AWS identity begins with IAM. An IAM user is a long-lived identity for a person or workload, a group attaches shared policies to multiple users, and a role provides temporary credentials that can be assumed by services, federated users, or other accounts. To give an EC2 instance permission to read from S3, you attach an IAM role through an instance profile rather than embedding keys on the machine. For human SSO, IAM Identity Center federates identities through SAML 2.0 or OIDC. The root account is uniquely powerful and should be protected with hardware MFA, no access keys, and locked-down access.
Encryption and secret management are first-class responsibilities. Secrets Manager handles automatic rotation of database credentials, while SSM Parameter Store is the cheaper option for simple configuration values. Server-side encryption on S3 can use SSE-S3, SSE-KMS, or SSE-C, and KMS gives you a per-key audit trail of decrypt operations through CloudTrail. For cross-account S3 access, the recommended pattern is a bucket policy that grants access to a specific role in the other account, combined with a role trust policy and required IAM permissions in that account.
Threat detection and protection are layered services. AWS WAF filters HTTP traffic at the edge against OWASP-style rules. AWS Shield Standard is automatic for every AWS customer; Shield Advanced adds enhanced DDoS mitigation and cost protection. Amazon GuardDuty applies machine learning to CloudTrail, VPC flow, and DNS logs to surface threats, while Amazon Inspector scans EC2 instances and ECR images for software vulnerabilities. Amazon Macie discovers and classifies PII in S3, and AWS Security Hub aggregates findings from these and other tools into a single dashboard. AWS Chatbot pipes alarms and security alerts into Slack or Microsoft Teams for live incident collaboration.
Governance spans accounts as well as services. AWS Organizations provides consolidated billing, and Service Control Policies (SCPs) set the maximum permissions for any account in an organizational unit. AWS Control Tower builds on Organizations to set up a multi-account landing zone with guardrails and an Account Factory for standardized account provisioning. AWS Config continuously records resource configurations and evaluates them against rules for compliance and change tracking.