Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS security architecture questions often test service selection rather than isolated feature memorization. The key decisions include whether identity should remain on premises, whether an application needs customer authentication or AWS access, and whether encryption keys require AWS-managed controls or dedicated hardware security modules.
This guide summarizes the security services and decision points covered in the lesson:
- AWS Directory Service options
- IAM federation and IAM Identity Center
- Amazon Cognito user and identity pools
- AWS Key Management Service (AWS KMS)
- AWS CloudHSM
- AWS Certificate Manager (ACM)
- AWS WAF
- AWS Shield
Key Concepts
AWS Directory Service Options
#### AWS Managed Microsoft AD
AWS Managed Microsoft AD is a fully managed Microsoft Active Directory deployment in AWS. It is appropriate when an organization needs Microsoft AD capabilities rather than only basic directory functionality.
Typical reasons to select it include:
- More than approximately 500 users
- Trust relationships with an on-premises Active Directory
- Schema extensions
- Microsoft-compatible directory functionality hosted in AWS
- A standalone directory for AWS workloads
A trust relationship can allow users and groups from an on-premises directory to access resources in the AWS-hosted domain through single sign-on. The connectivity between environments must be provided through a network path such as AWS Site-to-Site VPN or AWS Direct Connect.
#### AD Connector
AD Connector is a directory gateway or proxy. It redirects directory requests to an existing on-premises Active Directory rather than deploying a separate directory in AWS.
Use it when:
- The organization already has an on-premises AD deployment
- AWS services or EC2 instances must use the existing directory
- Directory identities should remain on premises
- Users need to authenticate to AWS management interfaces with on-premises AD credentials
AD Connector requires connectivity to the on-premises directory through VPN or Direct Connect. It does not replicate or cache directory data in AWS as a standalone domain controller would.
The lesson identifies two AD Connector sizes:
- Small: organizations with up to approximately 500 users
- Large: organizations with up to approximately 5,000 users
#### Simple AD
Simple AD is an inexpensive, standalone directory service in AWS that provides common directory features. It is generally the least expensive choice for smaller environments that do not need advanced Microsoft AD capabilities.
It supports capabilities such as:
- User and group management
- Group policies
- Kerberos-based single sign-on
- Joining Windows or Linux EC2 instances
It is a poor fit when the scenario requires advanced AD functionality, schema extensions, or trust relationships with an existing on-premises AD.
Federation and Application Identity
#### IAM Identity Providers
An IAM identity provider allows identities managed outside AWS to federate into AWS. Common federation protocols include:
- SAML 2.0
- OpenID Connect (OIDC)
Federation avoids creating and managing a separate IAM user for every external identity. The external identity provider authenticates the user, and AWS grants access through an IAM role and temporary credentials.
This pattern is useful for corporate directories, web applications, mobile applications, and social sign-in providers such as Google, Facebook, or Login with Amazon.
#### IAM Identity Center
IAM Identity Center, formerly AWS Single Sign-On, centrally manages workforce access to multiple AWS accounts and business applications. It is commonly used with AWS Organizations to assign users and groups permission sets across accounts.
Identity sources can include:
- The built-in Identity Center directory
- Active Directory
- Other supported external identity stores, such as Microsoft Entra ID integrations
IAM Identity Center is primarily a workforce access solution. It is usually a better fit than Cognito for employees and administrators who need access to AWS accounts and business applications.
#### Amazon Cognito
Amazon Cognito is designed for application users rather than AWS workforce administrators.
A Cognito user pool provides:
- User registration and sign-in
- User account management
- Application authentication
- Federation with social identity providers
- Federation with SAML- or OIDC-compatible identity providers
A Cognito identity pool exchanges authenticated identities for temporary, limited-privilege AWS credentials. Internally, the application obtains credentials through AWS Security Token Service (AWS STS) by assuming an IAM role.
The distinction is important:
- User pool: authenticates and manages application users
- Identity pool: provides temporary AWS credentials to authenticated or appropriately configured users
AWS KMS
AWS Key Management Service creates and manages cryptographic keys and integrates with many AWS services and applications.
KMS supports symmetric and asymmetric KMS keys. KMS keys are the primary resources managed by the service; older material may refer to them as customer master keys, or CMKs.
Important properties include:
- Symmetric key material and asymmetric private keys remain protected within KMS and are not exported unencrypted by default.
- KMS keys directly encrypt or decrypt only small payloads, with a maximum direct data size of 4 KB.
- For large data sets, KMS generates or decrypts data keys, while the application or integrated service performs the bulk encryption outside KMS.
- KMS does not store, manage, or perform encryption operations with data keys after they are returned. The caller must handle data-key usage and lifecycle.
This is the envelope encryption model:
- KMS generates a data key.
- The application uses the plaintext data key to encrypt data.
- The application stores the encrypted data key with the ciphertext.
- The plaintext data key is removed from memory when no longer needed.
- KMS can later decrypt the encrypted data key when authorized.
#### KMS Key Ownership and Control
| Key type | Managed by | Customer control | Typical use |
|---|---|---|---|
| Customer managed KMS key | Customer | Can define key policy, grants, aliases, and rotation settings | Detailed control, cross-account use, audit and compliance requirements |
| AWS managed KMS key | AWS service | Limited control; key is created and managed for an integrated service | Default encryption for supported AWS services |
| AWS owned key | AWS | Not visible or manageable by the customer | Service-managed encryption where AWS owns the key infrastructure |
AWS managed KMS keys are created and used on behalf of an integrated AWS service. Customers cannot manage their key policies or perform the same level of rotation and lifecycle control available with customer managed keys. When the scenario requires direct control over key policy, rotation, grants, or cross-account permissions, select a customer managed KMS key.
AWS CloudHSM
AWS CloudHSM provides dedicated hardware security modules in a VPC. The service uses single-tenant HSM hardware and gives the customer greater control over cryptographic keys and operations than KMS.
CloudHSM is appropriate when requirements include:
- FIPS 140-2 Level 3 validated hardware
- Customer control of key material and HSM administration
- Strict separation from AWS access to key material
- Custom cryptographic operations
- Offloading SSL/TLS processing
- Protecting private keys used by a certificate authority
- Hosting an Oracle Transparent Data Encryption master key
- A custom key store for AWS KMS
CloudHSM is managed as an AWS service, but the customer is responsible for more of the HSM configuration, users, policies, and operational design. It is not simply a higher-cost replacement for every KMS use case.
AWS Certificate Manager
AWS Certificate Manager (ACM) creates, stores, and renews SSL/TLS X.509 certificates. It supports:
- Single-domain certificates
- Multiple-domain certificates
- Wildcard certificates
- Public certificates issued by the AWS public certificate authority
- Private certificates through an ACM-integrated private CA
- Imported certificates from third-party certificate authorities
ACM integrates with services such as Elastic Load Balancing, Amazon CloudFront, AWS Elastic Beanstalk, AWS CloudFormation, and Nitro Enclaves.
A common architecture is to use an ACM certificate on an Application Load Balancer or CloudFront distribution, allowing TLS termination without manually managing certificate renewal on each web server.
AWS WAF
AWS WAF is a web application firewall for inspecting HTTP and HTTPS requests. A web ACL is associated with a supported resource, and rules determine whether requests should be allowed, blocked, counted, or otherwise handled.
WAF rules can inspect conditions such as:
- Source IP addresses and IP ranges
- Geographic origin
- HTTP headers
- Request body
- URI paths
- Request size
- Specific strings
- SQL injection patterns
- Cross-site scripting patterns
- Regular-expression matches
Core WAF components include:
- Web ACL: the policy attached to a protected resource
- Rule: inspection criteria and the resulting action
- Rule group: reusable collection of rules
- IP set: reusable list of IP addresses or ranges
- Regex pattern set: reusable collection of regular expressions
- Match statement: compares request attributes against configured conditions
- Rule action: commonly allow, block, or count
WAF is an application-layer control. It is not a replacement for security groups, network ACLs, or DDoS protection.
AWS Shield
AWS Shield is a managed Distributed Denial of Service protection service for applications running on AWS.
The two tiers are:
- Shield Standard: included at no additional charge and provides baseline DDoS protection for supported AWS services, including CloudFront.
- Shield Advanced: paid protection with additional capabilities and a subscription commitment, intended for applications with higher DDoS risk and stronger protection requirements.
Shield focuses on DDoS attacks, while WAF evaluates web requests against application-layer rules. They are complementary controls rather than interchangeable services.
Exam-Relevant Takeaways
- Choose AWS Managed Microsoft AD when the scenario needs advanced Microsoft AD features, schema extensions, or trust relationships.
- Choose AD Connector when the existing on-premises directory must remain the source of identity and AWS only needs a gateway to it.
- Choose Simple AD for a low-cost, standalone directory with basic features and no advanced AD requirements.
- VPN or Direct Connect is required for directory services that depend on an on-premises AD.
- Use IAM Identity Center for centralized workforce access across AWS accounts and business applications.
- Use Cognito user pools for application user registration and authentication.
- Use Cognito identity pools when authenticated application users need temporary AWS credentials.
- Use federation with SAML 2.0 or OIDC instead of creating duplicate IAM users for external identities.
- KMS is primarily a key-management and envelope-encryption service; it is not intended to encrypt large files directly with a KMS key.
- Select a customer managed KMS key when the customer must control key policy, rotation, grants, or cross-account permissions.
- Select CloudHSM when dedicated HSM hardware, customer-controlled key material, or FIPS Level 3 requirements are central to the design.
- Use ACM to automate certificate provisioning and renewal for integrated AWS services.
- Use WAF to filter malicious or unwanted HTTP/HTTPS requests.
- Use Shield for DDoS protection; use WAF for request inspection and application-layer filtering.
Architecture Decision Guide
| Requirement | Best-fit service or feature | Why |
|---|---|---|
| Existing on-premises AD must authenticate AWS workloads | AD Connector | Proxies directory requests to the existing directory |
| AWS-hosted Microsoft AD with trusts or schema extensions | AWS Managed Microsoft AD | Supports advanced Microsoft AD scenarios |
| Small, inexpensive standalone directory in AWS | Simple AD | Provides common directory functions at lower cost |
| Central workforce access to many AWS accounts | IAM Identity Center | Centralized users, groups, permission sets, and SSO |
| User sign-up and sign-in for a mobile or web application | Cognito user pool | Application identity directory and authentication |
| Application users need temporary AWS permissions | Cognito identity pool | Federates identities to STS and IAM roles |
| Managed encryption keys integrated with AWS services | AWS KMS | Central key management and service integration |
| Customer needs complete control of dedicated HSMs | AWS CloudHSM | Single-tenant HSMs and customer-controlled operations |
| Automated public TLS certificates for CloudFront or a load balancer | ACM | Certificate issuance, storage, and renewal |
| Block SQL injection, XSS, bad IPs, or unwanted HTTP requests | AWS WAF | Layer 7 request inspection and filtering |
| Protect public applications from DDoS attacks | AWS Shield | Managed DDoS detection and mitigation |
Common Exam Traps
- Confusing AD Connector with Managed Microsoft AD: AD Connector does not create an independent directory in AWS. It forwards requests to an existing on-premises AD.
- Selecting Simple AD for advanced AD requirements: Trust relationships and schema extensions point toward Managed Microsoft AD, not Simple AD.
- Using IAM Identity Center for customer sign-up: Identity Center is primarily for workforce and organizational access. Cognito is designed for application users.
- Confusing Cognito user pools and identity pools: A user pool authenticates users; an identity pool exchanges identities for temporary AWS credentials.
- Encrypting large objects directly with KMS: KMS has a small direct payload limit. Use envelope encryption and data keys for large data.
- Assuming all KMS keys have the same control model: Customer managed, AWS managed, and AWS owned keys differ significantly in policy, rotation, and visibility.
- Treating CloudHSM as a fully hands-off KMS alternative: CloudHSM offers more control but also introduces additional operational responsibility and cost.
- Using WAF as a DDoS replacement: WAF filters requests; Shield provides DDoS protection.
- Installing and renewing certificates manually on every server: ACM should be considered when certificates terminate on supported AWS services.
- Forgetting hybrid connectivity: AD Connector and AD trust scenarios require connectivity to the on-premises directory through VPN or Direct Connect.
Real-World Engineer Notes
- Design directory dependencies around failure domains and network reachability. If an application cannot reach the directory, authentication and authorization workflows may fail even when the application itself is healthy.
- Prefer IAM roles and temporary credentials over long-lived access keys for federated users and application workloads.
- Use customer managed KMS keys selectively. They provide control, but key policies and grants become additional operational and governance responsibilities.
- For envelope encryption, protect plaintext data keys carefully and minimize their lifetime in application memory.
- CloudHSM is most justified by regulatory, cryptographic, or key-custody requirements—not simply because it sounds more secure than KMS.
- Combine controls according to the threat model: security groups and network ACLs for network filtering, WAF for HTTP request inspection, and Shield for DDoS protection.
- ACM reduces certificate-management toil, but certificate deployment still depends on using a supported integration or managing imported certificates appropriately.
Quick Reference Summary
- Managed Microsoft AD: full AWS-hosted Microsoft AD; advanced features, trusts, and schema extensions.
- AD Connector: gateway to an existing on-premises AD; requires VPN or Direct Connect.
- Simple AD: low-cost standalone directory with basic functionality.
- IAM Identity Center: workforce SSO across AWS accounts and applications.
- Cognito user pool: application user authentication and registration.
- Cognito identity pool: temporary AWS credentials through STS and IAM roles.
- KMS: managed key service and envelope-encryption support; direct payload limit is 4 KB.
- CloudHSM: dedicated, customer-controlled HSMs in a VPC.
- ACM: create, import, store, and renew TLS certificates.
- WAF: inspect and filter web requests.
- Shield: managed DDoS protection.
Flashcards
- Q: When is AWS Managed Microsoft AD preferred over Simple AD?
A: When advanced Microsoft AD features, schema extensions, trust relationships, or larger directory requirements are needed.
- Q: What does AD Connector do?
A: It proxies directory requests from AWS to an existing on-premises Active Directory.
- Q: What connectivity is needed for AD Connector or an AD trust relationship?
A: A network connection such as AWS Site-to-Site VPN or AWS Direct Connect.
- Q: What is the primary use of IAM Identity Center?
A: Centralized workforce SSO and permissions across multiple AWS accounts and business applications.
- Q: What is the difference between a Cognito user pool and identity pool?
A: A user pool authenticates application users; an identity pool provides temporary AWS credentials to access AWS services.
- Q: Which federation protocols are commonly supported by IAM?
A: SAML 2.0 and OpenID Connect.
- Q: What is the direct payload limit for KMS encryption operations?
A: 4 KB; larger data should use envelope encryption with data keys.
- Q: What is a customer managed KMS key?
A: A KMS key whose policy, lifecycle, and configuration are controlled by the customer.
- Q: When should CloudHSM be considered instead of ordinary KMS usage?
A: When dedicated HSM hardware, customer control of key material, or FIPS Level 3 requirements are needed.
- Q: What does ACM manage?
A: Public and private X.509 SSL/TLS certificates, including storage and renewal for supported integrations.
- Q: What is the difference between WAF and Shield?
A: WAF filters web requests according to application-layer rules; Shield protects against DDoS attacks.
- Q: What is an IP set in AWS WAF?
A: A reusable collection of IP addresses or CIDR ranges used in rule statements.
Practice Questions
Question 1
A company has an on-premises Microsoft Active Directory and wants employees to authenticate to AWS services using their existing credentials. The company does not want to deploy or synchronize a separate directory in AWS. Which solution best meets the requirement?
A. Simple AD
B. AWS Managed Microsoft AD
C. AD Connector
D. Amazon Cognito user pool
Correct answer: C. AD Connector
Explanation: AD Connector forwards authentication and directory requests to the existing on-premises AD. It requires connectivity through VPN or Direct Connect and avoids creating a separate AWS-hosted directory.
Question 2
A web application allows users to register with email addresses or sign in through a social identity provider. After authentication, some users must upload objects to an S3 bucket using temporary, restricted permissions. Which Amazon Cognito design should be used?
A. Identity pool only
B. User pool only
C. User pool combined with an identity pool
D. IAM Identity Center with an AWS managed KMS key
Correct answer: C. User pool combined with an identity pool
Explanation: The user pool handles registration and authentication. The identity pool exchanges the authenticated identity for temporary AWS credentials through STS and an IAM role.
Question 3
An application encrypts multi-gigabyte records. Security requirements state that encryption keys must be managed centrally, and the application must not use a KMS key to encrypt the entire record in one operation. Which approach should the architect recommend?
A. Encrypt each record directly with the KMS key
B. Use KMS to generate data keys and encrypt the records with those data keys
C. Store the plaintext records in CloudHSM
D. Use WAF to encrypt the records before storage
Correct answer: B. Use KMS to generate data keys and encrypt the records with those data keys
Explanation: KMS is intended to protect and generate data keys, while the application uses the data keys for bulk encryption. Direct KMS encryption is limited to small payloads.
Question 4
A regulated organization requires dedicated single-tenant HSM hardware, FIPS 140-2 Level 3 validation, and customer control over cryptographic keys. Which service is the best fit?
A. AWS owned KMS key
B. AWS managed KMS key
C. AWS CloudHSM
D. AWS WAF
Correct answer: C. AWS CloudHSM
Explanation: CloudHSM provides dedicated HSMs in the customer VPC and greater control over cryptographic operations and key material than standard KMS key usage.
Question 5
A public API is receiving requests containing SQL injection attempts and malicious cross-site scripting payloads. The architect needs a managed control that can inspect request headers, URI paths, and request bodies and then block matching requests. Which service should be selected?
A. AWS Shield Standard
B. AWS WAF
C. AWS CloudHSM
D. AWS Certificate Manager
Correct answer: B. AWS WAF
Explanation: AWS WAF provides web ACLs and rules for inspecting HTTP/HTTPS requests, including SQL injection, XSS, IP, geographic, string, size, and regular-expression conditions. Shield addresses DDoS protection rather than general request filtering.