Security

Security protects the confidentiality, integrity, and availability of information and systems. Confidentiality means only authorized parties can access information; integrity means information and configurations are protected against unauthorized changes; availability means systems remain accessible when needed. Engineers apply security by identifying valuable assets and likely threats, selecting controls, and checking that those controls remain effective as workloads change.

Cloud security follows a shared responsibility model. AWS is responsible for security of the cloud, including physical facilities and the infrastructure supporting its services. Customers are responsible for security in the cloud, including their data, access permissions, and workload configurations. The boundary depends on the service: customers patch the guest operating system on an Amazon EC2 instance, while AWS handles more of the underlying platform maintenance for managed services. Using a managed service reduces some operational duties but does not remove responsibility for access controls or data protection.

Identity is a primary security boundary. Grant people and applications only the permissions needed for their tasks, use temporary credentials where possible, and require multifactor authentication for sensitive human access. For example, an application that reads invoices should receive permission to read the required storage objects, not administrative access to the entire account. Avoid using root credentials for routine work, and review permissions as job roles and application requirements change.

Encryption is an important benefit of cloud security capabilities. Encryption at rest protects stored information, while encryption in transit, commonly implemented with TLS, protects information moving between endpoints. Managed key services can simplify key protection, access control, and auditing. However, encryption does not prevent an authorized identity from reading data, fix excessive permissions, or secure a compromised application. Key permissions and lifecycle decisions also matter: disabling or deleting a required key can make encrypted data unavailable.

Network and application controls provide additional protection. Security groups filter traffic to associated resources, while network ACLs provide subnet-level filtering. Web application firewalls inspect supported HTTP and HTTPS traffic for unwanted requests, and distributed denial-of-service protections help maintain availability during attacks. For a public application, engineers might expose only its load balancer, restrict database access to the application tier, and apply web filtering at the entry point. A private subnet alone does not guarantee that a workload is secure.

Detection and response complement preventive controls. AWS provides capabilities for API activity auditing, threat detection, vulnerability assessment, and configuration evaluation. AWS CloudTrail records supported account activity, Amazon GuardDuty analyzes supported data sources for suspicious behavior, Amazon Inspector assesses supported workloads for vulnerabilities, and AWS Config can evaluate resource configurations against rules. These tools have different purposes: an audit log is not automatically a threat detector, and a finding is not proof that remediation has occurred. Teams must route findings, investigate them, and maintain tested response procedures.

Cloud platforms make security controls easier to deploy consistently through APIs, infrastructure as code, and centralized policies. Provider compliance reports, available through resources such as AWS Artifact, can support customer assurance and audit work, but a provider's certification does not automatically make a customer workload compliant. Customers still need appropriate configurations, evidence, and operating procedures. Security also has trade-offs: detailed logging creates storage and analysis costs, restrictive controls can disrupt legitimate operations, and stronger isolation can increase architectural complexity. Effective security uses layered controls proportional to risk, tests changes, and regularly verifies that protection remains in place.