AWS Identity and Access Management (IAM) controls who can access what in an account. Its four core components are Users (individual people or applications), Groups (collections of users with shared permissions), Roles (identities that can be assumed by trusted entities without permanent credentials), and Policies (JSON documents defining permissions with Effect, Action, and Resource fields). Policies can be identity-based (attached to users, groups, or roles) or resource-based (attached to resources like S3 buckets). The Principle of Least Privilege guides all IAM design: start with no permissions and grant only the minimum required, prefer managed policies over inline ones, enable MFA on all human users, rotate credentials regularly, and use IAM Access Analyzer to surface unused or unintended access.
IAM Roles shine in scenarios that need temporary, credential-free access: EC2 instance roles let workloads call AWS services securely, Lambda execution roles give functions their permissions, cross-account roles connect users in different accounts, and federation roles integrate external identity providers via SAML or OIDC. Roles always issue temporary credentials through the AWS Security Token Service (STS). When identity is established, encryption is the next concern. AWS Key Management Service (KMS) creates and controls the encryption keys used by S3, EBS, RDS, DynamoDB, Lambda, SQS, and many more services. AWS-managed keys are free and rotate automatically, while customer-managed CMKs give full control, all auditable through CloudTrail. KMS powers envelope encryption at scale, in which a data key encrypts the actual payload and that data key is itself encrypted by the KMS key, allowing huge objects to be protected without exhausting KMS API quotas. Secrets Manager adds automatic rotation (typically via Lambda) for RDS, Redshift, and DocumentDB credentials, while Systems Manager Parameter Store provides hierarchical configuration storage with a free Standard tier and an Advanced tier, where SecureString parameters use KMS for sensitive values.
Governance relies on configuration and event history. CloudTrail records every API call as an event, capturing who made it, when, from where, and what was requested, and delivers events to an S3 bucket or a CloudWatch Logs group for long-term retention. AWS Config maintains a detailed inventory of resources and tracks configuration changes over time, answering "what did my resource look like at point T?" while evaluating Config Rules for desired state. Security Hub aggregates findings from GuardDuty, Macie, Inspector, IAM Access Analyzer, and third-party products into a single pane of glass, running continuous automated checks against standards such as the CIS AWS Foundations Benchmark and PCI DSS. GuardDuty is the threat-detection workhorse, analyzing CloudTrail, VPC Flow Logs, and DNS logs with machine learning and threat intelligence to flag malicious activity and unauthorized behavior. Macie focuses on data security in S3, discovering and classifying PII, credentials, and financial information. For perimeter protection, AWS WAF inspects web requests and blocks common exploits via managed rule groups for SQL injection and XSS, IP allow/block lists, and rate-based rules, attaching to CloudFront, ALB, API Gateway, and Cognito. AWS Shield Standard protects every AWS customer from common DDoS attacks at no cost, while Shield Advanced adds 24/7 access to the DDoS Response Team, real-time visibility, and cost protection against scaling charges incurred during an attack.