Hermes Wiki
CertExams/SAA-C03/Domain1/README

Domain 1: Design Secure Architectures

Domain 1 Mind Map

Mind Map Outline

  • Secure Access to AWS Resources
    • IAM Fundamentals: IAM Users (Long-term), IAM Groups (Permissions), IAM Roles (Temporary STS), Root User (MFA Security)
    • Policy Management: Identity-based Policies, Resource-based (Principals), SCPs (Permission Ceiling), Permissions Boundary, Explicit Deny Priority
    • Multi-Account Governance: AWS Organizations, AWS Control Tower, IAM Identity Center, Amazon Cognito
  • Secure Workloads and Applications
    • VPC Network Security: Public/Private Subnets, Security Groups (Stateful), Network ACLs (Stateless), NAT Gateways
    • Service Connectivity: Interface Endpoints (PrivateLink), Gateway Endpoints (S3/DynamoDB), Site-to-Site VPN, AWS Direct Connect
    • Application Protection: AWS WAF (SQLi/XSS), AWS Shield (DDoS), Amazon GuardDuty (Threats), AWS Network Firewall
    • Secrets & Config: AWS Secrets Manager (Rotation), Systems Manager Parameter Store
  • Data Security Controls
    • Encryption at Rest: AWS KMS (Key Management), AWS CloudHSM (Hardware), EBS Volume Encryption, S3 Server-Side Encryption
    • Encryption in Transit: AWS Certificate Manager (ACM), TLS/SSL Protocols
    • S3 Protection & Compliance: Amazon Macie (PII Discovery), S3 Object Lock, S3 Bucket Policies
    • Disaster Recovery (DR): RPO & RTO Metrics, Backup and Restore, Pilot Light, Warm Standby, Multi-site Active-Active
  • Auditing and Traceability
    • Monitoring Services: AWS CloudTrail (API History), Amazon CloudWatch (Logs/Alarms), VPC Flow Logs
    • Governance & Discovery: AWS Config (Compliance), IAM Access Analyzer, AWS Security Hub, Amazon Inspector
    • Compliance Resources: AWS Artifact (Reports), AWS Audit Manager

To thoroughly master Domain 1: Design Secure Architectures for the SAA-C03 exam, you must focus on building a "defense-in-depth" strategy that layers security at the identity, infrastructure, and data levels. Based on your provided transcripts, this domain is structured into three critical task statements.

1. Design Secure Access to AWS Resources

This task focuses on defining how people and applications interact with your environment while maintaining the principle of least privilege.

  • AWS Accounts & Organizations: Use AWS Organizations and Service Control Policies (SCPs) to manage multiple accounts and set high-level permission guardrails. AWS Control Tower helps enforce these security standards across your entire organization.
  • IAM Fundamentals: IAM is a global service. You must understand the difference between IAM users (for long-term identities), IAM groups, and IAM roles (for temporary access).
  • Identity Federation & Temporary Access: Instead of hardcoding credentials, use IAM roles for applications and AWS Security Token Service (STS) for ephemeral (temporary) credentials. For external users, use IAM Identity Center (successor to AWS Single Sign-On) or Amazon Cognito to federate identities from corporate directories like Active Directory.
  • Policy Types & Evaluation:
    • Identity-based policies define what an identity can do.
    • Resource-based policies (e.g., S3 bucket policies or KMS key policies) define who can access a specific resource.
    • Note that an explicit Deny always overrides an Allow when AWS evaluates these policies.
  • Traceability: Implement monitoring and auditing using AWS CloudTrail for API calls and Amazon CloudWatch for real-time alerting.

2. Design Secure Workloads and Applications

This task involves securing the network and the application tiers themselves.

  • VPC Security Components:
    • Security Groups (SG): Act as stateful firewalls at the instance level.
    • Network Access Control Lists (NACLs): Act as stateless firewalls at the subnet level.
    • Subnets: Use private subnets for application servers and databases to isolate them from the public internet.
  • Secure Connectivity:
    • Use AWS PrivateLink to expose services securely to other VPCs without using the public internet or complex peering.
    • For hybrid connections, choose between AWS Site-to-Site VPN (encrypted over the internet) and AWS Direct Connect (a dedicated private connection).
  • Specialized Security Services:
    • AWS WAF: Protects against web exploits (e.g., SQL injection) on ALBs, API Gateway, and CloudFront.
    • AWS Shield: Provides DDoS protection (Standard is free; Advanced provides higher-level protection).
    • Amazon GuardDuty: A threat detection service that monitors for malicious activity.
    • Amazon Macie: Uses machine learning to discover and protect Personally Identifiable Information (PII) in S3.
  • Secrets Management: Use AWS Secrets Manager for secrets that require automatic rotation; use Systems Manager Parameter Store for general configuration data.

3. Determine Appropriate Data Security Controls

The final task centers on protecting data both at rest and in transit.

  • Encryption at Rest: Protects data stored on disks. Use AWS KMS for most managed key scenarios or AWS CloudHSM if you require dedicated hardware for regulatory compliance. Encrypted EBS volumes are the "least effort" way to protect data generated on an EC2 instance.
  • Encryption in Transit: Protects data moving between parties. Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates for services like ALBs or CloudFront.
  • S3 Security & Lifecycle: S3 offers multiple encryption options, including Server-Side Encryption (SSE) managed by S3, KMS, or the customer. Use S3 Lifecycle configurations or S3 Intelligent-Tiering to manage data access patterns and costs automatically.
  • Disaster Recovery (DR): Aim for a balance between cost and performance based on your RPO (Recovery Point Objective) and RTO (Recovery Time Objective).
    • Backup & Restore: Lowest cost; relies on periodic snapshots (EBS, RDS, etc.).
    • Pilot Light/Warm Standby: Keeps a minimal version of the environment running in another region.
    • Multi-site Active-Active: Highest cost and complexity; traffic is served from multiple regions simultaneously.
  • Compliance: Use AWS Artifact to access self-service security and compliance reports to meet regulatory requirements.

Domain 1: Design Secure Architectures (30%)

The Core Theme: Principle of Least Privilege, Identity Isolation, and Data Protection.

1. Identity & Access Management (IAM)

  • The Blueprint: Standard RBAC. Never use root credentials. Use IAM Roles for application components instead of hardcoded long-term Access Keys.
  • Exam Hotspots: * Cross-Account Access: You need to allow an app in Account A to access an S3 bucket in Account B. Correct answer: App in A assumes an IAM Role in Account B via AWS STS (AssumeRole), or Account B uses a resource-based policy on the S3 bucket allowing Account A's root/IAM identity.
  • AWS Organizations & SCPs: Service Control Policies (SCPs) act as a maximum permission guardrail for accounts within an organization. Exam trap: Even if an IAM policy grants AdministratorAccess, if an SCP explicitly denies s3:*, the user cannot access S3. Deny always wins.

2. Network Security & Perimeter Protection

  • The Blueprint: Layered network defenses inside your VPC.

  • Security Groups vs. Network ACLs (NACLs):

  • Security Groups: Statefull (if traffic enters on port 80, it can automatically leave on a random ephemeral return port). Operate at the instance level. Can reference other security groups as sources.

  • NACLs: Stateless (you must explicitly create inbound AND outbound rules). Operate at the subnet level. Exam hotspot: Use NACLs when you need to block a specific, malicious IP address block. Security Groups can only allow; they cannot explicitly deny.

  • Private VPC Connectivity:

  • VPC Endpoints: Keep traffic to AWS services off the public internet.

  • Interface Endpoints (PrivateLink): Elastic Network Interfaces with private IPs. Costs money. Used for most services (e.g., SQS, Kinesis).

  • Gateway Endpoints: Free, uses routing table targets. Only two services use this: S3 and DynamoDB. (High probability exam answer for cost-effective private access).

3. Data Protection & Compliance

  • KMS (Key Management Service): Managed symmetric/asymmetric encryption. Understand the distinction between AWS-managed keys vs. Customer Managed Keys (CMKs) which allow for custom rotation policies and cross-account usage.
  • Secrets Manager vs. Parameter Store: Both store configurations. Secrets Manager costs money but automatically rotates credentials (like RDS passwords) and integrates with Lambda. Systems Manager Parameter Store is a free/low-cost hierarchical configuration store (no automatic rotation).
Hermes Wiki