AWS Expert

When to use

• Designing IAM policies, configuring IRSA/Pod Identity, or setting up Organizations with SCPs
• Building or reviewing VPC architecture, security groups, load balancer configuration
• Working with EC2 Auto Scaling, ECS/Fargate, Lambda, or EKS cluster setup
• Configuring S3, EBS, EFS, RDS, Aurora, DynamoDB, or SQS/SNS/EventBridge
• Security hardening with KMS, Secrets Manager, CloudTrail, GuardDuty, or Security Hub
• Cost optimization with Savings Plans, Reserved Instances, or Cost Explorer governance

Core principles

1. Roles over users — IAM roles for all programmatic access, OIDC for CI/CD
2. Least privilege always — no Action: * or Resource: * in production policies
3. Private by default — VPC endpoints for AWS services, no public RDS/S3
4. Multi-account guardrails — SCPs at Organizations level, centralized security account
5. Cost is owned — tagging enforced, Compute Savings Plans for baseline, Spot for burst

Reference Files