AWS Security Specialty Study Topics and Tips (SCS-C03)
66 key facts from the official AWS documentation, grouped into 8 study topics. Each note links to the AWS page it comes from, so you can verify it and go deeper. In the Android app you get one every 3 hours.
IAM policy evaluation, SCPs and boundaries
How AWS evaluates IAM policies: explicit deny, permissions boundaries, SCPs and RCPs, with the exact rules to know for the SCS-C03 exam.
9 notes
Confused deputy, External ID and presigned URLs
Give third parties and AWS services access safely: External ID, aws:SourceArn and aws:SourceAccount, RCPs and S3 presigned URL expiration.
5 notes
IAM Access Analyzer
What IAM Access Analyzer finds: external, internal and unused access, plus policy validation, custom policy checks and policy generation.
4 notes
AWS KMS keys, rotation and deletion
AWS KMS exam notes: key policies vs IAM, key administrators vs users, automatic and on-demand rotation, key deletion and imported key material.
16 notes
- The key policy grants no automatic access
- Unmanageable key
- Key administrators vs key users
- Grants for AWS services
- Automatic rotation
- Rotating does not re-encrypt data
- Manual vs automatic rotation
- AWS managed keys
- Multi-Region keys and rotation
- Key deletion
- Alarm on use during deletion
- Deleting an asymmetric encryption key
- Imported key material (BYOK)
- Deleting imported material vs deleting the key
- Symmetric ciphertext can't be recreated
- Alarm for imported material expiration
S3 Object Lock, Macie and Secrets Manager
Governance vs compliance mode, legal holds, Macie findings and discovery jobs, and Secrets Manager rotation for the AWS Security Specialty exam.
8 notes
GuardDuty, CloudTrail and AWS Config
GuardDuty data sources, CloudTrail log file integrity validation and AWS Config rules, conformance packs and aggregators for the SCS-C03 exam.
7 notes
Security groups, NACLs, VPC endpoints and WAF
Security groups vs NACLs, S3 gateway vs interface endpoints, Session Manager logging limits and AWS WAF rate-based rules for the SCS-C03 exam.
12 notes
- Security group vs NACL
- NACL rule order
- NACL association
- What SGs and NACLs don't filter
- Security group best practices
- Session Manager
- Session Manager logging limits
- S3 gateway endpoint
- aws:SourceIp doesn't work with endpoints
- A sourceVpce policy cuts off the console
- Rate-based rules
- WCU cost of rate-based rules
Incident response: compromised EC2 and credentials
Contain a compromised EC2 instance and leaked IAM credentials: memory capture, security groups vs NACLs, access keys and temporary credentials.
5 notes
Test what you just read
A note sticks when you use it. Answer practice questions on these topics.