Practical AWS security guides covering IAM least-privilege, GuardDuty, WAF, Secrets Manager, VPC design, and compliance automation. Built from real remediation work across SOC 2, HIPAA, and PCI-regulated environments.
On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.
Security Hub detects control failures. It is not the compliance pipeline — and treating it as one is why teams still scramble for evidence at audit time. The four jobs are distinct: AWS Config detects drift, conformance packs deploy rules org-wide as immutable bundles, SSM Automation remediates the safe class, and evidence accrues via conformance-pack exports plus Security Hub control status (Audit Manager only if you onboarded before it closed to new customers on 30 April 2026). Here is the tool-per-job matrix, a conformance pack with auto-remediation, and the auto-remediation gotcha to design around.
Two 2025 shifts rewrite the IR playbook: GuardDuty Extended Threat Detection now emits a single critical attack-sequence finding instead of a pile of high findings, and AWS Security Incident Response moved to metered pricing (free first 10,000 findings/month, then $0.000676 each) on November 21, 2025. The lesson is to page humans on the <1% of correlated criticals, isolate instead of terminate, and let auto-triage absorb the rest. Here are the runbooks.
Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. Here is the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.
The AWS European Sovereign Cloud reached GA in Brandenburg on January 15, 2026—but most EU SaaS workloads still fit standard EU regions plus DPA/SCC. This guide separates data at rest, inference routing (Bedrock geographic vs global profiles), and when sovereign cloud is worth the premium.
After Security Hub Essentials consolidated Inspector and CSPM into per-resource pricing (example: 500 units ≈ $1,875/mo), most AWS-only estates should run native first. This guide scores when Wiz/Orca-class tools earn a line item—and when paying twice for the same CVE is the real failure mode.
On May 12, 2026 AWS announced full repository code review for AWS Security Agent—whole-codebase reasoning over trust boundaries and data flows plus file/line remediations, preview at no additional charge for existing Security Agent customers.
GitHub Actions OIDC role sessions are short-lived by design—teams still paste static access keys into workflow logs until scanners or audits catch the diff; supply-chain writeups keep repeating the pattern into 2026.
Bedrock Automated Reasoning checks ground LLM outputs against formal logic policies you encode and mathematically validate that the response is consistent with the policy. This guide covers when to use Automated Reasoning vs contextual grounding, how to author the policy in production, the integration with Bedrock Guardrails, and the regulated use cases (HR, insurance, eligibility, regulatory determinations) where the difference matters.
CloudTrail Event History on the default plan isn't your audit trail — it's a 90-day story you tell auditors. A production CloudTrail setup with multi-region trails, KMS encryption, log file integrity validation, and CloudTrail Lake as the queryable layer for incident response and compliance evidence.
EBS encryption is one of the easiest controls to get right — and one of the most expensive to retrofit. Account-level default encryption, re-encrypting legacy volumes without downtime, blocking public snapshots, and operating the KMS key lifecycle without losing data to accidental deletion.
AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.
