Design Secure Architectures

AWS is responsible for protecting the infrastructure that runs all AWS services — hardware, software, networking, and the physical facilities (Regions, AZs, edge locations).

The customer secures everything they put in and configure on AWS — their data, IAM identities and permissions, OS/network/firewall configuration, application code, and client/server-side encryption.

With EC2 the customer must patch the guest OS, runtime, and app. With Lambda/managed services AWS handles the OS and runtime, so the customer's responsibility shrinks to code, data, and IAM permissions.

An IAM user is a single identity (a person or app) with long-term credentials. A group is a collection of users used to attach policies to many users at once; groups cannot be a principal and cannot be nested.

Use a role whenever an entity needs temporary credentials and you don't want long-term keys — for EC2/Lambda workloads, cross-account access, federated users, and AWS services acting on your behalf.