Design Secure Architectures
What you will learn
In this domain, you learn how to design secure access to AWS resources (IAM roles and policies, service control policies in AWS Organizations, and AWS IAM Identity Center), protect workloads (security groups and network ACLs, AWS WAF, AWS Shield, and Amazon GuardDuty), and protect data (encryption with AWS KMS, encryption in transit, and access control for S3). It accounts for 30% of the scored content, the highest share of the four domains.
Key points
- IAM - IAM Identity Center for human sign-in, and for applications, temporary credentials from IAM roles rather than long-term access keys
- Least privilege - Limit policies to the required actions and resource ARNs, and set the maximum permissions for the entire organization with service control policies
- Network - Security groups have allow-only rules at the instance level, and network ACLs have rules at the subnet level that can also deny
- Perimeter protection - AWS WAF for web attacks, AWS Shield for DDoS attacks, and Amazon GuardDuty for threat detection
- Encryption - AWS KMS keys at rest, and TLS in transit (AWS Certificate Manager certificates and the aws:SecureTransport condition)
- Private connectivity - Gateway endpoints for S3 and DynamoDB, and AWS PrivateLink for other services and your own services
Terms and concepts
IAM roles and temporary credentials
An IAM role is a mechanism that gives time-limited credentials to the people or services that assume it. Use an instance profile for EC2, an execution role for Lambda, and for another account, a role whose trust policy allows it to be assumed. If credentials leak, the damage is smaller than when access keys are distributed, and this pattern is often the correct answer on the exam.
Service control policies (SCPs)
SCPs set the maximum permissions available to the accounts in an AWS Organizations organization. Even an account administrator cannot perform operations denied by an SCP. Because SCPs do not grant permissions, actual operations also need to be allowed by IAM policies.
→ AWS Organizations Glossary / → Managing multiple accounts with Organizations
Security groups and network ACLs
A security group is a firewall attached to resources such as instances. You write only allow rules, and return traffic is allowed automatically. Because you can specify another security group as the source, security groups suit controlling traffic between tiers. A network ACL is attached to a subnet, evaluates allow and deny rules in number order, and requires return traffic to be explicitly allowed as well.
Types of AWS KMS keys
AWS KMS keys include customer managed keys, which you create and whose key policies and automatic rotation you can manage, and AWS managed keys, which AWS services create and manage on your behalf. If you have requirements such as deciding yourself who can use a key or tracking its usage in detail, choose a customer managed key.
Choosing among AWS WAF, AWS Shield, and Amazon GuardDuty
AWS WAF inspects HTTP requests in front of resources such as CloudFront and ALB and stops SQL injection and large volumes of requests. AWS Shield protects against DDoS attacks: Standard is automatic and free, and Advanced adds consultation with a specialized team and compensation for usage charges. Amazon GuardDuty is a service that analyzes logs to find suspicious communication and operations, and it does not stop them.
VPC endpoints and AWS PrivateLink
A gateway endpoint is a free mechanism available only for S3 and DynamoDB that adds routes to the route table. An interface endpoint uses AWS PrivateLink to connect to many AWS services and to services in the VPCs of other companies with private IP addresses, without traversing the internet.
→ AWS PrivateLink Glossary / → Private connectivity with PrivateLink