Security and Compliance: shared responsibility, IAM, and detection services
Security and Compliance is the largest domain at 30%, so precision about who secures what earns more marks than breadth.
Shared responsibility
AWS is responsible for security of the cloud: facilities, hardware, the hypervisor, and the managed-service layer. The customer owns security in the cloud: data, identity and access configuration, guest-OS patching on EC2, network rules, and client-side encryption. On abstracted services the line moves - with Lambda and S3, AWS patches the runtime and infrastructure, but you still own permissions and data.
Identity and access
Protect the root user with MFA, create no root access keys, and use it only for root-only tasks. Grant least privilege through IAM policies attached to users, groups, and roles. Groups contain users, never other groups. Roles are assumed temporarily and issue short-lived credentials - for cross-account access, EC2 instance profiles, and federated users - so no secret keys travel between accounts. AWS Organizations service control policies cap the maximum permissions of member accounts but never grant permissions themselves.
Detection and protection
CloudTrail records API activity; GuardDuty finds malicious or anomalous behaviour; Inspector scans EC2, ECR images, and Lambda for vulnerabilities; Macie classifies sensitive data in S3; Config tracks resource compliance; Security Hub aggregates findings; IAM Access Analyzer flags resources shared outside the account; Shield absorbs DDoS; WAF filters web requests. AWS Artifact is where compliance reports such as SOC and ISO certificates are downloaded.
Worked example
An auditor wants evidence that no S3 bucket is publicly reachable, plus ongoing alerts. GuardDuty is the wrong tool (threat behaviour) and Macie is the wrong tool (data classification). Enable S3 Block Public Access and use IAM Access Analyzer, which identifies buckets and roles accessible outside the account.
Traps
Assuming AWS patches the EC2 guest OS; believing SCPs grant permissions; mixing up GuardDuty, Inspector, and Macie; thinking penetration testing is prohibited - it is permitted for many services without prior approval, though not for all.