Security and compliance

IAM foundations

• User: long-term credentials (password and/or access keys). Group: users sharing policies. Role: no long-term credentials — someone assumes it and gets temporary credentials from STS. Roles are always preferred.
• A policy is JSON: Effect, Action, Resource, optional Condition. Identity-based policies attach to users, groups and roles; resource-based policies attach to resources (S3 bucket, KMS key, SQS queue, Lambda function) and name principals.
• A role has a trust policy (who can assume it) and a permissions policy (what it can do).
• Cross-account access: a role in the target account trusts the source account, and users in the source account are allowed sts:AssumeRole on that role. Both sides must allow it.
• Instance profile attaches a role to EC2. Service role: a role a service assumes for you (CodeBuild, CodePipeline). Service-linked role: predefined and owned by a service (for example the Auto Scaling role that uses KMS keys to launch encrypted volumes).
• Evaluation: everything is denied by default; an explicit Deny always wins. Effective permissions are the overlap of SCPs ∩ permission boundary ∩ identity policy (plus resource policies).
• IAM Roles Anywhere: on-premises servers get temporary credentials with X.509 certificates — no stored keys.
• Require IMDSv2 for instance metadata.

Condition keys worth knowing

Delegating safely

• Permission boundaries cap the maximum permissions of a user or role. To let developers create roles without escalating, allow iam:CreateRole only when iam:PermissionsBoundary is set to your boundary.
• ABAC: allow when aws:ResourceTag/department equals ${aws:PrincipalTag/department} — one policy works for every team. With IAM Identity Center, turn on attributes for access control.
• Force MFA for IAM users: Deny everything except the MFA self-service actions when BoolIfExists aws:MultiFactorAuthPresent = false.

IAM Access Analyzer

Finds resources shared outside your account or organization, finds unused roles, keys and permissions, validates policies (usable in pipelines), runs custom policy checks against a reference policy, and generates least-privilege policies from CloudTrail activity.

Preventive controls with SCPs

SCPs block actions; Config only detects them. Common patterns:

To add tags automatically rather than require them, use EventBridge on the CloudTrail RunInstances event → Lambda that tags the instance with its creator.

Keys, certificates and secrets

KMS

• The key policy is the primary control. Cross-account use needs the key policy to allow the other account and an IAM policy there allowing the key actions.
• Grants give temporary delegated permissions — used by services such as Auto Scaling launching encrypted volumes.
• Multi-Region keys share key material across Regions.
• “Manual rotation” means creating a new key and repointing the alias; track key age with a custom Config rule.

Sharing an encrypted AMI with another account’s Auto Scaling group

1. Copy the AMI with a customer managed key (the default EBS key can’t be shared). Copying is also how you encrypt an unencrypted AMI.
2. Share the AMI (launch permission) with the account.
3. The key policy lets the target account create a grant for its Auto Scaling service-linked role.

ACM

Free public certificates for load balancers, CloudFront and API Gateway. DNS-validated certificates auto-renew; imported certificates don’t. Watch expiry with the DaysToExpiry metric, the Config rule acm-certificate-expiration-check, or the EventBridge event ACM Certificate Approaching Expiration.

Secrets Manager rotation

Rotation runs four steps — createSecret → setSecret → testSecret → finishSecret — and moves staging labels from AWSPENDING to AWSCURRENT (the old value becomes AWSPREVIOUS), so applications calling GetSecretValue never break. Share across accounts with a resource policy plus a customer managed key; replicate to other Regions for DR.

Old and unused credentials

Config rule access-keys-rotated (maxAccessKeyAge) with SSM Automation remediation to deactivate keys; iam-user-unused-credentials-check for unused credentials.

Encryption facts

Detection across an organization

The common setup: designate a delegated administrator (often the Audit account) and turn on auto-enable for new member accounts.

GuardDuty response: isolate, don’t terminate — keep the evidence. Swap to a quarantine security group with no rules, snapshot EBS volumes, tag the instance, detach it from the Auto Scaling group.

Network and edge protection

• AWS WAF: layer-7 web ACLs on ALB, CloudFront, API Gateway (REST), AppSync and Cognito. Managed rule groups (SQL injection, XSS, known bad inputs, bot control), IP sets, geo match, and rate-based rules (block IPs over N requests in 5 minutes). Logs to S3, CloudWatch or Firehose.
• AWS Shield: Standard is free and automatic; Advanced adds the response team and cost protection.
• AWS Firewall Manager: centrally enforces WAF, Shield Advanced, security group policies, Network Firewall and DNS Firewall across the organization, applying automatically to new resources. Needs a delegated administrator and AWS Config. The answer to “every ALB and API in every account must have a web ACL”.
• AWS Network Firewall for stateful VPC inspection (domain filtering, IPS); Route 53 Resolver DNS Firewall blocks malicious domains.
• VPC endpoints: gateway endpoints (S3 and DynamoDB, free, route tables) and interface endpoints (most other services — ssm, ssmmessages, ec2messages, logs, ecr.api, ecr.dkr, secretsmanager, sts, kms…), with endpoint policies restricting what can be done through them.
• Security groups are stateful and allow-only; network ACLs are stateless with allow and deny.

Pipeline security

• Least-privilege service roles, and a separate CloudFormation deployment role.
• Secrets from Secrets Manager or Parameter Store; artifacts encrypted with KMS.
• Scan code (CodeGuru, Amazon Q Developer), dependencies (Inspector), images (ECR enhanced scanning) and IaC (cfn-guard, cfn-lint, Checkov).
• Manual approval before production where required; separate tooling, dev and prod accounts.