AWS security and FinOps glossary: 30 terms explained

Identity and access

IAM (Identity and Access Management)

The AWS service that decides who can do what. It manages users, groups, roles and policies (JSON documents that allow or deny actions on resources). Every AWS API call goes through an IAM evaluation.

Least privilege

The principle of granting only the permissions a task strictly needs. On AWS it means named actions and resources rather than * wildcards, and removing unused permissions. A policy with "Action": "*" on "Resource": "*" is its exact opposite.

MFA (multi-factor authentication)

A second factor required at sign-in on top of the first one: TOTP app, FIDO2 key or hardware key. The CIS AWS Foundations Benchmark requires it for the root account and for every IAM user with console access.

Cross-account role and External ID

An IAM role that another AWS account can assume (sts:AssumeRole) to get temporary credentials, with no shared access key. The External ID is a value known only to the two parties and required by the role's trust policy: it stops a third party from abusing the provider to reach the account (the "confused deputy" problem).

SCP (Service Control Policy)

An AWS Organizations policy that sets the maximum permissions available in the accounts of an organizational unit. An SCP grants nothing: it caps what IAM policies can allow, for example forbidding leaving the organization or using a region. It does not apply to the management account.

IAM Access Analyzer

A service that detects resources shared outside the account or organization: S3 bucket, IAM role, KMS key, Lambda function, SQS queue and more. External access analysis is free; unused access analysis is paid.

Detection and standards

Shared responsibility model

How security duties split between AWS and its customer: AWS secures the cloud itself (data centers, hardware, hypervisor, managed services), the customer secures what they put in the cloud (identities, configuration, data, encryption, network). A configuration audit covers the customer's share only.

AWS CloudTrail

The log of AWS API calls: who did what, when, from which address. Management event history is kept for 90 days; beyond that you need a trail writing to an S3 bucket, ideally multi-region, encrypted and with log file integrity validation.

AWS Config

The service that records the configuration state and history of resources, and evaluates it continuously against rules (for example: EBS volume encrypted, bucket not public). Where CloudTrail says who changed a resource, Config says what it looked like before and after.

AWS Security Hub

The console that aggregates security findings (GuardDuty, Inspector, Access Analyzer, Config) and checks the account against standards: FSBP, CIS, PCI DSS, NIST SP 800-53. AWS has called this part Security Hub CSPM since 2025. The service fixes nothing by itself.

Amazon GuardDuty

The threat detection service: it analyzes CloudTrail events, VPC Flow Logs and DNS queries to spot suspicious behavior, such as a call from a known malicious address, cryptocurrency mining or data exfiltration.

Amazon Inspector

The AWS vulnerability scanner: it looks for known CVEs in the packages of EC2 instances, ECR container images and Lambda functions, and flags instances reachable from the internet.

FSBP (AWS Foundational Security Best Practices)

The AWS security standard in Security Hub: more than 200 controls, service by service, added to continuously. It complements CIS, which is narrower but independent: see FSBP or CIS, which one to enable.

CIS AWS Foundations Benchmark

An AWS account hardening benchmark published by the Center for Internet Security, in five sections: IAM, storage, logging, monitoring, networking. Version 5.0 is the latest supported by Security Hub: see the CIS AWS v5.0 guide.

CVE (Common Vulnerabilities and Exposures)

The public identifier of a software vulnerability, in the form CVE-2026-12345, usually paired with a CVSS severity score. Knowing which resources of an account a critical CVE affects means matching installed versions with exposure: that is what the CVE watch does.

DAST (dynamic application security testing)

Testing a running web application from the outside, as a visitor would: security headers, cookies, error pages, software versions on display. It complements configuration analysis, which cannot see what the application actually returns.

Kill chain (attack path)

The sequence of steps an attacker would follow to reach a goal: initial access, privilege escalation, lateral movement, exfiltration. Reasoning in kill chains shows how medium findings taken one by one become critical once combined, and which fix breaks the most paths at once.

Where these terms show up in the audit

• The terms in the first three parts frame the AWS security audit: each finding cites the FSBP or CIS control involved and the resource at fault (ARN).
• The FinOps terms frame the AWS FinOps audit: each action prices the expected monthly saving.
• Kill chains connect the two: they prioritize the fixes that break the most attack paths.

Where does your AWS account stand?

Ten questions, three minutes, no access to your account: a security score, a FinOps score and the article to read for each of your three weakest points. Your answers stay in your browser.