Security, identity and compliance
Security and compliance are 30% of the exam, the largest weight after technology. Keep the shared responsibility model in mind for every service.
IAM
Identity and Access Management
Controls who can do what in the account: users, groups, roles and policies.
Key points
- Least privilege: grant only the permissions needed.
- Roles give temporary credentials to services, applications and other accounts.
- AWS managed or custom policies, in JSON.
- Protect the root user with MFA and do not use its access keys day to day.
On the exam
Some tasks only the root user can do, such as changing the support plan and closing the account. For everything else, use users or roles with MFA.
IAM Identity Center
AWS IAM Identity Center
Single sign-on (SSO) to many AWS accounts and applications from one central place.
Key points
- Integrates with external identity providers (federation).
- Assigns access per account and per permission set.
- Recommended for managing workforce access in multi-account environments.
On the exam
"Employees sign in once and reach many accounts": IAM Identity Center.
Organizations
AWS Organizations
Centrally manages many AWS accounts, with governance and consolidated billing.
Key points
- Groups accounts into organizational units (OUs).
- SCPs (service control policies) cap what accounts can do.
- Consolidated billing and volume discounts.
On the exam
Prevent accounts from using certain services or Regions: an SCP in Organizations.
KMS
Key Management Service
Creates and manages encryption keys used by AWS services and your applications.
Key points
- Integrated with S3, EBS, RDS and dozens of other services.
- Key usage is logged in CloudTrail.
- CloudHSM provides dedicated HSMs when exclusive control of the hardware is required.
On the exam
Encryption at rest with managed keys: KMS. A dedicated HSM: CloudHSM.
Secrets Manager
AWS Secrets Manager
Stores, rotates and retrieves secrets such as database passwords and API keys.
Key points
- Automatic rotation of credentials.
- Takes passwords out of source code.
- Access controlled through IAM.
On the exam
Store database credentials with automatic rotation: Secrets Manager.
Shield and WAF
AWS Shield and AWS WAF
Protection against DDoS attacks (Shield) and filtering of malicious web requests (WAF).
Key points
- Shield Standard: automatic and free for every customer.
- Shield Advanced: extended protection and a specialized response team.
- WAF: rules against SQL injection, cross-site scripting and bots, on CloudFront, ALB and API Gateway.
- Firewall Manager: manages WAF and Shield rules across accounts.
On the exam
A DDoS attack: Shield. SQL injection or XSS: WAF.
GuardDuty
Amazon GuardDuty
Continuous threat detection from account, network and DNS logs, using machine learning.
Key points
- Analyzes CloudTrail, VPC Flow Logs and DNS logs.
- Detects malicious activity such as crypto mining and compromised credentials.
- No agents or infrastructure required.
On the exam
Intelligent threat detection and anomalous behavior: GuardDuty.
Inspector
Amazon Inspector
Automated vulnerability management for EC2 instances, container images and Lambda functions.
Key points
- Scans for known software vulnerabilities (CVEs).
- Detects unintended network exposure.
- Prioritizes findings by risk.
On the exam
Vulnerabilities in EC2, containers and Lambda: Inspector.
Macie
Amazon Macie
Discovers and protects sensitive data in Amazon S3 using machine learning.
Key points
- Identifies personal (PII) and financial data.
- Evaluates bucket security and access.
- Generates findings for investigation.
On the exam
Find personal data (PII) in S3 buckets: Macie.
Security Hub
AWS Security Hub
A central view of security posture, bringing together findings from many services.
Key points
- Aggregates findings from GuardDuty, Inspector, Macie and partners.
- Checks compliance with standards and best practices.
- Prioritizes and automates response.
On the exam
"A single view of security alerts from many services": Security Hub.
Artifact
AWS Artifact
A self-service portal for AWS compliance reports and agreements.
Key points
- On-demand audit reports (ISO, SOC, PCI).
- Accept agreements such as the BAA for health data.
- Free.
On the exam
"An auditor asked for AWS compliance reports": Artifact.
Cognito
Amazon Cognito
Sign-up, sign-in and access control for the users of your web and mobile apps.
Key points
- Social (Google, Facebook, Apple) and enterprise (SAML, OIDC) sign-in.
- Scales to millions of users.
- Unlike IAM, which controls access to the AWS account.
On the exam
Sign-in for your app’s customers: Cognito. Employee access to AWS: IAM or Identity Center.
Detective
Amazon Detective
Investigates the root cause of security findings by building graphs from logs.
Key points
- Uses data from CloudTrail, VPC Flow Logs and GuardDuty.
- Shows relationships between accounts, IPs and resources over time.
- Complements GuardDuty: one detects, the other investigates.
On the exam
GuardDuty detects the threat; Detective investigates the root cause.
Directory Service
AWS Directory Service
Managed Microsoft Active Directory on AWS.
Key points
- AWS Managed Microsoft AD: a real AD, managed by AWS.
- Can trust an existing on-premises AD.
- Used by WorkSpaces, FSx for Windows and AD-dependent applications.
On the exam
"Use Active Directory on AWS without managing domain controllers": Directory Service.
Resource Access Manager
AWS RAM
Shares resources across AWS accounts or within an organization.
Key points
- Examples: subnets, Transit Gateways, Route 53 Resolver rules.
- Avoids duplicating resources in every account.
- Integrates with AWS Organizations.
On the exam
"Share subnets or a Transit Gateway with other accounts": RAM.