Zero-trust S3 architecture isolates an Application Server (t3.medium) in a private subnet with no internet gateway, enforcing encrypted access through a VPC Gateway Endpoint. The IAM Role grants least-privilege access to an S3 Bucket encrypted with a KMS Customer Managed Key, while a bucket policy explicitly denies all requests except from the app role and blocks public access entirely. Security Hub aggregates findings from GuardDuty threat detection, Macie data classification, AWS Config compliance rules, CloudTrail API audit logs, and Wiz CSPM monitoring to provide unified visibility. Fork this diagram on Diagrams.so to customize IAM policies, add additional VPC endpoints, or integrate your own CSPM tooling for multi-account deployments.