Security Notes: detect, contain, and least privilege

Module 1: Monitoring and alerting

Start from the signal you need. Amazon GuardDuty looks for threats: unusual API calls, compromised credentials, malware, and runtime behavior. Amazon Inspector looks for vulnerable packages and unintended network paths on EC2, container images, and Lambda. Amazon Macie looks for sensitive data in S3. AWS Security Hub aggregates findings and checks them against a standard. Amazon Security Lake stores normalized security logs, often in the Open Cybersecurity Schema Framework, so you can query them later. A finding inbox and a log lake are not the same store.

Module 2: Logging

An organization CloudTrail trail records API calls for every member account, and a member cannot turn that trail off. A trail the member owns can be stopped by that member. Send the trail to a dedicated log account. CloudTrail Lake lets you query events with SQL. VPC Flow Logs, transit gateway flow logs, and Route 53 Resolver query logs show who talked to whom. They record metadata, not a packet capture.

CloudWatch Logs is the application and service log. A metric filter turns a matching line into a number, and an alarm pages you. Logs Insights queries the group. It does not notify anyone until you publish a metric or start a workflow. Amazon Athena queries logs that already landed in S3. Amazon OpenSearch Service is where you parse and correlate. The CloudWatch agent, and the service's own logging switch, are why a log is missing when the resource never sent it.

Module 3: When the alert never arrives

A missing log is usually a permission, a destination, or a switch. Lambda and API Gateway log only when logging is enabled and the role can write. CloudFront and load balancer access logs need a bucket policy that lets the service write. The CloudWatch agent fails when the configuration or the instance role is wrong. A health check that looks at the wrong path stays green while the application is down.

Fix the writer before you build another dashboard. A metric filter on an empty log group will never alarm. An organization trail in a log account is the pattern that survives a member who tries to hide activity.

Module 4: Incident plans

Write the runbook before the event. Systems Manager OpsCenter tracks the operational item and the runbooks related to it. Prepare access for the responders, deploy the tools they will need, and keep the blast radius small: separate accounts, narrow security groups, and backups you have restored at least once. AWS Shield Advanced adds DDoS response support beyond the automatic Shield baseline.

Test the plan on purpose. AWS Fault Injection Service runs a planned experiment. AWS Resilience Hub assesses whether the workload meets the recovery objective. Deleting a production database is not a test. Automatic remediation belongs in Systems Manager Automation, Step Functions, or a Lambda function that the finding invokes. Application Recovery Controller is the routing control for a failover you already designed. Automated Forensics Orchestrator for Amazon EC2 is the in-scope way to capture forensic artifacts from an instance. Capture first. Terminate later.

Module 5: Responding to an event

Keep the evidence, contain the resource, eradicate the cause, then recover. Store the relevant logs and a snapshot or memory capture before you stop the instance. Search CloudTrail, flow logs, and the application log for the same principal and the same time window. Validate the GuardDuty or Security Hub finding before you treat every neighbor as compromised. Amazon Detective is the graph for that investigation. It does not replace the detector that raised the finding.

Containment is a security group or network ACL that stops the instance's traffic, a revoked role, and a disabled key. Eradication removes the malicious change and the credential that made it. Recovery restores from a backup you trust. The first step for an exposed access key is to disable the key, then read CloudTrail. Deleting the trail hides what the key already did.

Module 6: Edge controls

Match the control to the threat. AWS WAF filters HTTP: a managed rule group, a rate limit, a geo match, or a rule you wrote. Third-party rule groups are in scope when the stem asks for a subscribed rule set. AWS Shield, and Shield Advanced when you need response support, is DDoS protection. Amazon CloudFront can require a header or sit in front of an origin so the origin is not public. An S3 CORS rule is a browser control, not an encryption control. AWS IoT policies authorize devices. They are not a bucket policy.

Integrations can ingest Open Cybersecurity Schema Framework data into the lake you already use. A WAF rule does not inspect traffic that never reaches the distribution or the load balancer.

Module 7: Compute workloads

EC2 Image Builder produces a hardened AMI or container image. Read a secret at launch from Secrets Manager. An image that contains the password is a leaked credential the moment you share the AMI. Give the instance an instance profile. Give Lambda an execution role. Do not put a long-term access key in user data or in the image.

Amazon Inspector scans images, instances, and functions for known vulnerabilities. GuardDuty monitors runtime behavior. Systems Manager Patch Manager applies a baseline in a maintenance window. Inspector does not install the patch by itself. Session Manager is administrative access without an inbound SSH port. EC2 Instance Connect pushes a short-lived SSH key and still uses SSH.

In a pipeline, Amazon Inspector, Amazon Q Developer, or Amazon CodeGuru Security can fail the build on a finding. Extra Training a model is outside the exam. Protections for a generative AI application are in scope: Bedrock Guardrails, filters for sensitive output, and a role that can do only what the application needs. A model with an administrator role is excessive agency, not a guardrail.

Module 8: Network controls

Security groups are stateful and attach to an elastic network interface. Network ACLs are stateless and attach to a subnet, so return traffic needs its own allow. AWS Network Firewall is the VPC firewall for domain lists and intrusion prevention. A security group does not filter by domain name. Route 53 Resolver DNS Firewall does.

North-south traffic enters or leaves the VPC. East-west traffic moves between workloads. Segment them with subnets, routes, and security groups. An isolated subnet has no path to an internet gateway. AWS Verified Access gives a person application access without placing them on the network. AWS Client VPN places them on the network. A gateway VPC endpoint keeps S3 or DynamoDB off the NAT path. Interface endpoints and AWS PrivateLink do that for other services.

AWS Site-to-Site VPN is encrypted over the internet. AWS Direct Connect is a private circuit and is not encrypted until you add MACsec or a VPN. Network Access Analyzer and Inspector network reachability findings show a path you did not intend. Extra Packet captures and host firewall design sit outside the scored guide.

Module 9: Authentication

People who work in AWS belong in IAM Identity Center, with permission sets and MFA, preferably through your identity provider. Amazon Cognito user pools sign users into your application. Cognito identity pools vend temporary AWS credentials to that application. IAM users with long-term keys are a poor fit for either case. AWS Directory Service is the Managed Microsoft AD or AD Connector path when the stem already depends on Active Directory.

Workloads on AWS use roles. AWS STS issues the temporary credentials. Amazon EC2 receives them through an instance profile. A workload outside AWS uses IAM Roles Anywhere and a certificate from a trust anchor you control. An S3 presigned URL is temporary access to one object, using the signer's permissions. It is not a role and it is not MFA.

When sign-in fails, read CloudTrail, the Identity Center permission set, the Cognito app client, and the directory trust. A policy that denies sts:AssumeRole looks like a password failure and is not one.

Module 10: Authorization

An allow has to exist in an identity policy or a resource policy. Everything else is a ceiling. A permissions boundary limits one IAM user or role. A session policy limits one session. A service control policy limits principals in member accounts. A resource control policy limits what those resources will accept. None of them grant access. The management account is not constrained by an SCP the way a member account is.

Role-based access attaches permissions to a role and puts people in that role. Attribute-based access uses tags, such as a department tag on the principal and the resource. Cross-account access is a resource policy plus a trust policy that names the other account, or a role that account may assume. Amazon Verified Permissions evaluates application authorization. IAM paths and IAM Roles Anywhere are still IAM. They are not a second kind of root user.

IAM Policy Simulator tests a policy without changing it. IAM Access Analyzer reports a resource shared outside the zone you trust, and it can report unused access. Investigate the finding, then remove the permission. A CPU alarm does not read a bucket policy.

Module 11: Data in transit

Require TLS on the listener. An Elastic Load Balancing security policy chooses the protocols and ciphers. A security group does not negotiate TLS. Private access is a gateway endpoint, an interface endpoint, AWS PrivateLink, AWS Client VPN, or AWS Verified Access, depending on whether the caller is a workload, a person on the network, or a person who should never join the network.

Between resources, use the service's own encryption: an Amazon EMR security configuration, encryption in transit for Amazon EKS, inter-container traffic encryption for SageMaker AI, and Nitro encryption between supported instances. Opening every port between nodes is not encryption.

Module 12: Data at rest

AWS KMS is the managed key most applications should use. AWS CloudHSM is a dedicated HSM you operate when the requirement is that control. Server-side encryption with KMS gives you a key policy and a CloudTrail record. Server-side encryption with Amazon S3-managed keys does not give you that control. Client-side encryption and SSE-C keep the key material in your request path. Pick the one the stem's custody requirement names.

S3 Object Lock in compliance mode keeps an object for the retention period, including from the root user. Governance mode can be bypassed by a principal you explicitly allow. A legal hold is separate from the retention clock. S3 Glacier Vault Lock locks a vault policy. Versioning keeps copies. It does not by itself stop a delete. Lifecycle policies move storage class or expire objects. They are not a legal hold.

AWS Backup, with a vault lock, is the ransomware control for backups you must not be able to delete. Amazon Data Lifecycle Manager manages EBS snapshots and AMIs. AWS DataSync copies data. It does not lock a vault.

Module 13: Secrets and key material

AWS Secrets Manager rotates a database password and lets the application read the current value. Parameter Store fits a static secret. An AMI, a repository file, and a public object expose the value.

Imported key material is material you supply. If you delete it, AWS cannot reconstruct it, and ciphertext stays unreadable until you import it again. Automatic rotation of AWS-generated material keeps the same key ID and retains older material for decryption. That rotation is not available in the same way for imported material. An external key store keeps the key manager outside KMS, so availability depends on that manager. A CloudHSM key store keeps the HSM in AWS.

CloudWatch Logs data protection policies and Amazon SNS message data protection mask sensitive values in the event. They do not replace encryption of the bucket. A multi-Region KMS key has replica keys so you can decrypt in another Region under the related key. AWS Private CA issues certificates your own clients trust. A public ACM certificate is for a name the public internet should trust.

Module 14: Accounts and guardrails

AWS Organizations is the account boundary. AWS Control Tower vends an account with a baseline instead of a checklist you apply after production. Service control policies, resource control policies, declarative policies, and AI services opt-out policies are organization policies. Declarative policies enforce a configuration, such as blocking public access. An opt-out policy tells AWS not to use content to improve AI services. Neither one is an IAM allow.

Run GuardDuty, Security Hub, and the other security services from a delegated administrator account so daily operations are not piled onto the management account. Centralize root credentials for member accounts, require MFA, and write a break-glass procedure. A root password in a shared document is not that procedure.

Module 15: Consistent deployment

CloudFormation StackSets lands the same stack in many accounts and Regions. CloudFormation Guard and cfn-lint check the template before you deploy it. Tags group resources by environment, owner, or cost center so a policy can use them. AWS Firewall Manager deploys WAF, Shield Advanced, security groups, Network Firewall, and DNS Firewall policies from one place. A rule you created in one account does not cover the organization.

AWS Service Catalog publishes an approved product. AWS RAM shares a resource such as a subnet or a transit gateway. RAM does not deploy a template, and a bucket policy does not share a subnet.

Module 16: Compliance evidence

AWS Config rules detect a resource that is already noncompliant and can start remediation. Security Hub does the same for findings and standards. Neither one prevents an API call that an SCP already denies. AWS Audit Manager collects evidence mapped to a framework you are audited against. AWS Artifact is where you download AWS compliance reports and agreements. The AWS Well-Architected Tool records a review against the security pillar. It is not a scanner.

Extra The older task that asked you to find security gaps through a cost analysis is not in SCS-C03. Cost belongs in the review only when the stem makes cost the constraint on a control that still meets the security requirement.

Frequently asked questions