Services at a glance

IAM (Identity and Access Management)

Global service. Controls who (authentication) can do what (authorization) on which resources.

Identities

• Root user: created with the account, unrestricted. Enable MFA, lock away, do not use daily
• IAM users: long-term credentials for a person or app (prefer roles / SSO)
• IAM groups: collections of users, attach policies to the group
• IAM roles: temporary credentials assumed by users, services (EC2, Lambda), or other accounts. No long-lived keys

Policies

JSON documents attached to identities or resources.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/uploads/*"
    }
  ]
}

• Elements: Effect, Action, Resource, optional Condition, Principal (resource policies)
• Identity-based policies (on users/roles/groups) vs resource-based (S3 bucket policy, SQS, KMS key)
• Managed (AWS or customer) vs inline policies
• Evaluation logic: default deny → explicit allow grants → an explicit deny always wins
• Permissions boundaries cap what an identity can ever be granted
• Service Control Policies (SCPs) in Organizations cap an entire account

Roles in practice

• Instance profile gives an EC2 instance a role
• Execution role gives a Lambda function its permissions
• Cross-account access: trust policy lets another account assume the role via STS (AssumeRole)

$ aws iam create-role --role-name app-role --assume-role-policy-document file://trust.json
$ aws sts assume-role --role-arn arn:aws:iam::123456789012:role/app-role --role-session-name test

Best practices

• Enable MFA, especially root and admins
• Least privilege: start with nothing, add what is needed
• Use roles, not long-term access keys; rotate keys when unavoidable
• Use IAM Identity Center for people
• Use IAM Access Analyzer to find unintended public/cross-account access
• Credential report and Access Advisor to audit and prune

Encryption

AWS KMS

• Manages KMS keys (formerly CMKs): AWS managed, customer managed, AWS owned
• Envelope encryption: a data key encrypts data, KMS key encrypts the data key
• Integrates with S3, EBS, RDS, DynamoDB, Lambda and more
• Key policies and grants control use; every use is logged in CloudTrail

$ aws kms create-key --description "app data key"
$ aws kms encrypt --key-id alias/app --plaintext fileb://secret.txt

Secrets Manager vs Parameter Store

Protection and Detection

• Security Groups / NACLs: see 5. AWS Networking
• AWS WAF: filters HTTP by rules (SQLi, XSS, rate limits, geo) on CloudFront, ALB, API Gateway
• AWS Shield: Standard on by default against common L3/L4 attacks; Advanced adds 24/7 DRT, cost protection
• GuardDuty: analyses CloudTrail, VPC Flow Logs, DNS logs for threats
• Inspector: automated CVE and exposure scanning
• Macie: discovers sensitive data in S3
• Security Hub: single pane of findings, compliance standards (CIS, PCI)
• Detective: investigate findings
• Firewall Manager: central firewall rules across accounts
• Penetration testing: allowed on certain services without prior approval, following AWS policy

Customer Identity: Amazon Cognito

• User pools: sign-up/sign-in directory, issue JWTs, social + SAML/OIDC federation, MFA
• Identity pools: exchange tokens for temporary AWS credentials to access services directly
• Often paired with API Gateway authorizers

Compliance and Governance

• AWS Artifact: download SOC / ISO / PCI reports
• Organizations + SCPs: guardrails across accounts
• Control Tower: preconfigured governance
• CloudTrail: who called which API, when, from where (enable in all regions, send to S3)
• Config rules: detect non-compliant resources and auto-remediate