Compute Security

• Use EC2 Image Builder pipelines to ship pre-hardened golden images
• Bake the SSM Agent and patches into the image, not on first boot
• Give EC2 its role through an instance profile, never an embedded access key
• Match the role attachment to the compute type: instance profile, execution role, task role
• Require IMDSv2 to block SSRF theft of instance role credentials
• Use IAM Roles Anywhere so on-prem workloads stop using long-lived keys
• Amazon Inspector continuously scans EC2, ECR images, and Lambda for CVEs
• Read the Inspector Risk score as environment-adjusted CVSS, and export an SBOM
• GuardDuty Runtime Monitoring detects threats on EC2, ECS, and EKS at runtime
• Patch Manager applies fixes on a baseline during a maintenance window
• Session Manager gives a logged shell with no inbound port or bastion
• EC2 Instance Connect pushes a one-time SSH key valid for 60 seconds
• Scan in the pipeline with Q Developer and CodeGuru Security to shift left
• Bedrock Guardrails defend generative-AI apps against the OWASP LLM Top 10
• Map Bedrock Guardrails filter categories to the specific LLM risk
• AWS patches the Fargate and Lambda substrate; you own the dependencies
• ECS injects secrets at startup with the task execution role, not the task role
• Secrets injected as ECS env vars are frozen at startup until you redeploy or fetch via SDK
• ApplyGuardrail evaluates content with no model call, and InvokeModel-with-guardrail needs bedrock:ApplyGuardrail
• Bedrock guardrails are edited on a mutable DRAFT and pinned in production by published version
• Bedrock model-invocation logging needs a service-role and S3 for large or binary payloads

Unlock with Premium — includes all practice exams and the complete study guide.