What vulnerabilities does Amazon Inspector automatically scan for across an AWS environment?

Amazon Inspector continuously scans Amazon EC2 instances (via the SSM Agent), container images in Amazon ECR, and AWS Lambda functions for software package vulnerabilities (CVEs) and unintended network exposure.

How does cross-account access differ when granted via a Resource-Based Policy versus assuming an IAM Role via STS?

With a resource-based policy, the principal retains its original account permissions while also accessing the target resource (provided both accounts allow it). When assuming an IAM Role via STS AssumeRole, the principal temporarily gives up its original permissions and takes on only the permissions of the assumed role.

In which AWS Region must an ACM certificate be provisioned to be attached to an Amazon CloudFront distribution?

An ACM certificate used with Amazon CloudFront must always be requested or imported in the US East (N. Virginia) Region (us-east-1), regardless of where the origin servers reside.

How does CloudTrail Log File Integrity Validation detect if audit logs stored in Amazon S3 were modified or deleted after delivery?

CloudTrail computes a SHA-256 hash for every log file delivered and writes hourly digest files signed with a private RSA key, forming a cryptographic hash chain that the AWS CLI can verify to prove no logs were altered or removed.

How does AWS Secrets Manager perform automatic credential rotation for an Amazon RDS database?

Secrets Manager invokes a managed AWS Lambda function that updates the database password (or alternates between two database users for zero-downtime rotation), verifies connectivity with the new credentials, and updates the encrypted secret value.

What is the architectural difference between an IAM Identity-Based Policy and a Resource-Based Policy?

Identity-based policies attach to IAM users, groups, or roles to define what actions that principal can perform. Resource-based policies attach directly to a resource (such as an S3 bucket, SQS queue, or KMS key) and include a Principal element specifying who can access it.

Which AWS resources can be directly associated with an AWS WAF Web ACL?

An AWS WAF Web ACL can be attached to Amazon CloudFront distributions (global), Application Load Balancers (ALB), Amazon API Gateway REST/HTTP APIs, AWS AppSync GraphQL APIs, Amazon Cognito User Pools, and AWS App Runner services.

What happens when Consolidated Billing is enabled in AWS Organizations regarding Reserved Instances (RIs) and Savings Plans?

Usage across all member accounts is aggregated to reach lower volume pricing tiers, and unused Reserved Instance or Savings Plan hourly commitments purchased in one member account are automatically shared across other accounts in the Organization (unless sharing is turned off).

How does the AWS IAM policy evaluation logic resolve conflicting Allow and Deny statements across multiple policies?

Evaluation starts with an implicit Deny. An explicit Deny in any applicable policy (SCP, resource-based policy, permissions boundary, session policy, or identity-based policy) always overrides any explicit Allow.

How does AWS Certificate Manager (ACM) handle TLS certificate renewal for integrated services like ALB and CloudFront?

ACM automatically renews public TLS certificates generated by ACM before expiration as long as DNS validation records remain in place (or email validation is completed) and the certificate is actively in use by an integrated AWS service.

What is the role of AWS Firewall Manager in a multi-account AWS Organizations environment?

AWS Firewall Manager centrally configures and enforces security rules—including AWS WAF rules, AWS Shield Advanced protections, VPC Security Groups, AWS Network Firewall, and Route 53 Resolver DNS Firewall—across all accounts and newly created resources in an Organization.

How does envelope encryption work in AWS Key Management Service (KMS) when encrypting payloads larger than 4 KB?

Because KMS API calls (Encrypt/Decrypt) have a 4 KB payload limit, KMS generates a Data Key (plaintext key + encrypted key). The application encrypts the large file locally using the plaintext data key, discards the plaintext key from memory, and stores the encrypted data key alongside the ciphertext.

What are KMS Multi-Region Keys, and when should a Solutions Architect use them?

KMS Multi-Region Keys are sets of interoperable KMS keys in different AWS Regions that share the same key ID and cryptographic material. They allow encrypting data in one Region and decrypting it in another without making cross-Region KMS API calls or re-encrypting the ciphertext.

What telemetry sources does Amazon GuardDuty analyze to detect malicious activity, and does it require installing agents?

GuardDuty is a completely agentless threat detection service that continuously analyzes CloudTrail management and S3 data events, VPC Flow Logs, DNS query logs, EKS audit logs, RDS login activity, and optional EBS malware scans using ML and threat intelligence feeds.

What security improvement does Instance Metadata Service Version 2 (IMDSv2) provide over IMDSv1 on Amazon EC2?

IMDSv2 requires session-oriented requests initialized with an HTTP PUT request containing a secret token and a configurable TTL header, mitigating Server-Side Request Forgery (SSRF) attacks and unauthorized container hop vulnerabilities.

Compare AWS Shield Standard and AWS Shield Advanced for DDoS protection.

Shield Standard is enabled automatically at no extra cost to defend against common Layer 3 and Layer 4 (SYN/UDP flood) attacks. Shield Advanced is a paid service adding sophisticated Layer 7 protection, 24/7 AWS DDoS Response Team (DRT) access, real-time visibility, and cost protection against DDoS scaling spikes.

Why should an EC2 instance use an IAM Instance Profile rather than storing long-lived IAM user access keys on the instance?

An Instance Profile attaches an IAM role to the EC2 instance and delivers short-lived, automatically rotated temporary credentials via the Instance Metadata Service (IMDS), eliminating the risk of leaked static access keys.

What is the difference between AWS IAM Identity Center (formerly AWS Single Sign-On) and IAM SAML 2.0 Identity Federation?

IAM Identity Center centrally manages workforce access across multiple AWS accounts in AWS Organizations and business applications using permission sets, whereas SAML 2.0 federation configures trust directly between an external IdP and an individual AWS account's IAM roles.

What is the primary use case for Amazon Macie in a data governance architecture?

Amazon Macie uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as Personally Identifiable Information (PII), financial data, and credentials stored in Amazon S3 buckets.

What happens to previously encrypted data when a Customer Managed Key in AWS KMS is rotated automatically?

KMS retains all prior backing cryptographic material indefinitely so decrypt calls transparently use the specific backing key version that encrypted the ciphertext, while all new encrypt operations use the latest backing key.

Distinguish between Amazon Cognito User Pools and Amazon Cognito Identity Pools (Federated Identities).

Cognito User Pools are serverless user directories that handle authentication (sign-up, sign-in, MFA, social/SAML IdP login) and issue JWT tokens. Cognito Identity Pools handle authorization by exchanging valid identity tokens for temporary, limited-privilege AWS credentials via STS to access AWS services directly.

What is the key architectural distinction between AWS Secrets Manager and AWS Systems Manager Parameter Store?

AWS Secrets Manager is designed for secret lifecycle management with native automatic rotation (including built-in templates for RDS, Aurora, Redshift, and DocumentDB), cross-Region replication, cross-account resource policies, and mandatory KMS encryption. SSM Parameter Store provides hierarchical configuration and SecureString storage (with a free Standard tier) but does not provide built-in automatic credential rotation.

How do AWS Config and AWS CloudTrail complement each other during a security audit?

AWS Config records the resource configuration state over time and evaluates whether resources comply with desired rules (answering 'what did the resource look like?'), whereas CloudTrail records the API calls made by principals (answering 'who made the change and when?').

What does Amazon Detective do when investigating a security finding triggered in Amazon GuardDuty or AWS Security Hub?

Amazon Detective automatically ingests logs from CloudTrail, VPC Flow Logs, and GuardDuty to build an interactive graph model of entity relationships and behavior over time, enabling rapid root-cause analysis of security incidents.

How do you share an encrypted Amazon EBS snapshot or Amazon RDS snapshot with another AWS account?

The resource must be encrypted with a Customer Managed Key (not the default AWS managed key). You must modify the KMS Key Policy to grant the target account permissions (kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant) and then share the snapshot with the target account.

What is the purpose of the ExternalId condition key when configuring cross-account IAM roles for third-party SaaS providers?

The ExternalId prevents the 'confused deputy' problem by requiring the third party to pass a unique customer-specific identifier in the sts:AssumeRole call, ensuring the third party cannot be tricked into accessing another customer's AWS account.

When should an organization choose AWS CloudHSM over AWS KMS?

Choose AWS CloudHSM when regulatory compliance requires dedicated, single-tenant FIPS 140-3 Level 3 (or FIPS 140-2 Level 3) hardware security modules where the customer exclusively controls the HSM cluster, cryptographic keys, and standard PKCS#11, JCE, or CNG APIs without AWS access.

What is the difference between Management Events and Data Events in AWS CloudTrail?

Management Events (logged by default) record control-plane operations on AWS resources (such as creating an EC2 instance, attaching an IAM policy, or modifying a VPC). Data Events (disabled by default due to high volume and cost) record high-volume data-plane resource operations such as s3:GetObject, s3:PutObject, lambda:InvokeFunction, and dynamodb:PutItem. CloudTrail Insights can also be enabled to detect unusual API call rate or error-rate spikes.

How do Service Control Policies (SCPs) in AWS Organizations affect IAM users and the account root user?

SCPs define the maximum available permissions (guardrails) for all IAM users, roles, and the account root user within member accounts of an AWS Organization or Organizational Unit (OU). SCPs do not grant permissions by themselves, do not apply to the Organization management account, and do not restrict service-linked roles.

Why can AWS WAF not be attached directly to a Network Load Balancer (NLB) or an EC2 instance?

AWS WAF inspects HTTP/HTTPS Layer 7 web traffic, whereas an NLB operates at Layer 4 (TCP/UDP/TLS). To protect workloads behind an NLB or EC2, place Amazon CloudFront or an Application Load Balancer in front of them with AWS WAF enabled.

Compare AWS Managed Keys (aws/service) and Customer Managed Keys (CMKs) in AWS KMS regarding rotation and cross-account access.

AWS Managed Keys rotate automatically every 1 year (cannot be disabled) and their key policies cannot be edited for cross-account sharing. Customer Managed Keys offer optional automatic 1-year rotation (or custom rotation periods), on-demand rotation, and customizable key policies supporting cross-account access.

What is an IAM Permissions Boundary, and does it grant permissions on its own?

An IAM Permissions Boundary is a managed policy attached to an IAM user or role that defines the maximum permissions the entity can ever have. It does not grant permissions on its own; effective permissions are the intersection of the permissions boundary and the identity-based policies.

Cloud Security: AWS IAM, Organizations, KMS, Encryption & Threat Detection

Cloud security architecture covering AWS Identity and Access Management (IAM) policy evaluation, STS roles, Service Control Policies (SCPs), KMS envelope encryption, CloudTrail, GuardDuty, WAF, and Shield.

Level: basic
Languages: en → en
Cards: 32
Markdown: Cloud Security: AWS IAM, Organizations, KMS, Encryption & Threat Detection (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	What vulnerabilities does Amazon Inspector automatically scan for across an AWS environment?	Amazon Inspector continuously scans Amazon EC2 instances (via the SSM Agent), container images in Amazon ECR, and AWS Lambda functions for software package vulnerabilities (CVEs) and unintended network exposure.
2	How does cross-account access differ when granted via a Resource-Based Policy versus assuming an IAM Role via STS?	With a resource-based policy, the principal retains its original account permissions while also accessing the target resource (provided both accounts allow it). When assuming an IAM Role via STS AssumeRole, the principal temporarily gives up its original permissions and takes on only the permissions of the assumed role.
3	In which AWS Region must an ACM certificate be provisioned to be attached to an Amazon CloudFront distribution?	An ACM certificate used with Amazon CloudFront must always be requested or imported in the US East (N. Virginia) Region (us-east-1), regardless of where the origin servers reside.
4	How does CloudTrail Log File Integrity Validation detect if audit logs stored in Amazon S3 were modified or deleted after delivery?	CloudTrail computes a SHA-256 hash for every log file delivered and writes hourly digest files signed with a private RSA key, forming a cryptographic hash chain that the AWS CLI can verify to prove no logs were altered or removed.
5	How does AWS Secrets Manager perform automatic credential rotation for an Amazon RDS database?	Secrets Manager invokes a managed AWS Lambda function that updates the database password (or alternates between two database users for zero-downtime rotation), verifies connectivity with the new credentials, and updates the encrypted secret value.
6	What is the architectural difference between an IAM Identity-Based Policy and a Resource-Based Policy?	Identity-based policies attach to IAM users, groups, or roles to define what actions that principal can perform. Resource-based policies attach directly to a resource (such as an S3 bucket, SQS queue, or KMS key) and include a Principal element specifying who can access it.
7	Which AWS resources can be directly associated with an AWS WAF Web ACL?	An AWS WAF Web ACL can be attached to Amazon CloudFront distributions (global), Application Load Balancers (ALB), Amazon API Gateway REST/HTTP APIs, AWS AppSync GraphQL APIs, Amazon Cognito User Pools, and AWS App Runner services.
8	What happens when Consolidated Billing is enabled in AWS Organizations regarding Reserved Instances (RIs) and Savings Plans?	Usage across all member accounts is aggregated to reach lower volume pricing tiers, and unused Reserved Instance or Savings Plan hourly commitments purchased in one member account are automatically shared across other accounts in the Organization (unless sharing is turned off).
9	How does the AWS IAM policy evaluation logic resolve conflicting Allow and Deny statements across multiple policies?	Evaluation starts with an implicit Deny. An explicit Deny in any applicable policy (SCP, resource-based policy, permissions boundary, session policy, or identity-based policy) always overrides any explicit Allow.
10	How does AWS Certificate Manager (ACM) handle TLS certificate renewal for integrated services like ALB and CloudFront?	ACM automatically renews public TLS certificates generated by ACM before expiration as long as DNS validation records remain in place (or email validation is completed) and the certificate is actively in use by an integrated AWS service.
11	What is the role of AWS Firewall Manager in a multi-account AWS Organizations environment?	AWS Firewall Manager centrally configures and enforces security rules—including AWS WAF rules, AWS Shield Advanced protections, VPC Security Groups, AWS Network Firewall, and Route 53 Resolver DNS Firewall—across all accounts and newly created resources in an Organization.
12	How does envelope encryption work in AWS Key Management Service (KMS) when encrypting payloads larger than 4 KB?	Because KMS API calls (Encrypt/Decrypt) have a 4 KB payload limit, KMS generates a Data Key (plaintext key + encrypted key). The application encrypts the large file locally using the plaintext data key, discards the plaintext key from memory, and stores the encrypted data key alongside the ciphertext.
13	What are KMS Multi-Region Keys, and when should a Solutions Architect use them?	KMS Multi-Region Keys are sets of interoperable KMS keys in different AWS Regions that share the same key ID and cryptographic material. They allow encrypting data in one Region and decrypting it in another without making cross-Region KMS API calls or re-encrypting the ciphertext.
14	What telemetry sources does Amazon GuardDuty analyze to detect malicious activity, and does it require installing agents?	GuardDuty is a completely agentless threat detection service that continuously analyzes CloudTrail management and S3 data events, VPC Flow Logs, DNS query logs, EKS audit logs, RDS login activity, and optional EBS malware scans using ML and threat intelligence feeds.
15	What security improvement does Instance Metadata Service Version 2 (IMDSv2) provide over IMDSv1 on Amazon EC2?	IMDSv2 requires session-oriented requests initialized with an HTTP PUT request containing a secret token and a configurable TTL header, mitigating Server-Side Request Forgery (SSRF) attacks and unauthorized container hop vulnerabilities.
16	Compare AWS Shield Standard and AWS Shield Advanced for DDoS protection.	Shield Standard is enabled automatically at no extra cost to defend against common Layer 3 and Layer 4 (SYN/UDP flood) attacks. Shield Advanced is a paid service adding sophisticated Layer 7 protection, 24/7 AWS DDoS Response Team (DRT) access, real-time visibility, and cost protection against DDoS scaling spikes.
17	Why should an EC2 instance use an IAM Instance Profile rather than storing long-lived IAM user access keys on the instance?	An Instance Profile attaches an IAM role to the EC2 instance and delivers short-lived, automatically rotated temporary credentials via the Instance Metadata Service (IMDS), eliminating the risk of leaked static access keys.
18	What is the difference between AWS IAM Identity Center (formerly AWS Single Sign-On) and IAM SAML 2.0 Identity Federation?	IAM Identity Center centrally manages workforce access across multiple AWS accounts in AWS Organizations and business applications using permission sets, whereas SAML 2.0 federation configures trust directly between an external IdP and an individual AWS account's IAM roles.
19	What is the primary use case for Amazon Macie in a data governance architecture?	Amazon Macie uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as Personally Identifiable Information (PII), financial data, and credentials stored in Amazon S3 buckets.
20	What happens to previously encrypted data when a Customer Managed Key in AWS KMS is rotated automatically?	KMS retains all prior backing cryptographic material indefinitely so decrypt calls transparently use the specific backing key version that encrypted the ciphertext, while all new encrypt operations use the latest backing key.
21	Distinguish between Amazon Cognito User Pools and Amazon Cognito Identity Pools (Federated Identities).	Cognito User Pools are serverless user directories that handle authentication (sign-up, sign-in, MFA, social/SAML IdP login) and issue JWT tokens. Cognito Identity Pools handle authorization by exchanging valid identity tokens for temporary, limited-privilege AWS credentials via STS to access AWS services directly.
22	What is the key architectural distinction between AWS Secrets Manager and AWS Systems Manager Parameter Store?	AWS Secrets Manager is designed for secret lifecycle management with native automatic rotation (including built-in templates for RDS, Aurora, Redshift, and DocumentDB), cross-Region replication, cross-account resource policies, and mandatory KMS encryption. SSM Parameter Store provides hierarchical configuration and SecureString storage (with a free Standard tier) but does not provide built-in automatic credential rotation.
23	How do AWS Config and AWS CloudTrail complement each other during a security audit?	AWS Config records the resource configuration state over time and evaluates whether resources comply with desired rules (answering 'what did the resource look like?'), whereas CloudTrail records the API calls made by principals (answering 'who made the change and when?').
24	What does Amazon Detective do when investigating a security finding triggered in Amazon GuardDuty or AWS Security Hub?	Amazon Detective automatically ingests logs from CloudTrail, VPC Flow Logs, and GuardDuty to build an interactive graph model of entity relationships and behavior over time, enabling rapid root-cause analysis of security incidents.
25	How do you share an encrypted Amazon EBS snapshot or Amazon RDS snapshot with another AWS account?	The resource must be encrypted with a Customer Managed Key (not the default AWS managed key). You must modify the KMS Key Policy to grant the target account permissions (kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant) and then share the snapshot with the target account.
26	What is the purpose of the ExternalId condition key when configuring cross-account IAM roles for third-party SaaS providers?	The ExternalId prevents the 'confused deputy' problem by requiring the third party to pass a unique customer-specific identifier in the sts:AssumeRole call, ensuring the third party cannot be tricked into accessing another customer's AWS account.
27	When should an organization choose AWS CloudHSM over AWS KMS?	Choose AWS CloudHSM when regulatory compliance requires dedicated, single-tenant FIPS 140-3 Level 3 (or FIPS 140-2 Level 3) hardware security modules where the customer exclusively controls the HSM cluster, cryptographic keys, and standard PKCS#11, JCE, or CNG APIs without AWS access.
28	What is the difference between Management Events and Data Events in AWS CloudTrail?	Management Events (logged by default) record control-plane operations on AWS resources (such as creating an EC2 instance, attaching an IAM policy, or modifying a VPC). Data Events (disabled by default due to high volume and cost) record high-volume data-plane resource operations such as s3:GetObject, s3:PutObject, lambda:InvokeFunction, and dynamodb:PutItem. CloudTrail Insights can also be enabled to detect unusual API call rate or error-rate spikes.
29	How do Service Control Policies (SCPs) in AWS Organizations affect IAM users and the account root user?	SCPs define the maximum available permissions (guardrails) for all IAM users, roles, and the account root user within member accounts of an AWS Organization or Organizational Unit (OU). SCPs do not grant permissions by themselves, do not apply to the Organization management account, and do not restrict service-linked roles.
30	Why can AWS WAF not be attached directly to a Network Load Balancer (NLB) or an EC2 instance?	AWS WAF inspects HTTP/HTTPS Layer 7 web traffic, whereas an NLB operates at Layer 4 (TCP/UDP/TLS). To protect workloads behind an NLB or EC2, place Amazon CloudFront or an Application Load Balancer in front of them with AWS WAF enabled.
31	Compare AWS Managed Keys (aws/service) and Customer Managed Keys (CMKs) in AWS KMS regarding rotation and cross-account access.	AWS Managed Keys rotate automatically every 1 year (cannot be disabled) and their key policies cannot be edited for cross-account sharing. Customer Managed Keys offer optional automatic 1-year rotation (or custom rotation periods), on-demand rotation, and customizable key policies supporting cross-account access.
32	What is an IAM Permissions Boundary, and does it grant permissions on its own?	An IAM Permissions Boundary is a managed policy attached to an IAM user or role that defines the maximum permissions the entity can ever have. It does not grant permissions on its own; effective permissions are the intersection of the permissions boundary and the identity-based policies.