AWS Security

AWS security combines identity, prevention, audit, detection and response. Managed security services provide evidence and controls; the customer still owns data classification, access design and incident decisions.

Learning map

Concern	Canonical lesson
Identity and federation	IAM, Identity Center, STS
Authorization diagnosis	Policy evaluation
Encryption and TLS	KMS, ACM
Audit and configuration	CloudTrail, Config
Threat and vulnerability detection	GuardDuty, Inspector
Sensitive-data discovery	Macie
Secret lifecycle	Secrets Manager
Findings and investigation	Security Hub, Detective

Start with account foundations: protect root credentials, use federation/temporary credentials and separate sandbox from production. Shared responsibility changes with the service: patching a guest EC2 OS is different from configuring a managed service’s data/access controls.

Response exercise

Use a test finding, not a live compromise. Verify collection in the correct Region/account, routing through EventBridge and assignment to an owner. Document the affected principal/resource, evidence preservation, containment approval and recovery check. Marking a finding resolved is not resource remediation.

Automation should have narrow permissions, idempotency, approval gates for destructive operations and rollback. Do not automatically delete resources based only on a single unreviewed event. Preserve CloudTrail coverage and evidence when estimating logging costs.

Cost and scope

Each service has its own billable dimensions and trial rules. Config evaluations are not free merely because Security Hub consumes results. Unified Security Hub plans and standalone CSPM pricing differ. Check coverage by account/Region and partition; aggregation does not create authorization to remediate source accounts.

Defense-in-depth request and response architecture

federated identity → trust/session/IAM → application authorization
                            ↓
      network paths/SG/NACL/WAF → encrypted data + scoped key access
                            ↓
        CloudTrail/Config → detectors/scanners → findings workflow
                            ↓
           investigation → approved containment → recovery test

Responsibility	AWS-managed boundary	Customer decision
Infrastructure	Service-specific infrastructure operation	Workload placement/configuration
Identity	IAM/STS mechanisms	Trust, assignments, policy/session scope
Data	Supported encryption/backup mechanisms	Classification, access, keys and restore proof
Detection	Product-specific telemetry/analysis	Coverage, triage, response and evidence retention
Guest software	Depends on service model	EC2 patches, images, application dependencies

Product comparisons and investigation walkthrough

Inspector finds supported software vulnerabilities; GuardDuty detects supported suspicious activity; Macie discovers sensitive S3 data; Config evaluates configuration. Security Hub aggregates/workflows evidence and Detective helps investigation. They overlap without substituting for one another.

For a suspicious role session, preserve principal/session attribution and UTC interval; inspect CloudTrail-supported calls, GuardDuty finding/source context, related resource configuration and network evidence. Check the caller’s trust/policy conditions and downstream key/data access. Containment can disrupt production: use approval, narrow scope and recovery validation rather than a blanket revoke/delete script.

For a vulnerable container, correlate its digest with deployment, patch/rebuild and redeploy through reviewed release controls. A resolved finding without a new image/scan/deployment is not remediation evidence. For sensitive data, contact the data owner before deletion/quarantine and preserve required audit trails.

A security budget includes separate Config/scanner/detection/secret/key/log dimensions. Optimize coverage and data retention deliberately, not by assuming all checks or management telemetry are permanently free.

References

• Shared responsibility
• Security best practices

Across the wiki

• Cloud Security Hub
• GKE Security & Hardening — Workload Identity & Binary Authorization
• AWS Security
• Azure Security

Application identity

Use Cognito for app-user pools, access tokens and optional identity-pool AWS credentials; workforce Identity Center is not every app’s sign-in solution.