Foundation Guide
The AWS Certified Solutions Architect – Associate (SAA-C03) examination validates technical expertise in designing secure, resilient, high-performing, and cost-optimized architectures. Domain 1, Design Secure Architectures, accounts for 30% of the exam and focuses on the "defense-in-depth" strategy, layering security at the identity, infrastructure, and data levels.
Task 1: Design Secure Access to AWS Resources
This task centers on defining how identities (people and applications) interact with the AWS environment while maintaining the principle of least privilege.
1.1 IAM Fundamentals
AWS Identity and Access Management (IAM) is a global service; its data is replicated across all regions.
- Root User: Created with a new account. It has unrestricted, unmodifiable permissions. Best practices require enabling Multi-Factor Authentication (MFA) immediately and using the root user only for a few specific tasks (e.g., closing the account or changing support plans).
- IAM Users: Permanent identities for specific people or applications requiring long-term access.
- IAM Groups: Collections of users. Attaching policies to a group grants those permissions to all members.
- IAM Roles: Identities intended to be assumed temporarily by services (EC2, Lambda), cross-account identities, or federated users. They provide ephemeral credentials via the AWS Security Token Service (STS).
1.2 Policy Types and Evaluation
Permissions are defined via JSON policies. Access is an "implicit deny" by default; permissions must be added explicitly.
| Policy Type | Attachment | Purpose |
|---|---|---|
| Identity-based | User, Group, or Role | Defines what the identity can do. |
| Resource-based | Resource (S3, KMS, SQS) | Defines who has access to that specific resource (requires a Principal element). |
| Service Control (SCP) | AWS Organizations | Sets the maximum permission ceiling for accounts; does not grant permissions. |
Decision Rule: An explicit
Denyin any policy (Identity, Resource, or SCP) always overrides anAllow.
1.3 Multi-Account Governance
- AWS Organizations: Central management for multiple accounts, enabling consolidated billing and SCPs.
- AWS Control Tower: Sets up a "Landing Zone" with automated account provisioning and mandatory security guardrails.
- IAM Identity Center (Successor to AWS SSO): Centralizes authentication via external providers (Okta, AD) for all accounts in an organization.
1.4 Identity Federation
- Enterprise: Use IAM Identity Center or SAML 2.0 to map corporate Active Directory groups to IAM roles.
- Web/Mobile: Use Amazon Cognito User Pools for authentication and Identity Pools to provide temporary AWS credentials for application users.
Task 2: Design Secure Workloads and Applications
This task focuses on securing the network and application tiers through VPC design, segmentation, and perimeter protection.
2.1 VPC Traffic Control Layers
Security is implemented using a layered approach involving Route Tables, Security Groups, and NACLs.
| Feature | Security Group (SG) | Network ACL (NACL) |
|---|---|---|
| Level | Instance/ENI | Subnet |
| State | Stateful (return traffic is auto-allowed) | Stateless (must allow both directions) |
| Rules | Allow rules only | Allow and Deny rules |
| Evaluation | Evaluates all rules | Evaluates in numeric order; first match wins |
Decision Rule: Use Security Groups for granular, least-privilege access between tiers (e.g., ALB to EC2). Use NACLs for coarse, subnet-wide blocking of specific malicious IP ranges.
2.2 Secure Connectivity and Gateways
- Public Subnet: Contains resources needing direct internet access (ALBs, Bastion hosts). Requires an Internet Gateway (IGW) and a route for
0.0.0.0/0to that IGW. - Private Subnet: Isolated from the internet. Resources use a NAT Gateway (placed in a public subnet) to initiate outbound traffic (e.g., for patches) without allowing inbound internet connections.
- VPC Endpoints: Enable private connectivity to AWS services without an IGW or NAT Gateway.
- Gateway Endpoints: Free; available only for Amazon S3 and DynamoDB.
- Interface Endpoints (PrivateLink): Hourly charge + data fee; uses an ENI for most other services (SQS, SNS, Kinesis).
- Hybrid Connectivity:
- Site-to-Site VPN: Encrypted IPsec tunnel over the public internet.
- Direct Connect (DX): Dedicated, private network connection. For high resiliency, connections should be established at multiple DX locations.
2.3 Application and Perimeter Protection
- AWS WAF: A Layer 7 firewall protecting against SQL injection and XSS. Deployable on ALB, API Gateway, and CloudFront.
- AWS Shield: DDoS protection. Standard is free/automatic for all; Advanced provides 24/7 access to the Shield Response Team and cost protection.
- Amazon GuardDuty: Threat detection service that monitors VPC Flow Logs, CloudTrail, and DNS logs for malicious activity (e.g., crypto-mining).
- Amazon Macie: Uses ML to discover and protect Personally Identifiable Information (PII) in S3.
2.4 Secrets Management
- AWS Secrets Manager: Designed for application secrets (DB credentials, API keys). Its defining feature is automatic rotation (built-in for RDS; custom Lambda for others).
- SSM Parameter Store: Best for static configuration data and non-rotating secrets. Lower cost than Secrets Manager but lacks built-in rotation.
Task 3: Determine Appropriate Data Security Controls
This task involves protecting data at rest and in transit through encryption, lifecycle management, and disaster recovery.
3.1 Encryption at Rest
- AWS KMS: Managed service for creating and controlling keys. Supports both AWS-managed and customer-managed keys (CMKs).
- AWS CloudHSM: Dedicated, single-tenant hardware security module. Choose this when regulatory compliance requires FIPS 140-2 Level 3 and full customer control of the hardware.
- Amazon EBS: Encryption is the "least effort" way to protect data on an EC2 instance. It can be enabled at creation or by copying a snapshot with encryption turned on.
3.2 Amazon S3 Encryption Options
The choice of S3 encryption depends on who manages the encryption key.
| Option | Key Manager | Detail |
|---|---|---|
| SSE-S3 | AWS | Simplest; AWS manages keys (AES-256). |
| SSE-KMS | AWS KMS | Auditable key usage; customer-controlled policies. |
| SSE-C | Customer | Customer provides the key with every request; AWS does not store it. |
| Client-Side | Customer | Data is encrypted before reaching S3. |
3.3 Encryption in Transit
- AWS Certificate Manager (ACM): Provisions and manages SSL/TLS certificates for use with ALBs and CloudFront distributions.
3.4 Disaster Recovery (DR) Strategies
Architectures are designed based on Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
| Strategy | Cost | RTO | RPO | Standing Compute |
|---|---|---|---|---|
| Backup & Restore | Lowest | Hours/Days | Hours/Days | None |
| Pilot Light | Low | Minutes/Hours | Minutes/Hours | Database only |
| Warm Standby | Medium | Minutes | Minutes | Scaled-down fleet |
| Multi-Site | Highest | Near-Zero | Near-Zero | Full duplication (Active-Active) |
Summary of Exam-Critical Decision Rules
| Requirement | Correct Service/Feature |
|---|---|
| Rotate DB credentials every 30 days | AWS Secrets Manager |
| Find SSNs/PII in S3 buckets | Amazon Macie |
| Block a specific malicious IP range | Network ACL (NACL) |
| Private S3/DynamoDB access (cost-optimized) | Gateway VPC Endpoint |
| Private access to a 3rd-party SaaS API | AWS PrivateLink (Interface Endpoint) |
| UDP/Non-HTTP acceleration and failover | AWS Global Accelerator |
| Stop SQL injection on a web app | AWS WAF |
| Audit "Who did what and when" | AWS CloudTrail |
| Standardize governance across all accounts | AWS Config Conformance Packs |
| Prevent direct S3 URL access (use CloudFront) | Origin Access Control (OAC) |
| Cross-Region RPO ≈ 1s / RTO ≈ 1min | Aurora Global Database |
| Encrypt existing unencrypted RDS instance | Snapshot → Copy with Encryption → Restore |