Lesson 2 of 6 · 11 min
Domain 1 — Design secure architectures
The 30% domain: identity, encryption, network isolation and the least-privilege patterns the exam rewards.
Identity questions have a predictable answer shape
If an option involves storing long-lived access keys — on an instance, in a config file, in an application — it is almost always wrong. The intended answer is an IAM role: an instance profile for EC2, an execution role for Lambda, an IRSA role for EKS, an assumed role for cross-account.
For workloads outside AWS, the modern answer is IAM Roles Anywhere or an OIDC federation, not a service account with permanent keys. For human access it is IAM Identity Center with an external identity provider.
Encryption choices
| Requirement | Answer |
|---|---|
| Encrypt at rest with minimal effort | AWS-managed key (aws/service) — free, automatic |
| Control the key policy or share cross-account | Customer-managed KMS key |
| Prove key material never left your control | Import key material, or CloudHSM |
| Rotate automatically every year | Customer-managed key with rotation enabled |
| Encrypt in transit | TLS; enforce with a aws:SecureTransport condition |
| Application-level field encryption | Client-side encryption via the Encryption SDK |
Network isolation
Anything described as 'must not traverse the internet' points at VPC endpoints for AWS services, PrivateLink for a partner service, or a Direct Connect or VPN link for on-premises. Public subnets and NAT gateways are wrong answers to that phrasing, since NAT still exits to the internet.
Anything about inspecting or filtering traffic points at Network Firewall for the VPC, WAF for HTTP applications behind CloudFront or an ALB, and Shield Advanced for large-scale DDoS with cost protection.
Security services and what each is for
| Service | Answers the question |
|---|---|
| GuardDuty | Is something malicious happening right now? |
| Inspector | Do my workloads have known vulnerabilities? |
| Macie | Is sensitive data sitting in S3 where it should not be? |
| Security Hub | One aggregated view of findings and standards |
| AWS Config | Is this resource compliant, and what changed? |
| Secrets Manager | Store and automatically rotate a credential |
| Parameter Store | Store configuration and simple secrets more cheaply |
Worth remembering
- Roles over access keys, always — this alone answers a surprising number of questions.
- KMS key choice is usually about who controls rotation and cross-account access.
- Private connectivity questions come down to endpoints versus NAT versus public.
Test it now
Security scenarios are the largest single group in the medium bank.