise implicit deny. SCPs in Organizations cap maximum permissions for member accounts but never grant. Permission boundaries cap a user or role without granting. Prefer roles and STS temporary credentials over access keys; for cross-account access the role trust policy and the caller's identity policy must both allow it.
Encryption and data protection
KMS key policies are the primary access control - a cross-account CMK needs the key policy to name the principal; IAM alone is insufficient. Use envelope encryption, enable rotation (automatic for symmetric keys), and prefer SSE-KMS or SSE-S3 over SSE-C. For S3, block public access at account and bucket level, disable ACLs with Object Ownership, and enforce TLS with a bucket policy condition on aws:SecureTransport. Secrets Manager stores and rotates credentials via Lambda; Parameter Store SecureString does not rotate on its own.
Detection and compliance
CloudTrail logs management events by default; data events are opt-in and billable. Enable log file validation and a multi-region trail. Config rules detect noncompliance and can auto-remediate through SSM Automation. GuardDuty finds threats, Inspector finds vulnerabilities, Macie finds sensitive data in S3, Security Hub aggregates findings, and Access Analyzer finds external exposure.
Traps
Config does not prevent actions. An explicit deny in a bucket policy beats an IAM allow. CloudTrail is regional unless you create a multi-region or organization trail.
Rule of thumb
To enforce encryption on every upload, write one bucket policy with two deny statements - deny when aws:SecureTransport is false, deny when s3:x-amz-server-side-encryption is absent - rather than relying on defaults.