India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
AWS Security, IAM & Identity Center Services in India
AWS Security & Identity is the set of AWS services that controls who can access cloud resources, encrypts data, filters hostile traffic and detects threats across accounts. NTSPL designs and runs this layer for Indian companies, from IAM Identity Center and service control policies to KMS, WAF, GuardDuty and Security Hub, mapped to DPDP Act, RBI and CERT-In obligations.
AWS services in scope
The Problem AWS IAM Identity Center and AWS Organizations with SCPs and RCPs Solve
Most AWS breaches we investigate in India do not start with an exotic exploit. They start with a long-lived IAM access key committed to a Git repository, a root user without MFA, an S3 bucket opened for a vendor demo and never closed, or a login API that lets a botnet try 40,000 passwords an hour. The underlying problem is that identity, encryption and detection grow account by account, team by team, with no organization-wide guardrails. By the time a CERT-In reportable incident occurs, nobody can say within six hours which principal did what, in which account, with which key.
NTSPL treats security as an account-structure and identity problem first, and a tooling problem second. We build an AWS Organizations hierarchy with separate security, log-archive and workload accounts, move every human to IAM Identity Center with short-lived credentials, and enforce non-negotiables through service control policies and resource control policies. Only then do we switch on GuardDuty, Inspector and Security Hub across all accounts in Mumbai and Hyderabad, tuned so that the findings queue is something your team can actually clear each week.
When You Need an AWS Security and Identity Baseline (and When You Do Not)
Signals that point to security & identity on AWS
- IAM credential reports show access keys older than 90 days or root users without hardware MFA in any account.
- You are preparing for a DPDP Act readiness review, an RBI cyber security inspection, a SEBI CSCRF audit or an ISO 27001 surveillance audit with AWS in scope.
- Login or OTP endpoints show bursts of failed authentications from thousands of IPs, or a past event (results day, sale, IPO allotment) took the site down.
- More than five AWS accounts exist with no central CloudTrail organization trail, no delegated security account and no consistent region restriction.
- A vendor or internal team has been given broad AdministratorAccess to production because finer permissions were 'too slow to set up'.
- Your incident response plan cannot show how you would gather evidence and notify CERT-In within six hours of detecting a cloud incident.
When a different approach is better
- If you run a single small account with one or two admins and a static website, a full Organizations landing zone is overkill; enable MFA, Shield Standard via CloudFront, S3 Block Public Access and GuardDuty, and revisit when you add accounts.
- If your primary need is endpoint and email security for laptops and Microsoft 365, AWS security services will not cover it; that belongs with your EDR and Microsoft Defender or equivalent stack, with only log integration into AWS.
- If you need a full managed SOC with threat hunters, AWS services alone are not a SOC; pair Security Hub and GuardDuty with an MSSP or a SIEM such as Amazon OpenSearch Service security analytics or your existing SIEM.
AWS Security Building Blocks: IAM Identity Center, SCPs, KMS, WAF, GuardDuty and Security Hub
| Service | Role in the architecture | Choose it when |
|---|---|---|
| AWS IAM Identity Center | Federates your workforce directory (Microsoft Entra ID, Google Workspace or Okta) into every AWS account through permission sets that issue short-lived role credentials instead of IAM users. | You have more than three AWS accounts or more than ten engineers still logging in with IAM users and static access keys. |
| AWS Organizations with SCPs and RCPs | Service control policies cap what principals in member accounts can do, and resource control policies cap who can reach resources such as S3 buckets and KMS keys, regardless of the IAM policies inside each account. | You need hard guarantees such as 'no workload may run outside ap-south-1 and ap-south-2' or 'nobody may disable CloudTrail', enforced even against account administrators. |
| AWS KMS and AWS Secrets Manager | KMS holds customer managed keys that encrypt EBS, RDS, S3 and backups with key policies separating key administrators from key users, while Secrets Manager stores and rotates database credentials and API tokens. | Auditors ask who can decrypt patient or customer data, or your applications still read database passwords from config files or environment variables. |
| AWS WAF and AWS Shield | WAF inspects HTTP requests at CloudFront, ALB and API Gateway using managed rule groups, rate-based rules, Bot Control and account takeover prevention, while Shield absorbs network and transport layer DDoS floods. | Your public login, OTP or results endpoints see traffic spikes, credential stuffing or scraping that your application servers cannot distinguish from real users. |
| Amazon GuardDuty | Continuously analyses CloudTrail management and data events, VPC Flow Logs and DNS logs, plus optional runtime monitoring for EKS, ECS and EC2, to raise findings such as credential exfiltration or crypto-mining. | You have no 24x7 view of anomalous API calls, and would currently learn of a compromised access key from your AWS bill. |
| AWS Security Hub and Amazon Inspector | Security Hub aggregates findings and posture checks (Security Hub CSPM controls against AWS Foundational Security Best Practices and CIS benchmarks) across accounts, while Inspector scans EC2, container images in ECR and Lambda functions for CVEs. | Each team runs its own scanner and spreadsheet, and the CISO cannot produce one prioritized list of misconfigurations and vulnerabilities per business unit. |
Federated identity, edge filtering and delegated detection across an AWS Organization
Federated identity, edge filtering and delegated detection across an AWS Organization
Users authenticate against the corporate IdP, receive short-lived role credentials from IAM Identity Center and reach workloads that sit behind CloudFront, WAF and Shield. Every API call and finding flows into a dedicated log-archive account and a delegated security account, where GuardDuty, Security Hub and Inspector results are triaged and routed to responders.
Select any component
Federated identity, edge filtering and delegated detection across an AWS Organization: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Security Engineering Decisions: OU Design, SCP Strategy, Key Management and WAF Thresholds
Account and OU structure before any tooling
We separate Security (delegated admin for GuardDuty, Security Hub, Inspector, Access Analyzer), Log Archive, Shared Network and per-environment workload OUs. Production and non-production never share an account, because IAM boundaries inside one account are far weaker than account boundaries. Use AWS Control Tower if you want managed account vending and drift detection; choose a custom Organizations build only when you already run Terraform pipelines and need OU designs that Control Tower guardrails would fight. Either way, the management account runs no workloads.
SCP strategy: deny lists, not allow lists
Keep FullAWSAccess attached and layer explicit deny SCPs: region restriction with exemptions for global services such as IAM, CloudFront and Route 53; deny leaving the organization; deny root user actions; deny deletion of CloudTrail, Config and GuardDuty detectors. Allow-list SCPs break whenever a team adopts a new service. SCPs are limited to 5,120 characters each and five per target, so we consolidate statements and exempt only the pipeline role via aws:PrincipalArn. Resource control policies then block access to your S3 and KMS resources from outside the organization.
Key management model for regulated data
Default AWS managed keys are acceptable for low-sensitivity logs, but personal and financial data should use customer managed KMS keys so you control key policy, rotation and the ability to revoke access instantly by disabling a key. Use multi-Region keys only where data must be decrypted in both Mumbai and Hyderabad for DR. Choose CloudHSM or the KMS external key store only when a regulator or contract demands single-tenant HSMs or keys held outside AWS; both add latency, cost and operational burden that most Indian fiduciaries do not need.
WAF rule design for login and OTP endpoints
Apply the account takeover prevention managed rule group only to the login path, because it is priced per request analysed. Pair it with a rate-based rule keyed on the username field at around 10 attempts per 5 minutes, and an IP rate limit at 300 to 1,000 requests per 5 minutes depending on NAT-heavy mobile carriers. Indian mobile users often share carrier-grade NAT addresses, so pure IP limits block real students and customers; aggregate keys on headers or tokens reduce that collateral damage.
Finding triage and CERT-In clock
A Security Hub queue with 4,000 open findings is useless. We suppress controls that do not apply, auto-close Inspector findings once a patched AMI is deployed, and route only critical and high findings on production-tagged resources to the on-call channel. For CERT-In's six-hour reporting window, we pre-build an evidence runbook: Athena queries over CloudTrail logs for the affected principal, GuardDuty finding export, and a reporting template, so the clock is spent on decisions rather than log hunting.
How NTSPL Rolls Out a Multi-Account AWS Security Baseline
IAM credential and CloudTrail audit
Pull credential reports and 90 days of CloudTrail from every account to map each IAM user, access key and role to actual usage before anything is changed.
Organization and OU build
Create or adopt AWS Organizations with Security, Log Archive and workload OUs, register the delegated administrator account and enable the organization CloudTrail trail with Object Lock.
Identity Center federation waves
Connect the IdP via SAML and SCIM, publish permission sets, migrate human users team by team and deactivate old keys after 14 days of zero use.
SCP and RCP promotion
Test region-deny, logging-protection and organization-boundary policies in a sandbox OU, then promote to non-production and finally production OUs with an exemption register.
Detection enablement and tuning
Enable GuardDuty, Inspector, Access Analyzer and Security Hub organization-wide with auto-enable, then spend two weeks suppressing inapplicable controls and setting EventBridge routing.
Edge protection and incident drill
Deploy WAF web ACLs in Count mode, move to Block after review, and run a tabletop drill that produces a CERT-In-format report from real CloudTrail and GuardDuty evidence.
What you receive
Defending the Control Plane: Stopping Credential Misuse and Logging Tampering
The threat model here is credential misuse and control tampering rather than server compromise alone. An attacker with a stolen access key will try to disable CloudTrail, create new IAM users, exfiltrate S3 data or spin up GPU instances. So controls must work even when an account administrator is the adversary: SCPs that cannot be overridden from inside an account, a log archive that member accounts cannot write-delete, and detections that fire on the tampering attempt itself.
- Deny SCP on cloudtrail:StopLogging, guardduty:DeleteDetector and config:StopConfigurationRecorder so an intruder cannot blind you
- IAM Access Analyzer unused-access findings to remove roles and permissions not used for 90 days
- S3 Block Public Access enforced at organization level plus RCPs denying non-organization principals
- KMS key policies separating kms:Decrypt users from key administrators, with alerts on ScheduleKeyDeletion
- GuardDuty findings for credential exfiltration, where instance role keys are used from outside AWS
AWS Security Pricing: GuardDuty Event Volume, WAF Requests, KMS API Calls and Shield Advanced
Security tooling bills on volume, not on seats. GuardDuty charges per million CloudTrail events and per GB of flow and DNS logs analysed, Security Hub per control check and finding ingested, Inspector per scanned instance and image, WAF per web ACL, rule and million requests, and KMS per key per month plus API calls. A noisy batch job calling S3 and KMS millions of times can quietly double detection cost.
- Use S3 Bucket Keys to cut KMS request charges on high-volume buckets by up to 99 percent
- Scope WAF Bot Control and account takeover prevention rules to login and checkout paths only, not static assets
- Use GuardDuty's usage statistics to find accounts where S3 data events dominate cost and tune protection plans
- Disable Security Hub CSPM controls that duplicate your Config rules or do not apply, reducing per-check charges
- Weigh Shield Advanced's flat monthly fee against expected DDoS impact and cost protection; it pays off for revenue-critical public apps
AWS-native security services vs third-party CNAPP: which should an Indian mid-size company choose?
Start AWS-native if more than 80 percent of your cloud estate is AWS. GuardDuty, Security Hub, Inspector and Access Analyzer are enabled organization-wide in a day, bill by usage, keep findings and logs inside Indian regions, and need no agents for most detections. Choose a third-party CNAPP when you run material workloads on Azure or GCP too and need one risk graph across clouds, or when you need attack-path analysis and code-to-cloud tracing beyond what Security Hub's exposure findings provide. Cost model matters: CNAPPs usually license per workload or per resource with annual commitments, while AWS-native costs scale with API and log volume. Many Indian enterprises end up hybrid: AWS-native detection as the always-on baseline, with the CNAPP or SIEM consuming Security Hub findings.
Key facts about security & identity on AWS
Security & Identity on AWS in Practice
3 security & identity scenarios from Health-tech SaaS, Banking (urban cooperative bank), Higher education: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Health-tech SaaS moves patient data behind KMS and Identity Center ahead of DPDP
Urban cooperative bank maps AWS controls to RBI cyber security framework levels
University keeps results day online through DDoS and 1.2 million credential-stuffing tries
Wealth firm's research assistant cuts RM client-prep time from 50 to 12 minutes
Multi-specialty hospital cuts HIS recovery time from 2 days to 38 minutes
FMCG distributor lifts DMS patch compliance from 41% to 97% and passes audit
Security & Identity on AWS: Frequently Asked Questions
How much do GuardDuty, Security Hub and WAF typically cost for a mid-size AWS estate?
For an estate of 15 to 25 accounts with moderate traffic, organization-wide GuardDuty, Security Hub and Inspector typically land between INR 60,000 and 2.5 lakh per month, and WAF between INR 15,000 and 80,000 per web ACL depending on request volume and Bot Control use. GuardDuty and Security Hub include 30-day free trials per account, which we use to measure real cost before committing.
We have dozens of IAM users with access keys. How do we migrate to IAM Identity Center without breaking things?
Migrate in waves, humans first. We connect your IdP, create permission sets that mirror current access, and move teams one at a time while CloudTrail confirms each old access key goes unused for 14 days before deactivation. Machine access keys are replaced with IAM roles for EC2, ECS and Lambda, or IAM Roles Anywhere for on-premises servers. Keys are deactivated, not deleted, for a fortnight so rollback is one click.
Does this help us comply with the DPDP Act 2023 and the DPDP Rules?
It covers the technical safeguards part, not the whole Act. The DPDP Rules, notified in November 2025, expect reasonable security safeguards such as encryption, access control, logging for detecting unauthorized access, and the ability to investigate and report breaches. Customer managed KMS keys, Identity Center access reviews, CloudTrail with retained logs and GuardDuty detections give you evidence for those safeguards. Consent, notices and data principal rights still need application and process work.
Can AWS controls meet the CERT-In requirement to report incidents within six hours?
AWS gives you the evidence; meeting six hours is a process outcome. CERT-In's April 2022 directions require reporting specified incidents within six hours of noticing them and keeping logs for 180 days within Indian jurisdiction. We store CloudTrail and VPC Flow Logs in a Mumbai log-archive bucket with Object Lock, alert on GuardDuty high-severity findings in near real time, and rehearse an evidence-gathering runbook so the report can be filed with facts.
Do we need AWS Shield Advanced, or is Shield Standard enough?
Shield Standard is free and automatic, and it handles most common network and transport layer floods. Shield Advanced costs USD 3,000 per month per organization on a one-year commitment plus data transfer, and adds application-layer DDoS mitigation with WAF, the Shield Response Team, health-based detection and cost protection for scaling charges during an attack. It is worth it for revenue or reputation-critical public applications with a history of attacks.
Can we keep all security logs and keys inside India?
Yes. We restrict workloads to ap-south-1 and ap-south-2 using a region-deny SCP, configure Security Hub aggregation and the CloudTrail log archive in Mumbai, and create KMS keys only in Indian regions. A few global services such as IAM, CloudFront and Route 53 have control planes outside India, which we document for auditors, but your log data and encrypted content stay in-country.