Chapter 2 of 4 · AWS DVA-C03
Security
Federation and roles, permissions and presigned URLs, encryption, secrets, and securing AI services and agents.
- 6topics
- 29 minfast track
- 1diagrams and exhibits
- 26%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Federation, Assumed Roles and Programmatic AccessHow a developer gets temporary AWS credentials: identity federation, assuming IAM roles, the SDK credential chain and Signature…Diagram5 min
- 2Permissions, Access Control and Presigned URLsWrite IAM identity and resource policies, apply fine grained conditions and MFA, and hand out time limited access with S3 and…5 min
- 3Encryption, KMS Keys and CertificatesApply encryption at rest and in transit: client side versus server side, KMS Encrypt and GenerateDataKey, ACM and Private CA…5 min
- 4Secrets and Sensitive DataKeep secrets out of code with Secrets Manager and Parameter Store, and find, mask and limit access to PII and PHI with Macie…4 min
- 5Securing Access, Privacy and Logs for AI ServicesControl who can call Amazon Bedrock and other managed AI services, keep prompts on a private network, and stop sensitive content…5 min
- 6Guardrails and AI Agent SecurityFilter model inputs and outputs with Amazon Bedrock Guardrails, and secure AI agents with tool authorization, session isolation…5 min
About this chapter
What this chapter covers
Security is 26% of the AWS Certified Developer Associate DVA-C03 exam, the second largest domain. It asks how an application gets credentials, what it is allowed to do, how its data is protected, and how it uses AI services safely.
The chapter follows the developer's view: use, configure, call and debug. You are not asked to administer IAM users or design an AI safety framework.
Questions are short developer scenarios. Most are single answer, and some are multiple response that state the count, such as "Which TWO actions meet these requirements?". Look for discriminators such as LEAST operational overhead or MOST secure. There are no exhibits.
How the topics fit together
Think of the chapter as the path of one request, from identity to data.
- Identity gives your code temporary credentials instead of stored keys.
- Permissions limit each principal to the actions and resources it needs.
- Data protection covers encryption, certificates, secrets and sensitive data.
- AI security applies the same ideas to model access, private connectivity, logs, guardrails and agents.
When two answers both work, choose the one with temporary credentials, least privilege and a managed AWS feature, because the exam rewards the most secure option with the least operational overhead.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order. Identity concepts come first because later pages build on roles, policies and key permissions.
Ready for more practice?
The full AWS DVA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.