Security and compliance

IAM features

• Users have long-term credentials; groups collect users; roles give temporary credentials through STS. Prefer roles for workloads (EC2 instance profile, Lambda execution role, ECS task role) and federation for people.
• Account password policy: minimum length, character types, expiry, reuse prevention, whether users can change their own password. It applies to IAM users in the account.
• MFA: virtual authenticator apps, FIDO2 security keys and hardware tokens (up to eight MFA devices per user). Root user: enable MFA, don’t create access keys, use only for the few root-only tasks (change account settings, close the account, restore IAM permissions when locked out, enable S3 MFA delete, and similar).
• Policy types: identity-based, resource-based (S3 bucket, KMS key, SQS, Lambda, secret), permission boundaries, SCPs, session policies, and resource control policies. Evaluation: explicit deny wins; otherwise needs an allow; the default is deny. For a principal in the same account, an identity policy or a resource policy allow is enough; for cross-account access both sides must allow.
• Roles and trust: a trust policy says who may assume the role; a permissions policy says what it can do. sts:AssumeRole returns credentials for 15 minutes to 12 hours (default one hour; role chaining caps at one hour). External ID protects third-party cross-account access (confused deputy). iam:PassRole controls who may hand a role to a service.
• Federation: IAM Identity Center for workforce SSO (preferred), SAML 2.0 providers into IAM roles, OIDC providers (including GitHub Actions) via AssumeRoleWithWebIdentity, Cognito identity pools for app users, and IAM Roles Anywhere for servers outside AWS using X.509 certificates.
• Policy conditions worth knowing:

• Use StringEquals vs StringLike; IfExists operators handle absent keys; Null tests presence. Multiple values within a key are OR’d; different keys are AND’d.
• Resource policy examples: an S3 bucket policy that denies non-TLS requests or restricts to a VPC endpoint; a KMS key policy; SQS or SNS policies allowing a service principal. Bucket policies can grant other accounts; an S3 Block Public Access setting (account or bucket level) overrides public grants.
• Service-linked roles are predefined by the service and can’t be edited. AWS managed policies are maintained by AWS (such as ReadOnlyAccess); customer managed policies give control and versioning (up to five versions).
• Credential hygiene: rotate access keys, delete unused ones, use the credential report and access advisor (last-accessed information) to find stale credentials and unused permissions.

Troubleshooting and auditing access

• An AccessDenied or UnauthorizedOperation error has a cause among: no allow in an identity policy; an explicit deny; an SCP; a permission boundary; a session policy; a missing or wrong resource policy (cross-account); a KMS key policy blocking the key; a condition not met (MFA, source IP, tag, Region); or an expired session. For EC2 errors the decoded message can be decoded with sts:DecodeAuthorizationMessage.
• IAM policy simulator tests whether a principal’s policies allow given actions on given resources, and shows which statement matched. It includes SCPs and boundaries only if you add them, and it doesn’t cover every resource policy case or conditions that depend on real context.
• CloudTrail records who called which API, from where and with what result (errorCode AccessDenied). Search Event history or query logs in S3/Athena or CloudTrail Lake. Look for userIdentity, sourceIPAddress, errorMessage.
• IAM Access Analyzer:
  • External access findings: resources (S3, IAM roles, KMS keys, Lambda, SQS, secrets, snapshots) shared outside the zone of trust (account or organization).
  • Unused access findings: unused roles, users, passwords, keys and permissions.
  • Policy validation (security warnings and errors against policy grammar) and custom policy checks (does this policy grant more than a reference?).
  • Policy generation builds a least-privilege policy from CloudTrail activity.
  • Analyzers in the organization use the management or a delegated administrator account.
• Access advisor and last accessed data show service-level use over the last 400 days (tracking period); use them to trim permissions.
• CloudTrail + CloudWatch alarms for root usage, console login failures, unauthorized API calls, IAM policy changes, and security group changes form the standard detective set.

Multi-account security

• AWS Organizations: a management account, member accounts, OUs (nested). Consolidated billing, and all features mode is needed for SCPs. Create accounts through the API or Control Tower.
• Service control policies (SCPs) set the maximum permissions for member accounts and OUs. They don’t grant anything, they never affect the management account, and they don’t affect service-linked roles. They apply to every user and role in the account, including the root user of the member account.
  • Deny list strategy (keep FullAWSAccess and add denies) is the default and easiest. An allow list requires removing FullAWSAccess and allowing each service.
  • Examples: deny leaving the organization, deny disabling CloudTrail/GuardDuty/Config, deny all actions outside approved Regions with aws:RequestedRegion (exempt global services), deny launching non-encrypted volumes, deny deleting a central role.
  • Effective permission = what the SCPs at every level allow ∩ the IAM permission.
• Resource control policies (RCPs) set maximum permissions on resources across accounts (for example, S3 only accessible within the organization).
• IAM Identity Center gives SSO to many accounts and applications: a user or group is assigned a permission set on an account, which creates a role there (AWSReservedSSO_...). Identity sources: the built-in directory, Active Directory (AWS Managed Microsoft AD or AD Connector), or an external identity provider (Okta, Microsoft Entra ID) through SAML with SCIM provisioning. It supports MFA, session duration and attributes for access control (ABAC). Use it instead of IAM users per account.
• Delegated administrators let security services (GuardDuty, Security Hub, Config, Inspector, Firewall Manager, Access Analyzer, Backup, CloudFormation StackSets) run from a security account instead of the management account.
• Control Tower adds landing zone, controls (preventive via SCPs, detective via Config, proactive via CloudFormation hooks), and drift reporting.
• Tag policies and backup policies standardize tags and backups; AI services opt-out policies control data use.
• Cross-account access patterns: role assumption (best), resource policies, RAM sharing. Prefer roles and short-lived credentials.

Trusted Advisor

• Trusted Advisor checks accounts across cost optimization, performance, security, fault tolerance, service limits and operational excellence. The full set of checks needs a Business Support+, Enterprise Support or Unified Operations plan (the plans that replaced the older Business and Enterprise tiers); free accounts get the core security and service quota checks.
• Security checks include: S3 buckets with open access, security groups with unrestricted access on specific ports, MFA on the root account, IAM access key rotation, exposed access keys, CloudTrail logging, public EBS and RDS snapshots, IAM use.
• Remediation flow: Trusted Advisor changes status → EventBridge event → Lambda or SSM Automation (for example, close a security group rule) or SNS; or refresh a check via the API. Organizational view aggregates checks across accounts. Weekly email notifications are available. Trusted Advisor Priority surfaces Support-curated risks for enterprise customers.
• Trusted Advisor flags; it doesn’t fix by itself.

Continuous compliance

• AWS Config records configuration items for resources, keeps history, and evaluates rules (managed or custom Lambda/Guard) as compliant or non-compliant, on configuration change or periodically.
  • Conformance packs are collections of Config rules and remediation actions deployed as one unit from a template, across an account or organization (examples: CIS, PCI-DSS, NIST, operational best practices for S3).
  • Remediation: attach an SSM Automation document to a rule, manual or automatic, with retries and a rate limit. Aggregators collect data from many accounts and Regions into one view. Advanced queries use SQL over the resource inventory.
  • Config detects; SCPs and IAM prevent. Config needs a recorder and a delivery channel (S3 bucket, optional SNS). Resources must be recorded to be evaluated.
• Region and service selection: restrict to approved Regions and services with SCPs (aws:RequestedRegion), Control Tower Region deny, and, for services not in use, deny the actions. For attribute enforcement use required-tags Config rule, tag policies and SCPs requiring tags.
• Security Hub checks against standards (AWS Foundational Security Best Practices, CIS, PCI DSS, NIST 800-53) using Config rules, and aggregates findings (see below). AWS Audit Manager collects evidence for audits; AWS Artifact downloads AWS compliance reports and agreements.
• CloudTrail (organization trail), Config, VPC flow logs, S3 access logs and Macie provide the evidence trail. Store logs in a locked-down, versioned S3 bucket in a log archive account with Object Lock or MFA delete.

Data classification and protection

• Classification scheme: define levels (public, internal, confidential, restricted), tag resources (DataClassification=confidential), and enforce with tag-based IAM and SCPs, bucket policies, and Config rules that require tags and encryption.
• Amazon Macie discovers and classifies sensitive data in S3 (PII, credentials, financial data) with managed and custom identifiers and sends findings to Security Hub and EventBridge. CloudWatch Logs data protection policies mask sensitive data in logs. Tag-driven automation then applies the right controls.
• S3 controls: Block Public Access, default encryption, bucket policies, Object Lock, access points, S3 Access Grants. Backup Vault Lock for backups.
• Handle PII with the least access, encryption and logging; Glue and Lake Formation tag-based access control for data lakes.

Encryption at rest and KMS

• Services encrypt at rest with AWS KMS keys: EBS, S3 (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C), RDS, DynamoDB (always encrypted), EFS, FSx, Secrets Manager, SQS, SNS, CloudWatch Logs, Backup.
• Key types: AWS owned (invisible), AWS managed (aws/ebs, rotated yearly, can’t edit the policy and can’t be used cross-account), customer managed (you control policy, rotation, deletion; optionally imported key material or custom key store with CloudHSM). Symmetric keys (AES-256-GCM) are used for most services; asymmetric for sign and verify or external use.
• Key policy is the primary access control; IAM policies only work if the key policy allows IAM to do so (the default key policy delegates to IAM). Grants give temporary, narrow permissions to services. Condition keys kms:ViaService, kms:EncryptionContext.
• Rotation: customer managed symmetric keys rotate automatically (configurable from 90 to 2,560 days; default yearly) keeping the same key ID and ARN and old key material so existing data still decrypts; there’s also on-demand rotation. Asymmetric and imported keys rotate manually (new key, update the alias).
• Deleting a key has a waiting period of 7 to 30 days (disable first); deleted keys make data unrecoverable. Multi-Region keys share key material across Regions.
• Envelope encryption: KMS makes a data key; the data key encrypts the data; the encrypted data key is stored with it. GenerateDataKey, Decrypt. KMS API limit for direct encryption is 4 KB.
• Common troubleshooting:
  • “Access denied” using an encrypted EBS volume, snapshot, AMI or S3 object: the user or role lacks kms:Decrypt, kms:GenerateDataKey or kms:CreateGrant, or the key policy doesn’t allow it.
  • Cross-account encrypted snapshot or AMI: re-encrypt with a customer managed key and share the key; AWS managed keys can’t be shared.
  • Can’t enable encryption on an existing unencrypted EBS volume or RDS instance: snapshot, copy the snapshot with encryption, restore. For RDS, same method (or a read replica for Aurora). Turn on EBS encryption by default per Region to prevent unencrypted volumes. Mixed-key ASG launches need the Auto Scaling service-linked role granted on the key.
  • Disabled or pending-deletion key: dependent services fail with KMSInvalidStateException.
  • S3 with SSE-KMS at high request rates can hit KMS request quotas; use S3 Bucket Keys to reduce KMS calls.
• CloudHSM gives single-tenant FIPS 140-2 Level 3 hardware modules you manage; KMS is the managed default.

Encryption in transit and ACM

• Use TLS everywhere: HTTPS on ALB/CloudFront/API Gateway, TLS to RDS (rds.force_ssl parameter or require SSL), Redis in-transit encryption, EFS mount with TLS, aws:SecureTransport in bucket policies, VPN (IPsec) and Direct Connect + VPN or MACsec for hybrid links.
• AWS Certificate Manager (ACM) issues and manages public TLS certificates for free, and private certificates through AWS Private CA (extra charge). Auto-renewal works for ACM-issued certificates that are in use and validated; DNS validation (a CNAME record, Route 53 can add it) renews automatically as long as the record stays; email validation needs manual action. Imported certificates are not auto-renewed: ACM warns before expiry (EventBridge ACM Certificate Approaching Expiration event, Config rule acm-certificate-expiration-check).
• ACM certs attach to ELB, CloudFront, API Gateway, Elastic Beanstalk and similar integrated services; you can’t export a public ACM certificate’s private key to install it on an EC2 instance (use an exportable public cert option or a private cert, or a third-party certificate).
• Region rules: a CloudFront certificate must be in us-east-1; an ALB or API Gateway regional endpoint needs the certificate in the same Region as the resource. Wildcard (*.example.com) covers one label only.
• Troubleshooting: certificate stuck in Pending validation (the CNAME wasn’t created or is in the wrong hosted zone), name mismatch, expired cert, incomplete chain on an imported cert, TLS policy rejecting old clients (security policy on the ALB or CloudFront minimum protocol version), SNI missing on old clients.
• ALB listeners use SNI for several certificates and let you choose a security policy; NLB TLS listeners can terminate TLS; end-to-end encryption re-encrypts to targets.

Secrets

• Applications fetch secrets at runtime with GetSecretValue using an IAM role. Rotation Lambda needs network access to both Secrets Manager and the database (VPC endpoint or NAT). CloudFormation can generate a password with AWS::SecretsManager::Secret GenerateSecretString and link it to an RDS instance, or use ManageMasterUserPassword for RDS-managed master credentials.
• Rotation failing: the rotation function can’t reach the database or Secrets Manager, security group blocks it, the function lacks permissions, or the secret’s staging labels are in an odd state.
• Reference secrets in ECS task definitions (secrets), Lambda (through the SDK or the Parameters and Secrets extension) and CloudFormation dynamic references. Use Secrets Manager or Parameter Store, not S3 object plaintext.

Findings and reports

• Remediation is the part tested: GuardDuty finding about a compromised instance → EventBridge → Lambda isolates the instance (swap to a quarantine security group, snapshot, revoke role sessions by attaching an inline deny policy keyed on token issue time). Inspector finding on an old package → Systems Manager Patch Manager or a new AMI via Image Builder. Config noncompliance → Automation remediation. Security Hub finding → custom action or automation rule to EventBridge.
• Firewall Manager applies WAF, Shield Advanced, security group and Network Firewall policies across the organization.
• Reports: Config and Security Hub compliance scores, Inspector coverage, Trusted Advisor, AWS Artifact for AWS’s own audit reports, IAM credential report, Backup Audit Manager.

Infrastructure protection reminders

• Security groups are stateful allow-lists; network ACLs are stateless and ordered. Use Session Manager instead of SSH, IMDSv2 (token-required metadata) for instance metadata, private subnets plus VPC endpoints, Systems Manager Patch Manager for patching, and least-privilege instance roles.
• S3: Block Public Access, encryption, versioning, logging, bucket policies. EBS and RDS snapshots should never be public.
• Detect public exposure with Trusted Advisor, Access Analyzer, Config, and Inspector network reachability.