Design Secure Architectures

AWS is responsible for protecting the infrastructure that runs all AWS services — hardware, software, networking, and the physical facilities (Regions, AZs, edge locations).

The customer secures everything they put in and configure on AWS — their data, IAM identities and permissions, OS/network/firewall configuration, application code, and client/server-side encryption.

With EC2 the customer must patch the guest OS, runtime, and app. With Lambda/managed services AWS handles the OS and runtime, so the customer's responsibility shrinks to code, data, and IAM permissions.

An IAM user is a single identity (a person or app) with long-term credentials. A group is a collection of users used to attach policies to many users at once; groups cannot be a principal and cannot be nested.

Use a role whenever an entity needs temporary credentials and you don't want long-term keys — for EC2/Lambda workloads, cross-account access, federated users, and AWS services acting on your behalf.

The root user is the identity created with the account that has unrestricted access to everything. It should be locked away, protected with MFA, have no access keys, and be used only for the few tasks that require it.