Security architecture is the set of controls that limits access, protects data, records activity, detects unexpected behavior, and supports recovery. It should make the safe path easy for product teams and make dangerous exceptions visible.
Establish an account boundary
Use AWS Organizations to separate production, non-production, security, logging, and shared services according to the size and risk of the organization. Service control policies can restrict entire classes of actions, but they do not grant permissions by themselves.
Protect root users, centralize identity, require strong authentication, and keep break-glass access documented and monitored.
Use roles and temporary credentials
Humans and workloads should assume roles with short-lived credentials. Avoid long-lived access keys. Write least-privilege policies around actual actions and resources, then use access analysis and logs to refine them.
Identity policies, resource policies, permission boundaries, session policies, and organization controls combine during authorization. When access is denied, evaluate the complete policy chain.
Encrypt data with clear key ownership
Many AWS services encrypt data by default. Customer-managed KMS keys provide additional control over key policy, rotation, separation, and auditing. Decide who can administer a key and who can use it. Those are different privileges.
Encryption is only one part of data protection. Classification, retention, backup, deletion, and access paths matter too.
Keep secrets out of code and images
Store database passwords, API credentials, and other secrets in AWS Secrets Manager or Systems Manager Parameter Store when appropriate. Grant retrieval to the workload role, rotate where the dependency supports it, and avoid copying secrets into environment files, AMIs, or build logs.
Design the network around explicit flows
Keep application and data tiers private when they do not need public addresses. Use security group references, VPC endpoints, controlled egress, and edge protections such as WAF where the protocol supports them. Network placement cannot replace application authorization or IAM.
Centralize evidence
CloudTrail records AWS API activity. AWS Config evaluates resource configuration and history. VPC Flow Logs provide network metadata. Service logs, CloudWatch alarms, GuardDuty findings, and Security Hub aggregation fill different detection roles.
Send critical logs to a dedicated account with restrictive write and delete permissions. The centralized security logging architecture shows an organization-level pattern.
Make recovery a security control
Immutable or protected backups reduce the impact of accidental deletion and ransomware. Test restoration. Separate the people and roles that administer production from those that control recovery data when the risk warrants it.
A useful review question
For every sensitive action, ask: who can perform it, from where, using which identity, against what resource, with what evidence, and how would we recover if it were abused?
That question connects IAM, KMS, networking, logging, monitoring, and backup into one architecture instead of a collection of checkboxes.
