Skip to main content

Scenario answers

IAM allow but access is denied​

Evaluate every applicable layer: trust policy, identity policy, resource policy, SCP, permissions boundary, session policy, VPC endpoint policy, and KMS key policy. An explicit deny wins.

Workload uses static access keys​

Replace the keys with a workload role and temporary STS credentials. Rotate and remove the old keys after validating the application.

Delegated developers may create roles​

Use a permissions boundary, controlled role-creation policy, approved trust patterns, and controls preventing boundary removal or privilege escalation.

Encrypting S3 data with a customer-managed key​

The caller and S3 service path must be permitted by IAM and the KMS key policy. Test upload, read, replication, backup, and recovery paths.

Public or cross-account resource access​

Use IAM Access Analyzer to identify external access, validate whether it is intended, and modify the resource or identity policy. Archive only documented intended findings.

High-severity GuardDuty finding​

Validate the resource and account, preserve evidence, contain with scoped reversible actions, rotate compromised credentials if required, investigate related activity, and verify recovery.

Inspector vulnerability in a container image​

Prioritize by severity, exploitability, reachability, workload exposure, and available fix. Rebuild the image from a patched base, scan, redeploy, and retire vulnerable tasks.

Security Hub finding automation​

Normalize and enrich the finding, verify current state and exceptions, route by severity and owner, and use bounded remediation with approval for high-risk actions.