Security Pillar
The ability to protect data, systems, and assets to take advantage of cloud technologies to improve your security posture.
Official Questions
Best Practices
High Risk if Missing
AWS Verbatim
IAM least privilege, temporary STS credentials, KMS Envelope Encryption, network isolation (public/private/isolated subnets), and edge defense (AWS WAF & Shield).
In AWS Well-Architected, questions do not have single-choice trick answers. Every listed Best Practice represents an official architectural answer you must incorporate into your workload. When asked these questions in an Amazon System Design interview, your score is evaluated by how many of these best practices you proactively articulate and defend with trade-offs.
Verbatim Questions & Architecture Answers
How do you securely operate your workload?
Apply security requirements through infrastructure as code, automated compliance, and account isolation.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Deploy all security controls via code templates and enforce AWS Organizations SCPs.
Security controls built into infrastructure templates execute with zero manual friction.
Prevents massive regulatory fines and breach penalties.
Eliminates security configuration drift across multi-account environments.
How do you manage identities for people and machines?
Use centralized identity providers, temporary STS credentials, and eliminate long-lived access keys.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Authenticate users via IAM Identity Center (Single Sign-On) with MFA.
Enforce AWS STS assumed roles for machine identities; prohibit hardcoded IAM access keys.
STS token generation adds minimal overhead (cached locally for 1 hour).
Zero cost for IAM STS temporary tokens.
Eliminates credential leakage risks and simplifies key rotation.
How do you manage permissions for people and machines?
Enforce least privilege access, use IAM Roles for service compute, and establish permission boundaries.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Scope IAM policies strictly to required actions and specific resource ARNs.
Prevent privilege escalation across developer roles.
IAM policy evaluation is handled locally at the AWS edge with zero latency penalty.
Prevents unauthorized provisioning of expensive cloud resources.
Auditable, deterministic permissions model.
How do you detect and investigate security events?
Enable AWS CloudTrail in all regions and automate threat detection with GuardDuty.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Maintain an immutable, encrypted audit trail of every AWS API request.
Use ML-based threat detection to identify compromised credentials and anomalous API calls.
CloudTrail logging is out-of-band and does not add latency to API requests.
Management events in CloudTrail are free for the first copy; S3 storage costs are negligible.
Automated GuardDuty alerts integrate directly into Slack/PagerDuty.
How do you protect your network resources?
Isolate subnets, use Security Groups and Network ACLs, and protect edge endpoints with AWS WAF.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Databases and compute have no public IP addresses.
Enforce strict ingress and egress port filtering.
Filter SQL injection, XSS, and rate limit brute force attacks at the CDN edge.
WAF edge filtering inspects packets in <1ms while shielding origin servers from malicious traffic.
AWS WAF costs $5/month per web ACL + $1 per rule + $0.60 per million requests; saves compute from processing junk requests.
AWS Managed Rules for WAF provide instant protections without writing custom regexes.
How do you protect your compute resources?
Harden container base images, scan vulnerabilities with Amazon Inspector, and enforce non-root execution.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Use minimal base images (Alpine/Distroless) with zero unnecessary packages.
Scan ECR container repositories continuously using Amazon Inspector.
Smaller container images download faster, improving ECS auto-scaling launch times.
Inspector scanning prevents zero-day exploit breaches.
Automated vulnerability alerts directly in GitHub / CI pipelines.
How do you classify your data?
Identify and tag data based on regulatory and sensitivity levels (PII, PCI-DSS).
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Categorize data into Public, Internal, Confidential, and Restricted tiers.
Enables applying strict encryption only where needed, avoiding overhead on public assets.
Prevents over-encrypting public static assets.
Establishes compliance audits (SOC2, HIPAA).
How do you protect your data at rest?
Enforce encryption at rest using AWS KMS with Customer Managed Keys and KMS Envelope Encryption.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Enable default AES-256 encryption across all S3 buckets, EBS volumes, and DynamoDB tables.
Encrypt data keys locally in memory to eliminate KMS API bottlenecks at high scale.
Envelope encryption performs encryption in hardware memory at line speed, bypassing network KMS calls per row.
Generates one data key per batch/session, saving thousands of dollars in direct KMS API request fees.
Customer Master Keys never leave KMS, providing centralized key rotation and revocation.
How do you protect your data in transit?
Enforce TLS 1.3 across all public boundaries and implement mutual TLS (mTLS) between microservices.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Redirect all HTTP traffic to HTTPS with modern TLS cipher suites.
Authenticate and encrypt service-to-service communication via Service Mesh.
TLS 1.3 cuts the handshake round-trip time (1-RTT) in half compared to TLS 1.2.
Zero cost for certificates managed by AWS Certificate Manager (ACM).
ACM handles automated certificate renewal with zero downtime.
How do you anticipate, respond to, and recover from incidents?
Automate compromised resource isolation (e.g. quarantining infected instances via security group swap).
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Automate instance quarantine and forensic snapshotting via EventBridge and Lambda.
Automated isolation stops lateral movement in seconds.
Minimizes data breach liability.
Codified incident response prevents frantic manual mistakes during breaches.
How do you incorporate and validate the security properties of applications throughout the lifecycle?
Run static code analysis (SAST) and software composition analysis (SCA) in automated build gates.
Recommended Answers (Official AWS Best Practices Checklist)
Every best practice below is an official answer to incorporate into your system design:
Block builds that introduce critical CVEs or insecure dependencies.
Catches vulnerable libraries before deployment without runtime overhead.
Fixing security bugs in PR reviews is 100x cheaper than fixing them post-incident.
Shifts security left into standard developer workflow.