AWS Cloud Security Services and Defense in Depth – SAP-C02 Study Guide

Purpose of This Lesson

AWS security is not provided by a single service. A secure architecture combines identity controls, network protections, encryption, certificate management, directory integration, and application-layer defenses. This lesson introduces the major security services covered in the security section and establishes a defense-in-depth mindset for AWS exam scenarios.

Key Concepts

Defense in depth

AWS security designs should use multiple independent controls. A typical application may combine:

• AWS Identity and Access Management (IAM) for authentication and authorization.
• Security groups for stateful instance- and network-interface-level traffic filtering.
• Network ACLs (NACLs) for stateless subnet-level traffic filtering.
• AWS Key Management Service (KMS) for creating and controlling encryption keys.
• AWS Certificate Manager (ACM) for managing SSL/TLS certificates.
• AWS WAF for filtering malicious web requests.
• AWS Shield for protection against distributed denial-of-service (DDoS) attacks.
• AWS Directory Service for managed directory capabilities and integration with Microsoft Active Directory environments.

These controls address different layers of the architecture. IAM does not replace network filtering, and WAF does not replace encryption or authorization.

AWS Directory Service

AWS Directory Service provides directory-related capabilities in AWS. It can support scenarios such as:

• Connecting AWS workloads to an existing on-premises Microsoft Active Directory environment.
• Running a managed directory in AWS.
• Providing directory functionality for applications that depend on LDAP-compatible or Microsoft directory features.

The exam distinction is usually architectural: determine whether the requirement is directory integration, identity federation, application authorization, or ordinary AWS resource permissions. These are related but are not interchangeable concerns.

AWS Key Management Service (KMS)

KMS is used to create and control cryptographic keys used to protect data. It commonly supports encryption for AWS services and applications, including scenarios involving customer-controlled key policies and auditability.

When evaluating an encryption requirement, identify:

• Whether data must be encrypted at rest, in transit, or both.
• Who controls the key and key policy.
• Which AWS service performs the encryption operation.
• Whether the application must perform client-side encryption itself.
• Whether key usage must be auditable and restricted by IAM or resource policies.

KMS is a key-management service; it is not a general replacement for IAM, ACM, or application authorization.

AWS Certificate Manager

AWS Certificate Manager (ACM) provisions and manages SSL/TLS certificates for supported AWS-integrated services. It is relevant when an architecture needs HTTPS encryption and certificate lifecycle management without manually operating certificate infrastructure.

Certificate management is distinct from request filtering. ACM helps establish encrypted connections, while AWS WAF evaluates HTTP or HTTPS requests for application-layer threats.

AWS WAF

AWS WAF protects supported web applications by inspecting and filtering HTTP and HTTPS requests. It can help mitigate common web exploits and enforce rules based on characteristics such as request patterns, IP addresses, headers, or geographic attributes.

WAF is an application-layer control. It should not be selected as the primary defense against every type of network attack, and it does not replace secure coding, IAM, encryption, or DDoS-specific protection.

AWS Shield

AWS Shield is designed to protect AWS resources from DDoS attacks. DDoS protection concerns the availability impact of large volumes of malicious traffic and is different from filtering individual web requests based on application rules.

In exam scenarios, distinguish between:

• DDoS resilience: AWS Shield and architectural scaling or distribution strategies.
• Web request inspection: AWS WAF.
• Transport encryption: ACM certificates and TLS termination.
• Resource authorization: IAM and resource policies.

Security groups and network ACLs

Security groups and NACLs provide network-level controls, but they operate differently:

• Security groups are associated with resources such as elastic network interfaces, are stateful, and use allow rules.
• NACLs are associated with subnets, are stateless, and support both allow and deny rules.

These controls complement identity and application-layer security. A correctly configured security group does not ensure that an application is authorized to access a resource, and a NACL does not inspect web requests like WAF.

Exam-Relevant Takeaways

• Build security as a layered architecture, not as a single-service solution.
• Use IAM to control access to AWS resources and APIs.
• Use security groups and NACLs for network traffic control at different scopes.
• Use KMS when the scenario requires managed encryption keys, key policies, or centralized key control.
• Use ACM to manage SSL/TLS certificates for supported AWS services.
• Use WAF to inspect and block common malicious HTTP/HTTPS requests.
• Use Shield when the primary concern is DDoS protection.
• Use AWS Directory Service when workloads require a managed directory or integration with an existing Active Directory environment.
• Check whether the requirement concerns identity, network access, encryption, certificate management, web filtering, or DDoS protection before selecting a service.

Architecture Decision Guide

Requirement	Primary AWS capability	What it addresses	What it does not replace
Control who can call AWS APIs or access resources	IAM	Authentication and authorization	Network filtering or web request inspection
Restrict traffic to a resource or interface	Security groups	Stateful resource-level network filtering	IAM or application authorization
Filter traffic at subnet boundaries	Network ACLs	Stateless subnet-level allow and deny rules	WAF or IAM
Manage encryption keys and key permissions	AWS KMS	Key creation, control, and use for encryption	Certificate management or user authorization
Enable HTTPS with managed certificates	AWS Certificate Manager	SSL/TLS certificate lifecycle	WAF request filtering
Block common malicious web requests	AWS WAF	HTTP/HTTPS application-layer filtering	General DDoS protection or encryption
Protect against DDoS attacks	AWS Shield	DDoS defense	Fine-grained application request rules
Use or integrate with directory services	AWS Directory Service	Managed directory and Active Directory scenarios	General IAM permissions for AWS APIs

Common Exam Traps

• Confusing WAF with Shield: WAF filters web requests; Shield addresses DDoS attacks.
• Treating ACM as an encryption-at-rest service: ACM manages TLS certificates, while KMS manages encryption keys.
• Assuming security groups provide authorization: Security groups control network reachability, not whether a principal is permitted to perform an operation.
• Confusing NACLs and security groups: NACLs are subnet-level and stateless; security groups are resource-level and stateful.
• Using IAM for on-premises directory integration: IAM controls AWS identities and permissions, while Directory Service addresses directory-based requirements.
• Selecting one control for every threat: Strong designs combine identity, network, encryption, application, and availability protections.
• Assuming HTTPS alone blocks attacks: TLS protects the connection, but WAF may still be needed to inspect and block malicious application requests.

Real-World Engineer Notes

• Start security design by classifying the threat and control objective rather than jumping to a service name.
• Separate confidentiality controls, such as encryption, from integrity and authorization controls, such as IAM policies and application permissions.
• Document which layer owns each control. For example, a security group may restrict a database port while IAM controls administrative access to the database service.
• Treat certificate, key, and directory lifecycles as operational concerns. Expiration, rotation, access review, and monitoring can create outages or security gaps if ignored.
• Use multiple controls so that failure or misconfiguration in one layer does not expose the entire application.

Quick Reference Summary

• IAM: AWS identity and access control.
• Security groups: Stateful, resource-level network filtering.
• NACLs: Stateless, subnet-level network filtering.
• KMS: Managed cryptographic key control and encryption integration.
• ACM: SSL/TLS certificate management.
• WAF: HTTP/HTTPS request inspection and filtering.
• Shield: DDoS protection.
• Directory Service: Managed directory and Active Directory integration.
• Core strategy: Apply defense in depth across identity, network, data, application, and availability layers.

Flashcards

1. Q: What is the central security design principle for AWS architectures?

A: Defense in depth: combine multiple independent controls across identity, network, data, application, and availability layers.

1. Q: Which service controls permissions to AWS resources and APIs?

A: AWS Identity and Access Management (IAM).

1. Q: Which service manages cryptographic keys used for encryption?

A: AWS Key Management Service (KMS).

1. Q: What is the primary purpose of AWS Certificate Manager?

A: To provision and manage SSL/TLS certificates for supported AWS-integrated services.

1. Q: Which AWS service filters malicious HTTP and HTTPS requests?

A: AWS WAF.

1. Q: Which AWS service is associated with DDoS protection?

A: AWS Shield.

1. Q: How do security groups differ from NACLs?

A: Security groups are stateful and associated with resources or network interfaces; NACLs are stateless and associated with subnets.

1. Q: Which AWS capability supports managed directories and Active Directory integration?

A: AWS Directory Service.

1. Q: Does ACM replace KMS for encrypting data at rest?

A: No. ACM manages TLS certificates; KMS manages encryption keys.

1. Q: Does WAF replace Shield?

A: No. WAF filters application-layer web requests, while Shield focuses on DDoS protection.

Practice Questions

Question 1

A company hosts a public HTTPS application on AWS. It wants to block common web exploits such as malicious request patterns while continuing to serve valid users. Which service is most appropriate?

A. AWS Shield
B. AWS WAF
C. AWS KMS
D. AWS Certificate Manager

Correct answer: B. AWS WAF

Explanation: AWS WAF evaluates HTTP and HTTPS requests and can block requests that match defined web security rules. Shield is focused on DDoS protection, KMS manages encryption keys, and ACM manages certificates.

Question 2

An architect must encrypt application data and ensure that the organization controls the cryptographic keys and their permissions. Which service should be included in the design?

A. AWS Certificate Manager
B. AWS Directory Service
C. AWS Key Management Service
D. Network ACLs

Correct answer: C. AWS Key Management Service

Explanation: KMS provides managed cryptographic key control and integrates with AWS services that support encryption. ACM handles TLS certificates rather than general encryption-at-rest key management.

Question 3

A workload must connect to an existing on-premises Microsoft Active Directory environment and use directory-based capabilities in AWS. Which service is the best fit?

A. AWS Directory Service
B. AWS Shield
C. AWS WAF
D. AWS Certificate Manager

Correct answer: A. AWS Directory Service

Explanation: AWS Directory Service supports managed directory scenarios and integration with Microsoft Active Directory environments. The other options address DDoS protection, web request filtering, and TLS certificates.

Question 4

A security design requires subnet-level traffic filtering with both explicit allow and deny rules. Which control should the architect use?

A. Security groups
B. IAM policies
C. Network ACLs
D. AWS KMS key policies

Correct answer: C. Network ACLs

Explanation: NACLs apply at the subnet level, are stateless, and support allow and deny rules. Security groups are stateful, resource-level controls and use allow rules.