Cloud · AWS
Amazon Web Services
The largest public cloud platform, organised around accounts within AWS Organizations, with IAM as the central authorisation system.
IntermediateAmazonUpdated 2026-09-01
Overview
AWS uses accounts as the primary isolation boundary. Organizations groups accounts into organisational units, and service control policies set the maximum available permissions for everything inside them, including root users.
IAM is unusually expressive: identity policies, resource policies, permission boundaries, session policies and SCPs all combine, with an explicit deny always winning. Reading an effective permission decision requires understanding all five.
How it works
- 01A multi account landing zone separates workloads, environments and shared services, with centralised logging and security tooling accounts.
- 02Human access is federated through IAM Identity Center to an external identity provider, granting short lived role sessions rather than IAM users with keys.
- 03Workloads assume roles via instance profiles, IRSA on EKS, or web identity federation, eliminating stored credentials.
- 04VPCs provide isolated networks; security groups are stateful instance level controls and network ACLs are stateless subnet level ones.
Reference table
| Function | Service | Notes |
|---|---|---|
| Compute | EC2, Lambda, ECS, EKS, Fargate | Instances through to serverless containers |
| Storage | S3, EBS, EFS, Glacier tiers | S3 versioning and Object Lock support immutability |
| Networking | VPC, Security Groups, NACLs, Transit Gateway, Route 53, CloudFront | Transit Gateway for hub connectivity |
| Databases | RDS, Aurora, DynamoDB, Redshift | Managed backups and multi AZ failover |
| Identity | IAM, IAM Identity Center, STS | Federate to Entra ID or Okta for human access |
| Monitoring | CloudWatch, CloudTrail, Config | CloudTrail is the control plane audit log |
| Security | GuardDuty, Security Hub, KMS, Secrets Manager | Detection, posture and key management |
Design considerations
- Use one account per workload and environment where practical; account boundaries are the strongest isolation available.
- Apply SCPs to deny region use, root actions and disabling of logging services organisation wide.
- Centralise CloudTrail, Config and VPC flow logs into a dedicated log archive account with restricted access.
- Tag for ownership and cost from the start and enforce with Config rules.
Security considerations
- Delete long lived access keys; require federated, short lived credentials with MFA.
- Block public access on S3 at the account level and enable default encryption.
- Enable GuardDuty and Security Hub across all accounts and regions, including unused regions.
- Review IAM policies for wildcard actions and resources, and for trust policies that allow any principal.
Common misconfigurations
- S3 buckets exposed publicly or via over broad bucket policies.
- Security groups open to 0.0.0.0/0 on administrative ports.
- IAM roles with AdministratorAccess attached for expedience.
- CloudTrail disabled or not multi region, leaving investigation blind spots.