Security and Compliance
Administrators enforce least privilege, protect data, and demonstrate compliance. This domain covers IAM operations, encryption management, and continuous compliance tooling.
IAM and access operations
Grant permissions with roles and policies scoped to least privilege, use IAM Access Analyzer to find resources shared externally, and enforce MFA on privileged users. AWS Organizations service control policies set permission guardrails across accounts. Rotate credentials and prefer roles over long-lived keys.
Data protection and key management
KMS manages encryption keys with rotation and policies, and services such as EBS, S3, and RDS integrate with it. Enforce encryption by default and require TLS in transit. Certificate management through AWS Certificate Manager provisions and renews TLS certificates automatically.
Continuous compliance
AWS Config records resource configuration over time and evaluates rules to flag noncompliance, while AWS Security Hub aggregates findings from services like GuardDuty and Inspector against standards. These tools give an auditable view of posture and can trigger remediation.
Protecting the network edge
AWS WAF filters malicious HTTP requests, AWS Shield defends against DDoS, and security groups and network ACLs limit reachability. Least-privilege network design places sensitive resources in private subnets and exposes only what is necessary.