Security & IAM Interview Guide

IAM is the backbone of AWS security. Every action in AWS is an API call that IAM evaluates:

Policy Types (Know All 6)

IAM Policy Evaluation Logic

1. Explicit Deny? → DENY (always wins, cannot be overridden)
2. SCP allows? → If no, DENY
3. Resource-based policy allows? → If yes, ALLOW
4. Identity-based policy allows? → If yes, check Permissions Boundary
5. Permission Boundary allows? → If yes, ALLOW
6. Nothing matches? → DENY (implicit deny)

Roles vs Users — The Rule

Never use long-term credentials (access keys). Use IAM Roles everywhere: EC2 instance profiles, ECS task roles, Lambda execution roles, cross-account roles. Only use IAM users for CLI access by humans, with MFA enforced.

Cross-account access is fundamental in multi-account AWS environments:

AssumeRole Flow (Know This Cold)

1. Account A creates role with trust policy: "Account B can assume this role"
2. Account B has identity policy allowing sts:AssumeRole on Account A's role ARN
3. Account B calls STS AssumeRole → receives temporary credentials (access key, secret key, session token)
4. Temporary creds expire in 1-12 hours (configurable) — no long-term keys

Confused Deputy Problem

When a third-party service assumes your role, another customer could potentially trick it into accessing your resources. Solution: Use ExternalId condition in the trust policy — a shared secret between you and the third party.

Encryption is not optional — it's a requirement. Know the differences:

KMS Key Types

• AWS Managed Key (aws/s3, aws/ebs) — AWS creates, manages. Free. No cross-account.
• Customer Managed Key (CMK) — You create, control policy. $1/month. Cross-account ✅. Recommended for production.
• AWS Owned Key — Used internally by AWS services. You can't see or manage them.

Envelope Encryption (Know This!)

KMS uses envelope encryption: KMS generates a Data Encryption Key (DEK) → DEK encrypts your data → KMS encrypts the DEK with your CMK → Store encrypted DEK alongside encrypted data. This avoids sending all your data to KMS (which has a 4KB limit per API call).

WAF Rule Groups (Quick Reference)

• AWS Managed Rules — Pre-built: OWASP Top 10, SQL injection, Known Bad Inputs, Bot Control, IP Reputation
• Rate-Based Rules — Block IPs exceeding threshold (e.g., 2000 requests/5 minutes)
• Geo-Match — Block/allow traffic from specific countries
• Custom Rules — Match on headers, URI path, query string, body content

Know the security service landscape — interviewers test whether you know which tool does what:

Enterprise Security Architecture

Enable in ALL accounts: GuardDuty → detects threats. Config → enforces compliance. Security Hub → aggregates findings. CloudTrail → audit trail. All findings flow to a central Security account for the security team to triage.

Zero Trust means "never trust, always verify" — every request is authenticated and authorized regardless of network location:

AWS Zero Trust Services

• AWS Verified Access — Zero-trust access to corporate apps without VPN. Evaluates identity + device posture per request.
• IAM Roles Anywhere — Extend IAM roles to on-premises servers using X.509 certificates. No access keys needed.
• AWS SSO (IAM Identity Center) — Centralized access management. Short-lived credentials. One identity across all accounts.

Security is tested in every architect interview. These questions cover IAM, encryption, incident response, and governance scenarios.

1. Walk me through the IAM policy evaluation logic. A user has an identity policy that allows s3:GetObject, but there's an SCP that denies all S3 actions. What happens and why?
   Answer Guide

   SCPs are evaluated first and act as a guardrail. Even if the identity policy allows it, the SCP deny wins. The evaluation order is: SCP → Resource policy → Permission boundary → Identity policy.
2. A third-party vendor needs read access to your S3 bucket in a different AWS account. Design the most secure cross-account access pattern. What's the "confused deputy" problem and how do you prevent it?
   Answer Guide

   IAM Role with trust policy + ExternalId condition. The ExternalId prevents confused deputy attacks where another customer could assume the role. Never use long-term access keys.
3. Where would you store database credentials for a Lambda function — environment variables, SSM Parameter Store, or Secrets Manager? Justify your choice.
   Answer Guide

   Secrets Manager for automatic rotation and cross-account sharing. Parameter Store (SecureString) for simpler secrets without rotation. Never plaintext env vars — they appear in console and logs.
4. GuardDuty alerts that an EC2 instance is communicating with a known cryptocurrency mining pool. Walk me through your incident response procedure.
   Answer Guide

   Isolate (change SG to deny all), preserve (snapshot EBS for forensics), investigate (VPC Flow Logs, CloudTrail, GuardDuty findings), remediate (terminate instance, rotate all credentials on it), post-mortem.
5. Design an encryption strategy for a HIPAA-compliant application. Data must be encrypted at rest and in transit, with customer-managed keys and annual key rotation.
   Answer Guide

   KMS CMKs with automatic rotation (now configurable 90-2560 days). Envelope encryption for large data. TLS 1.2+ enforced via security policies. Discuss S3 SSE-KMS, RDS encryption, EBS encryption, and ACM for certificates.
6. Your organization has 50 AWS accounts. How do you implement guardrails so that no account can launch resources outside of us-east-1 and eu-west-1?
   Answer Guide

   AWS Organizations with SCPs. Create a deny policy for all regions except the allowed ones. Apply at the OU level. Discuss the "deny all + allow list" vs "allow all + deny list" approach.
7. Explain the difference between AWS WAF and AWS Shield. A customer is experiencing a Layer 7 DDoS attack (HTTP flood). Which service handles this and how would you configure it?
   Answer Guide

   WAF handles Layer 7 (rate-based rules, IP reputation, SQL injection). Shield Standard (free, Layer 3/4 DDoS). Shield Advanced ($3K/month) adds DRT support, cost protection, and advanced metrics.
8. A developer created an IAM user with AdministratorAccess for a CI/CD pipeline and stored the access keys in a GitHub repository. What are the immediate risks and how do you remediate?
   Answer Guide

   Immediate: rotate/delete the keys, audit CloudTrail for unauthorized usage. Long-term: use OIDC federation (GitHub Actions → IAM role) instead of keys. Implement permission boundaries and SCP to prevent admin access.
9. What is a Permission Boundary and how does it differ from a regular IAM policy? Give a scenario where you'd use one.
   Answer Guide

   Permission boundary sets the maximum permissions a role/user can have. Use case: allow developers to create IAM roles but limit what those roles can do (prevent privilege escalation). Effective permissions = intersection of boundary and identity policy.
10. Design a Zero Trust architecture for an enterprise replacing their traditional VPN-based access. Which AWS services would you use?
    Answer Guide

    AWS Verified Access (per-request verification, no VPN), IAM Identity Center for SSO, IAM Roles Anywhere for on-prem workloads, mTLS between services, microsegmented Security Groups, short-lived STS tokens.