AWS Defense in Depth: Layered Security Architecture – SAP-C02 Study Guide

Purpose of This Lesson

Defense in depth is the practice of applying multiple, independent security controls across an architecture. Instead of relying on a single firewall, identity provider, encryption mechanism, or monitoring tool, a secure AWS design uses layered protections so that the compromise or failure of one control does not expose the entire environment.

For the SAP-C02 exam, think about security across the complete path of a request and the complete lifecycle of data:

• Perimeter and edge
• Network and subnet boundaries
• Application and endpoint layers
• Identity and access management
• Data stores and storage media
• Logging, detection, and response

The goal is to reduce the impact of a security-control failure, limit unauthorized access, and avoid single points of security failure.

Key Concepts

Layered security controls

A defense-in-depth architecture combines preventive, detective, and responsive controls. Examples include:

• Preventive controls: IAM policies, security groups, network ACLs, AWS WAF rules, encryption, and least-privilege permissions
• Detective controls: AWS CloudTrail, VPC Flow Logs, Amazon GuardDuty, AWS Config, and centralized log analysis
• Responsive controls: automated isolation, credential revocation, security group changes, and incident response workflows

No single control should be expected to detect or block every threat.

Identity and access security

Identity is one of the most important security layers because network placement alone does not establish trust. Use:

• IAM roles instead of long-term access keys where possible
• Least-privilege policies and resource-based policies when appropriate
• Centralized workforce identity through AWS IAM Identity Center or an external identity provider
• Multi-factor authentication for privileged access
• Separate roles and accounts for workloads, administrators, deployment pipelines, and security operations

Role-based access control should be combined with strong authentication, permission boundaries or service control policies where required, and continuous review of permissions.

Perimeter and edge protection

For public-facing applications, traffic commonly enters through services such as Amazon CloudFront, Elastic Load Balancing, or Amazon API Gateway. Relevant controls include:

• TLS certificates managed with AWS Certificate Manager
• AWS WAF for HTTP and HTTPS request filtering
• AWS Shield protections for DDoS-related threats
• Route 53 routing and health-check capabilities
• Rate limiting and application-specific request rules

A load balancer can terminate TLS at the edge. However, terminating TLS there does not automatically encrypt traffic on every subsequent network segment.

Encryption in transit

Encryption requirements should be evaluated at each hop:

1. Client to edge or load balancer
2. Load balancer to web or application tier
3. Application tier to databases and other services
4. Cross-Availability Zone, cross-Region, or hybrid connectivity

Public-facing endpoints generally use certificates trusted by public certificate authorities. Internal services can use certificates issued by a private certificate authority, such as AWS Private CA, when internal TLS is required.

The correct design depends on data sensitivity, compliance requirements, service support, and operational complexity. If traffic contains sensitive data, encrypting only the internet-facing segment may be insufficient.

Network segmentation and traffic control

Use multiple network boundaries rather than placing every component in one flat VPC. Typical segmentation includes:

• Public subnets for components that must accept internet-routable traffic, such as internet-facing load balancers
• Private application subnets for compute workloads
• Isolated or tightly restricted data subnets for databases and internal services
• Separate VPCs or AWS accounts for applications, shared services, security tooling, and sensitive environments

AWS security groups are stateful virtual firewalls associated with elastic network interfaces. Network ACLs are stateless subnet-level controls. They serve different purposes and can be used together. Routing, VPC endpoints, AWS Network Firewall, and centralized inspection architectures can add further control points.

Security controls should address both directions of traffic:

• Ingress: traffic entering a subnet, security group, service, or workload
• Egress: traffic leaving a subnet, workload, or VPC toward another network or service

Unrestricted outbound access is a common weakness. Where practical, restrict egress destinations and use VPC endpoints to keep service traffic on private AWS connectivity.

Endpoint and workload security

Workloads still require protection after traffic passes through network controls. Examples include:

• Hardened operating systems and container images
• Timely patching
• Host-based security and vulnerability assessment
• Restricted instance roles
• Secrets stored in AWS Secrets Manager or Systems Manager Parameter Store rather than in code or user data
• Runtime monitoring and controlled administrative access

A trusted subnet does not make an individual instance, container, or function trustworthy by default.

Data protection at rest

Encrypt data stores according to the sensitivity of the data and applicable compliance requirements. Potential targets include:

• Amazon S3 objects
• Amazon EBS volumes and snapshots
• Amazon RDS and Aurora databases
• Amazon DynamoDB tables
• Amazon EFS file systems
• Backup data and exported snapshots
• Application-managed files and shared storage

AWS Key Management Service (AWS KMS) provides centralized key management for many AWS encryption integrations. Consider key policies, IAM permissions, key rotation requirements, separation of duties, and recovery procedures.

Encryption at rest should also account for data on backups, replicas, temporary files, and removable or underlying storage media. Encryption is valuable even when physical storage access is unlikely because it reduces the impact of unauthorized access to stored data.

Monitoring, detection, and response

Centralized visibility is required to identify attacks that bypass preventive controls. A security monitoring design may include:

• AWS CloudTrail: records AWS API activity and management events
• VPC Flow Logs: provides metadata about network traffic accepted or rejected by network interfaces, subnets, or VPCs
• Amazon GuardDuty: detects suspicious activity using AWS account, workload, and network signals
• AWS Config: evaluates resource configuration against rules and compliance requirements
• Amazon Inspector: helps identify software vulnerabilities and unintended network exposure
• Amazon Security Hub: aggregates and prioritizes security findings from supported services
• Amazon CloudWatch: supports operational metrics, logs, and alarms

Send logs and findings to a centralized, protected security account or logging account. Apply retention, access control, integrity protection, and alerting. Detection without a response process provides limited value, so high-confidence findings should trigger documented or automated actions where appropriate.

Architecture Decision Guide

Decision	Prefer	Important considerations
Public application entry point	CloudFront, API Gateway, or an internet-facing load balancer	Add TLS, AWS WAF, logging, and appropriate DDoS protections
TLS certificate for a public endpoint	AWS Certificate Manager public certificate	Public clients must be able to establish trust through the certificate chain
TLS for internal services	Private CA or another trusted internal PKI	Use when internal traffic is sensitive or compliance requires encryption in transit
Subnet-level traffic filtering	Network ACLs	Stateless; return traffic usually needs an explicit rule
Workload-level traffic filtering	Security groups	Stateful; use least-privilege source and destination rules
AWS API activity auditing	AWS CloudTrail	Centralize trails and protect log access and retention
Suspicious activity detection	GuardDuty, Security Hub, and related detection services	Detection must be integrated with triage and response processes
Encryption at rest	Native service encryption using AWS KMS where supported	Protect keys and verify that backups, replicas, and exports are also covered
Administrative access	Federated identity, MFA, and short-lived IAM roles	Avoid shared users and long-lived credentials
Outbound workload traffic	Restricted egress and VPC endpoints where suitable	Egress controls reduce data-exfiltration paths but add design complexity

Exam-Relevant Takeaways

• Defense in depth means multiple layers of protection, not multiple copies of the same control.
• IAM and network security are complementary. A private subnet does not replace least-privilege authorization.
• TLS termination at a load balancer protects the client-to-load-balancer connection. Re-encrypt traffic to the backend when end-to-end encryption is required.
• Public certificates and private certificates solve different trust problems. Public endpoints generally need publicly trusted certificates; internal services can use private PKI.
• Security groups are stateful; network ACLs are stateless and operate at the subnet boundary.
• Evaluate both ingress and egress. A design that blocks incoming attacks but permits unrestricted outbound communication may still enable data exfiltration.
• Encrypt databases, files, object storage, volumes, snapshots, backups, and replicas when the data is sensitive.
• Centralized logging and monitoring should be protected from alteration by the workloads being monitored.
• Automated response is useful for repeatable, high-confidence events, but destructive actions should be carefully scoped to avoid disrupting legitimate workloads.
• In larger environments, separate security and logging responsibilities from application accounts to improve isolation and governance.

Common Exam Traps

Treating a firewall as complete security

A firewall controls selected network flows. It does not replace identity controls, application-layer inspection, encryption, patching, data protection, or monitoring.

Assuming a private subnet provides encryption

Private routing reduces exposure to the public internet but does not encrypt application traffic by itself. Use TLS or service-specific encryption when encryption in transit is required.

Confusing security groups and network ACLs

Security groups are stateful and associated with network interfaces. Network ACLs are stateless and associated with subnets. The appropriate answer may require both, depending on the requirement.

Encrypting only the primary database

Backups, snapshots, replicas, exports, file stores, and temporary copies may contain the same sensitive data. A complete encryption strategy covers the entire data lifecycle.

Relying only on preventive controls

Attackers may use stolen credentials, exploit application vulnerabilities, or operate through allowed traffic. Logging, detection, alerting, and response are essential additional layers.

Using public certificates for internal-only names

Public certificate authorities generally cannot validate arbitrary private hostnames. Internal service-to-service TLS commonly uses a private CA or another internal trust model.

Allowing unrestricted outbound access by default

Open egress can make command-and-control traffic or data exfiltration easier. Restrict outbound destinations when the application and operational model permit it.

Real-World Engineer Notes

• Define security requirements per trust boundary and data flow rather than applying one blanket rule to the whole VPC.
• Document where TLS terminates and whether each subsequent hop is encrypted. This avoids ambiguity during audits and incident investigations.
• Centralize CloudTrail, security findings, and important logs in an account or environment with limited application access.
• Test that alerts are actionable. Excessive low-value alerts cause teams to ignore high-severity findings.
• Use infrastructure as code and AWS Config rules to detect drift in security groups, public exposure, encryption settings, and logging configuration.
• Build response playbooks for common events, such as a compromised access key, an exposed security group, or a GuardDuty finding involving an instance.
• Apply defense in depth across accounts, Regions, data centers, and branch connectivity—not just within one application VPC.

Quick Reference Summary

• Identity: least privilege, MFA, federation, short-lived roles
• Perimeter: CloudFront, load balancers, API Gateway, AWS WAF, Shield
• Network: VPC segmentation, security groups, network ACLs, routing, egress controls
• Application and endpoint: secure configuration, patching, image scanning, secrets management
• Data: encryption in transit and at rest, KMS, protected backups and replicas
• Visibility: CloudTrail, VPC Flow Logs, GuardDuty, Config, Security Hub, CloudWatch
• Response: alert triage, automated containment where safe, credential revocation, documented playbooks

Flashcards

1. Q: What is defense in depth?

A: A layered security strategy using multiple independent controls so that one compromised control does not expose the entire architecture.

1. Q: What are the major security layers in a typical AWS application?

A: Identity, perimeter, network, application, endpoint, data, monitoring, and incident response.

1. Q: What does TLS termination at a load balancer protect?

A: The connection between the client and the load balancer; backend traffic requires separate encryption if end-to-end TLS is required.

1. Q: When might an application use a private certificate authority?

A: For trusted TLS between internal services or private hostnames that are not intended for public certificate validation.

1. Q: How do security groups differ from network ACLs?

A: Security groups are stateful and attached to network interfaces; network ACLs are stateless and applied at the subnet boundary.

1. Q: Why should egress traffic be controlled?

A: To reduce unauthorized communication and data-exfiltration paths after a workload or credential has been compromised.

1. Q: What AWS service records AWS API activity?

A: AWS CloudTrail.

1. Q: What is the purpose of GuardDuty?

A: Detect suspicious or malicious activity using signals from AWS accounts, workloads, and network activity.

1. Q: What data should be considered for encryption at rest?

A: Primary stores, backups, snapshots, replicas, exports, file systems, object data, and other copies containing sensitive information.

1. Q: Why is centralized logging important?

A: It improves visibility and makes it harder for a compromised workload to alter or delete the evidence needed for detection and investigation.

Practice Questions

Question 1

A company hosts a sensitive web application behind an Application Load Balancer. TLS is configured from users to the load balancer, but the application servers are in private subnets. The security team requires encryption for all application traffic. What should the architect recommend?

A. Use security groups to encrypt traffic between the load balancer and application servers.
B. Install and configure certificates on the application servers and re-encrypt traffic from the load balancer to the targets.
C. Move the application servers to public subnets.
D. Replace the load balancer with a network ACL.

Correct answer: B

Explanation: Security groups filter traffic but do not provide encryption. TLS must be configured on the backend targets, with the load balancer establishing a separate encrypted connection to them. Public subnet placement is unnecessary and would increase exposure.

Question 2

A security architect wants to reduce the impact of a compromised EC2 instance. The instance needs to download updates from approved repositories but should not communicate freely with the internet. Which design best supports defense in depth?

A. Allow all outbound traffic and rely on inbound security group rules.
B. Place the instance in a public subnet with a public IP address.
C. Restrict outbound rules and route required AWS service traffic through suitable VPC endpoints or approved inspection paths.
D. Use only a network ACL that denies all inbound traffic.

Correct answer: C

Explanation: Restricting egress limits command-and-control and exfiltration paths. VPC endpoints can provide private access to supported AWS services, while approved inspection paths can control other required destinations. Inbound-only controls are not sufficient.

Question 3

An organization stores customer records in an Amazon RDS database and periodically exports them to Amazon S3 for analytics. The database is encrypted with an AWS KMS key. What additional security consideration is most important?

A. Encryption of the database makes the S3 exports automatically encrypted.
B. The organization should encrypt the S3 exports and control access to the associated KMS key and bucket.
C. The S3 bucket should be made public so analytics services can access it.
D. Network ACLs automatically encrypt data stored in S3.

Correct answer: B

Explanation: Encryption of one data store does not automatically protect copies exported elsewhere. The S3 bucket and objects require their own encryption and access controls, including appropriate KMS key and bucket policies.

Question 4

A company wants to investigate whether an attacker has used compromised AWS credentials. Which combination provides the most relevant visibility into AWS API activity and suspicious behavior?

A. CloudTrail and GuardDuty
B. Route 53 and Amazon EFS
C. AWS Certificate Manager and AWS WAF
D. Network ACLs and Amazon S3 lifecycle rules

Correct answer: A

Explanation: CloudTrail records AWS API activity, while GuardDuty analyzes signals for potentially malicious behavior. Together with centralized alerting and response processes, they provide important detective capabilities.

Question 5

A public application uses a certificate from a public certificate authority on its internet-facing load balancer. Internal service-to-service traffic contains sensitive customer information. Which approach best satisfies a requirement for layered encryption?

A. Use the public certificate only on the load balancer because all internal traffic is private.
B. Disable encryption internally to reduce certificate-management overhead.
C. Use trusted internal certificates for the service connections and retain the public certificate for the public endpoint.
D. Replace all certificates with network ACL rules.

Correct answer: C

Explanation: Public and internal connections have different trust requirements. Public certificates are appropriate for public clients, while private PKI or another internal trust model can provide TLS for sensitive service-to-service traffic.