AWS Certified Solutions Architect Design Secure Architectures Syllabus

Design Secure Architectures syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Design Secure Architectures in AWS Certified Solutions Architect, not a summary of it.

1. 1

   Identity and Access Management (IAM)

   4 topics

   • IAM Core Identities and Policies
     • IAM users, groups, and the root account
     • Identity-based vs resource-based policies
     • Policy structure: Effect, Action, Resource, Condition
     • Policy evaluation logic and explicit deny precedence
     • Managed vs inline policies and permissions boundaries
   • IAM Roles and Temporary Credentials
     • Roles for EC2 instance profiles and AWS services
     • AWS STS AssumeRole and temporary credentials
     • Cross-account role access and trust policies
     • Role chaining and session policies
   • Federation and Centralized Access
     • SAML 2.0 and OIDC web identity federation
     • AWS IAM Identity Center (SSO) and permission sets
     • Amazon Cognito user pools and identity pools
   • Multi-Account Governance
     • AWS Organizations and organizational units (OUs)
     • Service Control Policies (SCPs)
     • Consolidated billing and account isolation strategy
2. 2

   Data Protection and Encryption

   4 topics

   • Encryption at Rest with AWS KMS
     • AWS-managed vs customer-managed keys (CMKs)
     • Key policies, grants, and rotation
     • Envelope encryption and data key concepts
     • S3, EBS, RDS, and DynamoDB encryption integration
   • Encryption in Transit
     • TLS termination at ELB and CloudFront
     • AWS Certificate Manager (ACM) provisioning and renewal
     • Enforcing HTTPS via policies and viewer protocol settings
   • Secrets and Credential Management
     • AWS Secrets Manager and automatic rotation
     • Systems Manager Parameter Store SecureString
     • Choosing Secrets Manager vs Parameter Store
   • CloudHSM and Compliance
     • CloudHSM dedicated hardware use cases
     • Data residency and compliance considerations
3. 3

   Network and Infrastructure Security

   3 topics

   • VPC Security Controls
     • Security groups (stateful) vs network ACLs (stateless)
     • Subnet segmentation: public, private, isolated tiers
     • VPC endpoints to keep traffic off the public internet
   • Edge and Application Protection
     • AWS WAF rules and managed rule groups
     • AWS Shield Standard and Advanced DDoS protection
     • AWS Firewall Manager for centralized policy
   • Threat Detection and Monitoring
     • Amazon GuardDuty threat detection
     • Amazon Inspector vulnerability assessment
     • AWS Security Hub aggregated findings
     • Amazon Macie for sensitive data discovery

Design Secure Architectures flashcards for AWS Certified Solutions Architect

20 of 70 cards from the Design Secure Architectures deck — real questions with worked answers.

1. In AWS IAM, what are the three core identity types and how do they differ?

   Users (long-term credentials for a person/app), Groups (a collection of users for shared permissions; not an identity you can authenticate as), and Roles (an identity with temporary credentials assumed by trusted principals).

2. What is the difference between an IAM identity-based policy and a resource-based policy?

   Identity-based policies attach to users, groups, or roles and define what that principal can do. Resource-based policies attach directly to a resource (e.g., S3 bucket, SQS queue) and specify which principals may access it, including cross-account principals.

3. In an IAM policy, what is the effective result when an explicit Deny conflicts with an explicit Allow?

   The explicit Deny always wins. IAM evaluation logic: by default deny, an explicit Allow overrides default deny, but any explicit Deny overrides any Allow.

4. What are the required elements that make up an IAM JSON policy statement?

   Effect (Allow/Deny), Action (API operations), and Resource (ARNs). Optional elements include Principal, Condition, and Sid. Principal is required in resource-based policies.

5. What is the difference between an AWS managed policy, a customer managed policy, and an inline policy?

   AWS managed policies are created and maintained by AWS and reusable. Customer managed policies are created by you and reusable across identities. Inline policies are embedded directly in a single identity with a strict 1:1 relationship and cannot be reused.

6. What is an IAM permissions boundary and what does it control?

   A permissions boundary is a managed policy that sets the maximum permissions an identity-based policy can grant to a user or role. Effective permissions = intersection of the boundary and the identity-based policy; it limits but never grants permissions.

7. What is the IAM policy evaluation order across SCPs, permissions boundaries, identity, and resource policies?

   Access is granted only if no explicit Deny exists anywhere AND the action is allowed by each applicable scope: Organizations SCPs, permissions boundary, identity-based policy (and/or resource-based policy). It is an intersection of allows with deny-override.

8. What is the AWS principle of least privilege and one tool AWS provides to help achieve it?

   Grant only the permissions required to perform a task. IAM Access Analyzer can generate least-privilege policies based on CloudTrail access activity, and last-accessed information helps remove unused permissions.

9. Why should an IAM role be preferred over embedding IAM user access keys in an EC2 application?

   Roles supply automatically rotated, temporary credentials via the instance metadata service, eliminating long-term secrets stored in code/config and reducing the risk of leaked, non-expiring keys.

10. What is the difference between authentication and authorization in AWS IAM?

    Authentication verifies identity (who you are) via credentials such as passwords, access keys, or MFA. Authorization determines what an authenticated principal is permitted to do, evaluated through IAM policies.

11. What AWS service issues temporary security credentials and what three components do they contain?

    AWS STS (Security Token Service). Temporary credentials contain an access key ID, a secret access key, and a session token, all with a limited expiration.

12. What STS API is used to assume a role within or across accounts, and what does it return?

    sts:AssumeRole. It returns temporary credentials (access key, secret key, session token) scoped to the assumed role's permissions for the session duration.

13. What is an IAM role trust policy and what does it define?

    The trust policy (assume-role policy) is the resource-based policy on a role that specifies which principals (accounts, services, federated users) are allowed to assume the role via sts:AssumeRole.

14. What is the valid session duration range for an assumed IAM role using AssumeRole?

    15 minutes minimum up to a maximum of 12 hours, bounded by the role's configured maximum session duration setting.

15. What is an IAM instance profile and why is it needed for EC2?

    An instance profile is a container for an IAM role that is attached to an EC2 instance, allowing the instance to assume the role and obtain temporary credentials automatically. EC2 cannot use a role directly without an instance profile.

16. What is the purpose of an external ID when a third party assumes a role in your account?

    The external ID is a shared secret in the trust policy condition that prevents the 'confused deputy' problem, ensuring the third party assumes the role only on behalf of your account and not someone else's.

17. How do EC2 IMDSv2 sessions improve security over IMDSv1 for retrieving role credentials?

    IMDSv2 requires a session-oriented, token-based request (PUT to obtain a token, then GET with the token), mitigating SSRF attacks that could otherwise read instance role credentials from the metadata endpoint.

18. What is an STS session policy and how does it affect permissions?

    A session policy is an inline policy passed during AssumeRole that further restricts the role's permissions for that session. Effective permissions = intersection of the role's identity policy and the session policy.

19. What is the difference between AssumeRoleWithSAML and AssumeRoleWithWebIdentity?

    AssumeRoleWithSAML exchanges a SAML 2.0 assertion (enterprise IdP like AD FS) for temporary credentials. AssumeRoleWithWebIdentity exchanges a web identity token from an OIDC provider (e.g., Google, Cognito, login.amazon.com) for temporary credentials.

20. What is the difference between identity federation and creating IAM users for external/enterprise users?

    Federation lets users authenticate with an existing external identity provider (SAML/OIDC) and assume roles for temporary access, avoiding the management overhead and security risk of creating and maintaining individual long-term IAM users.

See more Design Secure Architectures flashcards →

Planning Design Secure Architectures for AWS Certified Solutions Architect

Design Secure Architectures (AWS Certified Solutions Architect) FAQ