Domain 1 Wrap-Up — Review Checklist

Purpose

This wrap-up is a self-test checklist, not new material — it's the set of "can you actually answer this?" prompts the course uses to close out Domain 1. Treat each bullet below as a flash-card prompt.

Multi-Account Least Privilege

Choosing between AWS Control Tower, AWS Service Catalog, and AWS Organizations for enforcing least privilege across many accounts — know that Organizations + SCPs sets the permission ceiling, Control Tower automates guardrails/landing zones on top of Organizations, and Service Catalog is for standardizing what users are allowed to provision, not account-level permission boundaries.

IAM Depth Check

IAM role vs. IAM user — when does each apply?
Distinguish four policy types that sound similar but aren't:
- Identity policy (attached to user/group/role)
- Resource policy (attached to a resource, e.g., S3 bucket policy)
- Permissions policy (the general term for policies granting permissions, as opposed to boundary/SCP-type policies)
- Service control policy (org-wide permission ceiling; doesn't grant anything by itself, only restricts)
Policy evaluation with overlapping allow/deny: an explicit deny anywhere always wins; absent any explicit deny, an explicit allow is required (default deny).

Federation

Know AWS IAM Identity Center (formerly AWS SSO) and its role as the hub for workforce access across accounts.
Know use cases for AWS Directory Service (e.g., AD Connector vs. Managed Microsoft AD) in federation scenarios.

Monitoring Beyond the Basics

Core trio: CloudTrail (API call history), CloudWatch (metrics/alarms), VPC Flow Logs (network traffic visibility) — know what else exists beyond these three (e.g., Config, GuardDuty) for a complete detective-controls picture.

VPC Security Setup

Be able to actually set up a VPC with appropriate security controls from scratch, not just describe the pieces.

Named Services to Have Crisp Definitions For

AWS Shield (Standard vs. Advanced)
AWS WAF
AWS Secrets Manager
AWS Systems Manager Parameter Store

Encryption Decision Points

Protecting data in transit and at rest across AWS.
AWS KMS vs. AWS CloudHSM — the deciding factor is almost always "do you need dedicated single-tenant HSM hardware / specific compliance mandate," not general encryption need.

Meta-Skill for the Exam

The repeated framing across this wrap-up: questions test your ability to choose between two plausible AWS services given a scenario stem. Studying isolated service definitions isn't enough — practice comparative recall ("X vs. Y, when would you pick each") for every pairing above.

Practical Examples

Control Tower vs. Service Catalog vs. Organizations, disambiguated: A company onboarding 15 new AWS accounts for different product teams wants every account to start with baseline guardrails (CloudTrail on, no public S3 by default, MFA enforced) — that's AWS Control Tower setting up the landing zone. Underneath it, AWS Organizations + SCPs is the mechanism enforcing "no team can ever disable CloudTrail, full stop." Separately, if they want developers to only be able to launch pre-approved, pre-configured EC2/RDS stacks instead of raw AWS console access — that's AWS Service Catalog.

IAM role vs. IAM user, one more time, concretely: A CI/CD pipeline (e.g., GitHub Actions) needs to deploy to AWS — use an IAM role assumed via OIDC federation, not a long-lived IAM user access key sitting in a GitHub secret. A human contractor who needs console access for 3 months — an IAM user with an expiring password policy (or better, federated access if your org supports it) is more appropriate than a role, since a person needs a persistent login identity across sessions.

SCP explicit-deny trap, concretely: A developer has an IAM policy granting AdministratorAccess. Their account sits under an OU with an SCP that denies s3:DeleteBucket org-wide (a guardrail against accidental data loss). The developer tries to delete a bucket via the console — it fails, even though their IAM policy technically allows it. This is the single most common SCP exam trap: SCPs never grant permissions, they only cap what IAM policies are allowed to grant — and a denying SCP always wins over an allowing IAM policy.

IAM Identity Center in a real org: A 200-person company wants employees to log into a single portal and see tiles for every AWS account/role they're entitled to (Prod-ReadOnly, Dev-Admin, Billing-View), without a separate IAM user per account. IAM Identity Center, backed by their existing Okta or Azure AD as the identity source, is the standard answer.

D1_DesginSecureAccessToAWSResources_Insights (unresolved)
D1_DesignSecureWorkloads&Applications_Insights (unresolved)
D1_DetermineAppropriateSecurityControls_Insights (unresolved)