Day 2: AWS Security, IAM and Shared Responsibility
Exam domain covered today: Domain 2, Security and Compliance (30%, the highest-weighted domain). Master this day.
What you will learn today
- The AWS Shared Responsibility Model
- IAM: users, groups, roles, and policies
- Root user, least privilege, and MFA
- AWS Organizations and governance
- Encryption, AWS KMS, and Secrets Manager
- GuardDuty, Inspector, WAF, and Shield (and other security services)
- CloudTrail, Config, and Artifact
- Compliance and governance
1. The Shared Responsibility Model
1
2
3
4
5
6
7
8
9
10
+--------------------------------------------------------------+
| CUSTOMER = Security **IN** the cloud |
| Your data, identities (IAM), apps, OS patches (EC2), |
| firewall rules (security groups), encryption choices |
+--------------------------------------------------------------+
| AWS = Security **OF** the cloud |
| Hardware, global infrastructure (Regions, AZs, edge), |
| physical data centers, virtualization, managed service |
| software |
+--------------------------------------------------------------+
| Who | Responsible for | Examples |
|---|---|---|
| AWS (security of the cloud) | Physical security, hardware, networking, virtualization layer, global infrastructure, software of managed services | Data center guards, disk disposal, hypervisor, Region and AZ operations |
| Customer (security in the cloud) | Customer data, IAM, OS and application patching you manage, network and firewall configuration, encryption choices | Who can read your S3 bucket, patching EC2 guest OS |
Responsibility shifts by service type
| Service | AWS handles | You handle |
|---|---|---|
| Amazon EC2 (IaaS) | Hardware, hypervisor, facilities | Guest OS patches, apps, security groups, data, IAM |
| Amazon RDS (managed) | OS patching, database software patching, hardware, backups infrastructure | Data, who can access, security groups, encryption settings |
| Amazon S3 (managed) | Infrastructure and durability | Bucket policies, public access, encryption config, data |
| AWS Lambda (serverless) | Servers, OS, runtime, scaling | Function code, IAM permissions, data |
| Amazon DynamoDB | Infrastructure and service software | Data, IAM, encryption choices |
1
2
The more managed the service ==> the less you manage ==> the less you are responsible for
EC2 (most customer work) > RDS > Lambda / DynamoDB / S3 (least)
Three types of controls
| Type | Meaning | Example |
|---|---|---|
| Inherited controls | Controls you inherit fully from AWS | Physical and environmental security |
| Shared controls | Apply to both AWS and the customer, in different contexts | Patch management, configuration management, awareness and training |
| Customer-specific controls | Depend on what you deploy | Service and communications protection based on your workloads |
Analogy: The landlord (AWS) secures the building: walls, roof, main gate, CCTV. You (the customer) lock your apartment door and decide who gets a key. If you leave your door open, that is not the landlord's fault.
Exam trap: "Who patches the guest OS on an EC2 instance?" The customer. "Who patches the OS under RDS?" AWS.
2. AWS Identity and Access Management (IAM)
IAM controls who (authentication) can do what (authorization) on which AWS resources. It is free and global (not tied to one Region).
1
2
3
4
5
6
7
8
9
10
11
+------------------------ AWS Account ------------------------+
| Root user (all powers - lock it away) |
| |
| IAM Group "Developers" IAM Group "Admins" |
| |- User Asha |- User Ravi |
| |- User Kiran |
| |
| IAM Role "EC2-S3-Reader" <-- assumed by an EC2 instance |
| |
| Policies (JSON) attached to users, groups, or roles |
+--------------------------------------------------------------+
IAM building blocks
| Component | What it is | Key facts |
|---|---|---|
| Root user | Identity created with the account (email and password) | Full, unrestricted access. Enable MFA, do not create access keys, do not use for daily work |
| IAM user | A person or application with long-term credentials | Password for console, access keys for CLI and SDK |
| IAM group | A collection of users | Attach a policy to the group; users inherit it. Groups cannot contain other groups |
| IAM role | An identity with temporary credentials that can be assumed | Used by AWS services (EC2, Lambda), cross-account access, federated users |
| IAM policy | JSON document that allows or denies actions | Attached to users, groups, or roles |
| Permission boundary | Maximum permissions an identity can have | Advanced guardrail |
| AWS STS | Security Token Service issues temporary credentials | Behind roles |
Policy types
| Type | Description |
|---|---|
| AWS managed policy | Created and maintained by AWS (for example AdministratorAccess, ReadOnlyAccess) |
| Customer managed policy | Created by you, reusable |
| Inline policy | Embedded directly in a single user, group, or role |
| Identity-based policy | Attached to an IAM identity |
| Resource-based policy | Attached to a resource, such as an S3 bucket policy |
| Service control policy (SCP) | Organization-level permission guardrail (see Organizations) |
Policy evaluation: everything is denied by default. An explicit Allow is needed. An explicit Deny always wins.
1
2
3
4
5
6
7
Request --> Explicit Deny? --yes--> DENIED
| no
v
Explicit Allow? --yes--> ALLOWED
| no
v
Default: DENIED
Example policy (read-only to one bucket)
1
2
3
4
5
6
7
8
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
}]
}
| Element | Meaning |
|---|---|
| Effect | Allow or Deny |
| Action | What can be done |
| Resource | On which resource (ARN) |
| Condition (optional) | When the rule applies (for example source IP or MFA present) |
IAM best practices (frequently tested)
| Best practice | Why |
|---|---|
| Protect the root user with MFA and use it only for tasks that require it | Root has unlimited power |
| Apply least privilege | Give only the permissions needed, nothing more |
| Use groups to assign permissions | Easier to manage |
| Use roles for applications and services (for example EC2 reading S3) | No long-term keys in code |
| Never hard-code or share access keys | Leaked keys are a top risk |
| Enable MFA for all users | Second factor beyond password |
| Create a strong password policy | Length, complexity, rotation |
| Rotate credentials regularly | Limit exposure |
| Use IAM Identity Center for workforce access | Single sign-on across accounts |
| Monitor with CloudTrail, review with the credential report and Access Analyzer | Visibility |
Tasks that require the root user (know a few)
| Task |
|---|
| Close the AWS account |
| Change account settings such as account name, email, or root password |
| Restore IAM user permissions when the only admin locked themselves out |
| Change or cancel an AWS Support plan (historically a root-only task) |
| Register as a seller in the Reserved Instance Marketplace |
| Enable MFA delete on S3 buckets (root only) |
MFA options
| MFA device type | Example |
|---|---|
| Virtual MFA app | Google Authenticator, Authy |
| FIDO2 security key (hardware) | YubiKey |
| Hardware TOTP token | Gemalto token |
Other identity services
| Service | Purpose | Exam hook |
|---|---|---|
| IAM Identity Center (successor to AWS SSO) | Central single sign-on to multiple AWS accounts and apps | "Workforce SSO across accounts" |
| Amazon Cognito | Sign-up, sign-in, and access control for your app's customers | "Mobile or web app users" |
| AWS Directory Service | Managed Microsoft Active Directory in AWS | "Active Directory" |
| IAM Access Analyzer | Finds resources shared outside your account | "External access findings" |
| IAM credential report | CSV of all users and credential status | "Audit passwords, keys, MFA" |
| IAM Access Advisor (last accessed) | Shows services a user actually used | "Remove unused permissions" |
| AWS Resource Access Manager (RAM) | Share resources (subnets, etc.) across accounts | "Share resources securely" |
Exam trap: IAM Identity Center is for your workforce; Cognito is for your application's customers.
3. AWS Organizations and governance
| Feature | Description |
|---|---|
| AWS Organizations | Centrally manage many AWS accounts in a hierarchy of Organizational Units (OUs) |
| Consolidated billing | One bill for all accounts, combined volume discounts, shared Reserved Instance and Savings Plan benefits |
| Service Control Policies (SCPs) | Set the maximum permissions for accounts or OUs; they do not grant permissions by themselves |
| AWS Control Tower | Automated landing zone with guardrails for a secure multi-account setup |
| AWS Service Catalog | Catalog of approved products users can launch |
| AWS Config | Track configuration changes and rule compliance |
| Tag policies | Enforce consistent tagging |
1
2
3
4
5
6
7
8
Management account (root of organization)
|
+--------------------+--------------------+
| |
OU: Production OU: Development
| | | |
Acct: App Acct: DB Acct: Dev1 Acct: Sandbox
SCP: "Deny leaving approved Regions" applies down the tree
Analogy: Organizations is a company head office. SCPs are company-wide rules ("no one may open an account outside India"), regardless of what each department wants.
4. Encryption and secrets
1
2
3
Encryption AT REST Encryption IN TRANSIT
(data stored on disk/S3/DB) (data moving over network)
Use KMS keys Use TLS/HTTPS
| Concept | Meaning | AWS examples |
|---|---|---|
| Encryption at rest | Protect stored data | S3 SSE, EBS encryption, RDS encryption, DynamoDB encryption |
| Encryption in transit | Protect data as it moves | HTTPS/TLS, VPN, ACM certificates |
| Client-side encryption | You encrypt before upload | Customer-managed process |
| Server-side encryption (SSE) | AWS encrypts after receiving | SSE-S3, SSE-KMS, SSE-C |
| Service | Purpose | Key points |
|---|---|---|
| AWS KMS (Key Management Service) | Create, control, and audit encryption keys | Integrated with most AWS services; every use is logged in CloudTrail; AWS managed keys vs customer managed keys |
| AWS CloudHSM | Dedicated hardware security module | You control the keys; for strict compliance (for example FIPS 140-2 Level 3) |
| AWS Secrets Manager | Store and automatically rotate secrets such as database passwords and API keys | Rotation, fine-grained access, cross-Region replication |
| SSM Parameter Store | Store configuration values and secrets | Cheaper, no built-in automatic rotation |
| AWS Certificate Manager (ACM) | Provision and renew SSL/TLS certificates | Free public certificates for integrated services |
| AWS Private CA | Create private certificate authorities | Internal certificates |
KMS vs CloudHSM
| KMS | CloudHSM | |
|---|---|---|
| Hardware | Multi-tenant managed | Dedicated single-tenant HSM |
| Who controls keys | Shared (AWS manages the service) | You have exclusive control |
| Typical need | General encryption | Strict regulatory requirements |
Secrets Manager vs Parameter Store
| Secrets Manager | Parameter Store | |
|---|---|---|
| Automatic rotation | Yes | No |
| Cost | Paid per secret | Free tier for standard parameters |
| Best for | DB credentials, API keys | Config values and simple secrets |
5. Network and threat protection services
1
2
3
4
5
6
7
8
9
10
11
12
Internet user
|
v
[ AWS Shield ] --> DDoS protection (network and transport layer)
|
[ AWS WAF ] --> Blocks SQL injection, XSS, bad bots (Layer 7 web rules)
|
[ CloudFront / ALB / API Gateway ]
|
[ Security group ] (instance firewall) + [ Network ACL ] (subnet firewall)
|
[ EC2 / app ] <--- monitored by GuardDuty, Inspector, Macie
| Service | What it does | Remember it as | Exam keywords |
|---|---|---|---|
| AWS Shield Standard | Automatic, free DDoS protection for all customers | Free DDoS shield | "DDoS", "free" |
| AWS Shield Advanced | Paid, enhanced DDoS protection, 24/7 DDoS response team, cost protection | Premium DDoS shield | "DDoS response team" |
| AWS WAF | Web application firewall; rules for SQL injection, cross-site scripting, rate limits, IP and geo blocking | Layer 7 web filter | "SQL injection", "XSS", "web ACL" |
| AWS Firewall Manager | Centrally manage WAF, Shield Advanced, security groups across accounts | One console for all firewalls | "Multi-account firewall rules" |
| AWS Network Firewall | Managed stateful firewall and intrusion prevention for VPCs | VPC-level firewall | "Filter VPC traffic" |
| Amazon GuardDuty | Intelligent threat detection by analyzing CloudTrail, VPC Flow Logs, DNS logs with ML | Threat detective | "Malicious activity", "unusual API calls", "compromised instance" |
| Amazon Inspector | Automated vulnerability scanning of EC2, container images (ECR), and Lambda | Vulnerability scanner | "Software vulnerabilities", "CVE", "exposure" |
| Amazon Macie | Discovers sensitive data (PII) in S3 using ML | PII finder | "Personal data in S3" |
| Amazon Detective | Investigates and finds the root cause of security findings | Investigator | "Root cause analysis" |
| AWS Security Hub | Central dashboard that aggregates findings from GuardDuty, Inspector, Macie and checks best practices | Single security pane | "Aggregate findings", "security posture" |
| AWS Shield + WAF + Firewall Manager | Together protect edge and web layers | ||
| Amazon Security Lake | Centralized security data lake | Awareness | |
| AWS IAM Access Analyzer | External-access findings |
GuardDuty vs Inspector vs Macie vs Detective
| Question | Answer |
|---|---|
| "Detect threats or malicious behavior now" | GuardDuty |
| "Scan for vulnerabilities in software" | Inspector |
| "Find PII or sensitive data in S3" | Macie |
| "Find the root cause of an incident" | Detective |
| "See all findings in one place" | Security Hub |
Security Group vs Network ACL (preview, full detail on Day 5)
| Security group | Network ACL | |
|---|---|---|
| Level | Instance | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny |
6. Logging, auditing, and compliance
| Service | What it does | Memory trick |
|---|---|---|
| AWS CloudTrail | Records API calls and account activity (who, what, when, from where). Event history keeps 90 days; create a trail to store logs in S3 for longer | "Who did it?" |
| AWS Config | Records resource configuration changes over time and evaluates them against rules | "What changed, and is it compliant?" |
| Amazon CloudWatch | Metrics, logs, alarms and dashboards (performance) | "How is it performing?" |
| AWS Artifact | Self-service portal to download AWS compliance reports (SOC, PCI, ISO) and accept agreements such as BAA and GDPR DPA | "Compliance paperwork" |
| AWS Audit Manager | Continuously collects evidence to simplify audits | "Audit evidence" |
| AWS Trusted Advisor | Checks for cost, performance, security, fault tolerance, quotas, operations (covered Day 6) | |
| VPC Flow Logs | Capture IP traffic going to and from network interfaces | "Network traffic logs" |
| AWS Security Hub | Compliance checks against standards (CIS, PCI) |
1
2
3
4
5
6
7
Something changed in my account. Which service helps?
"Who made this API call?" ---> CloudTrail
"What did the configuration look ---> Config
like before and after?"
"Is the CPU too high right now?" ---> CloudWatch
"Where is the SOC 2 report?" ---> Artifact
Compliance and governance concepts
| Concept | Meaning |
|---|---|
| Compliance programs | AWS undergoes third-party audits (for example SOC 1/2/3, ISO 27001, PCI DSS, HIPAA eligibility, FedRAMP, GDPR support). You still own compliance for your workloads |
| Data residency | Data stays in the Region you choose unless you move it |
| Governance | Policies, guardrails, and processes (Organizations, Control Tower, Config) |
| AWS Customer Compliance Center | Resources about compliance practices |
| Penetration testing | Customers may test their own resources for certain services without prior approval, following the AWS policy; prohibited activities include DDoS simulation outside approved partners |
| Reporting abuse | Contact the AWS Trust and Safety team |
7. Exam traps for Day 2
| Trap | Correct thinking |
|---|---|
| "AWS patches my EC2 OS" | Wrong. Customer patches the guest OS on EC2 |
| Using the root user for daily tasks | Wrong. Use IAM users/roles; root only for specific tasks |
| Putting access keys inside EC2 code | Wrong. Attach an IAM role |
| GuardDuty finds PII | Wrong. Macie finds PII. GuardDuty finds threats |
| Inspector detects DDoS | Wrong. Shield handles DDoS; Inspector finds vulnerabilities |
| CloudTrail monitors CPU | Wrong. That is CloudWatch |
| SCPs grant permissions | Wrong. They only set the maximum allowed permissions |
| Groups can be nested | Wrong. IAM groups cannot contain other groups |
| IAM is regional | Wrong. IAM is global |
| Artifact is for storing your documents | Wrong. Artifact provides AWS's compliance reports |
8. Key takeaways
- Shared responsibility: AWS = security of the cloud; customer = security in the cloud.
- IAM: least privilege, MFA, roles over keys, root only when needed.
- Remember the security service matrix (Shield, WAF, GuardDuty, Inspector, Macie, Detective, Security Hub).
- CloudTrail = who, Config = what changed, CloudWatch = how it performs, Artifact = compliance reports.
- KMS manages keys, Secrets Manager rotates secrets, ACM manages certificates.
9. Day 2 practice questions
| # | Question | Answer |
|---|---|---|
| 1 | Who is responsible for patching the guest operating system on an EC2 instance? | The customer |
| 2 | Which service discovers sensitive data such as PII stored in S3? | Amazon Macie |
| 3 | Where can you download AWS SOC and ISO compliance reports? | AWS Artifact |
| 4 | Which service records API calls made in your AWS account? | AWS CloudTrail |
| 5 | Which service protects web applications from SQL injection? | AWS WAF |
| 6 | Which feature should an EC2 instance use to access S3 securely without storing keys? | An IAM role |
| 7 | Which service provides automatic, free DDoS protection to all customers? | AWS Shield Standard |
| 8 | Which service automatically rotates database credentials? | AWS Secrets Manager |
| 9 | What is the best practice for the root user? | Enable MFA and avoid daily use |
| 10 | Which service applies guardrails (SCPs) across many AWS accounts? | AWS Organizations |
| 11 | Which service performs intelligent threat detection using CloudTrail, VPC Flow Logs and DNS logs? | Amazon GuardDuty |
| 12 | Which service scans EC2 instances and containers for software vulnerabilities? | Amazon Inspector |
Up next on Day 3: AWS Compute: EC2, pricing options, Auto Scaling, containers, and serverless.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article