SAA-C03 – Deep Dive Prep

MODULE 1: DESIGN SECURE ARCHITECTURE

Secure access

This includes defining how people, tools, and applications you build will access the necessary AWS services and your data. This could involve determining not only who or what can launch or terminate your resources but also managing how and when access is given along with operational permissions and almost anything else that would involve calls to the services.

IAM is a global AWS service that secures any data in the AWS IAM database across all AWS Regions.
AWS accounts begin with a single account root user with full permissions.
Every user added to the account become IAM user, with no permission to start with. Permission must be granted (IAM) to do something
IAM: User (Individual, tool, application) , Group (group of users), and Role is job/task/title/hat that any user or group can do temporarily
IAM User Case: User: Long term access, Own credentials. Group: Many users with similar job/task/operations. Role: Temporary access to do a job/task
Switching IAM | Overlapping IAM | Deciding which one to use |
Federated/Federation Access: Access to AWS via External ID providers. The process of establishing trust between the IdP and AWS.
Policy: The document/Json containing policy. Either for Identity > User/group/role OR AWS resources (S3, VPC end points). Bucket policy is different to Identify policy
Different Policies | Component of policies |
Multiple Accounts: Use organisations, Service Control Policies (SCPs): Implement SCPs to enforce compliance and security policies across all accounts.
Multiple accounts | Security Strategies | Visibility |Security Standards | Automation based on data |AWS Security Token Service (STS)
AWS APIs: AWS APIs (Application Programming Interfaces) are a set of programming instructions and standards for accessing AWS services | Read more
VPC: Regional, logical boundary of your space in AWS cloud. Default: Internet facing, startup needs public placing application. Custom: Not connected to Internet
What is VPC | Design | Build | Security | Cost | Limitations | Use cases |High availability | Resiliance| Logging and monitoring | Networking Fundamentals
Protecting Sensitive Data: Macie auto detection personally identifiable information (PII) or intellectual property. Cognito for User identity, Guard Duty: Treat detection
Protecting Sensitive Data | Cognito user pools | Cognito Identity pools| Cognito brokers | Single Sign on Or ID federation |
Proxy and Firewalls: Proxy: for security, anonymity, caching. Firewall: device contains rules for Inbound/Outbound traffic
Proxy and Firewalls: Designing and Securing workload and Applications with firewalls and proxy servers
Managing secrets and configuration data: API keys, passwords, and tokens, Database connection strings etc. More..
Plaintext: Unencrypted data that can be in various forms such as text, images, or applications.
Algorithm: A set of rules used for encryption, requiring plaintext and a key.
Key: A password used with the algorithm to produce ciphertext.
Ciphertext: Encrypted data that is unreadable without the correct key.
Symmetric Encryption: Uses the same key for both encryption and decryption.
Asymmetric Encryption: Uses a pair of keys (public and private) for encryption and decryption.
AWS KMS: Centralized key management and encryption.
AWS CloudHSM: Hardware-based key storage for enhanced security.
Amazon S3 Server-Side Encryption: Offers SSE-S3 (S3 managed keys), SSE-KMS (KMS managed keys), and SSE-C (customer-provided keys).
SSE-S3: S3 manages the encryption keys.
SSE-KMS: Uses keys managed by AWS KMS.
SSE-C: Customers provide and manage the encryption key
AWS Artifact: Provides access to AWS compliance reports and agreements.
Data Retention and Classification: Classify data based on sensitivity and apply appropriate security controls.
Access Pattern-Based Security: Manage security based on specific access patterns and data lifecycle requirements.
S3 Lifecycle Policies: Automate data transition between storage classes.
S3 Intelligent Tiering: Automatically move data to the most cost-effective storage tier based on access patterns.
Data Security Control| Determining appropiate data controls in AWS
One of the fundamental security best practices in AWS is to follow the principle of least privilege, granting only the permissions needed and no more. This principle helps minimize potential security risks and ensures that users and services have the access necessary to perform their tasks without exposing additional vulnerabilities. In this wrap-up blog, we will explore the services and strategies to implement this principle effectively in a multi-account environment, understand the differences between various policies, and examine additional security measures and monitoring services.

Services for Implementing Least Privilege in a Multi-Account Environment

AWS Organizations

Purpose: Centralized management of multiple AWS accounts.

Features: Service Control Policies (SCPs) to manage permissions across accounts, consolidated billing, and account management.

Use Case: Enforcing governance and security controls across multiple AWS accounts.

AWS Control Tower

Purpose: Automates the setup of a secure, multi-account AWS environment.

Features: Pre-configured blueprints for account structure, guardrails for governance, and automated account provisioning.

Use Case: Quickly setting up and governing a multi-account environment with best practices.

AWS Service Catalog

Purpose: Create and manage catalogs of approved IT services.

Features: Allows administrators to centrally manage commonly deployed IT services, and helps achieve consistent governance.

Use Case: Standardizing the provisioning of AWS resources across accounts with predefined configurations and permissions.

Understanding IAM: Roles vs. Users

AWS IAM Roles:

Purpose: Grant temporary access to AWS resources.

Use Case: Use for applications or services that need temporary access to resources, and for cross-account access.

AWS IAM Users:

Purpose: Grant long-term access to AWS resources for individual users.

Use Case: Use for people who require long-term access with specific permissions, such as employees or administrators.

Policies in AWS: Identity, Resource, Permissions, and Service Control Policies

Identity Policy: Attached to IAM identities (users, groups, roles). Specifies what actions the identity can perform on which resources.

Resource Policy: Attached to resources such as S3 buckets or DynamoDB tables. Specifies who can access the resource and what actions they can perform.

Permissions Policy: A broad term encompassing both identity and resource policies.

Service Control Policy (SCP): Attached to AWS Organizations units. Enforces what actions can be performed across accounts, overriding other policies.

Policy Evaluation with Overlapping Rules

When there are overlapping allow and deny rules, AWS evaluates policies using the following logic:

Explicit Deny: Overrides any allows.

Allow: Grants permission only if there is no explicit deny.

Default Deny: If no explicit allow is found, access is denied by default.

Federating Access into AWS

Federation Methods:

AWS Single Sign-On (SSO): Simplifies access management by providing SSO to multiple AWS accounts and business applications.

AWS Directory Service: Integrates with on-premises Active Directory or creates a managed Active Directory in AWS for seamless authentication.

SAML Federation: Uses Security Assertion Markup Language (SAML) to enable SSO from enterprise identity providers.

Monitoring Services in AWS

In Addition to Amazon CloudTrail, CloudWatch, and VPC Flow Logs:

AWS Config: Tracks configuration changes and evaluates them against desired configurations.

AWS Security Hub: Provides a comprehensive view of security alerts and compliance status across AWS accounts.

Amazon GuardDuty: Continuous security monitoring service that analyzes logs for threat detection.

Setting Up Secure VPCs

VPC Security Controls: Implement Network ACLs, security groups, and flow logs.

Use Cases:

AWS Shield: Protects against DDoS attacks.

AWS WAF: Protects against common web exploits.

AWS Secrets Manager: Manages and rotates secrets securely.

AWS Systems Manager Parameter Store: Manages configuration data and secrets.

Protecting Data in Transit and at Rest

Encryption Options:

AWS KMS: Manages encryption keys with integration across AWS services.

Use Case: General encryption needs with managed key rotation.

AWS CloudHSM: Provides dedicated hardware security modules.

Use Case: High-security environments requiring compliance with stringent standards.

Conclusion

Understanding and implementing the principle of least privilege, using appropriate policies, and leveraging AWS security services effectively are crucial for securing your AWS environment. Whether managing a multi-account setup with AWS Organizations and Control Tower, enforcing governance with SCPs, or securing data with AWS KMS and CloudHSM, each service has its unique strengths and use cases. By mastering these tools and strategies, you can design a robust security architecture that meets the highest standards of compliance and performance, ensuring your AWS environment is both secure and efficient. Prioritize security at every layer, stay informed about best practices, and continuously evaluate and enhance your security posture to excel in your AWS certification exam and real-world applications.

MODULE 2: DESIGN RESILIENT ARCHITECTURES

Resilient Systems: Ability to recover quickly from attacks, faults, or failures; essential for high availability and durability.

Scalable Architecture: Dynamically grow during high demand and shrink during low demand; ensures cost efficiency and performance.

Horizontal Scaling: Add more resources to existing pool; enhances overall system capacity and resilience.

Vertical Scaling: Increase capacity of existing resources; improves performance without adding more instances.

Elasticity: Automatically adjust resources to match demand; achieved through services like AWS Auto Scaling.

AWS Auto Scaling: Unified, predictive scaling for multiple AWS resources; efficient but can be costly.

EC2 Auto Scaling: Scales EC2 instances, supports mixed instances; non-predictive but versatile for varying workloads | Read more

Virtual Machines: Full OS with kernel; manages resources on underlying hardware, enabling multiple VMs on one host.

Containers: Lightweight, share host OS kernel; platform-independent, run anywhere without a full OS install.

AWS Purpose-Built Databases: Optimized for performance, scalability, and reliability; tailored for specific use cases. | Read more

DynamoDB Overview: Fully managed NoSQL database; low latency and high performance for real-time applications.

DynamoDB Auto Scaling: Automatically adjusts read/write throughput; based on traffic patterns for cost efficiency.

DynamoDB Global Tables: Multi-region replication; provides low-latency access and high availability globally.

DynamoDB Use Cases: Ideal for real-time bidding, gaming leaderboards, and IoT data storage.

Amazon RDS Overview: Managed relational database service; supports multiple database engines for versatility.

Amazon RDS Read Replicas: Offloads read traffic; improves performance and scalability of the primary database.

Amazon RDS Sharding: Distributes data across multiple instances; handles larger datasets efficiently.

Amazon RDS Use Cases: Suitable for web applications, e-commerce platforms, and financial applications.

Amazon Aurora Overview: Cloud-native relational database; compatible with MySQL and PostgreSQL, offering enhanced performance.

Amazon Aurora Replicas: Supports up to 15 low-latency replicas; provides high availability across multiple AZs.

Amazon Aurora Serverless: Automatically adjusts capacity; ideal for variable workloads with pay-per-use pricing.

Amazon Aurora Use Cases: Fits enterprise applications, SaaS, and OLTP workloads.

Amazon Redshift Overview: Managed, scalable data warehouse service; optimized for large-scale analytics.

Amazon Redshift Elastic Resize: Quickly adds or removes nodes; enables on-demand scalability.

Amazon Redshift Concurrency Scaling: Automatically adds capacity; handles high query loads efficiently.

Amazon Redshift Use Cases: Ideal for data warehousing, business analytics, and reporting.

Amazon RDS Multi-AZ Deployments: Automated failover to standby instance; ensures high availability and fault tolerance.

Amazon RDS Read Replicas Performance: Improves read performance; provides fallback option in case of primary failure.

Amazon ElastiCache Caching: In-memory caching service; reduces database load by storing frequently accessed data.

Amazon ElastiCache Overview: Supports Redis and Memcached; fully managed for high-performance caching.

Amazon ElastiCache Use Cases: Suitable for session storage, database query caching, and real-time analytics.

Amazon ElastiCache + Read Replicas: Enhances performance; combines caching with read replicas for high throughput.

Amazon RDS Performance Bottlenecks: Identify and address issues; crucial under extreme loads for optimal performance.

Amazon RDS Query Optimization: Optimize SQL queries; reduces execution time and resource consumption.

Amazon RDS Indexing: Speeds up data retrieval; uses proper indexing strategies to enhance performance.

AWS Elastic Load Balancing: Distributes traffic; improves performance and availability across multiple instances.

AWS Auto Scaling: Adjusts instances based on demand; ensures resources match workload requirements.

DynamoDB Cost: Pay-per-request pricing; cost-effective scaling for varying workloads.

DynamoDB Security: Encryption at rest and in transit; integrates with IAM for secure access control.

DynamoDB Limitations: Best for NoSQL workloads; may not suit relational data needs.

Amazon RDS Cost: Instance-based pricing; varies by type and usage, reflecting performance needs.

Amazon RDS Security: VPC integration, IAM, and encryption; ensures data protection and secure access.

Amazon RDS Limitations: Requires instance scaling management; no automatic write scaling.

Amazon Aurora Cost: Pay-per-use and instance pricing; flexible for different workload demands.

Amazon Aurora Security: Automated backups, VPC integration, encryption; ensures comprehensive data protection.

Amazon Aurora Limitations: Some features specific to MySQL/PostgreSQL; not suitable for all database needs.

Amazon Redshift Cost: Pay-per-node hour pricing; optimized for large-scale analytics workloads.

Amazon Redshift Security: VPC integration, encryption, IAM; ensures secure data handling and access control.

Amazon Redshift Limitations: Best for read-heavy workloads; not ideal for OLTP applications.

DynamoDB Auto Scaling Cost: Additional charges based on usage; ensures cost-effective scaling.

DynamoDB Auto Scaling Security: Integrated with IAM; secure and automated scaling operations.

DynamoDB Auto Scaling Limitations: Fully automated; no manual control over scaling process.

DynamoDB Global Tables Cost: Charges for multi-region replication; provides global access with added cost.

DynamoDB Global Tables Security: IAM integration; secure global data replication and access.

DynamoDB Global Tables Limitations: Increased cost for global replication; requires careful planning.

Amazon RDS Read Replicas Cost: Additional instance costs; improves read scalability and performance.

Amazon RDS Read Replicas Security: VPC and IAM; secure access and isolation for replicas.

Amazon RDS Read Replicas Limitations: No write scaling; only improves read performance.

Amazon RDS Sharding Cost: Costs increase with shards; involves complex management for large datasets.

Amazon RDS Sharding Security: VPC and IAM; secure data partitioning and access control.

Amazon RDS Sharding Limitations: Complex implementation; requires significant planning and management.

Amazon Aurora Replicas Cost: Additional costs for replicas; enhances read scalability.

Amazon Aurora Replicas Security: Automated backups, VPC, encryption; ensures data protection.

Amazon Aurora Replicas Limitations: Only provides read scalability; not suitable for write-intensive workloads.

Amazon Aurora Serverless Cost: Pay-per-usage; cost-efficient for variable workloads.

Amazon Aurora Serverless Security: Automated backups, VPC; secure serverless operations.

Amazon Aurora Serverless Limitations: Not suitable for all workloads; especially high-throughput OLTP.

Amazon Redshift Elastic Resize Cost: Pay-per-node hour; scalable data warehousing.

Amazon Redshift Elastic Resize Security: VPC integration, encryption; secure resizing operations.

Amazon Redshift Elastic Resize Limitations: Possible downtime during resizing; affects availability.

Amazon Redshift Concurrency Scaling Cost: Additional pay-per-query charges; scales with query load.

Amazon Redshift Concurrency Scaling Security: VPC, encryption; secure concurrency scaling.

Amazon Redshift Concurrency Scaling Limitations: Cost increases with high concurrency; manage usage carefully.

Amazon RDS Multi-AZ Cost: Additional instance costs; ensures high availability.

Amazon RDS Multi-AZ Security: Automated backups, VPC; secure high availability.

Amazon RDS Multi-AZ Limitations: No performance improvement; only provides availability.

Amazon ElastiCache Cost: Costs based on cache instances; high-performance in-memory caching.

Amazon ElastiCache Security: VPC, IAM; secure access and management.

Amazon ElastiCache Limitations: Requires effective cache invalidation; maintain data accuracy.

Amazon RDS Query Optimization Cost: Developer expertise required; optimize SQL queries for performance.

Amazon RDS Query Optimization Security: N/A; focused on performance improvement.

Amazon RDS Query Optimization Limitations: Requires ongoing maintenance; expert knowledge needed.

Amazon RDS Indexing Cost: Developer time for maintenance; improves data retrieval speed.

Amazon RDS Indexing Security: N/A; performance enhancement strategy.

Amazon RDS Indexing Limitations: Increased storage usage; requires regular maintenance.

AWS Elastic Load Balancing Cost: Pay-per-usage; scales traffic management.

AWS Elastic Load Balancing Security: SSL termination, VPC; secure traffic distribution.

AWS Elastic Load Balancing Limitations: Requires proper configuration; ensure optimal performance.

AWS Auto Scaling Cost: Instance costs based on scaling; matches resources to demand.

AWS Auto Scaling Security: VPC, IAM integration; secure automated scaling.

AWS Auto Scaling Limitations: Requires continuous monitoring; define appropriate policies.

Microservices Architecture: Independent services, API communication; flexibility and scalability.

API-Driven Design: Services structured around APIs; API Gateway and Lambda for HTTP handling.

Event-Driven Design: React to real-time events; EventBridge and Lambda for asynchronous processing.

Data Streaming Design: Real-time data processing; Kinesis and Lambda for continuous ingestion.

Serverless Fundamentals: No server management; Lambda and API Gateway for scaling and fault tolerance.

High Throughput Messaging: Scalable message volume; SQS for decoupling and horizontal scaling.

Containers in AWS: Manage containerized apps; ECS and Fargate for simplified orchestration.

Resilient Microservices: Fault-tolerant systems; DynamoDB and RDS for scalable data storage.

Scalable User Interfaces: Low-latency content delivery; CloudFront and API Gateway.

Hybrid Cloud: Extend AWS on-premises; Outposts for hybrid cloud and low-latency access.

Monitoring and Logging: Ensure application health; CloudWatch and X-Ray for monitoring and tracing.

Security Best Practices: Protect applications; IAM and Shield for access control and DDoS protection.

Cost Optimization: Pay for usage; Lambda and Spot Instances for cost-efficient compute.

Automation and CI/CD: Streamline deployment; CodePipeline and CodeBuild for continuous delivery.

Infrastructure as Code: Programmatic infrastructure management; CloudFormation and CDK.

Scaling Lambda: Understand concurrency; Lambda auto-scales with incoming requests.

API Gateway Use Cases: Securely expose services; API Gateway for API management.

Event Processing with Lambda: Asynchronous events; Lambda for serverless event-driven compute.

Asynchronous Decoupling: Independent component operation, SQS and Lambda for fault tolerance and scalability | Introduction to decoupling techniques

API-Driven Design: Structured around APIs, API Gateway and Lambda for efficient HTTP request handling.

Event-Driven Design: Real-time event processing, EventBridge and Lambda for asynchronous workflows.

Data Streaming Design: Continuous data processing, Kinesis and Lambda for real-time

WRAP UP

MODULE 3: DESIGN HIGH-PERFORMING ARCHITECTURES

No Content

MODULE 4: DESIGN COST-OPTIMIZED ARCHITECTURES

No Content

MODULE 1: DESIGN SECURE ARCHITECTURE

Services for Implementing Least Privilege in a Multi-Account Environment

AWS Organizations

AWS Control Tower

AWS Service Catalog

Understanding IAM: Roles vs. Users

Policies in AWS: Identity, Resource, Permissions, and Service Control Policies

Policy Evaluation with Overlapping Rules

Federating Access into AWS

Monitoring Services in AWS

Setting Up Secure VPCs

Protecting Data in Transit and at Rest

Conclusion

MODULE 2: DESIGN RESILIENT ARCHITECTURES

MODULE 3: DESIGN HIGH-PERFORMING ARCHITECTURES

MODULE 4: DESIGN COST-OPTIMIZED ARCHITECTURES