Design Secure Architectures · Topic 4 of 6
Application Security and Threat Detection
Secure applications with Secrets Manager, Parameter Store and Cognito, and detect threats with GuardDuty, Inspector, Macie, Security Hub and Config.
- 5 min
- Never store secrets in code, images or environment files. Use Secrets Manager or Parameter Store.
- Secrets Manager has automatic rotation. Parameter Store is the lower cost option for configuration.
- Cognito user pools authenticate app users. Identity pools give those users AWS credentials.
What it is
Once the network is locked down, the application itself must be secured. That means keeping secrets out of code, signing in the people who use the application, and noticing when something goes wrong.
AWS offers managed services for each of these jobs. The exam usually asks you to match a requirement to the right service, so the key skill is knowing what each one is for.
How it works
Keeping secrets out of code
| Service | Best for | Notable feature |
|---|---|---|
| AWS Secrets Manager | Database credentials, API keys, tokens | Built in automatic rotation, including for Amazon RDS credentials |
| Systems Manager Parameter Store | Configuration values and simple secrets | Standard parameters have no extra charge, and SecureString values use AWS KMS |
Choose Secrets Manager when the question needs automatic rotation of a secret. Choose Parameter Store when it needs cheap or free storage of configuration and plain values. Both integrate with IAM, so the application role is the only thing that gets access.
Authenticating application users
Amazon Cognito serves the customers of your web or mobile application, not your employees.
- A user pool is a user directory. It handles sign up, sign in, multi factor authentication and social or SAML sign in, and it issues JSON Web Tokens (JWTs).
- An identity pool exchanges a token from a user pool or another provider for temporary AWS credentials, so a mobile app can call S3 directly.
Amazon API Gateway can use a Cognito user pool as an authorizer. An Application Load Balancer can also authenticate users with Cognito or an OpenID Connect provider before forwarding the request.
Detecting threats
| Service | What it does |
|---|---|
| Amazon GuardDuty | Analyzes CloudTrail, VPC Flow Logs and DNS logs to find suspicious behavior such as compromised instances or unusual API calls |
| Amazon Inspector | Scans EC2 instances, container images and Lambda functions for software vulnerabilities and unintended exposure |
| Amazon Macie | Finds sensitive data such as personal information in S3 buckets |
| AWS Security Hub | Collects and prioritizes findings from many security services in one place |
| Amazon Detective | Helps investigate the root cause of a finding by relating logs and events |
| AWS CloudTrail | Records API calls and account activity for auditing |
| AWS Config | Records resource configuration over time and checks it against rules |
GuardDuty needs no agents for its core log analysis and can be turned on for a whole organization. Findings can trigger Amazon EventBridge rules that start automation, such as isolating an instance with a Lambda function.
Compliance and change tracking
CloudTrail answers "who did what, and when". Config answers "what did this resource look like, and does it follow our rules". For example, a Config rule can flag any security group that allows unrestricted SSH, or any unencrypted EBS volume, and it can start remediation.
AWS Audit Manager helps collect evidence for audits. AWS Artifact gives access to AWS compliance reports and agreements.
Patching and hardening
Systems Manager Patch Manager applies operating system patches to managed instances on a schedule. For immutable designs, you build a new image with patches included and replace the instances, which is often cleaner than patching in place.
Remember the shared responsibility model. AWS secures the cloud itself, and you secure what you put in it, including guest operating system patches on EC2 and your IAM settings. For managed services like RDS or Lambda, AWS takes over more of the patching.
A phrase like "rotate the database password automatically with the least code" points to Secrets Manager. A phrase like "detect compromised instances without agents" points to GuardDuty.
What to remember for the exam
- Never store secrets in code, images or environment files. Use Secrets Manager or Parameter Store.
- Secrets Manager has automatic rotation. Parameter Store is the lower cost option for configuration.
- Cognito user pools authenticate app users. Identity pools give those users AWS credentials.
- GuardDuty detects threats from logs, Inspector finds vulnerabilities, and Macie finds sensitive data in S3.
- Security Hub aggregates findings from many services and accounts.
- CloudTrail records API activity, and Config records resource configuration and checks compliance.
- EventBridge can react to findings and start automated remediation.
- In the shared responsibility model, the customer patches the guest operating system on EC2.
Common mistakes
Mixing up GuardDuty and Inspector. GuardDuty looks for active threats and strange behavior. Inspector looks for known software weaknesses.
Using Cognito for employees. Workforce access to AWS accounts belongs to IAM Identity Center. Cognito is for the application's own customers.
Treating CloudTrail as a firewall. CloudTrail only records activity. It does not block anything.
Choosing Macie for databases. Macie scans S3. For sensitive data in other stores you need another approach.
Environment variables in a Lambda function or an EC2 user data script are visible to anyone with the right read permissions. Do not use them for long lived secrets when a managed secret store is an option.
Check yourself
Which service rotates RDS credentials automatically?
AWS Secrets Manager, which has built in rotation for supported databases.
What is the difference between a Cognito user pool and an identity pool?
A user pool authenticates users and issues tokens, and an identity pool turns a token into temporary AWS credentials.
Which service detects sensitive data such as personal information stored in S3?
Amazon Macie.
Topic 4 of 6 in Design Secure Architectures
Test yourself on Design Secure Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.