Module 7 · SAA-C03

Security and encryption

Encryption with KMS / CloudHSM, secrets management, certificates, web protection (WAF, Shield), threat detection and compliance.

DomainSecure architectures
14 diagrams
10 scenarios
15 services

5-minute essentials

KMS manages encryption keys; AWS services (S3, EBS, RDS…) use KMS in an envelope pattern: the KMS key encrypts a data key, and the data key encrypts the data.KMS Encrypt directly accepts at most 4 KB; for large data use GenerateDataKey and encrypt locally.
Three types of KMS keys: customer managed (you manage the policy, rotation, deletion), AWS managed (aws/s3, aws/ebs… created by the service), AWS owned (used internally by AWS, not visible to you).Need control over the key policy, cross-account sharing, or your own rotation / disabling: it must be a customer managed key.
The key policy is the main gate of a KMS key: if no statement in the key policy allows access, an IAM policy alone is not enough.AccessDenied when decrypting from another account: check the key's key policy first.
Automatic rotation of a customer managed key is yearly by default (period configurable); old key material is kept to decrypt old data, and the key ID does not change.No need to re-encrypt data when rotating; applications need no changes.
Deleting a KMS key requires a 7–30 day waiting period (default 30); once deleted, data encrypted with it is lost permanently.To stop using a key but still be able to recover it: disable the key, do not delete it.
CloudHSM: a single-tenant HSM in your VPC; you manage users and keys yourself, and AWS cannot see the keys.Question demands "full control of keys, FIPS 140 level 3, AWS cannot access them" → CloudHSM (or a KMS custom key store backed by CloudHSM).
Secrets Manager stores secrets and rotates them automatically (managed rotation or Lambda), charged per secret; Parameter Store stores configuration (SecureString for secrets), and the standard tier costs nothing extra."Automatically change the database password periodically" → Secrets Manager. Just need cheap storage for configuration → Parameter Store.
ACM issues free public TLS certificates and renews them automatically for ALB, CloudFront, API Gateway; you cannot export the private key of a public certificate.A certificate for CloudFront must be in us-east-1; for an ALB it must be in the same Region as the ALB.
WAF filters HTTP(S) at layer 7 (SQL injection, XSS, rate limiting, IP / country blocking, bots) on CloudFront, ALB, API Gateway…Blocking web application attacks: WAF. Security groups / NACLs do not understand HTTP content.
Shield Standard is free and automatically protects layers 3/4; Shield Advanced is paid monthly with a 1-year commitment, and includes a DDoS response team and cost protection during attacks.Question mentions "24/7 DDoS response team" or "credit for scaling costs caused by DDoS" → Shield Advanced.
GuardDuty detects threats from CloudTrail, VPC Flow Logs, DNS logs (pulled automatically, no need to enable the logs separately); Inspector scans EC2, ECR, Lambda for vulnerabilities; Macie finds sensitive data in S3.Three services often swapped as distractors: threats / unusual access → GuardDuty; software CVEs → Inspector; PII in S3 → Macie.
Security Hub aggregates findings from many services and checks against standards (CIS, AWS best practices); Detective investigates root causes using graphs."One place to view the overall security posture of multiple accounts" → Security Hub.
Config records resource configuration over time and checks compliance with rules, and can auto-remediate; CloudTrail records who called which API and when."Who deleted the security group?" → CloudTrail. "Which buckets are unencrypted, and fix them automatically" → Config rule + remediation.
Encryption in transit: TLS (ACM); encryption at rest: KMS in almost every storage service, usually enabled with a single option.Snapshots / copies of encrypted resources are also encrypted; to encrypt an existing resource, create an encrypted copy and switch to it.

Diagrams

Envelope encryption with KMS

The KMS key never leaves KMS. The application encrypts data with a data key and stores only the encrypted copy of the data key.

S3 encryption with SSE-KMS

S3 calls KMS to get a data key for each object (Bucket Key reduces calls). Every key use is logged in CloudTrail; the key policy decides who can decrypt.

Step by step

S3 uses the KMS key to encrypt / decrypt each object.
Every key use is recorded in CloudTrail for auditing.
Another account can read the object only if both the bucket policy and the key policy allow it.

Edge protection layers: Shield, WAF, CloudFront

Shield blocks layer 3/4 DDoS at the edge; WAF filters HTTP requests; the origin only receives filtered traffic.

Step by step

Shield (Standard is free, Advanced is paid) absorbs network-layer DDoS at the edge.
WAF blocks SQLi, XSS, bots, and IPs sending too many requests.
Only legitimate traffic reaches the origin; you can lock the ALB to accept only CloudFront.

Secrets Manager rotating a database password automatically

The application reads the secret at runtime, so it needs no changes when the password changes.

Detect and auto-respond

Detection services push findings to Security Hub; EventBridge catches findings to notify or remediate automatically.

Step by step

Each service detects one kind of issue and pushes findings to Security Hub.
An EventBridge rule catches findings by severity: runs Lambda to remediate and sends notifications.

Organization trail to a dedicated log account

The organization trail is created in the management account and records API calls of all member accounts into a bucket in the log account; people in member accounts cannot modify / delete the logs.

Step by step

The organization trail records every API call of the member accounts into a bucket in the log account.
It also sends to CloudWatch Logs to set alarms (root login, security group changes…).

ACM certificates: CloudFront uses us-east-1

ACM certificates are per Region. CloudFront only reads certificates in us-east-1; an ALB needs a certificate in its own Region.

Step by step

Viewer → CloudFront: the certificate must be in us-east-1.
CloudFront → ALB: the certificate is in the same Region as the ALB.

KMS vs CloudHSM

KMS: managed, built into almost every service. CloudHSM: a dedicated HSM cluster in your VPC, spread across multiple AZs for high availability; you manage users and keys yourself.

Step by step

KMS: call the API, access via IAM and key policy; fits most cases.
CloudHSM: the application talks directly to your HSM; a multi-AZ cluster prevents key loss.

Session Manager replacing a bastion

No port 22, no SSH keys, no bastion. Access to the instance is via IAM, and sessions are logged.

Step by step

The administrator opens a session from the console / CLI, access controlled by IAM.
The SSM Agent on the instance connects out to Systems Manager (via NAT or VPC endpoint); no inbound port is needed.
Session content is written to CloudWatch Logs / S3.

Cross-account KMS key use: needs both key policy and IAM policy

The key policy in the key owner's account decides who can use it; the IAM policy in the other account decides who is actually allowed. Missing either one means denial. AWS managed keys (aws/s3, aws/ebs…) have an uneditable key policy so they cannot be shared: to share, use a customer managed key.

Step by step

Account A adds a statement to the key policy allowing account B (or B's specific role) to use the key.
Account B attaches an IAM policy to the role, pointing at the exact key ARN. Both policies must allow it for the key to be usable; every use is logged in CloudTrail in both accounts.
Data encrypted with an AWS managed key cannot be shared with another account: switch to a customer managed key.

AWS WAF: web ACLs and rule types

A web ACL attaches to layer 7 resources (CloudFront, ALB, API Gateway REST API, AppSync, Cognito user pool, App Runner…), not directly to EC2 or NLB. Blocked requests get a 403 or a custom response.

Step by step

A web ACL groups rules in priority order: AWS managed rule groups, rate-based (block IPs sending too many requests), geo match and IP sets.
Every HTTP(S) request to a resource with a web ACL passes through the rules before reaching the application.
One web ACL can attach to CloudFront, ALB, API Gateway REST API, AppSync, Cognito… It cannot attach to an NLB or EC2.

Shield Advanced: detection, response and cost protection during DDoS

Shield Standard is free and automatically protects layers 3/4. Shield Advanced adds: the SRT response team (requires Business or Enterprise Support), credits for scaling costs caused by DDoS, and standard WAF fees for protected resources.

Step by step

Put CloudFront, Route 53, Global Accelerator in front to absorb attacks at the edge; Shield Advanced also protects EC2 (Elastic IP) and ELB.
Shield Advanced detects per resource and can add WAF rules automatically to block application-layer attacks.
Large attacks: the SRT analyzes WAF logs and applies rules for you (requires Business or Enterprise Support).
If the bill rises because the system auto-scaled during a DDoS: request credits through AWS Support.

Defense in depth

Do not rely on a single layer: the edge blocks DDoS and web attacks, the network filters with NACLs / security groups, servers sit in private subnets and are patched, data is encrypted; IAM limits permissions; GuardDuty and Security Hub detect what slips through.

Step by step

Edge: CloudFront takes the traffic, Shield blocks DDoS, WAF filters SQLi / XSS / bots before they enter the VPC.
Network: only the ALB is in the public subnet; the EC2 security group accepts only from the ALB security group; NACLs block bad IP ranges.
Data: the database is in a private subnet, encrypted at rest with KMS and in transit with TLS.
Identity: each component has only the permissions it needs; do not use the root account for daily work.
Detection: GuardDuty finds anomalous behavior, Security Hub aggregates and scores, then triggers automated response.

ACM certificate lifecycle

ACM retries validation for 72 hours, then moves to VALIDATION_TIMED_OUT. A certificate issued by ACM and attached to an integrated service is renewed automatically (DNS: 45 days before expiration; the CNAME record must stay in place). Imported certificates are not renewed automatically.

Step by step

Request a certificate, add the CNAME record (DNS) or click the email link; once validated it becomes ISSUED.
Not validated within 72 hours or an error occurs (CAA blocks, invalid domain): delete the request, fix it and request again.
Attach to CloudFront / ALB… and keep the DNS record: ACM renews automatically, keeping the same ARN.
Imported certificates or failed renewals will expire; a certificate can also be revoked.

Quick comparisons

S3 encryption

Method	Who holds the key	Notes
SSE-S3	Fully managed by S3	Default for new objects
SSE-KMS	KMS key (AWS managed or customer managed)	CloudTrail logs every key use, controlled by key policy; use S3 Bucket Key to reduce KMS calls
DSSE-KMS	KMS, two layers of encryption	Compliance requirements that demand two layers of encryption
SSE-C	You send the key with every request	AWS does not store the key; lose the key and you lose the data
Client-side encryption	You	Data is encrypted before it reaches S3

KMS and CloudHSM

	KMS	CloudHSM
Model	Managed service, multi-tenant	Single-tenant HSM in your VPC
Who manages users / keys	IAM + key policy	You manage users on the HSM yourself
AWS service integration	Almost every service	Through a KMS custom key store, or applications calling PKCS#11 / JCE
Use when	Default choice	Full control required, FIPS 140 level 3, SSL offload, private PKI

Storing secrets and configuration

	Secrets Manager	Parameter Store
Automatic rotation	Yes (managed rotation or Lambda)	Not built in (write your own)
Cost	Per secret and per API call	Standard: no extra charge; Advanced: charged
Size	Larger secrets (multi-field JSON)	Standard 4 KB, Advanced 8 KB
Used for	Database passwords, API keys that must change periodically	Configuration, feature flags, rarely changing secrets

Detection and compliance services

Service	What it does	Exam question
GuardDuty	Threat detection with ML and threat intel	Unauthorized crypto mining, leaked keys, access from bad IPs
Inspector	Scans for software and network vulnerabilities	CVEs on EC2, ECR images, Lambda
Macie	Finds sensitive data in S3	PII, card numbers in buckets
Security Hub	Aggregates findings, scores against standards	One security dashboard for multiple accounts
Detective	Root cause investigation	Trace a GuardDuty finding
Config	Configuration history, compliance rules	Which resources deviate from the standard, auto-fix
CloudTrail	API call log	Who did what, when, from where

Network and web protection

Layer	Service	What it blocks
Layer 3/4 (DDoS)	Shield Standard / Advanced	SYN flood, UDP reflection
Layer 7 (HTTP)	WAF	SQLi, XSS, bots, rate limiting, by IP / country
Central management	Firewall Manager	Apply WAF / Shield / SG / Network Firewall across the organization
Packet filtering in a VPC	Network Firewall	Stateful filtering, by domain name, IDS / IPS
Instance / subnet	Security group / NACL	IP, port, protocol

Exam scenarios

1An application needs to encrypt a 50 MB file with a KMS key.

Show answer

Right: GenerateDataKey, encrypt the file with the data key on the application side, store the encrypted data key with the file (envelope encryption)
The KMS key never leaves KMS; large data is encrypted locally, fast and cheap.

Wrong: Call KMS Encrypt with the whole file
Encrypt accepts at most 4 KB.

2Requirement: AWS must not have access to the keys, keys live in an HSM dedicated to the company, FIPS 140 level 3 certified.

Show answer

Right: CloudHSM (can be used through a KMS custom key store)
A single-tenant HSM in your VPC; you manage users and keys yourself.

Wrong: KMS customer managed key
KMS is a managed multi-tenant service; it does not meet "dedicated HSM, self-managed users".

3The RDS password must change automatically every 30 days, and the application must not need code changes each time.

Show answer

Right: Secrets Manager with automatic rotation; the application reads the secret at runtime
Secrets Manager changes the password in both the database and the secret.

Wrong: Store it in a Lambda environment variable
No automatic rotation, exposed in configuration.

Wrong: Parameter Store SecureString
It can store the secret, but has no built-in automatic rotation.

4You want to attach an ACM certificate to a CloudFront distribution but the certificate does not appear in the list.

Show answer

Right: Request / import the certificate in us-east-1
CloudFront only uses ACM certificates in us-east-1; an ALB needs a certificate in the same Region as the ALB.

Wrong: ACM does not support CloudFront
It does.

5A website is under SQL injection attack and one IP sends thousands of requests per minute.

Show answer

Right: WAF on CloudFront / ALB: managed rule against SQLi + rate-based rule
WAF filters at layer 7 by request content and frequency.

Wrong: Security group blocking that IP
Security groups have no deny rules, and do not understand HTTP content to block SQLi.

Wrong: Shield Standard
Shield Standard protects against layer 3/4 DDoS; it does not filter SQLi.

6The company wants the AWS DDoS response team available 24/7 and compensation for scaling costs caused by attacks.

Show answer

Right: Shield Advanced
Includes the Shield Response Team, cost protection, detailed reports; paid monthly with a 1-year commitment.

Wrong: Shield Standard
Free, but no response team and no cost protection.

7You need to detect EC2 instances mining crypto and access keys used from unusual IPs, without building your own log analysis system.

Show answer

Right: GuardDuty
Analyzes CloudTrail, VPC Flow Logs, DNS logs on its own; just turn it on.

Wrong: Inspector
Inspector scans for software vulnerabilities; it does not detect behavior.

Wrong: Macie
Macie finds sensitive data in S3.

8Find buckets containing credit card numbers and national ID numbers among thousands of buckets.

Show answer

Right: Macie
Scans and classifies sensitive data in S3.

Wrong: GuardDuty S3 Protection
It detects suspicious behavior, not classify content.

9Any bucket with encryption turned off or made public must be fixed automatically, with a history of changes.

Show answer

Right: Config rule (s3-bucket-public-read-prohibited…) + remediation with SSM Automation
Config tracks configuration, evaluates rules, and runs fix actions automatically.

Wrong: CloudTrail
Records who called an API; it does not evaluate compliance or auto-fix.

10Administrators need shell access to EC2 in a private subnet, with no port 22, no bastion, and session logs.

Show answer

Right: Systems Manager Session Manager
Connects through the SSM agent, access via IAM, session logs go to S3 / CloudWatch Logs.

Wrong: Bastion host in a public subnet
Requires opening SSH, managing keys, and one more instance to patch.

Quick picks

Protect what with what?

When you need	Use
Encrypt large data with a KMS-managed key	Envelope encryption (GenerateDataKey) · see diagram
S3 encryption with a log for every key use, cross-account sharing	SSE-KMS with a customer managed key · see diagram
Dedicated HSM, AWS cannot access the keys	CloudHSM · see diagram
Password must change automatically on a schedule	Secrets Manager · see diagram
HTTPS certificate for CloudFront / ALB	ACM (CloudFront: us-east-1) · see diagram
SQLi, XSS, bots, rate limiting	WAF · see diagram
Large DDoS, need a response team	Shield Advanced · see diagram
Detect suspicious behavior	GuardDuty → Security Hub → EventBridge · see diagram
Store API logs of all accounts safely	Organization trail → S3 in the log account · see diagram
Access EC2 without opening SSH	Session Manager · see diagram

Common pitfalls

Calling KMS Encrypt on data larger than 4 KB.
Deleting a KMS key when you only want to pause its use: disable it instead.
Forgetting the key policy when sharing a KMS key with another account.
Thinking KMS key rotation requires re-encrypting all data.
Creating the ACM certificate for CloudFront in a Region other than us-east-1.
Using a security group / NACL to block SQL injection.
Mixing up GuardDuty (threats), Inspector (vulnerabilities), Macie (sensitive data).
Mixing up CloudTrail (who called the API) with Config (configuration and compliance).
Storing passwords in code or environment variables instead of Secrets Manager / Parameter Store.
Choosing Parameter Store when the question requires automatic password rotation.
Opening port 22 for a bastion when Session Manager does the job without opening any port.
Thinking Shield Standard must be enabled or paid for: it is always on and free.

Services in this module

Numbers that change (checked against AWS docs)

KMS Encrypt with a symmetric key accepts at most 4,096 bytes of data; use GenerateDataKey for larger data. checked 2026-10-16 ↗
Automatic rotation of a customer managed key is every 365 days by default (period configurable); AWS managed keys always rotate yearly; old key material is kept for decryption. checked 2026-10-16 ↗
Deleting a KMS key requires a waiting period of 7–30 days, default 30 days; only customer managed keys can be deleted. checked 2026-10-16 ↗
CloudHSM is a single-tenant HSM, FIPS 140-2 or 140-3 level 3 in FIPS mode. checked 2026-10-16 ↗
An ACM certificate used for CloudFront (viewer HTTPS) must be requested / imported in us-east-1. checked 2026-10-16 ↗
Shield Standard is free; Shield Advanced is charged monthly (AWS example: 3,000 USD) plus data transfer fees, with a 1-year commitment. checked 2026-10-16 ↗
Secrets Manager: 0.40 USD per secret per month, 0.05 USD per 10,000 API calls. checked 2026-10-16 ↗
Parameter Store: standard up to 10,000 parameters, 4 KB, no extra charge; advanced 100,000 parameters, 8 KB, charged, with parameter policies. checked 2026-10-16 ↗
Enabling GuardDuty automatically ingests CloudTrail management events, VPC Flow Logs (EC2) and DNS logs, with nothing extra to enable. checked 2026-10-16 ↗
Using a KMS key across accounts needs a key policy in the key owner's account and an IAM policy in the other account; data encrypted with an AWS managed key cannot be shared. checked 2026-10-19 ↗
AWS WAF protects CloudFront, API Gateway REST API, ALB, AppSync, Cognito user pool, App Runner, Verified Access, Amplify. checked 2026-10-19 ↗
Using the Shield Response Team requires the Business or Enterprise Support plan; Shield Advanced includes standard WAF fees for protected resources. checked 2026-10-19 ↗
ACM certificate statuses: PENDING_VALIDATION, ISSUED, INACTIVE, EXPIRED, VALIDATION_TIMED_OUT, REVOKED, FAILED; ACM retries validation for 72 hours. checked 2026-10-19 ↗
ACM starts automatic renewal 45 days before expiration for DNS / email validated certificates (60 days for private certificates). checked 2026-10-19 ↗

Practice this module →