Security & Compliance (Domain 2) (previous edition)

AWS is responsible for security 'of' the cloud (hardware, global infrastructure, managed services); the customer is responsible for security 'in' the cloud (data, configuration, access management, OS/patching depending on the service).

Customers manage data encryption, IAM users/permissions, network/firewall configuration, client-side and server-side encryption, and patching of guest OS and applications on EC2.

A free service that controls authentication and authorization for AWS resources. It manages users, groups, roles, and policies, and is global (not Region-specific).

A JSON document that defines permissions — what actions are Allowed or Denied on which resources. Policies are attached to users, groups, or roles. By default everything is implicitly denied.

An identity with permissions that can be assumed temporarily by users, applications, or AWS services (such as EC2 instances). Roles use temporary credentials and avoid hard-coding long-term access keys.

Lock away the root account credentials, enable MFA on it, and avoid using it for daily tasks. Create individual IAM users/roles with least-privilege permissions instead.