Task 1.1: Design secure access to AWS resources
Answer: AWS is responsible for security "of" the cloud (infrastructure, hardware, software, networking, facilities), while customers are responsible for security "in" the cloud (data encryption, IAM, OS patches, network traffic protection, guest OS).
Answer: Grant users, groups, and roles only the minimum permissions necessary to perform their job functions. Start with no permissions and gradually add only what's needed, regularly review and remove unnecessary permissions.
- Users: Individual identities for people/applications
- Groups: Collections of users with shared permissions
- Roles: Temporary credentials that can be assumed by users, services, or external identities for specific tasks
Answer: AWS Security Token Service provides temporary security credentials. Used for cross-account access, federation, role switching, and providing temporary access to applications without embedding long-term credentials.
Answer: SCPs are JSON policies that define maximum permissions for accounts in an organization. They act as guardrails, limiting what actions can be performed regardless of IAM permissions within member accounts.
Answer: Centralized identity service that enables single sign-on access to multiple AWS accounts and cloud applications. Integrates with external identity providers and provides centralized permission management.
Answer: Identity policies are attached to users/roles/groups and define what they can do. Resource policies are attached to resources and define who can access them. Use resource policies for cross-account access and when you need resource-centric control.
Answer: Enable MFA in IAM console, choose virtual MFA device, hardware MFA device, or SMS. Scan QR code with authenticator app, enter two consecutive codes to verify. Root user MFA is critical for account security.
Answer: Allows users in one AWS account to access resources in another. Implement using IAM roles with trust policies that allow the external account to assume the role, then attach permission policies to the role.
Answer: Provides pre-configured guardrails, centralized logging, automated account provisioning, and compliance monitoring across multiple AWS accounts using best practices and organizational policies.
Task 1.2: Design secure workloads and applications
Answer: Inbound and outbound rules specifying protocol (TCP/UDP/ICMP), port range, and source/destination (IP addresses, CIDR blocks, or other security groups). Security groups are stateful - return traffic is automatically allowed.
| Feature | Security Groups | NACLs |
|---|---|---|
| State | Stateful | Stateless |
| Level | Instance-level | Subnet-level |
| Rules | Allow rules only | Allow and deny rules |
| Evaluation | Evaluate all rules | Process rules in order |
Answer: Use multiple subnets (public for internet-facing resources, private for internal resources), implement security groups and NACLs, use VPC endpoints for AWS services, and implement proper routing tables.
Answer: Web Application Firewall that protects web applications from common exploits like SQL injection, XSS, and DDoS. Use with CloudFront, ALB, or API Gateway to filter malicious traffic before it reaches your application.
| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Cost | Free DDoS protection | Paid service |
| Protection | Common layer 3/4 attacks | Enhanced protection |
| Support | Basic | 24/7 DDoS Response Team access |
| Additional | - | Cost protection |
Answer: Provides user authentication, authorization, and user management. Supports user pools for authentication, identity pools for authorization, and integrates with social identity providers and SAML.
Answer: Allow private connectivity to AWS services without internet gateway. Interface endpoints use private IP addresses, Gateway endpoints route traffic through route tables. Traffic stays within AWS network, reducing exposure.
- AWS VPN: Encrypted connections over internet
- AWS Direct Connect: Dedicated private connections
- AWS PrivateLink: Private connectivity to AWS services
Answer: Threat detection service using machine learning to monitor for malicious activity and unauthorized behavior. Analyzes VPC Flow Logs, DNS logs, and CloudTrail logs to identify threats.
Answer: Uses machine learning to automatically discover, classify, and protect sensitive data (PII, PHI) in S3. Provides visibility into data security risks and compliance status.
Task 1.3: Determine appropriate data security controls
- Encryption at rest: Data stored on disk
- Encryption in transit: Data moving between systems
- Client-side encryption: Data encrypted before sending to AWS
AWS provides various services like KMS, CloudHSM, and SSL/TLS certificates.
Answer: Key Management Service for encryption key management.
- Customer managed keys: Full control
- AWS managed keys: AWS controls
- AWS owned keys: Used by AWS services
Supports key rotation and policies.
Answer: When you need dedicated hardware security modules for regulatory compliance, want exclusive control over encryption keys, or need to integrate with applications requiring PKCS#11, JCE, or Microsoft CryptoNG libraries.
- Use TLS/SSL certificates (AWS Certificate Manager)
- VPN connections
- AWS PrivateLink
- Application-level encryption
Ensure all communication channels are encrypted end-to-end.
Answer: Service to provision, manage, and deploy SSL/TLS certificates. Provides free certificates for AWS services, automatic renewal, and integration with ELB, CloudFront, and API Gateway.
- Use AWS Backup for centralized backup
- S3 cross-region replication
- RDS automated backups and read replicas
- EBS snapshots
- Implement appropriate retention policies based on compliance requirements
Answer: Rules that automatically transition objects between storage classes or delete them based on age, tags, or other criteria. Helps optimize costs while maintaining data availability and compliance.
- Enable automatic key rotation in KMS (annual rotation)
- Implement manual rotation procedures for customer-managed keys
- Update applications to use new keys
- Maintain audit trails of key usage
Answer: Process of categorizing data based on sensitivity, value, and regulatory requirements. AWS Config and Macie help automate discovery and classification of sensitive data across AWS resources.
- Use S3 lifecycle policies
- RDS automated backup retention
- Implement legal hold capabilities
- Create secure deletion procedures
- Ensure compliance with regulations like GDPR for data retention periods