Hermes Wiki
CertExams/SAA-C03/Domain1/D1_defense_in_depth

To thoroughly master Domain 1: Design Secure Architectures for the SAA-C03 exam, you must focus on building a "defense-in-depth" strategy that layers security at the identity, infrastructure, and data levels. Based on your provided transcripts, this domain is structured into three critical task statements.

1. Design Secure Access to AWS Resources

This task focuses on defining how people and applications interact with your environment while maintaining the principle of least privilege.

  • AWS Accounts & Organizations: Use AWS Organizations and Service Control Policies (SCPs) to manage multiple accounts and set high-level permission guardrails. AWS Control Tower helps enforce these security standards across your entire organization.
  • IAM Fundamentals: IAM is a global service. You must understand the difference between IAM users (for long-term identities), IAM groups, and IAM roles (for temporary access).
  • Identity Federation & Temporary Access: Instead of hardcoding credentials, use IAM roles for applications and AWS Security Token Service (STS) for ephemeral (temporary) credentials. For external users, use IAM Identity Center (successor to AWS Single Sign-On) or Amazon Cognito to federate identities from corporate directories like Active Directory.
  • Policy Types & Evaluation:
    • Identity-based policies define what an identity can do.
    • Resource-based policies (e.g., S3 bucket policies or KMS key policies) define who can access a specific resource.
    • Note that an explicit Deny always overrides an Allow when AWS evaluates these policies.
  • Traceability: Implement monitoring and auditing using AWS CloudTrail for API calls and Amazon CloudWatch for real-time alerting.

2. Design Secure Workloads and Applications

This task involves securing the network and the application tiers themselves.

  • VPC Security Components:
    • Security Groups (SG): Act as stateful firewalls at the instance level.
    • Network Access Control Lists (NACLs): Act as stateless firewalls at the subnet level.
    • Subnets: Use private subnets for application servers and databases to isolate them from the public internet.
  • Secure Connectivity:
    • Use AWS PrivateLink to expose services securely to other VPCs without using the public internet or complex peering.
    • For hybrid connections, choose between AWS Site-to-Site VPN (encrypted over the internet) and AWS Direct Connect (a dedicated private connection).
  • Specialized Security Services:
    • AWS WAF: Protects against web exploits (e.g., SQL injection) on ALBs, API Gateway, and CloudFront.
    • AWS Shield: Provides DDoS protection (Standard is free; Advanced provides higher-level protection).
    • Amazon GuardDuty: A threat detection service that monitors for malicious activity.
    • Amazon Macie: Uses machine learning to discover and protect Personally Identifiable Information (PII) in S3.
  • Secrets Management: Use AWS Secrets Manager for secrets that require automatic rotation; use Systems Manager Parameter Store for general configuration data.

3. Determine Appropriate Data Security Controls

The final task centers on protecting data both at rest and in transit.

  • Encryption at Rest: Protects data stored on disks. Use AWS KMS for most managed key scenarios or AWS CloudHSM if you require dedicated hardware for regulatory compliance. Encrypted EBS volumes are the "least effort" way to protect data generated on an EC2 instance.
  • Encryption in Transit: Protects data moving between parties. Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates for services like ALBs or CloudFront.
  • S3 Security & Lifecycle: S3 offers multiple encryption options, including Server-Side Encryption (SSE) managed by S3, KMS, or the customer. Use S3 Lifecycle configurations or S3 Intelligent-Tiering to manage data access patterns and costs automatically.
  • Disaster Recovery (DR): Aim for a balance between cost and performance based on your RPO (Recovery Point Objective) and RTO (Recovery Time Objective).
    • Backup & Restore: Lowest cost; relies on periodic snapshots (EBS, RDS, etc.).
    • Pilot Light/Warm Standby: Keeps a minimal version of the environment running in another region.
    • Multi-site Active-Active: Highest cost and complexity; traffic is served from multiple regions simultaneously.
  • Compliance: Use AWS Artifact to access self-service security and compliance reports to meet regulatory requirements.
Hermes Wiki