Cloud security operates on the shared responsibility model. You are responsible for securing your data, access control, and application — the provider secures the underlying infrastructure. Follow the principle of least privilege and encrypt everything.
| Term / Service | Description / Value | Notes |
|---|---|---|
| IAM User | Individual identity with long-term credentials | Best practice: use roles instead of users for apps |
| IAM Role | Identity with temporary credentials assumed by services | EC2, Lambda, ECS — always use roles not access keys |
| IAM Policy | JSON document defining permissions | Attach to users, groups, or roles |
| Least Privilege | Grant only permissions actually needed | Start with deny-all, add permissions as needed |
| Root Account | AWS account root user — full unrestricted access | NEVER use root for daily tasks — enable MFA immediately |
| MFA | Multi-Factor Authentication | Require for all human users, especially root and admins |
| Access Key | Key ID + Secret — programmatic AWS access | Rotate regularly, never commit to git, use roles instead |
| STS | Security Token Service — temporary credentials | assume-role returns time-limited access key+secret+token |
| Service Control Policy | SCP — guardrails across AWS Organization accounts | Prevent any account from leaving region or disabling CloudTrail |
| AWS Organizations | Manage multiple AWS accounts centrally | Consolidated billing, SCPs, shared services |
| VPC endpoint | Private connection to AWS services without internet | S3, DynamoDB without NAT Gateway — more secure, cheaper |
| PrivateLink | AWS PrivateLink — expose service to other VPCs privately | No internet, no peering — private connectivity |
| Encryption at rest | KMS, S3 SSE, EBS encryption, RDS encryption | Enable by default for all storage — compliance requirement |
| Encryption in transit | TLS/HTTPS for all connections | ACM (AWS Certificate Manager) for free TLS certs |
| KMS | Key Management Service — manage encryption keys | Customer Master Keys (CMK) for data encryption |
| Secrets Manager | Store and rotate database credentials, API keys | Never hardcode credentials — use Secrets Manager |
| Parameter Store | SSM Parameter Store — config and secrets | Free tier available, good for non-sensitive config |
| GuardDuty | Threat detection — analyze CloudTrail, VPC Flow Logs, DNS | ML-based anomaly detection — enable in every account |
| Security Hub | Centralized security findings across AWS services | Aggregates GuardDuty, Inspector, Macie findings |
| Inspector | Automated vulnerability scanning for EC2 and containers | CVE scanning, network exposure checks |
| WAF | Web Application Firewall — protect against OWASP Top 10 | Rate limiting, SQL injection, XSS protection |
| Shield | DDoS protection — Standard (free) and Advanced | Shield Advanced for volumetric DDoS protection |
| Macie | Sensitive data discovery in S3 — PII, credentials | Find credit cards, SSNs, passwords in S3 buckets |
| CloudTrail | API audit log — who did what, when, from where | Enable in all regions, store in S3, retain 7+ years |
# Cloud Security Best Practices
# ── 1. Never use root account ────────────────────────────────
# Enable MFA on root immediately:
# AWS Console > My Account > Multi-factor authentication > Assign MFA device
# Create admin IAM user instead:
aws iam create-user --user-name alice-admin
aws iam attach-user-policy \
--user-name alice-admin \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
aws iam create-login-profile \
--user-name alice-admin \
--password "TempPass123!" --password-reset-required
# ── 2. Use IAM Roles for EC2/Lambda (NOT access keys) ────────
# Create role for EC2 to access S3
aws iam create-role \
--role-name EC2-S3-ReadOnly \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Service": "ec2.amazonaws.com"},
"Action": "sts:AssumeRole"
}]
}'
aws iam attach-role-policy \
--role-name EC2-S3-ReadOnly \
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
# Attach to EC2 instance (no access keys needed!)
aws ec2 associate-iam-instance-profile \
--instance-id i-1234567890abcdef0 \
--iam-instance-profile Name=EC2-S3-ReadOnly
# ── 3. Use Secrets Manager for credentials ────────────────────
# Store database password
aws secretsmanager create-secret \
--name mywebuniversity/production/db-password \
--description "Production PostgreSQL password" \
--secret-string '{"username":"admin","password":"SecurePass123!"}'
# Python: retrieve secret (no hardcoded credentials!)
import boto3, json
def get_secret(secret_name):
client = boto3.client('secretsmanager', region_name='us-east-1')
response = client.get_secret_value(SecretId=secret_name)
return json.loads(response['SecretString'])
creds = get_secret('mywebuniversity/production/db-password')
print(f"Connecting as: {creds['username']}")
# ── 4. Enable CloudTrail ──────────────────────────────────────
aws cloudtrail create-trail \
--name mywebuniversity-audit \
--s3-bucket-name mywebuniversity-cloudtrail-logs \
--include-global-service-events \
--is-multi-region-trail \
--enable-log-file-validation
aws cloudtrail start-logging --name mywebuniversity-audit
# ── 5. Enable GuardDuty ───────────────────────────────────────
aws guardduty create-detector --enable
# ── 6. S3 bucket security ─────────────────────────────────────
# Block ALL public access (default should be ON)
aws s3api put-public-access-block \
--bucket mywebuniversity-content \
--public-access-block-configuration \
BlockPublicAcls=true,IgnorePublicAcls=true,\
BlockPublicPolicy=true,RestrictPublicBuckets=true
# Enable versioning and encryption
aws s3api put-bucket-versioning \
--bucket mywebuniversity-content \
--versioning-configuration Status=Enabled
aws s3api put-bucket-encryption \
--bucket mywebuniversity-content \
--server-side-encryption-configuration '{
"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]
}'
# ── 7. Security checklist ─────────────────────────────────────
# [ ] Root account MFA enabled
# [ ] No root account access keys
# [ ] CloudTrail enabled in all regions
# [ ] GuardDuty enabled
# [ ] S3 block public access enabled
# [ ] Encryption at rest for RDS, EBS, S3
# [ ] Secrets in Secrets Manager, NOT environment variables
# [ ] EC2/Lambda use IAM roles, NOT access keys
# [ ] Security groups: deny all, allow only what's needed
# [ ] VPC Flow Logs enabled
# [ ] Budget alerts configured