Security in AWS is governed by the Shared Responsibility Model, which divides responsibilities between AWS and the customer. AWS is responsible for the security of the cloud, meaning it protects the underlying infrastructure, hardware, and foundational software that run all services. The customer, on the other hand, is responsible for security in the cloud, which includes protecting data, configuring operating systems and applications, managing identity and access, and applying network controls. Understanding where AWS responsibility ends and customer responsibility begins is essential to building a secure environment.
Access to AWS resources is controlled through AWS Identity and Access Management, or IAM. IAM lets administrators create identities such as users, groups, and roles, and attach policies that define exactly what actions each identity is allowed or denied to perform. An IAM User represents a person or application that needs long-term access to AWS and is associated with credentials like access keys or passwords. An IAM Role, by contrast, is a temporary identity that can be assumed by users, services, or applications, making it ideal for short-lived tasks or for granting permissions across accounts without sharing long-term credentials.
Permissions in IAM are expressed through IAM Policies, which are JSON documents listing actions, resources, and effects such as allow or deny. A guiding principle when writing policies is least privilege, which means granting only the permissions necessary for a user or role to perform its tasks. Beyond IAM, AWS provides additional security services. AWS Shield protects against distributed denial-of-service attacks, with a Standard tier that is automatic and free and an Advanced tier that adds enhanced mitigation and support. AWS WAF, the Web Application Firewall, filters malicious web requests such as SQL injection and cross-site scripting using customizable rules. AWS Key Management Service, or KMS, creates and manages cryptographic keys used to encrypt data across many AWS services. Together, these tools help customers fulfill their side of the Shared Responsibility Model.
For larger organizations, AWS Organizations provides centralized governance across multiple AWS accounts. It enables consolidated billing, grouping of accounts into organizational units, and the application of Service Control Policies, or SCPs, that set permission guardrails across the entire organization. Multiple accounts separated by team, project, or environment improve isolation, simplify billing, and make security boundaries easier to enforce at scale.