Security and Identity (IAM, Sub Account, Security Monitoring)
Domain 5 - Security and Identity (IAM, Sub Account, Security Monitoring). The core skill is separating network controls from identity controls and applying least privilege.
Two identity surfaces
- IAM: machine/API identity. Access keys and secret keys plus JSON policies using Effect, Action, Resource and Condition.
- Sub Account: human console identity. Users, groups, policies, MFA, IP access restrictions and role switching.
- Organization: governs multiple accounts with central policy and billing.
- Cloud Activity Tracer: records who called which API and when - your audit trail.
Protection services
Security Monitoring for host-level intrusion and file-integrity detection, WAF for SQL injection and XSS, Anti-DDoS, KMS and Secret Manager for keys and credentials, Certificate Manager for TLS, SSL VPN for administrative access.
Worked example
An external contractor needs read access to one bucket. Reasoning: create a Sub Account and place it in a group; attach a custom policy allowing Get and List actions on that bucket's resource only; enable MFA; restrict source IPs; issue no access key unless the contractor needs API access, and rotate it if issued.
Traps
- Embedding a main-account access key in application code.
- Writing policies with Action star and Resource star.
- Treating ACG rules as authorization - ACG is network filtering, not identity.
- Skipping MFA and IP restrictions on console users.
- Assuming a leaked key is harmless once deleted; deactivate and rotate deliberately.
- Enabling audit logging only after an incident instead of beforehand.