Cheat sheet¶
The one-liners that kept coming back across the labs.
Which service?¶
| Question words | Service |
|---|---|
| detect threats, malicious IP, crypto mining, unusual API calls | GuardDuty |
| root cause, "what else did this role/IP do", visualise over months | Detective |
| one place for all findings, compliance score (FSBP, CIS, PCI) | Security Hub |
| resource configuration history, "is it compliant", auto-remediate | Config (+ SSM Automation) |
| who called which API, when, from where | CloudTrail |
| CVEs / software vulnerabilities on EC2, ECR, Lambda | Inspector |
| PII / credit cards in S3 | Macie |
| external or unused access, policy validation | IAM Access Analyzer |
| L7 filtering (SQLi, XSS, rate limits) | WAF |
| DDoS L3/L4 (free) / SRT + cost protection ($3k/mo) | Shield Standard / Advanced |
| rotate a DB password automatically | Secrets Manager |
| cheap config + small secrets, no rotation | Parameter Store |
| TLS certs that renew themselves | ACM (DNS validation) |
Policy evaluation¶
- Explicit Deny > Allow > implicit deny. Effective access = the intersection of identity policy, permission boundary, session policy, SCP, RCP, resource policy (same-account resource policy can grant alone).
- SCPs/RCPs never restrict the management account.
- Cross-account: the caller's identity policy and the resource policy must both allow.
- KMS: the key policy is the root of trust; IAM policies only work if the key policy allows the account.
aws:SourceIpdoesn't work through VPC endpoints →aws:SourceVpce/aws:SourceVpc/aws:VpcSourceIp.
Incident response¶
- Leaked key: deactivate → explicit Deny (temp creds from
GetSessionTokensurvive the key!) → CloudTrail (IAM events are in us-east-1) → clean up → delete key. - EC2: termination protection → detach ASG/ELB → memory first → EBS snapshot → isolate → analyse a read-only copy in a forensics account.
- An isolation SG doesn't kill already-tracked connections. Stop after capture, or a NACL.
Network¶
- SG = stateful, allow-only, ENI level. NACL = stateless, allow + deny, numbered, subnet boundary (doesn't filter traffic inside a subnet). Ephemeral ports 1024–65535 for replies.
- Gateway endpoint = S3/DynamoDB, free, a route, not reachable from on-prem. Interface endpoint = ENI + SG, paid, private DNS.
- Flow logs = metadata only; not DNS to the Amazon resolver, IMDS, Time Sync.
Detection & logging¶
- GuardDuty reads its own copy of CloudTrail, VPC Flow Logs and DNS logs — no need to enable them. Suppression rules archive findings and stop them reaching EventBridge.
- Org-wide anything (GuardDuty, Macie, Config, Security Hub) = trusted access + delegated admin, per region.
- CloudTrail: one org trail, multi-region, KMS + log file validation; data events cost extra and take minutes
to apply after
put-event-selectors.
Federation¶
- Identity Center permission set →
AWSReservedSSO_*role in each account (don't edit it: it's overwritten). - Session tags are fixed when the session starts → attribute changes need a new session.
- Cognito user pool = who you are (JWTs). Identity pool = AWS credentials. Trust must check
aud+amr.${cognito-identity.amazonaws.com:sub}= identity ID, not the user-pool sub. - Classic flow lets the client pick any role that trusts the pool → group roles aren't a boundary.
Data protection¶
- Object Lock: governance (bypass with permission) vs compliance (nobody, not even root); legal hold has no end date. A plain DELETE only adds a delete marker.
- Block Public Access: 4 settings, account + bucket, most restrictive wins. Public site → CloudFront + OAC.
- Cross-account sharing of anything encrypted (snapshots, secrets) needs a customer managed KMS key.