AWS Security Specialty Course Notes

Detection is about collecting the right evidence, protecting it, correlating it, and turning it into a response-worthy security signal. Centralized logging commonly uses organization-level collection and a dedicated log archive so a compromised workload or member account cannot easily alter its own evidence. CloudTrail records AWS API activity; VPC Flow Logs record network-flow metadata; service logs add workload-specific context; Security Lake can centralize and normalize supported security data in OCSF; and CloudWatch/EventBridge provide monitoring and event routing. GuardDuty performs managed threat detection from multiple AWS data sources and protection plans; Inspector performs vulnerability management for supported workloads; Macie discovers sensitive data in S3; Detective helps investigate entities and findings; and Security Hub correlates, enriches, and centralizes security findings/posture information. Protect audit evidence with separation, least privilege, retention, CloudTrail log-file integrity validation, and S3 Object Lock where WORM-style immutability is required.

• Memorizing GuardDuty as network-only.

• Start with the evidence source, then choose the detection/investigation service.

Incident Response is evidence-aware containment, investigation, eradication, and recovery—not a reflexive shut-everything-down exercise. Credential incidents require identifying the credential type and stopping its effective use: disable or delete compromised access keys where appropriate, revoke/restrict sessions when possible, change passwords/MFA when relevant, remove unintended trust or permissions, and contain affected resources. Event-driven automation can route GuardDuty/Security Hub findings through EventBridge to Lambda, Systems Manager Automation, Step Functions, or integrations. Automated remediation must be scoped, idempotent, logged, and safe enough that a false positive does not create a larger outage. Preserve the evidence needed to answer the investigation before destructive remediation removes it. Root-cause analysis asks how initial access occurred and which control failed; impact analysis asks which identities, resources, data, actions, Regions/accounts, and persistence mechanisms were affected.

• Assuming every credential incident is solved by a password reset.

• Identify credential type before containment.

Infrastructure Security tests how AWS network and compute controls combine into enforceable paths. Segmentation is not just public versus private subnet: route tables determine reachability, security groups provide stateful resource-level filtering, network ACLs provide stateless subnet-level filtering, AWS Network Firewall or approved appliances provide deeper inspection, and endpoints can remove public-network dependencies. Internet-facing applications use layered controls such as CloudFront or Global Accelerator where appropriate, load balancers, TLS, AWS WAF, AWS Shield, origin restrictions, least-privilege security groups, and monitoring. Private service connectivity depends on the target: gateway endpoints provide private S3/DynamoDB access; interface endpoints use AWS PrivateLink and ENIs for many AWS/SaaS services. Hybrid security combines Direct Connect/VPN routing, encryption, inspection, DNS, segmentation, and monitoring. Direct Connect is dedicated connectivity, not encryption by itself.

• Treating subnet placement alone as segmentation.

• Trace the packet path first, then place the control at the enforcing layer.

Identity and Access Management is policy-evaluation reasoning. Least privilege means granting only the required actions on the required resources under the required conditions—not merely replacing users with roles. Workloads should normally use roles and temporary STS credentials instead of embedded long-lived keys. Workforce access across accounts is commonly centralized with IAM Identity Center and federation; workload cross-account access normally uses role assumption and resource policies where supported. SCPs define the maximum available permissions for member-account principals; they do not grant permissions. Permissions boundaries, session policies, identity policies, resource policies, SCPs/RCPs, trust policies, VPC endpoint policies, and service-specific rules can all participate in the final decision. AWS starts from implicit deny, requires applicable authorization, and any applicable explicit deny wins.

• Saying SCPs grant permissions.

• Write request as Principal + Action + Resource + Conditions.

Data Protection begins with classification and then chooses controls for confidentiality, integrity, availability, key ownership, and lifecycle. Encryption at rest can use AWS-owned keys, AWS-managed keys, or customer-managed KMS keys depending on the service and governance requirement. Customer-managed keys provide greater policy, rotation, auditing, and lifecycle control but also greater customer responsibility. KMS authorization is special: every KMS key has a key policy, and key policies, IAM policies, grants, and sometimes VPC endpoint policies can participate in access. A KMS grant is an AWS KMS authorization object—not an IAM grant. Separate key administrators from cryptographic users when duties require it. Data in transit normally uses TLS, but certificate trust/identity still matters. Secrets belong in managed stores rather than code or images. Secrets Manager is purpose-built for secret lifecycle and rotation; Systems Manager Parameter Store can securely store configuration/secrets but does not provide the same native rotation workflow. Macie discovers and classifies sensitive data in S3; classification should drive access, encryption, retention, monitoring, and handling.

• Saying customer-managed keys are always required.

• Start with classification, then choose encryption and key ownership.

Security Foundations and Governance tests how security scales across AWS services and accounts. The shared responsibility model is service-specific: AWS protects infrastructure of the cloud while customers configure security in the cloud, but the exact division changes with the service. Do not memorize rigid IaaS/PaaS/SaaS slogans; identify the service and determine who controls the operating system, runtime, application, identity, data, encryption, network configuration, and patching. Multi-account governance uses Organizations/OUs, delegated administrators, SCPs, Control Tower controls where applicable, centralized CloudTrail/Config/security services, and dedicated security/log archive accounts. Vulnerability management combines inventory/coverage, Inspector scanning for supported EC2/ECR/Lambda resources, remediation, and validation. Software supply-chain risk also includes provenance, trusted build sources, artifact integrity, dependency control, and CI/CD credential protection. Compliance is proven with evidence that controls are configured and operating. Audit Manager can automate collection of customer control evidence; Artifact provides AWS compliance reports and agreements.

• Assuming AWS owns every security issue in a managed service.

• For shared responsibility name the exact AWS service first.