AWS SECURITY

Milka bakhuya

2 min read

·

Sep 22, 2026

--

Listen

Share

1. The AWS Shared Responsibility Model

• AWS Responsibility (Security OF the Cloud): AWS manages and protects the physical infrastructure, including hardware, software, networking, physical facilities, host operating systems, and virtualization layers.
• Customer Responsibility (Security IN the Cloud): Customers are responsible for managing guest operating systems, application code, data encryption (at rest and in transit), firewall/network configurations (Security Groups, ACLs), and Identity & Access Management (IAM) permissions.

2. Identity and Access Management (IAM)

• Principle of Least Privilege: Grant users, roles, and applications only the absolute minimum permissions necessary to perform their tasks.
• Root Account Security: Avoid using the AWS root user account for daily tasks. Enable Multi-Factor Authentication (MFA) immediately on the root user and restrict access exclusively to initial account management tasks.
• Roles over Static Credentials: Use temporary security credentials via IAM Roles (e.g., EC2 Instance Profiles) instead of hardcoding static access keys inside applications.

3. Network & Infrastructure Protection

• VPC Architecture: Isolate network resources within a Virtual Private Cloud (VPC) using public subnets for public-facing resources and private subnets for sensitive backends.
• Security Groups vs. Network ACLs:
• Security Groups: Stateful firewalls applied at the EC2 instance level that control inbound and outbound traffic.
• Network ACLs (NACLs): Stateless firewalls applied at the subnet level providing a secondary layer of defense.
• Edge Security: Use AWS WAF (Web Application Firewall) to block common web exploits and AWS Shield to protect against Distributed Denial of Service (DDoS) attacks.

4. Data Protection & Encryption

• Data at Rest: Encrypt static data using services like AWS KMS (Key Management Service) across storage mediums including EBS volumes, S3 buckets, and RDS databases.
• Data in Transit: Enforce Transport Layer Security (TLS/HTTPS) protocols to protect data moving across internal and external network connections.
• Access Control: Enforce strict bucket policies, disable public access on S3, and use Amazon Macie to discover and protect sensitive data (such as PII).

5. Detection, Logging, and Monitoring

• AWS CloudTrail: Logs and records every API call and user action across your AWS environment for auditing and compliance.
• Amazon CloudWatch: Monitors system metrics, logs, and application performance, triggering alarms or automated actions when thresholds are breached.
• Amazon GuardDuty: An intelligent threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events for suspicious behavior.
• AWS Security Hub: Aggregates, organizes, and prioritizes security alerts and compliance statuses across multiple AWS accounts.