If the user is going to specify an IP range in RDS security group, AWS recommends using the private IP
address of the Amazon EC2 instance. This provides a more direct network route from the Amazon EC2
instance to the Amazon RDS DB instance, and does not incur network charges for the data sent outside
of the Amazon network.
Reference:
http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithSecurityGroups.html

AWS IAM allows an organization to create multiple users and provide them access to various AWS
services. By default when the user is created, he does not have password enabled and can not login to
AWS console. If the organization wants to allow the users to login to AWS console, they can enable
password for each user. It is required that IAM users follow certain guidelines to set their IAM login
password. For this IAM provides root account owner to setup passwrod policy. The password policy also
lets the specify whether all IAM users can change their own passwords. As part of policy, organization can
specify that passwords for IAM users must be of a certain minimum length, must include certain
characters, and a few more criteria such as below.
One upper / lower or both letters
One alpha numeric
One number
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingPasswordPolicies.html

Every Amazon SQS queue has a configurable visibility timeout. For the designated amount of time after a
message is read from a queue, it will not be visible to any other reader. As long as the amount of time that
it takes to process the message is less than the visibility timeout, every message will be processed and
deleted. In the event that the component processing the message fails or becomes unavailable, the
message will again become visible to any component reading the queue once the visibility timeout ends.
This allows you to have many components all reading messages from the same queue, with each working
to process different messages.
Reference: https://aws.amazon.com/sqs/faqs/

Explanation
https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-y