1) IAM: permissions and access control for every API call. Least-privilege policies, role-based access, never long-lived keys. 2) VPC: your private network with subnets, security groups, NAT gateways. 3) CloudWatch: metrics, logs, alarms, dashboards. These three are non-negotiable -- everything else builds on them.