Chapter 4 of 5 · AWS SOA-C03
Security and Compliance
IAM access, Organizations and Config governance, threat detection, encryption, and network and host protection.
- 5topics
- 25 minfast track
- 1diagrams and exhibits
- 16%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1IAM Policies, Roles and AccessUnderstand IAM policy types, evaluation logic, roles and STS, MFA and access analysis, and how to troubleshoot AccessDenied…5 min
- 2Organizations, SCPs and AWS ConfigGovern many AWS accounts with Organizations and SCPs, and check compliance with AWS Config rules, conformance packs, aggregators…Diagram5 min
- 3Detection and Audit ServicesKnow what CloudTrail, GuardDuty, Security Hub, Inspector, Macie, Trusted Advisor and Artifact each do, and which one answers each…5 min
- 4Encryption, KMS and SecretsProtect data at rest and in transit with KMS keys, EBS, RDS and S3 encryption, ACM certificates, and choose between Secrets…5 min
- 5Protecting Network and InfrastructureLayer defences with security groups, NACLs, WAF, Shield, Network Firewall and Firewall Manager, and harden EC2 and S3 with IMDSv2…5 min
About this chapter
What this chapter covers
Security on AWS is shared. AWS protects the cloud itself, and you protect what you run in it: identities, data, networks and configuration. This chapter follows the security and compliance domain of the AWS Certified CloudOps Engineer Associate (SOA-C03) outline.
The first topic is tools and policies: IAM, Organizations, AWS Config and the detection services. The second is protecting data and infrastructure with encryption, secrets and network controls.
The chapter has two outline topics, and they are spread across five pages because each service family needs room.
How the topics fit together
Controls come in three kinds, and the pages cover all three.
- IAM and SCPs decide who can do what, and set account wide limits.
- AWS Config checks resources against rules and can fix them.
- CloudTrail, GuardDuty, Inspector, Macie and Security Hub record, detect and report.
- KMS, Secrets Manager and ACM protect data and credentials.
- WAF, Shield, security groups and network ACLs protect the network.
When a question asks for the most secure option, look for least privilege, temporary credentials, encryption and private access, and rule out wide permissions and stored keys.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Many security questions are matching exercises between a need and a service name. Make your own table of verbs, such as records, detects, scans, aggregates and blocks, and the service for each.
Ready for more practice?
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.