第 2 章，共 4 章30% 占考试比重
Security, Identity, and Compliance
Security is the largest topic on the exam. This chapter explains the AWS shared responsibility model, how Identity and Access Management (IAM) controls who can do what, and the many services AWS provides for protection, detection, and compliance. You will also learn core practices such as least privilege, MFA, and encryption in transit and at rest.
The shared responsibility model
Security in AWS is a partnership. AWS is responsible for security 'of' the cloud, meaning the infrastructure, while customers are responsible for security 'in' the cloud, meaning their data and configurations. The exact split shifts depending on the service used.
AWS secures the infrastructure
AWS manages physical facilities, hardware, the network, and the virtualization layer that runs the cloud.
Customers secure their content
Customers manage their data, access controls, identity configuration, and guest operating systems where applicable.
Responsibility varies by service
Managed services shift more responsibility to AWS, while services like EC2 leave OS patching and firewall configuration to the customer.
Customers always own their data
Data classification, encryption choices, and access permissions remain the customer's responsibility.
Identity and Access Management (IAM)
IAM controls authentication and authorization in AWS. It lets you create users, organize them into groups, define roles for temporary access, and attach policies that grant or deny specific permissions.
Users, groups, and roles
Users are persistent identities, groups simplify assigning permissions to many users, and roles provide temporary credentials to trusted entities.
Apply least privilege
Grant only the permissions needed for a task to limit the impact of compromised or misused credentials.
Prefer roles over long-term keys
Roles provide temporary credentials that expire automatically, which is safer than embedding static access keys in code.
Policies define permissions
JSON policies attached to identities specify which actions are allowed or denied on which resources.
Protecting the account and credentials
Strong account hygiene is a foundation of AWS security. Special care is required for the root user, and multi-factor authentication greatly reduces the risk of compromised sign-ins.
Protect the root user
Enable MFA on the root user and avoid using it for everyday tasks, delegating routine work to IAM identities.
Enable multi-factor authentication
MFA adds a second verification factor, such as a device code, making stolen passwords far less useful.
Rotate and safeguard credentials
Regularly rotate keys, avoid sharing credentials, and never hard-code secrets in source code.
Use Secrets Manager for secrets
Store and automatically rotate database passwords and API keys instead of embedding them in applications.
Detection, monitoring, and network protection
AWS offers services to detect threats, audit activity, and filter malicious traffic. Together they help you monitor your environment and respond to security events.
CloudTrail and Config
CloudTrail records API calls for an audit trail, while Config tracks resource configurations and evaluates them for compliance.
GuardDuty, Inspector, and Macie
GuardDuty detects threats from logs, Inspector scans for vulnerabilities, and Macie discovers sensitive data in S3.
Shield and WAF
Shield provides DDoS protection, and WAF filters web requests to block common exploits like SQL injection.
Security groups and NACLs
Security groups are stateful instance-level firewalls, while NACLs are stateless subnet-level firewalls with allow and deny rules.
Encryption and compliance
Protecting data and demonstrating compliance are essential. AWS provides key management, certificate services, and access to compliance documentation.
Encryption at rest and in transit
Encrypt stored data with services like KMS and protect data moving over networks with TLS.
Key Management Service (KMS)
KMS creates and controls encryption keys and integrates with many services to encrypt data at rest.
AWS Artifact for compliance reports
Artifact provides on-demand access to compliance documents such as SOC and PCI reports.
Organizations and SCPs
AWS Organizations centrally manages accounts, and service control policies set guardrails on what member accounts can do.
测试你的知识
练习 Security, Identity, and Compliance 的相关题目