Security & Secrets

The cheat table: Azure security → AWS security

KMS keys and envelope encryption

Three flavors of KMS key

Envelope encryption (the pattern that makes KMS scalable)

KMS itself has a strict request size limit: 4KB of plaintext per Encrypt call. You wouldn't shove a 5GB video file at it. Instead, services use envelope encryption: KMS encrypts a small data key, and the data key encrypts the bulk data locally.

Create a CMK side-by-side

resource "azurerm_key_vault" "app" {
  name                = "kv-app"
  location            = "eastus"
  resource_group_name = "rg-app"
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "premium"
}

resource "azurerm_key_vault_key" "app" {
  name         = "app-key"
  key_vault_id = azurerm_key_vault.app.id
  key_type     = "RSA-HSM"
  key_size     = 2048
  key_opts     = ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
}

resource "aws_kms_key" "app" {
  description             = "Encrypts app data at rest"
  deletion_window_in_days = 14
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "EnableRootAdmin"
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.me.account_id}:root" }
      Action    = "kms:*"
      Resource  = "*"
    }]
  })
}

resource "aws_kms_alias" "app" {
  name          = "alias/app-key"
  target_key_id = aws_kms_key.app.key_id
}

Multi-region keys

By default, a KMS key lives in exactly one region. If you need the same key material in another region (cross-region replication of encrypted data, multi-region disaster recovery), you have two options:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Root",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowLambdaRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111:role/gfn-reports-role"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Effect": "Allow",
  "Action": ["kms:Decrypt", "kms:DescribeKey"],
  "Resource": "arn:aws:kms:us-east-1:111:key/abcd-..."
}

Secrets Manager vs Parameter Store

Reading a secret from code

# Python - azure-keyvault-secrets
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

client = SecretClient(
    vault_url="https://kv-app.vault.azure.net",
    credential=DefaultAzureCredential(),
)
db_pwd = client.get_secret("db-password").value

# Python - boto3
import boto3, json

sm = boto3.client("secretsmanager")
resp = sm.get_secret_value(SecretId="prod/db/master")

# Convention: store as JSON blob
secret = json.loads(resp["SecretString"])
db_pwd = secret["password"]
db_user = secret["username"]

Secrets Manager rotation: what really happens

When you enable rotation on a secret, you schedule a Lambda. Every rotation interval (default 30 days), Secrets Manager invokes the Lambda four times with different step labels:

ACM: free TLS certs (mostly)

Public vs private CA

Get a free public TLS cert (Terraform)

resource "aws_acm_certificate" "app" {
  domain_name               = "app.example.com"
  subject_alternative_names = ["www.app.example.com"]
  validation_method         = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

# Wire up the DNS CNAMEs ACM asks for, in Route 53
resource "aws_route53_record" "validation" {
  for_each = {
    for dvo in aws_acm_certificate.app.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  zone_id = data.aws_route53_zone.app.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.record]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "app" {
  certificate_arn         = aws_acm_certificate.app.arn
  validation_record_fqdns = [for r in aws_route53_record.validation : r.fqdn]
}

GuardDuty: managed threat detection

What GuardDuty watches

Findings, in practice

A GuardDuty finding looks like this (truncated):

{
  "SchemaVersion": "2.0",
  "Type": "CryptoCurrency:EC2/BitcoinTool.B!DNS",
  "Severity": 8.0,
  "Title": "EC2 instance is querying a domain associated with a Bitcoin-related activity.",
  "Description": "EC2 instance i-0abc123 is querying a domain on a known Bitcoin denylist.",
  "Resource": {
    "ResourceType": "Instance",
    "InstanceDetails": {
      "InstanceId": "i-0abc123def4567890",
      "InstanceType": "t3.micro",
      "LaunchTime": "2025-03-12T18:21:00Z"
    }
  },
  "Service": {
    "Action": { "ActionType": "DNS_REQUEST" },
    "Count": 42,
    "EventFirstSeen": "2025-03-13T09:14:00Z"
  }
}

Findings stream into EventBridge by default. Wire them up to SNS, Slack, PagerDuty, or your SIEM. Severity is on a 1-10 scale; teams typically alert on >=7 (high) and dashboard everything below.

Security Hub & Access Analyzer

Security Hub: the aggregator

Security Hub is AWS's CSPM and findings-aggregation service. It does two things:

1. Pulls findings from sister services - GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Config, Firewall Manager, plus third-party (Crowdstrike, Splunk, etc.) - into a single normalized format (ASFF: AWS Security Finding Format).
2. Runs continuous control checks against benchmarks (AWS Foundational Security Best Practices, CIS, PCI-DSS, NIST 800-53). Outputs pass/fail per control per resource.

IAM Access Analyzer: catch the over-shares

The single most useful free security tool in AWS. Access Analyzer continuously inspects resource-based policies (S3 buckets, KMS keys, IAM roles, Lambda functions, SQS, Secrets Manager, etc.) and flags anything that grants access to:

• Any AWS account outside your Organization (cross-account share)
• Anyone on the internet (Principal: * with no condition narrowing it)
• Any federated identity provider not pinned to specific subjects

It's free to enable. There is no excuse to not enable it. It catches "we accidentally made the S3 bucket public" 99% of the time, often within minutes of the misconfiguration.

aws accessanalyzer create-analyzer \
  --analyzer-name account-analyzer \
  --type ACCOUNT

# For org-wide visibility (run in mgmt account):
aws accessanalyzer create-analyzer \
  --analyzer-name org-analyzer \
  --type ORGANIZATION

# Findings show up immediately:
aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:us-east-1:111:analyzer/account-analyzer \
  --query "findings[?status=='ACTIVE'].[id,resource,resourceType]" \
  --output table

Try it: peek at your security posture

aws kms list-keys --region us-east-1

# Get details on one to see its kind (AWS_OWNED, AWS_MANAGED, CUSTOMER):
aws kms describe-key --key-id <some-key-id-from-above>

# Or list with aliases, which is more readable:
aws kms list-aliases --query "Aliases[].[AliasName,TargetKeyId]" --output table

aws secretsmanager list-secrets \
  --query "SecretList[].[Name,LastChangedDate,RotationEnabled]" \
  --output table

# For a specific secret, see metadata WITHOUT revealing the value:
aws secretsmanager describe-secret --secret-id <name>

# To actually fetch the plaintext (this is the dangerous one):
# aws secretsmanager get-secret-value --secret-id <name>

aws acm list-certificates --query "CertificateSummaryList[].[DomainName,Status,CertificateArn]" --output table

# Get details including renewal status:
aws acm describe-certificate --certificate-arn <arn> \
  --query "Certificate.[DomainName,Status,NotAfter,RenewalSummary.RenewalStatus]"

aws guardduty list-detectors

# If non-empty, get current findings count by severity:
DETECTOR=$(aws guardduty list-detectors --query "DetectorIds[0]" --output text)
aws guardduty get-findings-statistics \
  --detector-id $DETECTOR \
  --finding-statistic-types COUNT_BY_SEVERITY

# Last 10 highest-severity findings:
aws guardduty list-findings --detector-id $DETECTOR \
  --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \
  --max-results 10

aws accessanalyzer list-analyzers

# If you have one, list active findings - these are real "over-shared resource" problems:
ANALYZER=$(aws accessanalyzer list-analyzers --query "analyzers[0].arn" --output text)
aws accessanalyzer list-findings \
  --analyzer-arn $ANALYZER \
  --filter '{"status":{"eq":["ACTIVE"]}}' \
  --max-results 25

Quick check

Gotchas for Azure devs

Project Compass: KMS + Secrets

Picking up from chapter 7, where gfn-reports got an SQS intake queue. So far the raw S3 bucket from chapter 5 uses default (AWS-managed) encryption, and the role has no access to any secrets. In this slice we tighten encryption with a CMK and prepare to consume an external API key via Secrets Manager.

# --- Customer-managed key for gfn-reports project ---
data "aws_caller_identity" "me" {}

resource "aws_kms_key" "gfn_reports" {
  description             = "CMK for gfn-reports raw bucket + future secrets"
  deletion_window_in_days = 14
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "RootCanAdmin"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.me.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Sid       = "AllowGfnReportsRole"
        Effect    = "Allow"
        Principal = { AWS = aws_iam_role.gfn_reports.arn }
        Action    = [
          "kms:Decrypt",
          "kms:GenerateDataKey",
          "kms:DescribeKey"
        ]
        Resource  = "*"
      }
    ]
  })

  tags = {
    Project   = "Compass"
    ManagedBy = "learn-aws"
  }
}

resource "aws_kms_alias" "gfn_reports" {
  name          = "alias/gfn-reports"
  target_key_id = aws_kms_key.gfn_reports.key_id
}

# Updates the chapter-5 bucket to use the new CMK + Bucket Keys
# (Bucket Keys reduce KMS API calls by ~99%, see Ch.5 cost trap)
resource "aws_s3_bucket_server_side_encryption_configuration" "raw" {
  bucket = aws_s3_bucket.gfn_reports_raw.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.gfn_reports.arn
    }
    bucket_key_enabled = true
  }
}

resource "aws_secretsmanager_secret" "ranking_api" {
  name        = "compass/gfn-reports/ranking-api"
  description = "API key for external ranking provider"
  kms_key_id  = aws_kms_key.gfn_reports.arn

  tags = {
    Project   = "Compass"
    ManagedBy = "learn-aws"
  }
}

resource "aws_secretsmanager_secret_version" "ranking_api_v1" {
  secret_id = aws_secretsmanager_secret.ranking_api.id
  secret_string = jsonencode({
    # Placeholder - in practice, set via a CI secret or aws cli, not committed.
    api_key  = "PLACEHOLDER_ROTATE_BEFORE_USE"
    endpoint = "https://ranking.example.internal/v1/score"
  })

  lifecycle {
    # Terraform should not overwrite the value once set out-of-band
    ignore_changes = [secret_string]
  }
}

# Add to the existing role's inline policy
resource "aws_iam_role_policy" "secrets_and_kms" {
  name = "compass-secrets-kms"
  role = aws_iam_role.gfn_reports.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DecryptWithProjectCMK"
        Effect = "Allow"
        Action = [
          "kms:Decrypt",
          "kms:GenerateDataKey",
          "kms:DescribeKey"
        ]
        Resource = aws_kms_key.gfn_reports.arn
      },
      {
        Sid    = "ReadRankingApiSecret"
        Effect = "Allow"
        Action = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
        Resource = aws_secretsmanager_secret.ranking_api.arn
      }
    ]
  })
}

cd compass/
terraform plan
terraform apply

# Verify the key works end-to-end:
aws kms describe-key --key-id alias/gfn-reports --profile compass

# Verify the bucket is now using the CMK:
aws s3api get-bucket-encryption \
  --bucket gfn-reports-raw-${ACCOUNT_ID} --profile compass

# Verify the role can read the secret (impersonate it):
aws sts assume-role \
  --role-arn arn:aws:iam::${ACCOUNT_ID}:role/gfn-reports-role \
  --role-session-name secret-test \
  --profile compass | jq -r .Credentials > /tmp/creds.json
# (export the creds and try GetSecretValue)

Recap & next

What stuck?

• KMS has three key flavors. AWS-owned (invisible, free), AWS-managed (visible, free, auto-rotated), customer-managed ($1/month, full control). Envelope encryption is the pattern every KMS-backed service uses internally.
• The KMS AND rule: the key's resource policy and the principal's identity policy must both allow the action. Unique to KMS; trips up everyone the first time.
• Secrets Manager vs Parameter Store: rotation = Secrets Manager. Free config strings = Parameter Store. Don't put 200 single-string secrets in Secrets Manager - bundle into JSON blobs.
• ACM gives free public TLS certs that auto-renew, but only attach to AWS-managed TLS terminators. Private CA is paid ($400/month per CA minimum) and is for internal mTLS.
• GuardDuty is a managed threat detector; the cost driver is data-event volume, especially S3.
• Security Hub aggregates, Access Analyzer proves no resource is over-shared. Both should be on, both are cheap or free.

The mental model in one sentence

Common pitfalls so far