AWS SAA · Domain 1
Design Secure Architectures
About 30% of the exam
Shared responsibility for architects
AWS owns
- Regions, zones and physical security
- Hardware and the hypervisor
- Managed service patching and durability
- Isolation between tenants
You own
- Identity, permissions and network rules
- Data classification and encryption
- Operating system on your instances
- Who you share resources with
Shifts with abstraction
- EC2 leaves the guest to you
- RDS hands the engine to AWS
- Lambda leaves code and permissions
- SaaS leaves only your data
The more managed the service, the less of the stack you configure, but data and access always remain yours
IAM for architects
- IAM role
- temporary credentials, nothing to leak
- Instance profile
- role attached to an instance
- Identity policy
- attached to user, group, role
- Resource policy
- attached to bucket, queue, key
- Explicit deny
- overrides any allow present
- Service control policy
- a ceiling, never a grant
- Access key
- last resort, rotate often
- MFA on root
- first task in a new account
Federation and directories
- SAML federation avoids per-user IAM accounts
- IAM Identity Center for workforce access
- Cognito user pools authenticate app users
- Cognito identity pools hand out credentials
- OIDC federation for build pipelines
- IAM Roles Anywhere for on-premises servers
- Break glass accounts stay MFA protected
Organizations and accounts
- One account per blast radius
- Organizational units group similar accounts
- Service control policies set the ceiling
- Consolidated billing across every member
- Control Tower builds the landing zone
- Account Factory applies the baseline
Network segmentation basics
- Public subnets hold only load balancers
- Application and database tiers stay private
- Security groups reference each other
- Network ACLs give a coarse deny
- One NAT gateway per Availability Zone
- Bastions replaced by Session Manager
Edge protection
CloudFront
- Caches close to the viewer
- Redirect HTTP to HTTPS
- Origin access control hides the bucket
- Signed URLs for private content
AWS WAF
- Managed rules for common exploits
- Rate based rules for floods
- Attach to CloudFront, ALB, API Gateway
- Count first, then block
Shield
- Standard protects every account already
- Advanced adds DDoS cost protection
- Response team for large events
- Elastic IP addresses can be protected
S3 security defaults
- New buckets are private by default
- Block Public Access at account level
- Object Ownership can disable ACLs
- Bucket policy for cross-account access
- Presigned URLs give timed access
- Versioning plus MFA Delete resists deletion
- Object Lock for write once storage
Encryption choices
- SSE-S3
- AWS keys, nothing to manage
- SSE-KMS
- your key, auditable usage
- SSE-C
- you supply the key each call
- Client-side
- encrypted before it leaves you
- EBS encryption
- set a Region wide default
- RDS encryption
- chosen when the instance is created
- In transit
- TLS everywhere, enforced by policy
- Key custody
- customer managed key when audited
Secrets and certificates
- Secrets Manager rotates database credentials
- Parameter Store holds plain configuration
- SecureString parameters encrypt with KMS
- Certificate Manager issues and renews certificates
- Private certificate authority for internal names
- Never hard code credentials anywhere
Private connectivity to services
- Gateway endpoint
- S3 and DynamoDB, route entry
- Interface endpoint
- private interface for most services
- PrivateLink
- expose your own service privately
- VPC peering
- two VPCs, not transitive
- Transit Gateway
- many VPCs through one hub
- Site-to-Site VPN
- encrypted over the public internet
- Direct Connect
- dedicated circuit, consistent latency
- Client VPN
- remote workers reach the VPC
If a private subnet needs an AWS service, reach for an endpoint before you reach for a NAT gateway
Application layer identity
- API Gateway authorizers check the caller
- Cognito authorizer validates the token
- Lambda authorizer for custom logic
- Mutual TLS verifies client certificates
- Resource policy limits calling accounts
- Usage plans and keys throttle partners
Detective controls a design needs
- CloudTrail on in every Region
- Config records configuration drift
- GuardDuty for account level threats
- Security Hub as the single queue
- Flow Logs for network forensics
- Access logs on load balancers
Common insecure designs
Exposure
- Database sitting in a public subnet
- Security group open to everywhere
- Bucket made public for convenience
Credentials
- Access keys baked into the image
- Secrets in environment variables
- One shared administrator user
Blind spots
- No trail in the new Region
- Logs stored in the same account
- No alarm on root sign-in
Service names to know
- Workforce sign-on
- IAM Identity Center
- App sign-up and sign-in
- Amazon Cognito
- Managed certificates
- AWS Certificate Manager
- Rotating credentials
- AWS Secrets Manager
- Web exploit filtering
- AWS WAF
- Sensitive data in S3
- Amazon Macie
- Threat findings
- Amazon GuardDuty
- Policy across accounts
- AWS Firewall Manager
Know the order
- Identity
- Network boundary
- Resource policy
- Encryption
- Logging
Design the identity first, then the boundary, then the data protection, and never lean on obscurity
Reference strip: identity, boundaries, data, secrets, assurance
Identity
- Roles over long-lived keys
- Federation for humans
- MFA on privileged access
- Least privilege from the start
Boundaries
- Private subnets by default
- Security groups referencing each other
- Endpoints instead of internet paths
- WAF and Shield at the edge
Data
- Encrypt at rest and in transit
- Customer managed keys when audited
- Block Public Access account wide
- Object Lock for retention
Secrets
- Secrets Manager for credentials
- Parameter Store for configuration
- Certificate Manager for TLS
- No secrets in code
Assurance
- CloudTrail, Config and GuardDuty
- Security Hub for one view
- Flow Logs and access logs
- Alarms with a named owner
Quick exam traps
- Trap: A security group can deny a specific address range
- Trap: S3 buckets are public until you lock them down
- Trap: An SCP grants permissions to the accounts it targets
- Trap: Encryption in transit is unnecessary inside a VPC
- Trap: A NAT gateway lets private instances accept inbound connections
- Trap: CloudTrail is already enabled for every Region in every account
- Trap: Cognito user pools hand out AWS credentials directly
cybercertprep.com · original revision sheet written from the public body of knowledge