Skip to content

AWS security for DevOps engineers

Not a certification course — the working subset: an IAM mental model that scales past ten engineers, roles and boundaries, OIDC from CI instead of access keys, SCP guardrails, network and KMS basics, CloudTrail/GuardDuty/Security Hub habits, SSM instead of SSH, and the IR runbook that makes incidents tractable.

Intermediate5 sections · 13 lessons · ~7h total · 15-question self-test

01

IAM & federation

4 lessonsTest yourself

01IAM mental modelPrincipals, policies, boundaries, and evaluation order.30 min 02Roles, trust policies, and PassRoleWho may assume whom — and the quiet escalator.30 min 03OIDC federation from CIGitHub/GitLab to AWS with zero stored keys.30 min 04Permission boundaries in practiceDelegate admin without handing over the kingdom.25 min

02

Org guardrails

1 lessonTest yourself

01Organizations and SCPsGuardrails that even account admins cannot cross.30 min

03

Data plane basics

3 lessonsTest yourself

01VPC security groups and private accessDefault deny, least ports, no public sprawl.30 min 02KMS encryption essentialsCMKs, key policies, and envelope encryption.30 min 03S3 misconfiguration greatest hitsPublic buckets, ACLs, and Block Public Access.25 min

04

Detection & response

4 lessonsTest yourself

01CloudTrail and GuardDuty baselineThe two services to turn on everywhere, today.30 min 02Security Hub and Config rulesFindings in one place, drift as a signal.30 min 03Instance roles and SSM Session ManagerKill standing SSH keys on bastions.25 min 04Incident response in AWSKey compromise runbook, step by step.30 min

05

Putting it together

1 lessonTest yourself

01Account security baseline checklistWhat “good enough” looks like on day one.25 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

15 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam