Security Identity & Governance

Security, Identity & Governance

1. IAM (Identity and Access Management)

AWS IAM is the core framework used to manage access to AWS resources securely by enforcing the Principle of Least Privilege.

  • IAM Roles: An identity you can create in your account that has specific permissions. Unlike users, roles do not have credentials (passwords or access keys) attached to them. Instead, they rely on temporary security credentials via AWS STS (Security Token Service). Roles are assumed by users, applications, or AWS services.

  • IAM Policies: JSON documents that define permissions.

    • Identity-based policies: Attached to users, groups, or roles.

    • Resource-based policies: Attached directly to a resource (e.g., an S3 bucket policy).

  • Permission Boundaries: An advanced feature where you use a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. It prevents privilege escalation (e.g., stopping a junior admin from creating an admin user).

2. Zero-Trust Architecture (ZTA)

Zero-Trust is a security framework based on the premise: “Never trust, always verify.” Traditional security relied on perimeter defense (castle-and-moat), but Zero-Trust assumes threats exist both inside and outside the network.

Core Pillars of Zero-Trust

  • Continuous Authentication and Authorization: Every request must be authenticated, authorized, and encrypted before granting access, regardless of where the request originates.

  • Micro-segmentation: Breaking networks down into smaller, isolated zones to contain lateral movement if a breach occurs.

  • Context-Aware Access: Evaluating user identity, device health, location, and the data being requested dynamically before granting access.

3. Secrets & Configuration Management

Managing sensitive data requires different tools depending on the lifecycle, rotation needs, and complexity of the data.

Feature / Service AWS KMS AWS Secrets Manager AWS Systems Manager Parameter Store
Primary Purpose Key management & cryptographic operations. Storage and rotation of secrets (passwords, API keys). Hierarchical configuration management (strings, URLs, passwords).
Secret Rotation Rotates the backing key automatically. Built-in integration to rotate database/API secrets using Lambda. Manual updates (no native automatic rotation).
Cost Per key per month + API request volume. Higher cost per secret per month. Free for standard parameters; low cost for advanced.

4. Security Monitoring, Logging, and Governance

These services provide visibility, threat detection, and a centralized security posture.

  • AWS CloudTrail: The Auditor. It records API calls and user activity across your AWS infrastructure. Essential for governance, compliance, and operational auditing.

  • Amazon GuardDuty: The Watchdog. A continuous security monitoring service that analyzes CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning and threat intelligence to identify malicious activity (e.g., crypto-mining, compromised EC2 instances).

  • AWS Security Hub: The Dashboard. It aggregates, organizes, and prioritizes security alerts (findings) from GuardDuty, Inspector, Macie, and AWS IAM Access Analyzer into a single pane of glass. It also runs automated compliance checks against industry standards.

5. Compliance Frameworks

Compliance ensures your cloud architecture meets specific legal and industry-mandated security standards.

  • PCI-DSS (Payment Card Industry Data Security Standard): Required for organizations that handle, store, or transmit credit card data. Requires strict network isolation, encryption of cardholder data, and rigorous logging.

  • HIPAA (Health Insurance Portability and Accountability Act): US legislation protecting Protected Health Information (PHI). Requires strict access controls, data encryption at rest and in transit, and business associate agreements (BAAs) with cloud providers.

  • SOC 2 (System and Organization Controls 2): An auditing procedure ensuring service providers securely manage data to protect the privacy and interests of their clients. Evaluated across 5 Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

6. Data Encryption Strategy

A robust strategy secures data throughout its entire lifecycle using strong cryptographic standards (like AES-256).

Data at Rest

Protecting data when it is stored on disk (S3, EBS, RDS). This prevents data exposure if physical storage media is compromised or improperly accessed.

Data in Transit

Protecting data as it moves across networks. Managed using cryptographic protocols like TLS (Transport Layer Security) and HTTPS. This prevents eavesdropping and man-in-the-middle (MitM) attacks.

Envelope Encryption

The practice of encrypting plaintext data with a Data Key, and then encrypting that Data Key with a Root Key (or Key Encryption Key – KEK).

  • Why use it? Network performance. Instead of sending massive files to AWS KMS to be encrypted (which has payload size limits), you generate a small data key. KMS encrypts only the tiny data key. You use that data key locally to encrypt your massive file, then store the encrypted file alongside the encrypted data key.