Understand AWS shared responsibility, defense in depth, threat modeling, and secure-by-design principles.

Secure AWS accounts, root credentials, alternate contacts, and emergency access.

Use centralized workforce identities and temporary AWS access instead of long-lived IAM user credentials.

Use AWS Security Token Service for short-lived credentials and controlled role assumption.

Understand identity policies, resource policies, explicit deny, boundaries, and policy evaluation logic.

Identify unintended public and cross-account access and validate IAM policies.

Use permission boundaries, SCPs, and policy conditions as layered authorization guardrails.

Understand encryption at rest, encryption in transit, envelope encryption, and key ownership.

Create, manage, rotate, authorize, and audit customer managed KMS keys.

Store, retrieve, rotate, and audit application secrets using AWS Secrets Manager.

Manage TLS certificates for AWS services and understand public and private certificate use.

Capture AWS API activity for security investigation, governance, and forensic analysis.

Use CloudTrail Lake for searchable event data stores and security investigations.

Record resource configurations, evaluate rules, and track configuration compliance.

Detect threats and suspicious activity across AWS accounts and workloads.

Centralize, prioritize, and respond to security findings and posture signals.

Scan supported compute and application artifacts for vulnerabilities and exposures.

Discover and protect sensitive data stored in Amazon S3.

Investigate security findings by analyzing relationships and activity across AWS resources.

Protect HTTP and HTTPS applications with web application firewall rules and managed protections.

Understand DDoS protection and the role of AWS Shield Standard and Advanced.

Protect VPC traffic using managed stateful and stateless firewall policies.

Centralize firewall and security policy management across AWS Organizations.

Apply security groups, network ACLs, VPC endpoints, flow logs, and network analysis as layered controls.

Secure S3 buckets using Block Public Access, bucket policies, encryption, versioning, and logging.

Secure EC2 instances with IAM roles, IMDSv2, patching, security groups, and host hardening.

Protect managed databases with network isolation, encryption, IAM authentication where supported, and secrets management.

Apply IAM, secrets, image, runtime, and network controls to ECS, EKS, and Lambda workloads.

Classify data, choose controls by sensitivity, and minimize unnecessary access to sensitive information.

Build centralized security logging and alerting using CloudTrail, CloudWatch, Config, and service findings.

Automate detection, enrichment, containment, and remediation of security events.

Prepare, detect, contain, eradicate, recover, and learn from AWS security incidents.

Collect AWS evidence safely while preserving integrity, timelines, and chain of custody.

Understand compliance frameworks, AWS Artifact, audit evidence, controls, and continuous compliance.

Understand centralized security data collection and normalization for security analytics.

Combine accounts, OUs, SCPs, delegated security services, and centralized findings.

Secure cross-account access using resource policies, IAM roles, AWS RAM, and trust boundaries.

Integrate secure coding, dependency management, secrets, authentication, authorization, and testing into AWS workloads.

Use Systems Manager for secure access, patching, inventory, and operational security controls.

Validate security controls using policy simulation, reachability analysis, configuration checks, and controlled testing.

Balance security controls, operational complexity, performance, and cost.

Apply the AWS Well-Architected Security Pillar to review and improve workload security.

Design a multi-account, defense-in-depth AWS security architecture and demonstrate detection and response.