Design Secure Architectures
Security is the largest domain of the SAA-C03 exam and reflects the Well-Architected Security pillar. This chapter covers identity and access management, data protection, network security, and how to apply least privilege across every layer of an AWS workload.
Identity and Access Management
IAM controls who can do what in your account through users, groups, roles, and policies. Prefer IAM roles over long-lived access keys so that EC2 instances, Lambda functions, and federated identities receive temporary, automatically rotated credentials. Always apply least privilege by granting only the actions and resources required for a task. Use the account root user only for a few account-level tasks and protect it with MFA.
Data Protection and Encryption
Encrypt data at rest and in transit by default. AWS KMS manages encryption keys and, with customer managed keys, lets you control rotation, key policies, and audit every use through CloudTrail. S3 supports SSE-S3, SSE-KMS, and client-side encryption, while services like EBS, RDS, and DynamoDB integrate directly with KMS. Enforce TLS for data in transit and use bucket policies or conditions to require encryption on upload.
Network Security
A VPC isolates your resources, and subnets, route tables, and gateways define what can reach them. Security groups are stateful and act at the instance or ENI level, allowing only listed inbound traffic, while network ACLs are stateless and filter at the subnet boundary. Place databases and application tiers in private subnets and reference security groups as sources rather than opening wide CIDR ranges. Use AWS WAF for HTTP-layer threats and Shield for DDoS protection.
Secrets and Application Credentials
Never hard-code credentials in code or store them in plaintext. AWS Secrets Manager stores secrets encrypted with KMS and can automatically rotate database and other credentials on a schedule. Systems Manager Parameter Store is a lower-cost option for configuration and secrets without managed rotation. Applications should retrieve secrets at runtime using an IAM role rather than embedding them.
User Authentication and Federation
Amazon Cognito user pools provide managed sign-up, sign-in, and token issuance for application end users, including federation with social and enterprise identity providers. This keeps application user authentication out of IAM, which is meant for AWS API access rather than per-user app logins. Combine Cognito identity pools with IAM roles to grant authenticated users scoped, temporary access to AWS resources.