Security
Developers must apply least privilege, protect data, and authenticate application users. This domain covers IAM for code, encryption with KMS, and end-user identity with Amazon Cognito.
IAM roles for application code
Application code should assume an IAM role that grants only the actions and resources it needs. EC2 instances use instance profiles, Lambda uses an execution role, and containers use task roles. Temporary credentials from a role are rotated automatically, which is safer than long-lived access keys. Scope policies to specific resource ARNs and use conditions to tighten access further.
Encryption with AWS KMS
KMS manages encryption keys and integrates with S3, EBS, DynamoDB, and more. Customer managed keys let you control rotation and key policies and record every use in CloudTrail. For large data, use envelope encryption: KMS encrypts a data key that in turn encrypts the payload. Always require TLS for data in transit.
End-user authentication with Cognito
Amazon Cognito user pools provide sign-up, sign-in, and JSON Web Token issuance for your app's end users, including federation with Google, Facebook, and SAML providers. Cognito identity pools then exchange those tokens for temporary IAM credentials so users can call AWS services with scoped permissions. Keep application user logins in Cognito rather than creating an IAM user per person.
Protecting API access
Amazon API Gateway can authorize requests with Cognito authorizers, Lambda (custom) authorizers, or IAM. Use usage plans and API keys to throttle clients, and validate request payloads at the gateway. Never expose secrets in client-side code; the client should present a token that the backend validates.