AWS Certified Security Specialty Course SCS-C03

Explore AWS Identity and Access Management (IAM) fundamentals, covering authentication, authorization, users, groups, roles, and policies, with hands-on exercises configuring the CLI and multifactor authentication.

Discover how AWS identity and access management enables authentication and authorization with users, roles, and policies. Manage access via user groups, identity-based policies, and programmatic credentials.

Learn IAM authentication methods and multi-factor authentication in AWS, differentiate console access via password from programmatic access with access keys, and cover root and IAM user MFA best practices.

Enable multi-factor authentication for an AWS user by using a virtual MFA with Google Authenticator, scanning a QR code, and entering two codes to sign in.

Explore the AWS security token service STS, comparing short-term and long-term credentials, and learn to obtain temporary credentials via assume role, SAML, and web identity for federated access.

Deepen your understanding of identity and access management by exploring identity-based and resource-based policies, implementing role-based and attribute-based access control, and examining evaluation logic and structure, including permissions boundaries.

Learn IAM policy structure in AWS by reading JSON policy statements, applying actions, effects, and resources to manage bucket-level and object-level permissions.

Learn how to implement role-based access control by creating a billing admins group, attaching the AWS managed billing policy, and adding users like Joanne to grant bill-paying permissions.

Use attribute-based access control to restrict RDS actions by policy conditions tied to department and environment tags, demonstrated through a DB Admins group, Dave, and production vs development databases.

Apply a permissions boundary to limit IAM permissions and prevent privilege escalation, ensuring users cannot exceed the administrator's access.

Learn to use the AWS policy generator to create IAM policies with granular actions for S3 and EC2, attach inline policies to a test user, and validate permissions.

Configure and enforce management policies across AWS organizations to centrally control resources and standardize configurations, backups, tagging, chat applications policies, ai services opt-out policies, and security hub practices.

Explore service control policies, comparing denial and allow list strategies, and see how explicit denies override allows while permissions flow down the OU hierarchy to govern DynamoDB, EC2, and CloudWatch.

Explore the use cases for IAM roles, leveraging AWS STS for temporary credentials, compare roles with access keys, and apply least privilege across EC2, Lambda, ECS, and cross-account access.

Explore AWS Organizations and Control Tower for centralized governance of multiple accounts, using service control policies, tag policies, and guard rails, preventive via SEPs and detective via RCPs.

Master AWS infrastructure security by examining VPC components, ACLs, security groups, Direct Connect, and VPNs, and implement host-based security for EC2. Leverage infrastructure as code for secure AWS deployments.

Explore secure VPC design, including regional structure, availability zones, subnets, route tables, internet gateways, IPv4 and IPv6, private subnets, and NAT gateways.

Create a custom vpc with public and private subnets across two availability zones and an internet gateway, manually and with the vpc wizard, understanding cidr blocks and routing.

Explore how security groups and network ACLs protect AWS resources in a VPC, comparing stateful and stateless filtering, subnet versus instance level application, and allow versus deny rules.

Configure security groups and NACLs to manage inbound and outbound traffic, test connectivity with instance connect, and explore security group chaining and stateless ACL behavior.

VPC peering creates a private network connection between two VPCs, enabling cross-account and cross-region communication with private IP addresses, non-overlapping CIDR blocks, and bi-directional routing.

Explore VPC endpoints to keep traffic private and avoid the internet. Use interface endpoints (ENI) for many AWS services and gateway endpoints for S3 and DynamoDB with route table updates.

Explore securing AWS Direct Connect with private and public virtual interfaces, VGW connectivity, and transit VIFs, and compare MacSec encryption and IPsec VPN options for end-to-end protection.

Use IAM roles for delegating to applications with short-term credentials via STS in AWS, avoiding exposure from access keys, which are long-term and tied to a user account.

Automating infrastructure as code uses templates in JSON or YAML to define resources, and CloudFormation provisions and manages them as stacks, with rollback, version control, and change sets.

Create an AWS config rule to flag security groups exposing non port 80 access and use SSM automation to remediate noncompliant resources by revoking ingress.

Explore AWS network security tools, including the VPC Reachability Analyzer, Network Access Analyzer, and Amazon Inspector, to troubleshoot connectivity, verify configurations, and enable secure application-level access with AWS Verified Access.

Identify unintended access in your VPC and verify compliance using network access analyzer. Define scopes with match conditions to report findings across network interfaces and gateways.

Learn infrastructure security across regions and availability zones, design with VPCs, subnets, security groups, and NACLs, and enable private connectivity, endpoints, and HA with NAT, VPC peering, and transit gateway.

Secure the network edge by applying Route 53 DNS routing, CloudFront caching, and protections from AWS WAF, AWS Shield, the DNS firewall, and the network firewall.

Master DNS resolution with Amazon Route 53 by creating public and private hosted zones, configuring routing policies, and distinguishing CNAME and alias records at the zone apex.

Explore how CloudFront handles SSL/TLS certificates (ACM or third-party), enables server name indication for multiple domains on one IP, and configures viewer and origin protocols across S3, ALB, and EC2.

Explore lambda at edge to run no js and python lambda functions near viewers, processing at viewer request, origin request, origin response, and viewer response to customize cloudfront content.

Explore AWS network firewall for VPC protection with stateful and stateless filtering, intrusion prevention, web filtering, and Route 53 Resolver DNS firewall, all managed across accounts by Firewall Manager.

Centralize policy management for WAF, Shield, network firewall, and Route 53 DNS firewall across an AWS organization using AWS Firewall Manager. Configure administrator accounts and auto remediation for security groups.

Explore encryption in transit and at rest with AWS Certificate Manager, KMS, and CloudHSM; apply to S3, EBS, EFS, RDS, and DynamoDB, and secure credentials with Secrets Manager, Lambda.

Contrast encryption in transit and encryption at rest, with https and load balancers, and explain asymmetric versus symmetric encryption using public/private keys and data encryption keys.

Learn how AWS Certificate Manager enables encryption in transit with SSL/TLS certificates and at rest for S3, while managing, renewing, and importing certificates for services like ELB, CloudFront, and CloudFormation.

Protect DynamoDB and RDS with encryption at rest and in transit using TLS and KMS in a VPC and gateway endpoints. Understand encryption status, backups, replicas, and changes via snapshots.

Learn how to safely retire KMS keys by disabling them to prevent cryptographic use and scheduling deletion with a seven-day waiting period, enabling recovery if needed.

Master CloudWatch for logging, monitoring, and alarms with the unified CloudWatch agent on EC2 to collect logs and system metrics, while CloudTrail enables auditing with centralized S3 logs and alerts.

Explore AWS directory services, including managed Microsoft AD, AD Connector, and simple AD, detailing high-availability domain controllers, trust relationships, group policies, single sign-on, and on-premises integration.

Enable IAM Identity Center, integrate with AWS Organizations, configure identity source and MFA, create administrator and view-only permission sets, add a group and user, assign accounts, and use access portal.