## AWS Security Fundamentals

Since AWS is the biggest player, let's look at its core security services. (Azure/GCP have equivalents).

### 1. IAM (Identity and Access Management)
The gatekeeper.
*   **Users**: People (Bob).
*   **Roles**: Hats that people/machines wear.
    *   *Best Practice*: Don't give an EC2 instance a password. Give it a **Role** allowing access to S3.
*   **Policies**: JSON documents defining rules.
    *   `Effect: Allow`, `Action: s3:GetObject`, `Resource: my-bucket/*`.
*   **Principle of Least Privilege**: Give only the permissions needed. Nothing more.

### 2. CloudTrail (The Black Box)
*   **What**: Logs EVERY API call made in the account.
*   **Example**: "User 'Alice' called 'TerminateInstance' on server i-12345 at 2 PM from IP 1.2.3.4".
*   **SOC Use**: This is your primary log source for investigation.

### 3. GuardDuty (The IDS)
*   **What**: Threat Detection service.
*   **How**: Analyzes CloudTrail, VPC Flow Logs (Network), and DNS logs using ML.
*   **Alerts**: "EC2 instance is mining Bitcoin", "API Key used from Tor Node".

### 4. Security Groups (The Firewall)
*   **What**: Stateful firewall for EC2 instances.
*   **Rules**: "Allow Port 80 from Anywhere". "Allow Port 22 from Office IP only".
*   **Common Mistake**: `0.0.0.0/0` on Port 22 (SSH Open to the world = Hacked in 5 minutes).

### 5. VPC (Virtual Private Cloud)
*   Your isolated network slice of the cloud.
*   **Public Subnet**: Can talk to Internet.
*   **Private Subnet**: Only talks internally (Database).
*   **NACL**: Stateless firewall at the subnet level.