Security and Compliance #1
Security groups versus network ACLs by scope and behavior
Security group = per-instance, stateful, allow-rules only. Per-subnet, stateless, and both allow/deny is the NACL. Distinguish them by layer and characteristics.
AWS CloudTrail as the audit log of API activity
'Who, when, which API operation' points to AWS CloudTrail (the audit log of operations). Performance/metrics monitoring is CloudWatch, and tracking resource configuration is Config — keep the roles separate.
AWS Config for recording configurations and evaluating compliance
'Recording resource configuration' and 'evaluating compliance with rules' point to AWS Config. 'Recording API operations' is CloudTrail. Config = configuration (state) / CloudTrail = operations (actions) is a frequent contrast.
Protecting the root user with MFA and least privilege
For the root user, the rules are don't use it daily / enable MFA / store credentials securely / use least-privilege IAM for daily work. Sharing, daily operations, and disabling MFA are all dangerous anti-patterns.
・MFA (multi-factor authentication): in addition to a password, it also requires another factor such as a one-time code to strengthen identity verification.
・SSO (single sign-on): a single authentication lets you sign in to multiple accounts and apps (on AWS, provided by IAM Identity Center).
Dividing roles among WAF, Shield, GuardDuty, Macie, and KMS
Role mapping: WAF = block web attacks / Shield = DDoS mitigation / GuardDuty = threat detection / Macie = sensitive-data detection / KMS = key management. Swapping service names and roles is the classic trap.