AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

SAA-C03 · LESSON 1

Design Secure Architectures30% · 3 topics

Learn to design secure access to AWS resources, secure workloads and applications, and data security controls.

1.1Design secure access to AWS resources

1.1 Design secure access to AWS resources.

Concept

The core of access design is IAM policy evaluation. An explicit deny always wins, and without an allow the result is an implicit deny. Across multiple accounts, AWS Organizations SCPs (service control policies) set the maximum permissions available in an account, and IAM Identity Center centralizes human access. Access to another account uses IAM role assumption (AssumeRole) and resource-based policies.

How it works / steps

  1. Federate human access through IAM Identity Center and an external IdP (SAML, OIDC)
  2. Use IAM roles for workloads and avoid long-term access keys
  3. Set organization-wide prohibitions with SCPs (Region restrictions, no disabling of logging and so on)
  4. Use roles with trust policies for cross-account access
  5. Detect externally shared resources with Access Analyzer

Workplace example

Staff in the audit account assume a read-only role in the production account with AssumeRole to investigate, and an SCP prevents CloudTrail from being stopped in every account.

Common confusions and exam tips

Mini quiz

Q1. Which statement about IAM policy evaluation is correct?

  1. Even if an identity policy allows access, the request is denied if any policy contains an explicit deny
  2. When an identity policy and a resource policy conflict, the policy created later always takes precedence
  3. Operations allowed by an SCP become possible even if no IAM policy allows them
  4. Operations not mentioned in any policy are allowed by default within the same account
Show answer and explanation

Answer: A Even if an identity policy allows access, the request is denied if any policy contains an explicit deny

In IAM, an explicit deny takes top priority, and anything not allowed anywhere is implicitly denied. SCPs only set the maximum permissions; they do not grant permissions themselves.

Q2. Which is a correct property of SCPs?

  1. Attaching an SCP automatically grants the same permissions to IAM users in the target account
  2. An SCP sets the maximum for operations; IAM policies must also allow an operation for it to be performed
  3. SCPs can be attached only to individual IAM users, not to OUs
  4. SCPs also apply to the management account and can restrict its operations as well
Show answer and explanation

Answer: B An SCP sets the maximum for operations; IAM policies must also allow an operation for it to be performed

SCPs are the ceiling (guardrail) on operations available in member accounts and do not grant permissions. They do not affect the management account, and are applied per OU or account.

Reference links

1.2Design secure workloads and applications

1.2 Design secure workloads and applications.

Concept

This is design that protects at the network layer. Put the exposed tier (ALB) in public subnets and the app and DB in private subnets, and use security groups that reference each other to allow traffic “only from the ALB” or “only from the app.” Connect to S3 and DynamoDB through gateway VPC endpoints and to other services through interface VPC endpoints (PrivateLink) without going over the internet. Use AWS WAF and Shield for attack protection and GuardDuty for threat detection.

How it works / steps

  1. Separate the three tiers (web, app, DB) by subnet
  2. In security groups, specify other security groups as sources and allow the minimum
  3. Use VPC endpoints from private subnets to AWS services
  4. Attach WAF to the ALB or CloudFront
  5. Keep secrets in Secrets Manager with automatic rotation

Workplace example

The DB security group allows only the app's security group as a source, and the app reaches S3 through a gateway endpoint instead of NAT.

Common confusions and exam tips

Mini quiz

Q1. You are placing a three-tier web app (ALB, app servers, RDS) in a VPC. Which placement is most appropriate from a security standpoint?

  1. Put everything in private subnets and accept traffic through a NAT gateway
  2. Put the ALB and app in public subnets and RDS in private
  3. Put the ALB in public subnets, and the app and RDS in private subnets
  4. Put the app and RDS in public subnets and allow only the ALB via security groups
Show answer and explanation

Answer: C Put the ALB in public subnets, and the app and RDS in private subnets

Make the ALB the only entry point from the internet and put the app and database in private subnets. Use security groups to allow only the traffic each tier needs. [Other options] The app need not be public. A NAT gateway serves outbound traffic, not inbound entry. Public placement risks exposure through misconfiguration.

Q2. Which is a correct difference between security groups and network ACLs?

  1. Security groups can have deny rules, while network ACLs can only have allow rules
  2. Both are stateless, and both evaluate rules in number order
  3. Security groups apply per subnet and network ACLs apply per instance
  4. Security groups automatically allow return traffic, while network ACLs also need rules for return traffic
Show answer and explanation

Answer: D Security groups automatically allow return traffic, while network ACLs also need rules for return traffic

Security groups are stateful (allow only) and apply per instance (ENI); network ACLs are stateless (allow and deny, in number order) and apply per subnet.

Reference links

1.3Determine appropriate data security controls

1.3 Determine appropriate data security controls.

Concept

Data protection uses encryption at rest (AWS KMS: AWS managed keys and customer managed keys), encryption in transit (TLS with ACM certificates), access control (bucket policies, S3 Block Public Access), and backup and retention (AWS Backup, S3 Versioning, S3 Object Lock). Separate key users from key administrators and control them with key policies.

How it works / steps

  1. Decide data classifications (confidential, internal, public)
  2. Enable S3 Block Public Access and set default encryption
  3. Use customer managed keys (with automatic rotation) when auditing or key management is required
  4. Put records that must not be tampered with under S3 Object Lock (compliance mode)
  5. Check where sensitive data lives with Macie

Workplace example

Financial transaction records are stored for 7 years unchangeable with S3 Object Lock, encrypted with a customer managed key, and key use is audited in CloudTrail.

Common confusions and exam tips

Mini quiz

Q1. Mobile app users upload photos directly to their own folder in S3. What is the most appropriate approach that avoids embedding AWS credentials in the app?

  1. Issue scoped-down temporary credentials with a Cognito identity pool
  2. Encrypt the root user credentials and store them in the app
  3. Embed a shared IAM user's access key in the app and have all users share it
  4. Make the S3 bucket public so anyone can write to it
Show answer and explanation

Answer: A Issue scoped-down temporary credentials with a Cognito identity pool

Cognito identity pools issue temporary credentials based on an IAM role to authenticated users. Policy variables can limit writes to the user's own prefix.

Q2. Which statement correctly describes a permissions boundary?

  1. It caps the number of groups a user can belong to and does not affect the scope of permissions
  2. It sets the maximum permissions an IAM user or role can have; operations outside the boundary cannot be performed even if allowed
  3. It is applied to Organizations OUs to restrict operations across the whole organization
  4. It replaces resource-based policies to directly allow access to S3 buckets or KMS keys
Show answer and explanation

Answer: B It sets the maximum permissions an IAM user or role can have; operations outside the boundary cannot be performed even if allowed

A permissions boundary is a managed policy that sets the maximum permissions identity-based policies can grant. Applying limits to OUs is what SCPs do.

Reference links

Lessons are written by this site based on public information and do not guarantee exam content. Product specifications change, so check the latest information at the reference links.

Notes (unofficial, original questions, no pass guarantee)