Security and Compliance: Shared Responsibility, IAM, and Detection Services
Domain 2 is the second-largest area of the exam. It does not ask you to write IAM policy JSON; it asks who is responsible for a control, which service detects a given problem, and which governance artifact proves compliance.
Shared responsibility, precisely
AWS is responsible for security of the cloud: facilities, hardware, the hypervisor, and the managed-service layer. You are responsible for security in the cloud: your data, identity and access configuration, network rules, and the guest operating system of anything you run yourself. The split moves with the service. On EC2 you patch the OS and everything above it. On RDS, AWS patches the database engine and the host; you still own the data, the credentials, the parameter groups, and network access. On S3, AWS secures the storage infrastructure; you own bucket policies, block-public-access settings, and encryption choices.
Identity and access
Use the root user only to create the first admin, then lock it away with MFA. Day-to-day access goes through IAM users, groups, and - most importantly - roles, which issue temporary credentials. Applications on EC2 or Lambda should assume a role rather than carry access keys. Grant least privilege, and use IAM Access Analyzer to find resources shared outside your account.
The detection family
- CloudTrail - records API calls: who did what, when, from where.
- CloudWatch - metrics, logs, and alarms on your resources.
- AWS Config - records resource configuration changes and evaluates rules for compliance.
- GuardDuty - managed threat detection from logs and network traffic.
- Inspector - vulnerability scanning of workloads.
- Macie - discovers sensitive data such as personal information in S3.
- Shield - DDoS protection; WAF - filters malicious web requests.
Security groups are stateful and allow-only; network ACLs are stateless and support allow and deny at the subnet level.
Worked example
A team runs MySQL on EC2 and asks what changes if they migrate to RDS. Answer: AWS becomes responsible for patching the database engine and underlying host OS; the team remains responsible for data classification, user accounts inside the database, encryption settings, and which security groups reach the instance. The responsibility did not disappear - it moved up the stack.
Traps that cost marks
- Assuming AWS backs up or encrypts your data by default in every service.
- Confusing CloudTrail (audit of API activity) with CloudWatch (performance and logs), or Config (configuration history) with either.
- Believing GuardDuty or Inspector automatically remediate findings; they detect and report.
- Choosing "security group" when a deny rule is required - only network ACLs deny.
- Forgetting that compliance of AWS services is documented in AWS Artifact reports, while your own compliance remains your responsibility.