Security and Compliance
Security and Compliance covers the shared responsibility model, identity and access management, data protection, detective controls, and the compliance resources AWS exposes to customers. Questions often test who does what, which tool produces which signal, and how to grant access without long-term credentials.
Shared responsibility
AWS is responsible for security of the cloud: physical facilities, hardware, the network, and the virtualization layer. Customers are responsible for security in the cloud: data, identity and access configuration, guest operating system patching on IaaS, and client-side and server-side encryption choices. The split shifts by service: on Amazon EC2 the customer patches the OS; on Amazon RDS AWS manages the database engine and the customer manages data, users, and network access rules.
IAM and access
IAM controls authentication and authorization. Users are long-term identities; groups are collections of users; roles are assumable identities that issue temporary credentials. Policies are JSON documents evaluated with an explicit deny overriding any allow, then an allow, otherwise an implicit deny. Apply least privilege and enable multi-factor authentication, especially for the root user.
Detection and compliance
AWS CloudTrail records API activity and account events; Amazon CloudWatch collects metrics and logs; AWS Config evaluates resource configuration against rules. GuardDuty detects threats, Inspector assesses vulnerabilities, Macie discovers sensitive data in S3, Shield provides DDoS protection, and WAF filters web requests. AWS Artifact supplies compliance reports and agreements.
Worked example
An application on EC2 must read objects from an S3 bucket. Do not create an IAM user and embed access keys. Create an IAM role with a least-privilege policy for the specific bucket and actions, attach it to the instance profile, and let the SDK obtain temporary credentials. Reasoning: no long-term secrets are stored, credentials rotate automatically, and calls are attributable in CloudTrail.
Traps
AWS does not automatically classify or encrypt customer data for you in every service; configuration is a customer task. Security groups are stateful and allow only; network ACLs are stateless and support allow and deny. CloudTrail is not a metrics service, and GuardDuty is not a configuration-compliance scanner.