Security, Identity, and Compliance
Security, Identity, and Compliance tests least-privilege access design, data protection, threat detection, and audit evidence. Expect scenario questions where a bad answer hands out long-lived credentials or a good answer uses a role.
IAM fundamentals
IAM principals are users, groups, and roles. Policies are JSON documents with Effect, Action, Resource, and Condition. An explicit Deny always wins; otherwise an implicit Deny applies unless an Allow exists. Identity-based policies attach to principals; resource-based policies attach to resources such as S3 buckets and can grant cross-account access directly. IAM roles provide temporary credentials via STS and are the answer for EC2, Lambda, and federated human access. IAM Identity Center handles workforce SSO and permission sets. Protect the root user with MFA and do not use it for daily work. Permission boundaries cap the maximum permissions a principal can receive without granting any themselves.
Data protection
KMS manages encryption keys and integrates with most services; CloudHSM provides dedicated single-tenant hardware modules for strict key-custody requirements. ACM issues and renews TLS certificates. Secrets Manager stores and rotates database credentials; Parameter Store holds configuration and non-rotating secrets.
Detection and protection services
GuardDuty finds threats from logs and network telemetry; Inspector scans workloads for vulnerabilities; Macie discovers sensitive data in S3; Security Hub aggregates findings; Detective investigates. Shield Standard is automatic DDoS protection, Shield Advanced adds response support; WAF filters HTTP requests by rule; Firewall Manager centralizes policies across accounts.
Audit trails and compliance
CloudTrail records API activity (90-day event history in the console, longer via trails to S3). AWS Config records resource configuration changes and evaluates rules. AWS Artifact supplies on-demand compliance reports such as SOC and ISO. Audit Manager automates evidence collection. Trusted Advisor surfaces security and fault-tolerance checks.
Worked example
An application on EC2 must read one S3 bucket, and auditors forbid access keys on disk. Reasoning: create an IAM role with a trust policy allowing ec2.amazonaws.com, attach a policy granting s3:GetObject on that bucket ARN, and associate the role through an instance profile. The SDK then fetches rotating temporary credentials automatically. Attaching a broad managed policy or embedding keys in user data would both fail the audit requirement.
Traps that cost marks
- Believing a resource-based policy cannot grant access on its own.
- Using CloudTrail as an alerting engine instead of CloudWatch alarms or EventBridge.
- Confusing Shield (DDoS) with WAF (application-layer filtering).
- Assuming permission boundaries grant permissions.