AWS Certified Solutions Architect Design Secure Architectures Syllabus

What is AWS IAM Identity Center (formerly AWS SSO) used for?

It provides centralized single sign-on and permission management across multiple AWS accounts and applications, connecting to an external identity source (its own directory, Active Directory, or external IdP) and assigning permission sets to users/groups.

In IAM Identity Center, what is a permission set?

A permission set is a collection of policies that defines the level of access; it is provisioned as an IAM role in each assigned account, mapping users/groups to permissions across the organization.

What is SAML 2.0 federation and which AWS component trusts the external IdP?

SAML 2.0 federation lets enterprise users sign in with a corporate IdP. You create a SAML identity provider entity in IAM that establishes trust, and users assume a role via AssumeRoleWithSAML using the IdP's signed assertion.

What is Amazon Cognito and what are its two main components?

Cognito provides authentication for web/mobile apps. User Pools handle sign-up/sign-in and issue tokens (user directory/authentication); Identity Pools (federated identities) exchange tokens for temporary AWS credentials to access AWS resources.

What is the difference between a Cognito User Pool and a Cognito Identity Pool?

A User Pool is a user directory that authenticates users and returns JWT tokens. An Identity Pool grants temporary AWS credentials (via STS) so authenticated or guest users can access AWS services directly.

What is AWS Organizations and what is the root of its structure?

AWS Organizations centrally manages and governs multiple AWS accounts. The structure is a tree with a management (root) account at the top, organizational units (OUs) for grouping, and member accounts.

What is a Service Control Policy (SCP) and what does it actually do?

An SCP is an Organizations policy that sets the maximum available permissions (a permission guardrail) for accounts in an OU or the organization. It never grants permissions; it only filters what IAM policies in member accounts can allow.

Do SCPs affect the AWS Organizations management account?

No. SCPs do not restrict the management (root) account or any service-linked roles, which is why running workloads in the management account is discouraged.

What is AWS Control Tower and how does it relate to Organizations?

Control Tower automates setup of a secure, multi-account 'landing zone' using AWS Organizations, with pre-packaged guardrails (preventive via SCPs and detective via Config rules), centralized logging, and an account factory for standardized account provisioning.

What is the recommended multi-account strategy for isolating production from development workloads?

Use separate AWS accounts per environment/workload under one organization, applying SCP guardrails per OU. Account boundaries provide strong blast-radius isolation, separate billing, and independent security controls.

What is consolidated billing in AWS Organizations and one cost benefit it provides?

Consolidated billing aggregates charges from all member accounts into the management account's single bill. Benefit: combined usage can reach volume pricing tiers and pooled Reserved Instance / Savings Plans discounts across accounts.

What is the difference between envelope encryption and direct encryption with a KMS key?

In envelope encryption, KMS generates a data key; the data key encrypts your data locally, and KMS encrypts (wraps) the data key with the KMS key. This avoids sending large payloads to KMS (limited to 4 KB) and improves performance.

What is the difference between an AWS managed KMS key, a customer managed KMS key, and an AWS owned key?

AWS managed keys (aws/service) are created/managed by AWS per service with limited control. Customer managed keys are created and fully controlled by you (policies, rotation, deletion). AWS owned keys are shared, invisible keys AWS uses internally at no cost and you cannot manage them.

How does automatic key rotation work for a customer managed symmetric KMS key?

When enabled, KMS rotates the backing cryptographic material annually (default) while keeping the same key ID/ARN. Old material is retained to decrypt previously encrypted data; rotation is transparent to applications.

What is a KMS key policy and how does it relate to IAM policies for key access?

Every KMS key has a key policy (resource-based) that is the primary control over who can use/manage it. Access requires permission in the key policy; IAM policies alone cannot grant access unless the key policy delegates to IAM (via the account-root statement).

What is a KMS grant and when would you use it instead of a key policy?

A grant is a programmatic, temporary delegation of specific KMS permissions to a principal, often used by AWS services to encrypt/decrypt on your behalf. It's preferred for fine-grained, revocable, often short-lived access without editing the key policy.

What is the mandatory waiting period when scheduling deletion of a KMS key, and why?

7 to 30 days (default 30). The waiting period is enforced because deleting a key is irreversible and makes all data encrypted under it permanently unrecoverable, allowing time to cancel.

What is the difference between a symmetric and an asymmetric KMS key?

Symmetric keys use a single 256-bit key for both encrypt and decrypt (never leaves KMS) and are the default for most AWS encryption. Asymmetric keys use a public/private key pair for encrypt/decrypt or sign/verify, useful when the public key must be shared outside AWS.

What does SSE-S3 vs SSE-KMS vs SSE-C mean for S3 server-side encryption?

SSE-S3: S3-managed keys (AES-256), no key control. SSE-KMS: keys managed in AWS KMS with auditing and access policies. SSE-C: customer-provided keys, where you supply the key on each request and AWS does not store it.

What protocol and which TLS feature provides encryption in transit for AWS API calls and web traffic?

TLS (Transport Layer Security) over HTTPS. AWS service endpoints and load balancers use TLS certificates to encrypt data between client and service in transit.

What is AWS Certificate Manager (ACM) and a key limitation on where its public certificates can be used?

ACM provisions, manages, and auto-renews TLS/SSL certificates. ACM public certificates integrate only with supported AWS services (e.g., ELB/ALB, CloudFront, API Gateway) and cannot be exported for use on standalone EC2 instances.

What is the difference between TLS termination and TLS passthrough on a load balancer?

TLS termination decrypts traffic at the load balancer (ALB/NLB), then optionally re-encrypts to targets; it offloads crypto and enables L7 inspection. TLS passthrough (NLB) forwards encrypted traffic unmodified to the backend, which holds the certificate (end-to-end encryption).

How can you enforce that S3 only accepts requests over encrypted (HTTPS) connections?

Add a bucket policy that denies actions when the condition aws:SecureTransport is false, forcing all access to use TLS/HTTPS.

What is AWS Secrets Manager and its key feature over plain Parameter Store?

Secrets Manager securely stores secrets (DB credentials, API keys) encrypted with KMS and provides built-in automatic rotation using Lambda functions, plus fine-grained resource policies and cross-region replication.

What is the difference between AWS Secrets Manager and SSM Parameter Store SecureString for storing secrets?

Both encrypt with KMS. Secrets Manager adds native automatic rotation, generates random secrets, and cross-region replication (paid per secret). Parameter Store SecureString is lower/no cost and good for config/secrets but has no built-in rotation (rotation must be custom).

Why is storing credentials in Secrets Manager and retrieving at runtime preferred over hardcoding them in code or environment variables?

It centralizes secrets, encrypts them at rest with KMS, enables automatic rotation and auditing via CloudTrail, and prevents secrets from leaking through source control, AMIs, or container images.

What is CloudHSM and how does it differ from AWS KMS in terms of key control?

CloudHSM provides dedicated, single-tenant FIPS 140-2 Level 3 hardware security modules where you have exclusive control of keys; AWS cannot access them. KMS is multi-tenant and managed by AWS. CloudHSM suits strict compliance and custom cryptographic needs.

What FIPS 140-2 validation levels are associated with AWS KMS and AWS CloudHSM respectively?

KMS HSMs are validated to FIPS 140-2 Level 3 (and offer FIPS endpoints), and CloudHSM provides FIPS 140-2 Level 3 validated single-tenant HSMs giving the customer sole control of key material.

What is a KMS custom key store and how does it relate to CloudHSM?

A custom key store backs KMS keys with a CloudHSM cluster you control, combining the KMS API integration with AWS services and the single-tenant, customer-controlled HSM key material required for stricter compliance.

What is AWS Artifact and what does it provide for compliance?

AWS Artifact is a self-service portal for on-demand access to AWS compliance reports and documents (e.g., SOC, PCI DSS, ISO) and agreements, used as evidence for audits.

What is the difference between a security group and a network ACL in a VPC?

Security groups are stateful, operate at the instance/ENI level, support only allow rules, and evaluate all rules. Network ACLs are stateless, operate at the subnet level, support allow and deny rules, and are evaluated in numbered order.

Why must a network ACL have explicit outbound rules for return traffic while a security group does not?

NACLs are stateless, so response traffic must be explicitly allowed (often on ephemeral ports). Security groups are stateful and automatically allow return traffic for any permitted inbound/outbound flow.

What is the difference between a public subnet and a private subnet in a VPC?

A public subnet has a route to an internet gateway, allowing direct inbound/outbound internet access. A private subnet has no direct internet route; outbound internet access requires a NAT gateway/instance, providing isolation for backend resources.

What is a VPC endpoint, and how do Gateway vs Interface endpoints differ?

A VPC endpoint privately connects a VPC to AWS services without traversing the internet. Gateway endpoints (route-table entries) support only S3 and DynamoDB. Interface endpoints (PrivateLink ENIs with private IPs) support most other services.

What is the security benefit of a NAT gateway for private subnet instances?

It allows instances in private subnets to initiate outbound internet connections (e.g., updates) while preventing any unsolicited inbound connections from the internet, preserving isolation.

What is AWS Network Firewall and how does it differ from security groups/NACLs?

Network Firewall is a managed, stateful network/VPC-level firewall with IDS/IPS, domain filtering, and deep packet inspection using Suricata-compatible rules. It provides far richer controls than the basic allow/deny of security groups and NACLs.

What is AWS WAF and at which layer does it protect applications?

AWS WAF is a web application firewall operating at Layer 7 (HTTP/HTTPS). It filters requests by rules (SQL injection, XSS, rate limiting, geo, IP) and attaches to CloudFront, ALB, API Gateway, or AppSync.

What is AWS Shield Standard versus AWS Shield Advanced?

Shield Standard is free, automatic protection against common L3/L4 DDoS attacks. Shield Advanced is paid and adds enhanced detection, protection for higher-layer attacks, 24/7 DDoS Response Team access, WAF integration, and DDoS cost protection (billing reimbursement).

How does Amazon CloudFront improve security at the edge for an application?

CloudFront serves content from edge locations over TLS, integrates with AWS WAF and Shield for DDoS/L7 protection, supports Origin Access Control to restrict S3 origins, and can use signed URLs/cookies and geo-restriction to control access.

What is Origin Access Control (OAC) for CloudFront with S3?

OAC restricts an S3 bucket so it can only be accessed through the CloudFront distribution (not directly), by having CloudFront sign origin requests; the bucket policy denies all other access. It replaces the legacy Origin Access Identity (OAI).

What is Amazon GuardDuty and what data sources does it analyze?

GuardDuty is a managed threat-detection service using ML and threat intelligence to find malicious or unauthorized activity. It analyzes CloudTrail events, VPC Flow Logs, and DNS logs (plus optional S3, EKS, malware, and RDS protection) without deploying agents.

What is AWS CloudTrail and what does it record?

CloudTrail records account activity by logging API calls and management/data events (who, what, when, from where) for governance, compliance, auditing, and incident investigation. Logs can be delivered to S3 and CloudWatch Logs.

What is the difference between AWS CloudTrail and Amazon CloudWatch?

CloudTrail audits API activity (who did what to which resource) for governance/security. CloudWatch monitors operational performance via metrics, logs, alarms, and dashboards. CloudTrail = audit trail; CloudWatch = monitoring/observability.

What is AWS Config and what core question does it answer?

AWS Config records and evaluates resource configurations over time, answering 'what is my configuration and is it compliant?'. It tracks configuration history/changes and uses Config rules to flag non-compliant resources.

What is Amazon Inspector and what does it assess?

Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.

What is Amazon Macie and what is its primary purpose?

Macie is a managed data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data (e.g., PII, credentials) stored in Amazon S3.

What is AWS Security Hub and how does it relate to GuardDuty, Inspector, and Macie?

Security Hub is a central dashboard that aggregates, normalizes, and prioritizes security findings from GuardDuty, Inspector, Macie, and partner tools, and runs automated compliance checks against standards (CIS, PCI DSS, AWS Foundational Best Practices).

What are VPC Flow Logs and what security purpose do they serve?

VPC Flow Logs capture metadata about IP traffic to/from network interfaces (source/dest IPs, ports, protocol, accept/reject). They support troubleshooting, traffic analysis, and detecting anomalous or unauthorized network activity, and feed GuardDuty.

What is AWS IAM Access Analyzer and what does it detect?

Access Analyzer uses automated reasoning to identify resources (S3 buckets, roles, KMS keys, etc.) shared with external entities or made public, flagging unintended access, and it can validate and generate least-privilege policies.

Under the AWS Shared Responsibility Model, who is responsible for encryption configuration, IAM policies, and OS patching on EC2?

The customer. AWS is responsible for security OF the cloud (hardware, global infrastructure, managed service software); the customer is responsible for security IN the cloud, including IAM, encryption settings, network/firewall config, and guest OS patching on EC2.