Cloud Security Engineer: Securing AWS from Day One

This is for you if

• You're a DevOps, SRE or platform engineer pulled into security work
• You know the AWS CLI and some Terraform and want real security depth
• You're aiming for cloud security engineer roles in Canada or the US
• You're preparing for the AWS Certified Security - Specialty (SCS-C03)

What's inside

• IAM policy evaluation explained, plus Access Analyzer checks you can run in CI
• Safe delegation with permissions boundaries, proven with the policy simulator
• Keyless GitHub Actions deploys with OIDC and a correctly scoped trust policy
• SCPs, RCPs, declarative policies, centralized root access and Control Tower 4.0
• A tamper-resistant CloudTrail trail, GuardDuty, and the new Security Hub vs CSPM
• KMS, private TLS-only S3, Macie and Secrets Manager done properly
• Checkov, Trivy and Conftest gates for Terraform, plus image scanning and SBOMs
• EventBridge alerts on risky changes and a compromised-key response drill
• SOC 2, ISO 27001 and PCI DSS mapped to real AWS controls, plus 26 interview Q&As

After this guide you can

• Design a multi-account AWS baseline with guardrails that teams can live with
• Replace long-lived keys with Identity Center and OIDC federation
• Make logs tamper-resistant and turn findings into alerts with runbooks
• Block risky infrastructure changes in CI with scanning and policy as code
• Run a calm cloud incident response: contain, preserve, rotate, recover
• Answer senior-level cloud security interview questions with confidence

Contents

1. The role and the mental modelp. 4
2. Identity firstp. 10
3. Accounts and guardrailsp. 25
4. Logging and visibilityp. 33
5. Network securityp. 42
6. Data protection and secretsp. 48
7. Shift left: IaC scanning, policy as code and vulnerability managementp. 57
8. Detection engineering and incident responsep. 67
9. Troubleshooting playbookp. 77
10. Production checklist, design decisions and compliancep. 81
11. Career path, certifications and interview questionsp. 85
12. Cheat sheetp. 94
13. 30-day practice planp. 98