Start security questions with four nouns: principal, action, resource, and context. Then inspect every policy boundary that can affect the request.
Authorization is an intersection with explicit-deny priority
Identity and resource policies can grant access. An Organizations SCP and a permissions boundary define maximum permissions; neither grants access by itself. Session policies can narrow assumed-role permissions. Any applicable explicit deny wins.
Use roles and temporary credentials for workloads. Use IAM Identity Center for workforce access across accounts. Use resource policies for cross-account access when the service supports them, otherwise assume a role in the target account. SCPs govern accounts and OUs but do not replace least-privilege IAM policies.
Pick the protection layer
| Requirement | Start with |
|---|---|
| Manage encryption keys integrated with AWS services | KMS |
| Dedicated hardware control of keys | CloudHSM |
| Rotate database/API credentials | Secrets Manager |
| Configuration or lower-cost encrypted values | Parameter Store |
| Layer 7 request filtering | WAF |
| DDoS protection | Shield |
| Central security rules across accounts | Firewall Manager |
KMS authorization may require both an IAM policy and the key policy. Cross-account encrypted copies require permission to use the source key and a key usable in the destination. Encryption at rest does not replace TLS in transit.
Detection services answer different questions
- GuardDuty: suspicious activity from threat signals and logs.
- Inspector: software vulnerabilities and unintended exposure for supported workloads.
- Macie: sensitive data, especially in S3.
- Security Hub: aggregate and normalize findings.
- Detective: investigate relationships behind findings.
- CloudTrail: who called which AWS API; it is an audit source, not a performance monitor.
Exam lens: “most secure” usually means least privilege, short-lived credentials, encryption, private connectivity, centralized guardrails, and auditable activity—not a single security product.
Review card
- Explicit deny overrides allow.
- SCPs and boundaries cap permissions; they do not grant them.
- Prefer roles to long-lived access keys.
- Separate prevention, detection, aggregation, and investigation.
- Match encryption ownership and rotation requirements before choosing KMS or CloudHSM.
安全題先找四個名詞：principal、action、resource、context，再逐層檢查會影響 request 的 policy boundary。
Authorization 是取交集，explicit deny 最優先
Identity policy 與 resource policy 可以 grant access。Organizations SCP 與 permissions boundary 定義權限上限，它們本身不 grant。Session policy 還能縮小 assumed-role permission。任何 applicable explicit deny 都會得勝。
Workload 使用 role 與 temporary credential；multi-account 員工存取用 IAM Identity Center。Cross-account 可用 resource policy，服務不支援時改成 assume target-account role。SCP 管 account/OU，不能代替 least-privilege IAM policy。
先選 protection layer
| 需求 | 優先想 |
|---|---|
| 與 AWS services 整合的 encryption key | KMS |
| 專屬 hardware 與完整 key control | CloudHSM |
| 輪替 database/API credential | Secrets Manager |
| 設定或低成本 encrypted value | Parameter Store |
| Layer 7 request filtering | WAF |
| DDoS protection | Shield |
| 跨 account 中央管理 security rules | Firewall Manager |
KMS authorization 可能同時需 IAM policy 與 key policy。Cross-account encrypted copy 需有權使用 source key，並在 destination 有可用 key。At-rest encryption 不能取代 TLS in transit。
Detection service 問的事不同
- GuardDuty：從 threat signals/logs 找異常活動。
- Inspector：支援 workload 的 vulnerability 與 exposure。
- Macie：敏感資料，特別是 S3。
- Security Hub：aggregate/normalize findings。
- Detective：調查 finding 背後的關係。
- CloudTrail：誰呼叫了哪個 AWS API；它是 audit source，不是 performance monitor。
考試視角： 「最安全」通常是 least privilege、short-lived credentials、encryption、private connectivity、central guardrail 與 auditability 的組合，不是某個單一產品。
複習卡
- Explicit deny 壓過 allow。
- SCP 與 boundary 限制上限，不 grant permission。
- 優先 role，不用 long-lived access key。
- Prevention、detection、aggregation、investigation 要分開。
- 根據 key ownership 與 rotation 要求選 KMS 或 CloudHSM。