Edward's AWS Certified Security Specialty Course (SCS-C02)

GuardDuty provides threat protection for AWS accounts and workloads by continuously monitoring data sources like CloudTrail and VPC logs to detect misconfigurations, compromised credentials, and suspicious activity.

Isolate a compromised ec2 instance with a dedicated isolation security group (no inbound or outbound rules); use network ACLs if needed, then identify the source and terminate and replace.

Remediate compromised AWS IAM roles by revoking active sessions, updating IAM policies to cut off old tokens, and leveraging instance profiles and the IMDS v1/v2 for short-lived credentials.

Investigate GuardDuty S3 findings to identify the IAM user or role behind a compromised bucket, then remediate access, apply least-privilege policies, and enforce block public access.

Remediate compromised S3 objects using GuardDuty malware protection, apply tag-based access control, and enforce read restrictions with IAM policies to block downloads of threats found.

Remediate compromised containers across ECS, Docker on EC2, and EKS by isolating tasks and updating images. Review Kubernetes config map, service accounts, and rotate access keys; redeploy with CI/CD.

Explore how AWS Config inventories resources, enforces compliance with built-in and custom rules, and enables automatic or manual remediation, including ACM certificate expiration check and Security Hub integration.

Explore how Security Hub provides a single pane of view across AWS services to assess and triage security posture against standards, and automate remediation with EventBridge.

Explore Amazon Inspector for vulnerability management across EC2, ECR, and Lambda; view findings by risk level, remediate critical issues, and integrate with Security Hub and EventBridge.

Analyze security findings with Amazon Detective, visualizing CloudTrail and VPC flow logs to identify root causes and trends, with integration to Security Hub, GuardDuty, and Security Lake.

Explore IAM access analyzer to identify external and unused permissions, remediate findings in S3, SNS, and role policies, and optimize IAM setups with CloudTrail insights.

Learn how AWS Systems Manager automates EC2 remediation with run commands, automation runbooks, and patch baselines, enabling fleet-wide patching, snapshot rollback, and compliant outcomes.

Learn to set up a CloudWatch alarm for low disk space using the CloudWatch agent and System Manager automation to safely halt batch processing when space runs low.

Discover how CloudWatch Logs organize data into log groups and streams, view storage size, and access log data, highlighting the centralized logging approach used by AWS services and applications.

Explore debugging IAM permissions for CloudWatch logs by creating a Lambda function, examining log groups and streams, and using CloudTrail event history to refine policies.

VPC flow logs capture IP traffic on network interfaces and publish to CloudWatch Logs, S3, or Data Firehose for diagnosing security group issues and monitoring traffic with no latency.

Explore dns resolver logs in Amazon Route 53, including resolver query logging and log destinations such as CloudWatch, s3, or kinesis, and how caching affects log records.

Learn how to query CloudTrail logs stored in S3 with Amazon Athena, including creating trails, selecting events, partitioning data, and querying via the Glue data catalog.

Learn to query CloudWatch Logs Insights across multiple streams or log groups, using the query language and JSON field access, while following best practices to avoid excessive charges.

Explore edge security by provisioning EC2 web servers in public and private subnets behind a load balancer and CloudFront, with WAF, and securing traffic via security groups.

Deploy two EC2 instances, one public and one private, using a NAT gateway for internet access. Route traffic through an application load balancer to secure the web two instance.

Block direct user access to the load balancer and permit only CloudFront by using a secret header in CloudFront origins and a routing rule with a default 403 response.

Integrate the AWS web application firewall with CloudFront, configure a web ACL, and apply managed rules and core rule set to protect against SQL injections and OWASP top ten threats.

Implement geographic match rules in the WAF to block by country or region using MaxMind GeoIP data and CloudFront Web ACL, with country-first then region checks.

Enable AWS WAF logging to CloudWatch with a WAF logs prefix to capture sampled requests. Review blocked requests, HTTP headers, and geo labels to refine rules.

Learn to configure rate limiting in a web application firewall with a rate-based rule that caps requests at ten per minute by source ip or api key, with debugging logs.

Learn how to control egress and ingress traffic at the VPC perimeter using the AWS Network Firewall, NAT gateway, and route configurations, with TLS inspection and Suricata-based rules.

Enable VPC endpoints for Systems Manager and related AWS services to route traffic privately via private IPs, reducing NAT/gateway exposure and enhancing security, while considering per-endpoint costs.

Explore how to connect VPCs using a Transit Gateway, compare with VPC peering, and learn to attach VPCs, update route tables, and test cross-VPC connectivity at scale.

Use the VPC Reachability Analyzer to analyze paths between instances across accounts and regions, diagnosing security groups, network ACLs, and route table issues in transit gateways.

Explore how IAM Identity Center delivers single sign-on to the AWS console and API, federating users from Active Directory or other providers with permission sets and temporary credentials.

Explore how Amazon Cognito provides token-based authentication with user directories, external identity providers (OAuth, SAML, OIDC), and identity pools that issue temporary AWS credentials for services like S3.

Learn to set up an Amazon Cognito user pool for web app authentication, obtaining access and id tokens, and retrieving temporary AWS credentials.

Learn to create an Amazon Cognito identity pool and issue temporary AWS credentials to authenticated users. Configure roles, trust policies, and attribute-based access using claims and principal tags.

Explore identity and access management with IAM roles, including how principals such as users or EC2 assume roles via STS, using SAML or OIDC, with trust policies and permissions boundaries.

Explore different trust policies for IAM roles, covering assume role actions, cross-account access, SAML and web identity, OIDC providers, external IDs, and policy conditions.

Explore IAM permissions and policies, including managed versus inline policies, conditions, and practical examples with KMS, S3, and deny and allow logic.

Test IAM policies with the policy simulator and policy generator to verify allowed and denied actions on EC2 and SSM, including get document.

Discover how permission boundaries work with identity-based policies to produce effective permissions. Learn to limit access to services and safely grant user creation rights using a boundary.

Apply least privilege by granting specific actions, use the access analyzer and last access tab to identify over-permissive roles and remediate with customer managed policies.

Explore identity based versus resource based policies in AWS IAM, comparing role and user permissions with resource policies on resources like S3 buckets and their principals.

Block public access in S3 to prevent public bucket access, protecting data from breaches. For new accounts, enable account-wide block; if public objects are needed, use an alternative method.

Enforce encryption on the wire for S3 buckets by requiring https connections through a bucket policy. Deny non-https requests before allow rules to ensure secure access.

Understand how Amazon S3 encrypts data at rest by default with server-side encryption and an Amazon S3 managed key, plus options for KMS keys, bucket keys, and access control.

Learn to deploy a private RDS MySQL instance with encryption at rest and encrypted transit, using default or custom KMS keys, secure access via VPC subnets and EC2.

Learn to enforce TLS for Amazon RDS MySQL by using a CA bundle, installing the MySQL client, and configuring parameter groups to require secure transport and verify identity.

Forward the MySQL 3306 port from a local machine to an AWS RDS in a private subnet using the AWS SSM session manager, AWS CLI, and MySQL workbench.

Enable default EBS encryption for new EC2 volumes with a customer-managed KMS key to secure boot and data volumes, and understand data keys and decrypt workflows.

Explore how a KMS key policy governs access for encrypting and decrypting EBS volumes, detailing create grant constraints, generating data keys, service roles for auto scaling, and cross-account access.

discover how to deploy TLS with the AWS certificate manager, securing services through application and network load balancers, CloudFront, and API Gateway with DNS validation.

Adopt a multi-account strategy to separate production and staging, minimize blast radius, and control cross-account access with IAM across AWS Organizations.

Create an AWS organization with a management account, invite subaccounts, and implement IAM Identity Center for cross-account access and centralized account management.

Set up and govern an Atlas multi-account AWS environment with Control Tower, enforcing guardrails and CloudTrail across accounts. Configure landing zones, organizational units, account factory, and IAM Identity Center.

Service control policies act as guardrails that limit permissions across member accounts, deny tampering with control tower resources, and enforce regional and service-level restrictions.

Set up a landing zone with organizational units and accounts, enroll non-enrolled subaccounts, and apply preventative, detective, and proactive controls across CloudFormation, AWS Config, and AWS Security Hub.

Learn to share resources across AWS accounts with the AWS Resource Access Manager and Transit Gateway. Define resource shares, pick sharing scope, and ensure non overlapping VPC IP ranges.

Test the services and concepts yourself to prepare for the ALS exam, compare solutions to understand the business case, and consult the recommended documentation and blogs.