Chapter 1 of 4 · AWS SAA-C03
Design Secure Architectures
IAM and federation, network and application security, encryption, and data protection and retention.
- 6topics
- 31 minfast track
- 2diagrams and exhibits
- 30%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1IAM Identities and PoliciesLearn how AWS Identity and Access Management users, groups, roles and policies work, how permissions are evaluated, and how to…5 min
- 2Multi Account Access and FederationGovern many AWS accounts with Organizations and service control policies, and give people access through federation, IAM Identity…5 min
- 3Network Security and Edge ProtectionSecure a VPC with subnets, security groups, network ACLs and endpoints, and protect applications at the edge with AWS WAF, Shield…Diagram5 min
- 4Application Security and Threat DetectionSecure applications with Secrets Manager, Parameter Store and Cognito, and detect threats with GuardDuty, Inspector, Macie…5 min
- 5Encryption with KMS and CertificatesChoose encryption at rest and in transit on AWS: KMS keys, envelope encryption, S3 encryption options, CloudHSM and AWS…Diagram6 min
- 6Data Protection, Backup and RetentionProtect stored data on AWS with S3 access controls, versioning, Object Lock, AWS Backup and lifecycle rules, and match each…5 min
About this chapter
What this chapter covers
Security is the first domain of the AWS Certified Solutions Architect Associate exam, and it also shapes the answers in every other domain. A good design controls who can reach a resource, how traffic flows, and how data is protected.
The chapter follows three outline topics.
The first is secure access to AWS resources, which covers identities, policies, accounts and federation. The second is secure workloads and applications, which covers the network, the edge and the application layer. The third is data security, which covers encryption, backup and retention.
How the topics fit together
Think of security as layers, from who is asking down to the data itself.
- Identity answers who can call an API, and least privilege keeps that access small.
- Network and edge controls limit what can reach your workloads.
- Application controls keep secrets out of code and spot threats early.
- Data controls protect the content with keys, copies and retention rules.
When two answers both look secure, pick the one that is managed, automatic and least privilege, because the exam rewards the lowest operational effort that still meets the requirement.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order. Identity concepts come first because later pages build on roles, policies and key permissions.
Ready for more practice?
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.