Section 1

Identity & Access Management (IAM)

Central web service that helps securely control authentication and authorization for users and services interacting with AWS resources.

Core Elements

Principal

An identity capable of making requests (Root User, IAM users, federated users, roles, applications).

Authentication vs Authorization

Authentication: Verifying identity (passwords, MFA, tokens).
Authorization: Evaluating policies to explicit Allow or Deny actions.

Identity Structures

Root User Absolute permissions. Use strictly for setup + MFA.
IAM User Human or application identity with permanent long-term keys.
IAM Group A collection of users to simplify management rules.
IAM Role Temporary, dynamic short-term credentials for services/identities.
Section 2

Operational Infrastructure Monitoring & Auditing

Amazon CloudWatch

PERFORMANCE

Real-time performance metrics tracker, log consolidator, and auto-remediation alarm pipeline.

  • 📊 Metrics: Automated physical resource instrumentation details (e.g. CPU, disk, network throughput).
  • 📝 Logs: Consolidated central app logs from EC2, Lambda, ECS, etc.
  • 🚨 Alarms: Threshold rules triggering SNS alerts, Auto Scaling, or lifecycle responses.

Amazon CloudTrail

AUDITING / GOVERNANCE

The immutable cryptographic record tracker. Records administrative API actions across your entire structural layout.

🔍 Who: User/Role principal
🛠️ What: Precise API action
⏰ When: Exact time event
🌐 Where: Source IP tracking
Section 3

AWS Trusted Advisor Optimization Focus Matrix

Focus Zone Automated Evaluation Scope & Examples
Cost Optimization Finds financial waste. Pinpoints idle ELBs, unattached EBS storage, low-use EC2, and flags Savings Plan models.
Performance Ensures throughput. Monitors over-extended EC2 nodes, CloudFront CDN gaps, and EBS-to-EC2 baseline constraints.
Security Validates isolation. Checks Root MFA activation, open structural port security rules, public S3 buckets, and stale access keys.
Fault Tolerance Guarantees resilience. Tracks EBS snapshot frequency age, Multi-AZ structures for Auto Scaling/RDS, and ELB structures.
Service Limits Prevents operational scale failures. Warns when cloud infrastructure consumption crosses 80% threshold of standard quotas.

Section 4: Specialized Security & Encryption

AWS KMS

Multi-Tenant / Level 2

Fully managed, multi-tenant automated encryption key service integrating effortlessly across primary AWS stacks. Satisfies FIPS 140-2 Level 2.

AWS CloudHSM

Single-Tenant / Level 3

Dedicated physical Single-Tenant hardware encryption engine. You have absolute exclusive ownership over physical hardware compliance bounds. Satisfies FIPS 140-2 Level 3.

Amazon Macie

AI PII Lookup

Machine learning engine explicitly targeted at discovering, classifying, and protecting sensitive fields (PII, credentials) inside S3 storage buckets.

Amazon GuardDuty

Threat Detection

Continuous anomaly behavior scanner. Watches VPC flow logs, CloudTrail logs, and DNS registries to catch active cloud hacks or configuration anomalies.

Amazon Inspector

Vulnerability Scanner

Automated structural vulnerability detection across active EC2 endpoints, application container base layers, and execution systems.

Amazon WAF vs Shield

Layer 7 & DDoS

WAF: Web app Layer 7 protection (SQLi, XSS, bots).
Shield: Layer 3/4 network DDoS infrastructure defenses (Standard is free, Advanced adds structural guarantees).

Section 5

Modern Cloud Deployment & Infrastructure Automation

laC

CloudFormation vs AWS CDK

CloudFormation: Declarative JSON/YAML template automation engine.
CDK: Native programming framework (Python, TypeScript, Java) compiling into CloudFormation models.

SSM

AWS Systems Manager

Centralized operational hub. Run Command handles safe remote terminal execution without raw SSH keys; Patch Manager updates dependencies safely.

GOV

Control Tower & Service Catalog

Control Tower: Setup governance and landings zones across multi-account structures.
Service Catalog: Store corporate, pre-approved software resource items.

Section 6

Governance & Testing

Shared Responsibility Split

🏢 AWS: Security OF the Cloud (physical systems, hardware lines, networks, virtualization hypervisor layers).

👤 Customer: Security IN the Cloud (data keys, identities lifecycle, IAM configuration profiles, strict policies).

Penetration Testing Scope

🟢 Permitted (8 Core Assets without notice): EC2, NAT Gateways, ELB, RDS, CloudFront, Aurora, API Gateway, Lambda.

🔴 Strictly Prohibited: DDoS load simulations, flood patterns, port sweeping, or Route 53 zone-walking.