01
AWS Shared Responsibility Model
AWS secures the cloud infrastructure. You are responsible for security in the cloud — everything you configure, deploy, and operate.
| AWS Secures | Customer Secures |
|---|
| Physical infrastructure | IAM configuration and policies |
| Hardware and hypervisor | OS on EC2 instances |
| Core AWS services | Network configuration (VPCs, security groups) |
| Availability and durability | Application code and data encryption |
| Physical security | Monitoring and incident response |
The most common AWS breaches are identity-related: over-permissive IAM roles, exposed access keys, and misconfigured S3 buckets. All are customer-configuration issues, not AWS platform vulnerabilities.
02
IAM: Identity and Access Management
Least Privilege Principles
✓No use of the root account for daily operations — create admin IAM users or use SSO
✓Assign IAM policies at minimum required scope — never attach AdministratorAccess unless absolutely required
✓Use IAM roles for EC2 instances and Lambda functions — not access keys embedded in code
✓Rotate access keys regularly — audit and delete unused keys
AWS IAM Identity Center (SSO)
✓Centralise access management across multiple AWS accounts
✓Integrate with Entra ID or Okta for single sign-on
✓Enforce MFA at the identity provider level
✓Use permission sets to assign AWS account access — not individual IAM user policies
Service Control Policies
✓In multi-account environments, use SCPs to set guardrails across the organisation
✓Block services from being used in certain regions
✓Prevent disabling of CloudTrail or GuardDuty across the organisation
03
Threat Detection: GuardDuty and Security Hub
Amazon GuardDuty
GuardDuty continuously analyses CloudTrail logs, VPC Flow Logs, and DNS logs to detect threats. It requires minimal configuration — enable it and it starts producing findings immediately.
✓Enable GuardDuty in all AWS regions — threats may originate in regions you're not actively using
✓Configure GuardDuty findings to flow to Security Hub for centralised management
✓Review GuardDuty findings weekly — prioritise High and Critical severity findings
✓Enable GuardDuty S3 protection — detect malicious access to S3 buckets
AWS Security Hub
✓Centralises findings from GuardDuty, Inspector, Macie, and third-party tools
✓Checks against security standards: CIS AWS Foundations, AWS Foundational Security Best Practices
✓Provides Security Score — overall posture metric across your accounts
✓Aggregate findings across multiple accounts in an AWS Organisation
04
Logging: CloudTrail and CloudWatch
Logging without analysis is noise. But without logging, you have no audit trail when something goes wrong.
✓Enable CloudTrail in all regions, in all accounts — log all management and data events
✓Configure CloudTrail logs to an S3 bucket with MFA delete — prevents attackers from deleting evidence
✓Enable CloudTrail log file integrity validation — detect tampering
✓CloudWatch Alarms — alert on root account usage, API error rates, failed authentication attempts
✓VPC Flow Logs — capture network traffic metadata for all VPCs
CloudTrail is the forensic audit trail for everything that happens in your AWS account. Without it, incident investigation is nearly impossible. Enable it now if you haven't.
05
Workload and Data Security
EC2 Instances
✓Patch OS and applications regularly — use AWS Systems Manager Patch Manager
✓Enable Amazon Inspector — automated vulnerability scanning for EC2 and containers
✓Enforce IMDSv2 — prevents SSRF attacks against instance metadata
✓Security Groups: deny by default, allow by exception — no 0.0.0.0/0 ingress unless absolutely required
S3 Security
✓Block public access at account level — unless specific buckets require it
✓Enable S3 server-side encryption by default — AWS KMS or S3-managed keys
✓Enable Amazon Macie — automatically discover and protect sensitive data in S3
✓S3 bucket policies: least privilege, no wildcard Principal unless required
Encryption
✓Enable encryption at rest for all storage: EBS, S3, RDS, DynamoDB
✓Use AWS KMS customer-managed keys for sensitive data — not AWS-managed keys
✓Enable encryption in transit — TLS 1.2 minimum, enforce HTTPS on all endpoints
06
De4sec AWS Security Service
Security Assessment
Review AWS environment against CIS benchmarks and AWS Foundational Security Best Practices. Produce prioritised remediation plan.
Security Baseline
Implement GuardDuty, Security Hub, CloudTrail, IAM hardening, and network security controls.
Ongoing Monitoring
GuardDuty and Security Hub alert monitoring. Weekly findings review. Monthly compliance report.
Incident Response
When a GuardDuty finding indicates active threat: containment, investigation, remediation, post-incident report.
