Start security questions with four nouns: principal, action, resource, and context. Then inspect every policy boundary that can affect the request.
Authorization is an intersection with explicit-deny priority
Identity and resource policies can grant access. An Organizations SCP and a permissions boundary define maximum permissions; neither grants access by itself. Session policies can narrow assumed-role permissions. Any applicable explicit deny wins.
Use roles and temporary credentials for workloads. Use IAM Identity Center for workforce access across accounts. Use resource policies for cross-account access when the service supports them, otherwise assume a role in the target account. SCPs govern accounts and OUs but do not replace least-privilege IAM policies.
Pick the protection layer
| Requirement | Start with |
|---|---|
| Manage encryption keys integrated with AWS services | KMS |
| Dedicated hardware control of keys | CloudHSM |
| Rotate database/API credentials | Secrets Manager |
| Configuration or lower-cost encrypted values | Parameter Store |
| Layer 7 request filtering | WAF |
| DDoS protection | Shield |
| Central security rules across accounts | Firewall Manager |
KMS authorization may require both an IAM policy and the key policy. Cross-account encrypted copies require permission to use the source key and a key usable in the destination. Encryption at rest does not replace TLS in transit.
Detection services answer different questions
- GuardDuty: suspicious activity from threat signals and logs.
- Inspector: software vulnerabilities and unintended exposure for supported workloads.
- Macie: sensitive data, especially in S3.
- Security Hub: aggregate and normalize findings.
- Detective: investigate relationships behind findings.
- CloudTrail: who called which AWS API; it is an audit source, not a performance monitor.
Exam lens: “most secure” usually means least privilege, short-lived credentials, encryption, private connectivity, centralized guardrails, and auditable activity—not a single security product.
Review card
- Explicit deny overrides allow.
- SCPs and boundaries cap permissions; they do not grant them.
- Prefer roles to long-lived access keys.
- Separate prevention, detection, aggregation, and investigation.
- Match encryption ownership and rotation requirements before choosing KMS or CloudHSM.