AWS Certified Security Specialty Course SCS-C03

Create an AWS free tier account for guided hands-on exercises, set up a billing alarm to avoid charges, and learn the AWS CLI and Visual Studio Code for the course.

Create and manage AWS accounts using IAM to avoid root usage; configure users, groups, and policies; authenticate via console, CLI, or SDK to access EC2 and RDS resources.

Compare the AWS free plan and paid plan, understand credits up to $200 and free tier limits, and learn sign-up, upgrades, and billing alarms.

Set up an AWS account by adding an account alias and enabling billing access for IAM users, then create a budget with email alerts and explore Cost Explorer.

Set up your aws security toolkit by downloading the code from github, installing visual studio code and the aws cli, and accessing cloud shell with pre-configured credentials.

Explore AWS Identity and Access Management (IAM) fundamentals, covering authentication, authorization, users, groups, roles, and policies, with hands-on exercises configuring the CLI and multifactor authentication.

Discover how AWS identity and access management enables authentication and authorization with users, roles, and policies. Manage access via user groups, identity-based policies, and programmatic credentials.

Learn how IAM roles grant temporary access via STS assume role, with identity-based and resource-based policies defining explicit allows and implicit denies for services like S3.

Create an IAM user and a group, attach administrator access to the group, add the user to the group, and log in to the management console as that user.

Learn IAM authentication methods and multi-factor authentication in AWS, differentiate console access via password from programmatic access with access keys, and cover root and IAM user MFA best practices.

Enable multi-factor authentication for an AWS user by using a virtual MFA with Google Authenticator, scanning a QR code, and entering two codes to sign in.

Explore the AWS security token service STS, comparing short-term and long-term credentials, and learn to obtain temporary credentials via assume role, SAML, and web identity for federated access.

Deepen your understanding of identity and access management by exploring identity-based and resource-based policies, implementing role-based and attribute-based access control, and examining evaluation logic and structure, including permissions boundaries.

Explore identity-based and resource-based policies in AWS IAM, using json policy documents, detailing how actions (api calls) attach to users, groups, and roles, and how resources enable cross-account access.

Explore IAM policy evaluation and how explicit denies, SCPs, resource-based and identity policies, permissions boundaries, and session policies determine effective permissions.

Learn IAM policy structure in AWS by reading JSON policy statements, applying actions, effects, and resources to manage bucket-level and object-level permissions.

Learn how to implement role-based access control by creating a billing admins group, attaching the AWS managed billing policy, and adding users like Joanne to grant bill-paying permissions.

Use attribute-based access control to restrict RDS actions by policy conditions tied to department and environment tags, demonstrated through a DB Admins group, Dave, and production vs development databases.

Apply a permissions boundary to limit IAM permissions and prevent privilege escalation, ensuring users cannot exceed the administrator's access.

Learn to use the AWS policy generator to create IAM policies with granular actions for S3 and EC2, attach inline policies to a test user, and validate permissions.

Explore the IAM policy simulator to test a user’s permissions across services like EC2 and S3, view inline policies and boundaries, and validate impact with a policy sandbox.

Adopt identity provider federation with AWS for temporary credentials and roles, enforce MFA and least privilege, and use access analyzer and permissions boundaries across accounts.

Review the key IAM concepts for the AWS IAM exam cram, including principals (users, groups, and roles), identity-based and resource-based policies, and STS short-term credentials.

Explore AWS Organizations and Control Tower to govern multiple accounts with consolidated billing and security controls. Learn to apply service control policies, guardrails, switch roles, and perform cross-account access.

Explore how AWS organizations enable centralized governance across accounts using a management account, organizational units, tagging, and service control policies. Support auditing with CloudTrail and consolidated billing.

Create an organization in AWS Organizations, establish the management account, add production accounts, and apply service control policies for admin access.

Explore service control policies and resource control policies in AWS organizations, and learn how they set maximum, not granted, permissions; compare SEP and RCP behavior across accounts and resources.

Configure and enforce management policies across AWS organizations to centrally control resources and standardize configurations, backups, tagging, chat applications policies, ai services opt-out policies, and security hub practices.

Explore service control policies, comparing denial and allow list strategies, and see how explicit denies override allows while permissions flow down the OU hierarchy to govern DynamoDB, EC2, and CloudWatch.

Learn to implement service control policies in AWS Organizations by creating a prod organizational unit, applying a deny IAM role modification policy, and verifying restrictions across accounts.

Explore the use cases for IAM roles, leveraging AWS STS for temporary credentials, compare roles with access keys, and apply least privilege across EC2, Lambda, ECS, and cross-account access.

Master cross-account access to an S3 bucket by creating a role in the production account, configuring a trust policy with external id, and using the AWS CLI to assume it.

Explore how AWS Control Tower sits atop AWS Organizations to deliver a well architected landing zone with guardrails, Identity Center integration, and centralized auditing across accounts.

Explore AWS Organizations and Control Tower for centralized governance of multiple accounts, using service control policies, tag policies, and guard rails, preventive via SEPs and detective via RCPs.

Master AWS infrastructure security by examining VPC components, ACLs, security groups, Direct Connect, and VPNs, and implement host-based security for EC2. Leverage infrastructure as code for secure AWS deployments.

Explore secure VPC design, including regional structure, availability zones, subnets, route tables, internet gateways, IPv4 and IPv6, private subnets, and NAT gateways.

Create a custom vpc with public and private subnets across two availability zones and an internet gateway, manually and with the vpc wizard, understanding cidr blocks and routing.

Explore stateful and stateless firewalls, and compare security groups with network access control lists in AWS. See how ports, IPs, and return traffic are managed at instance and subnet levels.

Explore how security groups and network ACLs protect AWS resources in a VPC, comparing stateful and stateless filtering, subnet versus instance level application, and allow versus deny rules.

Configure security groups and NACLs to manage inbound and outbound traffic, test connectivity with instance connect, and explore security group chaining and stateless ACL behavior.

VPC peering creates a private network connection between two VPCs, enabling cross-account and cross-region communication with private IP addresses, non-overlapping CIDR blocks, and bi-directional routing.

Configure vpc peering between us east 1 and us west 1 using cloud formation, establish security groups and routes, and test private connectivity with ping and curl.

Explore VPC endpoints to keep traffic private and avoid the internet. Use interface endpoints (ENI) for many AWS services and gateway endpoints for S3 and DynamoDB with route table updates.

Create a VPC S3 gateway endpoint, configure the route to the endpoint, and verify access from an EC2 instance with S3 read-only permissions.

Learn how AWS site-to-site VPN creates a hybrid cloud link between a data center and AWS using IPEC tunnels, VGW, CGW, dual tunnels, and BGP or static routing.

Explore securing AWS Direct Connect with private and public virtual interfaces, VGW connectivity, and transit VIFs, and compare MacSec encryption and IPsec VPN options for end-to-end protection.

Create and configure a VPC flow log to capture IP traffic in a VPC, storing logs in CloudWatch logs or S3, and view traffic data.

Use IAM roles for delegating to applications with short-term credentials via STS in AWS, avoiding exposure from access keys, which are long-term and tied to a user account.

Learn to use access keys with EC2 and then replace them with an IAM role and instance profile to securely grant permissions, including S3 full access.

Explore host-based firewalls, security groups, and NACLs, and learn how OS firewalls plus Inspector assessments and session manager enable defense in depth for secure EC2 administration.

Launch an EC2 in a custom VPC private subnet and connect via the instance connect endpoint, establishing private connectivity with a security group and subnet configuration.

Connect securely to EC2 instances with Session Manager, enable the default host management configuration, ensure the agent is installed, and log commands with CloudWatch for an auditable port-free remote session.

Learn how to connect RDS, ElastiCache, and Lambda to a Vpc using subnets, ENIs, and security groups, and how OpenSearch and Redshift deploy within a VPC.

Define infrastructure as code with AWS CloudFormation by creating templates in JSON or YAML, deploying stacks, and updating or deleting resources with change sets.

Deploy a two-AZ VPC with CloudFormation using a YAML template to provision public and private subnets, internet gateway, NAT gateways, and route tables, then perform drift detection and updates.

Learn how AWS Config evaluates resource configurations against desired rules, stores changes, and triggers remediation via sns, eventbridge, and lambda. Discover managed and custom rules to enforce security best practices.

Create an AWS config rule to flag security groups exposing non port 80 access and use SSM automation to remediate noncompliant resources by revoking ingress.

Explore how AWS Transit Gateway acts as a scalable central hub that connects VPCs and on-prem networks, enables transitive routing, and simplifies routing with VPN, Direct Connect, and shared services.

Utilize AWS Resource Access Manager to share VPC subnets across accounts in the organization, enabling shared infrastructure while the VPC owner manages core networking and charges apply to the owner.

Explore how AWS service catalog centralizes IT services with CloudFormation templates, creates products and portfolios, and uses launch and template constraints and sharing to govern access for end users.

Explore AWS network security tools, including the VPC Reachability Analyzer, Network Access Analyzer, and Amazon Inspector, to troubleshoot connectivity, verify configurations, and enable secure application-level access with AWS Verified Access.

Identify unintended access in your VPC and verify compliance using network access analyzer. Define scopes with match conditions to report findings across network interfaces and gateways.

Use network access analyzer in the AWS network manager to identify findings and inbound paths from internet gateways to EC2 instances across public and private subnets.

Automate security across every stage of a CI/CD pipeline by integrating code scans, dependency checks, and configuration reviews with AWS CodePipeline, CodeBuild, and CodeGuru Security.

Explore AWS Systems Manager, an end-to-end management hub for AWS, on-premises, and multi-cloud resources, featuring automation, run command, inventory, patch manager, compliance, session manager, and parameter store.

Explore AWS Systems Manager Parameter Store as a hierarchical store for secrets and configuration values, storing passwords and connection strings as plain text or ciphertext, referenced by unique names.

Learn infrastructure security across regions and availability zones, design with VPCs, subnets, security groups, and NACLs, and enable private connectivity, endpoints, and HA with NAT, VPC peering, and transit gateway.

Secure the network edge by applying Route 53 DNS routing, CloudFront caching, and protections from AWS WAF, AWS Shield, the DNS firewall, and the network firewall.

Master DNS resolution with Amazon Route 53 by creating public and private hosted zones, configuring routing policies, and distinguishing CNAME and alias records at the zone apex.

Secure CloudFront content with signed URLs and signed cookies, including expiration, IP restrictions, and Lambda-backed authentication, and update from origin access identity to origin access control.

Deploy a CloudFront distribution to serve an S3 bucket's index.html, configure origin access, TLS certificate, Route 53 DNS, and test deployment before disabling and deleting.

Explore how CloudFront handles SSL/TLS certificates (ACM or third-party), enables server name indication for multiple domains on one IP, and configures viewer and origin protocols across S3, ALB, and EC2.

Explore lambda at edge to run no js and python lambda functions near viewers, processing at viewer request, origin request, origin response, and viewer response to customize cloudfront content.

Discover AWS WAF and web ACLs to filter traffic with IP sets, regex pattern sets, and geographic or SQL injection and cross-site scripting protection.

Protect your applications from DDoS attacks with AWS Shield, offering standard protection integrated with CloudFront and advanced, a costlier tier for enhanced inline mitigations and 24/7 support.

Explore AWS network firewall for VPC protection with stateful and stateless filtering, intrusion prevention, web filtering, and Route 53 Resolver DNS firewall, all managed across accounts by Firewall Manager.

Centralize policy management for WAF, Shield, network firewall, and Route 53 DNS firewall across an AWS organization using AWS Firewall Manager. Configure administrator accounts and auto remediation for security groups.

Explore security concepts in AWS, including Route 53 routing policies (geolocation, geoproximity, latency, health checks) and CNAME usage; secure delivery via HTTPS listeners, CloudFront access controls, WAF, certificates, and Shield.

Explore encryption in transit and at rest with AWS Certificate Manager, KMS, and CloudHSM; apply to S3, EBS, EFS, RDS, and DynamoDB, and secure credentials with Secrets Manager, Lambda.

Contrast encryption in transit and encryption at rest, with https and load balancers, and explain asymmetric versus symmetric encryption using public/private keys and data encryption keys.

Learn how AWS Certificate Manager enables encryption in transit with SSL/TLS certificates and at rest for S3, while managing, renewing, and importing certificates for services like ELB, CloudFront, and CloudFormation.

Create and validate an ACM SSL certificate using DNS validation in Route 53, then bind it to a CloudFront distribution serving index.html from a S3 bucket with HTTP to HTTPS redirect.

Learn how AWS KMS creates and manages symmetric and asymmetric keys, protected by hardware security modules, and how customer managed keys and data encryption keys integrate with AWS services.

Create two customer managed KMS keys in the AWS KMS console, configure symmetric encryption and policies, then restrict the second key to EC2 and RDS in us-east-1.

Discover AWS CloudHSM, a cloud-based hardware security module in your VPC that generates and controls encryption keys with PIPS 140-2 level 3 security, offering a single-tenant alternative to KMS.

Explore encryption options for S3, EBS, and EFS, including SSE-S3, SSE-KMS, client-provided keys, and client-side encryption, with default encryption, encryption in transit, and vault lock controls.

Enforce KMS encryption for an S3 bucket by using a bucket policy that denies unencrypted uploads and requires a KMS key for all objects.

Copy an encrypted EBS snapshot across AWS accounts, share it with the destination account, then decrypt and re-encrypt using the destination key, updating KMS key policies and roles as needed.

Protect DynamoDB and RDS with encryption at rest and in transit using TLS and KMS in a VPC and gateway endpoints. Understand encryption status, backups, replicas, and changes via snapshots.

Explore encryption options for AWS databases, focusing on RDS and DynamoDB, including selecting KMS keys, enabling encryption at rest, and cross-account snapshot sharing and re-encryption workflows.

Learn how to safely retire KMS keys by disabling them to prevent cryptographic use and scheduling deletion with a seven-day waiting period, enabling recovery if needed.

Learn to store secrets using AWS Systems Manager Parameter Store and AWS Secrets Manager, compare rotation capabilities, data types, and hierarchical keys, and identify services that support automatic rotation.

Secure lambda functions by using a function execution role with IAM permissions, encrypting environment variables with a KMS key, storing secrets with Secrets Manager, and enforcing TLS.

Orchestrate distributed applications with AWS Step Functions by defining a state machine in JSON and visualizing the workflow, executions, and logic over lambda functions.

Explore AWS data lifecycle management features to automate data retention, transition storage classes, and deletion across S3, EBS, and AMIs, helping you cut costs and meet compliance.

Explore AWS data integrity features like S3 object lock, glacier vault lock, and backup vault lock, with governance and compliance modes, retention rules, and legal holds.

Explore Amazon Verified Permissions, a centralized service that manages fine-grained authorization for users, applications, and systems, including third-party apps, using the CA policy language to define access rules.

Leverage AWS KMS, CMKs, and HSMs to manage keys, rotation, and policies, then encrypt RDS, EBS, EFS, and Lambda data with Secrets Manager for credentials.

Learn how to log, monitor, and audit AWS resources using CloudWatch, EventBridge, and CloudTrail, to monitor performance, log events, trigger actions from state changes, and audit API calls.

Master Amazon CloudWatch and EventBridge to monitor performance with metrics, set alarms, trigger actions like auto scaling, and collect logs via the unified CloudWatch agent for system level metrics.

Create a custom CloudWatch metric to monitor the memory utilization of an EC2 instance, then configure an alarm and an SNS notification.

Compare VPC flow logs, ELB access logs, and S3 server access logging to choose the right option for a scenario, detailing layer 3/4 IP data and layer 7 HTTP headers.

Learn how AWS CloudTrail records API calls, capturing who made the request, what action, resources touched, and when, with logs sent to S3, CloudWatch, or EventBridge for audits and compliance.

Create an Amazon EventBridge rule to capture CloudTrail API calls for EC2 stop events, invoke a Lambda function, and log results in CloudWatch for monitoring.

Normalize and analyze logs to turn diverse formats into a consistent, searchable dataset, then correlate events across apps, networks, and security tools using OpenSearch and Grafana for dashboards and insights.

Master CloudWatch for logging, monitoring, and alarms with the unified CloudWatch agent on EC2 to collect logs and system metrics, while CloudTrail enables auditing with centralized S3 logs and alerts.

Explore directory services and federation in AWS, including AWS managed Microsoft Active Directory, AD Connector, and single sign-on with IAM, SAML 2.0, and Amazon Cognito.

Explore AWS directory services, including managed Microsoft AD, AD Connector, and simple AD, detailing high-availability domain controllers, trust relationships, group policies, single sign-on, and on-premises integration.

Explore identity providers and federation, linking on-premises Active Directory to AWS via SAML and Cognito, enabling single sign-on and secure access to DynamoDB.

Enable IAM Identity Center, integrate with AWS Organizations, configure identity source and MFA, create administrator and view-only permission sets, add a group and user, assign accounts, and use access portal.

Explore Amazon Cognito's user pools for sign-in and sign-up with social IDPs, and identity pools for issuing temporary credentials via STS to access API Gateway and Lambda.

Explore directory services in AWS, including AWS managed Microsoft AD, AD connector, and Simple AD, with group policy, single sign-on, and MFA support.