How do you design secure VPCs, manage IAM policies, and ensure data encryption at rest and in transit?