title: “Learnings — Security” created: 2026-07-20 updated: 2026-10-23 type: knowledge tags:

• aws
• certification
• security

Security

Atomic notes on AWS security — IAM, KMS, Secrets Manager, WAF, Shield, GuardDuty.

Notes

IAM Core

• [[iam-users]] — IAM user identity, credentials, zero-permission default
• [[iam-groups]] — Group-based permission inheritance, common patterns
• [[iam-policy-structure]] — Effect/Action/Resource JSON structure, evaluation logic
• [[iam-managed-vs-inline-policies]] — Managed vs Inline, when to use each
• [[iam-sign-in-url]] — Account-specific sign-in URL, account alias
• [[iam-instance-profiles]] — EC2 roles for S3 access, credential delivery via IMDS
• [[passkeys]] — FIDO2/WebAuthn phishing-resistant sign-in for root & admin (not AWS access keys)

S3 Security

• [[s3-block-public-access]] — BPA settings, hierarchy, interaction with ACLs/policies
• [[s3-access-control-lists]] — Legacy ACLs, object ownership, making objects public
• [[s3-bucket-policies]] — JSON policy structure, Policy Generator, common actions
• [[aws-arns]] — ARN format, S3-specific ARNs, common patterns
• [[s3-access-without-public]] — Granting access via bucket policy while keeping BPA ON and ACLs disabled