Security use cases
A catalogue of practical security use cases across the five Well-Architected security epics. Use it as a checklist when designing an engagement's security scope.
01 — Identity and access management
Objective. Manage identities and permissions at scale so the right people and machines have access to the right resources under the right conditions.
Design principles: centralise the identity provider; use groups and attributes for fine-grained access; use temporary credentials; enforce strong sign-in such as MFA; set permissions to specific actions on specific resources under specific conditions; use permissions boundaries and SCPs; adopt attribute-based access control so policies scale; continuously validate that policies still protect what they were written to protect.
| Use case | What it means in practice |
|---|---|
| Keep AWS policies and practices up to date | Every process has a documented, versioned owner; the document changes when the process does |
| Configure a password policy | Align with the organisation's standard; enforce length, complexity and reuse rules; rotate and retire credentials |
| Centralise identity | Identity Center or an external IdP; no local IAM users for people |
| Use temporary credentials | Roles and OIDC for humans and machines; access keys are an exception with a rotation policy |
| Apply least privilege | Specific actions on specific resources; no */*; permissions boundaries where delegation is needed |
| Validate permissions continuously | IAM Access Analyzer and unused-permission findings drive policy changes |
| Adopt ABAC where it scales | Tag-based conditions instead of per-resource policy edits |
02 — Infrastructure protection
Objective. Protect systems against unintended and unauthorised access and against vulnerabilities, using defence in depth.
Design principles: create network layers and place workloads with no internet requirement in private subnets; use security groups, NACLs and network firewalls; apply zero trust according to the value of the asset; use VPC endpoints for private connectivity; inspect and filter traffic at each layer; use hardened images; secure any hybrid infrastructure physically.
| Use case | What it means in practice |
|---|---|
| Deploy AWS Network Firewall | Stateful inspection at the VPC perimeter — ingress, egress, and over VPN or Direct Connect |
| Segment by subnet | Public subnets for load balancers; private subnets for application and data |
| Use VPC endpoints | S3, ECR, CloudWatch, Secrets Manager reachable without traversing the internet |
| Harden images | CIS-aligned builds produced by the Packer pipeline, not hand-configured |
| Require IMDSv2 | Enforced by SCP to remove metadata credential theft |
| Filter egress | Domain allow-lists for environments that do not need open internet |
| Apply WAF on public endpoints | Managed rule groups plus custom rules for the application's abuse patterns |
03 — Threat detection
Objective. Identify misconfigurations, threats and unexpected behaviour quickly enough to respond.
Design principles: monitor ubiquitously; correlate across network, OS, application and database sources; agree tactical, operational and strategic intelligence goals; use deception where it adds signal.
| Use case | What it means in practice |
|---|---|
| Delete abandoned objects | Retention policies remove stale data and the cost and exposure that come with it |
| Track who changes resources | CloudTrail across all accounts and regions, centralised and alarmed |
| Patch managed nodes | Systems Manager patch compliance; patch baselines by environment |
| Implement a virtual SOC | Control Tower, Security Hub, GuardDuty and centralised logging as the detection foundation |
| Correlate findings | Security Hub aggregation; EventBridge routing to the owning team |
| Detect credential misuse | GuardDuty findings with automated containment |
| Monitor anomalies | Cost anomaly detection, GuardDuty anomaly findings, Config drift |
04 — Data protection
Objective. Protect data at rest and in transit, and manage the keys that protect it.
Design principles: classify data and apply controls according to classification; encrypt by default; separate key administration from key use; limit access to the data to the people and services that need it; retain only as long as required.
| Use case | What it means in practice |
|---|---|
| Use KMS keys for sensitive data | Separate keys per classification and service boundary; automatic rotation |
| Use TLS 1.2 or higher in transit | Enforced at the load balancer, database connections and file systems |
| Encrypt backups | KMS encryption on backups, snapshots and replicas |
| Manage secrets centrally | Secrets Manager with rotation; no secrets in code or images |
| Control data residency | Region restrictions and a documented data map |
| Classify and tag | DataClassification tag drives retention, access and encryption requirements |
| Protect keys from deletion | Key deletion requires a waiting period and raises an alarm |
05 — Incident response
Objective. Detect, contain, recover and learn — with a rehearsed process rather than an improvised one.
Design principles: prepare access and tooling before an incident; use automation for the deterministic containment steps; preserve evidence; review every incident.
| Use case | What it means in practice |
|---|---|
| Maintain an incident response procedure | Documented roles, escalation, communication and decision rights |
| Automate response with Security Hub | Predefined remediation for common findings, with a human gate where action is destructive |
| Contain compromised credentials | Automatic deactivation or session revocation on a GuardDuty finding |
| Isolate a compromised instance | Replace security groups; snapshot volumes for forensics |
| Preserve evidence | Log archive is immutable; snapshots retained before remediation |
| Practise | Tabletop exercises and a game day that exercises detection through to recovery |
Mapping to standards
| Epic | Primary standards |
|---|---|
| Identity and access management | Identity and SSO, Service control policies |
| Infrastructure protection | Infrastructure protection, Network and encryption |
| Threat detection | Detection, API activity tracking |
| Data protection | Network and encryption, Security best practices |
| Incident response | Runbooks, Security best practices |