Security Overview
How we secure production — the layers, tools, and where each control lives.
Security is applied in layers across our AWS environment. No single control is sufficient on its own — identity, network isolation, encryption, and continuous threat detection work together to protect production workloads and data.
Defense in depth
The four control areas
| Area | What it protects | Key controls |
|---|---|---|
| Identity & Access | Who can access AWS and how | SAML SSO, temporary credentials, MFA, root-user lockdown |
| Network Security | How traffic reaches workloads | Private subnets, NAT Gateway, IP allow-lists, WAF |
| Encryption | Data in transit and at rest | ACM/TLS, AWS KMS across S3, RDS, EBS, EFS |
| Threat Detection | Detecting misconfiguration and compromise | AWS Security Hub, Amazon GuardDuty, CloudTrail |
Guiding principles
- Never use the AWS root user for day-to-day work — see Root User Protection.
- Require MFA on all privileged and user accounts — see Multi-Factor Authentication.
- Keep workloads private and expose only load balancers — see Private Networking.
- Encrypt everything in transit and at rest — see Encryption in Transit and Encryption at Rest.
- Monitor continuously for misconfiguration and threats — see Security Hub and GuardDuty.
Where to go next
| Guide | Description |
|---|---|
| Root User Protection | Retire the root user with SAML SSO and STS |
| Multi-Factor Authentication | Enforce TOTP MFA on every account |
| Private Networking | Private subnets and NAT Gateway egress |
| AWS WAF | Layer-7 protection for web applications |
| AWS Security Hub | Centralized posture and compliance |
| Amazon GuardDuty | Intelligent threat detection |