AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

DVA-C03 · LESSON 2

Security26% · 3 topics

Obtain credentials through roles and retrieve secrets from managed storage. Model output is not authorization: enforce tool access server-side. Isolate conversations and caches by user, and redact sensitive inputs and logs as required.

2.1Protect application and AI authorization boundaries

Concept

Obtain credentials through roles and retrieve secrets from managed storage. Model output is not authorization: enforce tool access server-side. Isolate conversations and caches by user, and redact sensitive inputs and logs as required.

How it works / steps

  1. Write requirements and success criteria first.
  2. Use a test environment and retain success and failure evidence.
  3. Review the result, then check your decisions with domain practice below.

Workplace example

Test rejection of another user’s session ID and an unauthorized tool request.

Common confusions and exam tips

Mini quiz

Q1. You are publishing an internal API with API Gateway. Only apps with internal IAM roles should be able to call it. Which authorization method is most appropriate?

  1. Keep the API public and tell users the API URL is confidential
  2. Put a NAT gateway in front of API Gateway to restrict sources
  3. Enable IAM authorization on the methods and allow the callers' roles to invoke them
  4. Issue API keys, embed them in each app, and identify callers only by matching the API key
Show answer and explanation

Answer: C Enable IAM authorization on the methods and allow the callers' roles to invoke them

IAM authorization evaluates SigV4-signed requests against IAM policies. API keys are for managing usage plans and are not sufficient as an authentication mechanism.

Q2. You want to limit who can use an encryption key. Which setting in the KMS key policy is most appropriate?

  1. Grant both key administration and usage permissions to all principals, including outside the account
  2. Allow kms:* to all IAM users and control who uses it in the app
  3. Leave the key policy empty so only the root user can use the key
  4. Separate key administrators from the roles that encrypt and decrypt, and allow each only the actions they need
Show answer and explanation

Answer: D Separate key administrators from the roles that encrypt and decrypt, and allow each only the actions they need

Separating key administration (policy changes, scheduling deletion) from key usage (Encrypt/Decrypt) in the key policy achieves separation of duties and least privilege.

Reference links

2.2Design secure access to AWS resources

Concept

The core of access design is IAM policy evaluation. An explicit deny always wins, and without an allow the result is an implicit deny. Across multiple accounts, AWS Organizations SCPs (service control policies) set the maximum permissions available in an account, and IAM Identity Center centralizes human access. Access to another account uses IAM role assumption (AssumeRole) and resource-based policies.

How it works / steps

  1. Federate human access through IAM Identity Center and an external IdP (SAML, OIDC)
  2. Use IAM roles for workloads and avoid long-term access keys
  3. Set organization-wide prohibitions with SCPs (Region restrictions, no disabling of logging and so on)
  4. Use roles with trust policies for cross-account access
  5. Detect externally shared resources with Access Analyzer

Workplace example

Staff in the audit account assume a read-only role in the production account with AssumeRole to investigate, and an SCP prevents CloudTrail from being stopped in every account.

Common confusions and exam tips

Mini quiz

Q1. Which statement about IAM policy evaluation is correct?

  1. Even if an identity policy allows access, the request is denied if any policy contains an explicit deny
  2. When an identity policy and a resource policy conflict, the policy created later always takes precedence
  3. Operations allowed by an SCP become possible even if no IAM policy allows them
  4. Operations not mentioned in any policy are allowed by default within the same account
Show answer and explanation

Answer: A Even if an identity policy allows access, the request is denied if any policy contains an explicit deny

In IAM, an explicit deny takes top priority, and anything not allowed anywhere is implicitly denied. SCPs only set the maximum permissions; they do not grant permissions themselves.

Q2. Mobile app users upload photos directly to their own folder in S3. What is the most appropriate approach that avoids embedding AWS credentials in the app?

  1. Issue scoped-down temporary credentials with a Cognito identity pool
  2. Encrypt the root user credentials and store them in the app
  3. Embed a shared IAM user's access key in the app and have all users share it
  4. Make the S3 bucket public so anyone can write to it
Show answer and explanation

Answer: A Issue scoped-down temporary credentials with a Cognito identity pool

Cognito identity pools issue temporary credentials based on an IAM role to authenticated users. Policy variables can limit writes to the user's own prefix.

Reference links

2.3Determine appropriate data security controls

Concept

Data protection uses encryption at rest (AWS KMS: AWS managed keys and customer managed keys), encryption in transit (TLS with ACM certificates), access control (bucket policies, S3 Block Public Access), and backup and retention (AWS Backup, S3 Versioning, S3 Object Lock). Separate key users from key administrators and control them with key policies.

How it works / steps

  1. Decide data classifications (confidential, internal, public)
  2. Enable S3 Block Public Access and set default encryption
  3. Use customer managed keys (with automatic rotation) when auditing or key management is required
  4. Put records that must not be tampered with under S3 Object Lock (compliance mode)
  5. Check where sensitive data lives with Macie

Workplace example

Financial transaction records are stored for 7 years unchangeable with S3 Object Lock, encrypted with a customer managed key, and key use is audited in CloudTrail.

Common confusions and exam tips

Mini quiz

Q1. Which is a correct characteristic of resource-based policies such as S3 bucket policies?

  1. When a resource-based policy is used, all IAM identity policies in the same account are always ignored
  2. They are attached to an IAM user to specify every service that user can use
  3. Like SCPs, they set organization-wide maximums and cannot grant permissions
  4. They are attached to a resource and specify which principals (including other accounts) can do what
Show answer and explanation

Answer: D They are attached to a resource and specify which principals (including other accounts) can do what

Resource-based policies are attached to resources and use the Principal element to specify who is allowed. They can be used for cross-account access.

Q2. You are designing access from another AWS account. Staff in the audit account need to temporarily review CloudTrail, Config, EC2 and other resources in the production account. Which is the most appropriate approach?

  1. Allow the operations for the other account with an SCP
  2. Create IAM users in your own account for the other party's staff and hand them out
  3. Allow read access to the other account's principals in an S3 bucket policy
  4. Create an IAM role in the target account and allow the other party to AssumeRole
Show answer and explanation

Answer: D Create an IAM role in the target account and allow the other party to AssumeRole

Assuming a role in the target account lets them use that role's permissions with temporary STS credentials. No long-term credentials need to be handed out.

Reference links

Lessons are written by this site based on public information and do not guarantee exam content. Product specifications change, so check the latest information at the reference links.

Notes (unofficial, original questions, no pass guarantee)