Security architecture

Security is a system of prevention, detection, response, and learning.

Protect identities

Federate people, use roles for workloads, grant least privilege, require MFA, rotate or remove long-lived credentials, and use Access Analyzer to find unintended access.

Protect data

Classify data. Encrypt in transit with TLS and at rest with service encryption and KMS. Put secrets in Secrets Manager. Restrict S3 public access. Use Macie to help discover sensitive data in S3 where useful. Define retention and deletion, not only encryption.

Protect workloads

Use security groups, private placement, Systems Manager instead of open administration ports, WAF for web exploits, Shield for DDoS protection, Inspector for vulnerability findings, and hardened deployment pipelines.

Detect

• CloudTrail records API activity.
• Config records resource configuration and evaluates rules.
• GuardDuty analyzes signals for threats.
• Security Hub aggregates and prioritizes security findings.
• CloudWatch handles metrics, logs, alarms, and operational events.

Centralize immutable logs in a dedicated account and protect them from workload administrators.

Respond

Predefine owners, severity, containment actions, evidence handling, and communication. Automate safe responses such as quarantining a resource or disabling a leaked key, but include rollback and human escalation.

Threat-model prompt

For each data flow ask: who can call it, how they authenticate, what data moves, where it is decrypted, what happens if a credential is stolen, and what signal would reveal misuse.