Chapter 2 of 430% of exam

Security, Identity, and Compliance

Security is the largest topic on the exam. This chapter explains the AWS shared responsibility model, how Identity and Access Management (IAM) controls who can do what, and the many services AWS provides for protection, detection, and compliance. You will also learn core practices such as least privilege, MFA, and encryption in transit and at rest.

The shared responsibility model

Security in AWS is a partnership. AWS is responsible for security 'of' the cloud, meaning the infrastructure, while customers are responsible for security 'in' the cloud, meaning their data and configurations. The exact split shifts depending on the service used.

AWS secures the infrastructure

AWS manages physical facilities, hardware, the network, and the virtualization layer that runs the cloud.

Customers secure their content

Customers manage their data, access controls, identity configuration, and guest operating systems where applicable.

Responsibility varies by service

Managed services shift more responsibility to AWS, while services like EC2 leave OS patching and firewall configuration to the customer.

Customers always own their data

Data classification, encryption choices, and access permissions remain the customer's responsibility.

Identity and Access Management (IAM)

IAM controls authentication and authorization in AWS. It lets you create users, organize them into groups, define roles for temporary access, and attach policies that grant or deny specific permissions.

Users, groups, and roles

Users are persistent identities, groups simplify assigning permissions to many users, and roles provide temporary credentials to trusted entities.

Apply least privilege

Grant only the permissions needed for a task to limit the impact of compromised or misused credentials.

Prefer roles over long-term keys

Roles provide temporary credentials that expire automatically, which is safer than embedding static access keys in code.

Policies define permissions

JSON policies attached to identities specify which actions are allowed or denied on which resources.

Protecting the account and credentials

Strong account hygiene is a foundation of AWS security. Special care is required for the root user, and multi-factor authentication greatly reduces the risk of compromised sign-ins.

Protect the root user

Enable MFA on the root user and avoid using it for everyday tasks, delegating routine work to IAM identities.

Enable multi-factor authentication

MFA adds a second verification factor, such as a device code, making stolen passwords far less useful.

Rotate and safeguard credentials

Regularly rotate keys, avoid sharing credentials, and never hard-code secrets in source code.

Use Secrets Manager for secrets

Store and automatically rotate database passwords and API keys instead of embedding them in applications.

Detection, monitoring, and network protection

AWS offers services to detect threats, audit activity, and filter malicious traffic. Together they help you monitor your environment and respond to security events.

CloudTrail and Config

CloudTrail records API calls for an audit trail, while Config tracks resource configurations and evaluates them for compliance.

GuardDuty, Inspector, and Macie

GuardDuty detects threats from logs, Inspector scans for vulnerabilities, and Macie discovers sensitive data in S3.

Shield and WAF

Shield provides DDoS protection, and WAF filters web requests to block common exploits like SQL injection.

Security groups and NACLs

Security groups are stateful instance-level firewalls, while NACLs are stateless subnet-level firewalls with allow and deny rules.

Encryption and compliance

Protecting data and demonstrating compliance are essential. AWS provides key management, certificate services, and access to compliance documentation.

Encryption at rest and in transit

Encrypt stored data with services like KMS and protect data moving over networks with TLS.

Key Management Service (KMS)

KMS creates and controls encryption keys and integrates with many services to encrypt data at rest.

AWS Artifact for compliance reports

Artifact provides on-demand access to compliance documents such as SOC and PCI reports.

Organizations and SCPs

AWS Organizations centrally manages accounts, and service control policies set guardrails on what member accounts can do.

Test your knowledge

Practice questions on Security, Identity, and Compliance

Practice now →

← Previous

Cloud Concepts and the Well-Architected Framework

Cloud Technology and Core AWS Services

Last updated: July 2026