Securing Compute Workloads

Everything that runs your code: golden AMIs and hardened container images built by pipeline, the three role shapes that authorize a workload, IMDSv2, Inspector versus GuardDuty Runtime Monitoring, Patch Manager against immutable rebuilds, Session Manager instead of SSH keys, and guardrails for pipelines and generative-AI applications.

Content current as of 2026-10.

Lessons

1. Hardened AMIs and container images
2. Instance profiles, service roles, execution roles
3. Finding vulnerabilities
4. Patching at scale
5. Administrative access without SSH keys
6. Pipeline scanning and GenAI guardrails

Sources

• SCS-C03 exam guide — Content Domain 3 (tasks 3.1–3.3)
• EC2 Image Builder — recipes, components, and pipelines
• Use IMDSv2 — Amazon EC2 user guide
• Scanning Amazon EC2 instances with Amazon Inspector (scan modes)
• AWS Systems Manager Patch Manager
• AWS Systems Manager Session Manager
• OWASP Top 10 for Large Language Model Applications