IAM Fundamentals · Organizations · Federation · Least Privilege · Cross-Account
Task 1.1 — IAM
IAM Core Concepts
Users · Groups · Roles · Policies
IAM UserA permanent identity for a person or application. Has long-term credentials (password + access keys). Avoid for applications — use roles instead.
IAM GroupA collection of IAM users. Policies attached to a group apply to all members. Simplifies permission management at scale. Groups cannot assume roles.
IAM RoleA temporary identity assumed by a trusted principal (user, service, account). Issues short-lived STS credentials. Preferred for EC2 instances, Lambda, and cross-account access.
IAM PolicyJSON document defining Allow/Deny actions on resources. Identity-based policies attach to users/groups/roles. Resource-based policies attach directly to resources (e.g., S3 bucket policy).
Roles are evaluated at runtime — no permanent credentials stored. Prefer roles over users for EC2 and Lambda. A Deny in any policy always overrides an Allow.
Effective permissions = intersection of identity policy AND resource policy (if cross-account, both must allow). SCPs restrict but never grant permissions.
Organizational Units (OUs): Logical groupings (e.g., Prod, Dev, Security)
Member Accounts: Isolated AWS accounts per team/environment
Root: Top of hierarchy — SCPs here apply everywhere
Key Features
Consolidated billing across all accounts
SCPs control what member accounts can do
AWS Control Tower automates landing zones
Enables cross-account IAM roles
Tag policies enforce tagging standards
SCP Rules to Know
SCPs do NOT apply to the management account
SCPs do NOT grant permissions — they restrict them
Deny at OU level blocks all accounts in that OU
FullAWSAccess is the default SCP (allow all)
SCPs affect even the root user in member accounts
Use SCPs to prevent member accounts from leaving the org, disabling GuardDuty, or using unapproved regions.
Task 1.1 — Federation
Identity Federation & AWS IAM Identity Center
Letting external identities access AWS
SAML 2.0 Federation
Corporate directory (Active Directory) → AWS
Uses STS AssumeRoleWithSAML
Up to 12-hour session tokens
Good for existing enterprise IdPs
Web Identity Federation
Social IdPs: Cognito, Google, Facebook
STS AssumeRoleWithWebIdentity
Cognito preferred for mobile apps
Cognito Identity Pools → temporary AWS creds
IAM Identity Center (SSO)
Single sign-on across all AWS accounts
Integrates with AD, Okta, Azure AD
Manages permission sets per account
Recommended for multi-account orgs
IAM Identity Center (formerly SSO) is the modern recommended approach for multi-account human access. Use Cognito for end-user app authentication. Never create IAM users for each employee in an enterprise.
Stateless — must explicitly allow inbound + outbound
Allow / Deny
Allow rules only
Allow AND Deny rules
Rule evaluation
All rules evaluated together
Rules evaluated in numbered order (lowest first)
Default behavior
Deny all inbound, allow all outbound
Allow all (default NACL)
Best use
Fine-grained instance protection
Subnet-level IP block lists (Deny bad IPs)
NACLs are stateless — if you allow inbound port 443, you MUST also allow outbound ephemeral ports (1024–65535). Security groups handle return traffic automatically.
Task 1.2 — VPC Design
Secure VPC Architecture Patterns
Public / Private / Isolated subnet tiers
Subnet Types
Public: Route to IGW; holds ALB, NAT GW, Bastion
Private: Route via NAT GW; holds EC2, ECS, Lambda
Isolated: No internet route; databases only
Key Components
Internet Gateway (IGW) — public internet
NAT Gateway — private → outbound only
VPC Endpoints — private AWS API access
VPC Peering / Transit Gateway — VPC-to-VPC
PrivateLink — cross-VPC service exposure
Exam Scenarios
"EC2 needs internet but not a public IP" → NAT Gateway in public subnet
"Lambda accesses RDS privately" → VPC-attached Lambda in private subnet, same VPC as RDS
"EC2 accesses S3 without internet" → VPC Gateway Endpoint for S3
"Centrally route traffic across 50 VPCs" → Transit Gateway (not VPC Peering — it doesn't scale)
AWS WAFWeb Application Firewall. Filters HTTP/S traffic with rules (IP sets, rate limiting, SQL injection, XSS). Attaches to CloudFront, ALB, API Gateway, AppSync.
AWS Shield StandardAutomatic DDoS protection for all AWS customers at no cost. Protects against Layer 3/4 attacks (volumetric, protocol).
AWS Shield AdvancedEnhanced DDoS protection with 24/7 DDoS Response Team (DRT), real-time metrics, Layer 7 attack detection, and cost protection. ~$3,000/month.
AWS Firewall ManagerCentrally manage WAF rules, Shield Advanced, and Security Groups across all accounts in an AWS Organization. Ensures consistent security posture.
WAF + CloudFront = the primary pattern for blocking Layer 7 attacks (SQL injection, XSS). Shield Advanced is for organizations needing DDoS financial protection and expert support.
Task 1.2 — Threat Detection
Security Monitoring Services
GuardDuty · Inspector · Macie · Security Hub
Amazon GuardDuty
Intelligent threat detection using ML
Analyzes CloudTrail, VPC Flow Logs, DNS logs
Detects: compromised instances, crypto mining, unusual API calls, port scanning
Agentless — no software to install
Finding types: Recon, Trojan, UnauthorizedAccess
Amazon Inspector
Automated vulnerability assessment
Scans EC2 instances and container images (ECR)
Checks OS vulnerabilities (CVEs), network exposure
Requires SSM Agent on EC2 instances
Continuous scanning (not just on-demand)
Amazon Macie
Discovers and protects sensitive data in S3
Uses ML to identify PII, financial data, credentials
Alerts on misconfigured S3 buckets (public access)
Generates findings for data compliance (GDPR, HIPAA)
AWS Security Hub
Centralizes findings from GuardDuty, Inspector, Macie
Provides security score and compliance checks
Integrates with AWS Config and third-party tools
Single pane of glass for security posture
Task 1.2 — Secure Access
Bastion Hosts vs. AWS Systems Manager Session Manager
Securely accessing EC2 instances in private subnets
Bastion Host (Legacy)
EC2 instance in public subnet acting as SSH jump server
Requires open inbound port 22 (SSH) or 3389 (RDP)
Must manage host OS, patching, and key rotation
Single point of failure if not made highly available
Logs SSH sessions separately — not native to CloudTrail
SSM Session Manager (Preferred)
No open ports required — no Security Group changes
No SSH keys to manage or rotate
Sessions logged to CloudTrail + S3/CloudWatch
Works for instances in private subnets with no internet
Requires SSM Agent + IAM role on the instance
Port forwarding and tunneling supported
Exam answer is almost always SSM Session Manager when the question mentions "no open ports," "eliminate bastion hosts," or "audit all session activity." Bastion hosts are operationally expensive and pose security risks.
AWS KMSManaged key service. Creates and controls Customer Master Keys (CMKs). Integrates natively with S3, EBS, RDS, DynamoDB, Lambda, and more. AWS-managed or customer-managed keys. FIPS 140-2 Level 2 validated.
AWS CloudHSMDedicated Hardware Security Module in your VPC. You have exclusive control of keys — AWS cannot access them. FIPS 140-2 Level 3. Required for strict regulatory compliance. More expensive; you manage the HSM cluster.
AWS Certificate Manager (ACM)Provision, manage, and deploy SSL/TLS certificates. Free public certificates. Auto-renews. Integrates with ALB, CloudFront, API Gateway. Private CA option available. Protects data in transit.
KMS = managed, shared hardware, multi-tenant. CloudHSM = dedicated hardware, single-tenant, you own the keys. Choose CloudHSM when compliance requires exclusive key custody (FIPS Level 3).
"Database password that must rotate automatically every 30 days" → Secrets Manager. "Application config values with some sensitive fields" → Parameter Store SecureString (cost-effective). Never hardcode credentials in code or EC2 user data.
Pilot Light — Core systems running (DB replicated). Scale up on disaster.
Warm Standby — Scaled-down version always running. Faster failover.
Multi-Site Active/Active — Full capacity in both regions. Near-zero RTO/RPO. Highest cost.
Lower RTO/RPO = higher cost. Match the DR strategy to the business requirement. "Minutes RTO" = Warm Standby or Active/Active. "Zero RPO" = synchronous replication (Multi-AZ RDS).
Task 1.4 — Route 53
Route 53 Routing Policies
Directing traffic for availability and performance
Failover requires health checks. Weighted with 0 weight = remove from rotation without deleting the record. Latency-based ≠ Geolocation — latency routes to lowest-latency AWS region, not nearest geography.