Design Secure Architectures

Key Concepts

• Least Privilege: Grant only the minimum permissions needed — applies to IAM users, roles, and policies
• IAM Roles vs Users: Roles are preferred for AWS services (EC2, Lambda, etc.); users for humans; never hardcode credentials
• Resource-based vs Identity-based policies: Resource-based policies (S3 bucket policy, KMS key policy) attach to the resource; identity-based attach to the principal
• SCPs (Service Control Policies): Applied at AWS Organizations level — they limit what accounts can do, but don't grant permissions
• Permission Boundaries: Set the maximum permissions an IAM entity can have — useful for delegating admin without over-permissioning
• Encryption at rest: Use KMS (managed keys) or SSE for S3, EBS, RDS, etc.
• Encryption in transit: TLS/HTTPS — use ACM for certificates, enforce via bucket policies or ALB listeners
• VPC Security Layers: Security Groups (stateful, instance level) + NACLs (stateless, subnet level)
• Private vs Public Subnets: Public = internet-facing (IGW route); Private = no direct internet access, use NAT Gateway for outbound
• Secrets Management: Use Secrets Manager (auto-rotation) or Parameter Store (cheaper, no auto-rotation natively)
• WAF: Protects against Layer 7 attacks (SQLi, XSS) — attach to CloudFront, ALB, or API Gateway
• Shield: DDoS protection — Standard (free, always on) vs Advanced (paid, 24/7 response team)
• GuardDuty: Threat detection using logs (CloudTrail, VPC Flow Logs, DNS) — no agents needed
• CloudTrail: Logs all API calls — critical for auditing and forensics; enable in all regions

How It Works

Request Authorization Flow: 1. AWS evaluates all applicable policies (SCP → Permission Boundary → Identity Policy → Resource Policy) 2. Explicit Deny always wins — anywhere in the chain 3. Default is implicit deny — nothing is allowed unless explicitly permitted

VPC Traffic Flow: - Inbound: Internet → IGW → NACL (subnet) → Security Group (instance) - Security Groups are stateful (return traffic auto-allowed) - NACLs are stateless (must explicitly allow inbound AND outbound rules)

KMS Envelope Encryption: - Data is encrypted with a data key, which is itself encrypted by the KMS CMK - Decryption requires calling KMS to unwrap the data key first

Commands / Syntax / Key Values

Exam Gotchas

1. SCPs don't grant permissions — even if SCP allows something, IAM policies must also allow it. An SCP is a guardrail, not a grant.
2. NACLs are stateless — a common trap is allowing inbound traffic but forgetting the outbound rule (especially ephemeral ports 1024–65535 for responses).
3. Security Groups can't explicitly deny — you can only allow; to block specific IPs you need NACLs.
4. Secrets Manager ≠ Parameter Store — if the question mentions automatic rotation, answer is Secrets Manager. If cost-sensitive or simple config, use Parameter Store.
5. **IAM