Domain 6: Security and Compliance on Album69

Amazon Macie

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Data security for S3 — machine learning plus pattern matching that finds sensitive data and bucket misconfigurations, then routes findings into your response workflow.

Exam-testable facts:

Two finding types: policy findings (bucket-level: publicly accessible, unencrypted, etc.) and sensitive data findings (object-level: credentials, financial data, personal/PII/PHI, custom identifiers, or multiple categories at once).
Discovery modes: automated sensitive data discovery (continuous, sampled) vs sensitive data discovery jobs (targeted, one-time or scheduled).
Custom data identifiers (regex) catch proprietary formats; allow lists suppress known-safe matches to cut noise.
Finding flow: findings go to EventBridge and Security Hub for automated response; full discovery details land in a customer-owned S3 bucket; findings retained 30 days.
Sensitive data findings are always treated as new — re-detecting the same object creates a fresh finding (unlike policy findings, which update in place).

Common traps:

AWS Audit Manager

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What it is: A service that continuously collects evidence from your AWS environment to help you audit compliance with frameworks like PCI-DSS, HIPAA, SOC 2, CIS, and GDPR — replacing manual evidence collection with automated, always-on gathering.

What problem it solves: Compliance audits traditionally require manually pulling screenshots, logs, and config snapshots before an audit. Audit Manager automates that collection continuously, so when an auditor asks for evidence you already have it.

AWS Certificate Manager (ACM)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is ACM?

Managed service for provisioning and managing SSL/TLS certificates
Free SSL/TLS certificates for AWS services
Automatic certificate renewal
Integration with AWS services (CloudFront, ALB, API Gateway)

Key Benefits

Free Certificates - No cost for AWS-integrated certificates
Automatic Renewal - Certificates renewed automatically before expiration
Easy Deployment - One-click deployment to AWS services
Centralized Management - Single place to manage certificates
Security - Private keys never leave AWS infrastructure

Use Cases

HTTPS for web applications
SSL/TLS termination at load balancers
API Gateway custom domains
CloudFront distributions
Elastic Beanstalk applications

2. Certificate Types

Public Certificates

Issued by Amazon Certificate Authority (CA)
Free for use with AWS services
Domain validation (DV) certificates
Wildcard certificates supported
Subject Alternative Names (SAN) supported

Private Certificates

Issued by AWS Private Certificate Authority (PCA)
For internal applications and services
Additional charges apply
Full control over certificate hierarchy
Custom certificate policies

Imported Certificates

Third-party certificates imported into ACM
Self-signed certificates
Certificates from other CAs
Manual renewal required
Additional validation steps

3. Certificate Provisioning

Request Public Certificate

# Request certificate with DNS validation
aws acm request-certificate \
 --domain-name "example.com" \
 --subject-alternative-names "*.example.com" "api.example.com" \
 --validation-method DNS \
 --tags Key=Environment,Value=Production

Domain Validation Methods

DNS Validation - Add CNAME record to DNS (recommended)
Email Validation - Receive validation email at domain contacts

DNS Validation Process

Request certificate with domain names
ACM provides CNAME records for validation
Add CNAME records to DNS zone
ACM validates domain ownership
Certificate issued and ready for use

Email Validation Process

Request certificate with email validation
ACM sends validation emails to domain contacts
Click validation link in email
Certificate issued after validation

4. Certificate Management

List Certificates

# List all certificates
aws acm list-certificates

# List certificates with specific status
aws acm list-certificates --certificate-statuses ISSUED PENDING_VALIDATION

Describe Certificate

# Get certificate details
aws acm describe-certificate \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"

Certificate Renewal

Automatic Renewal - ACM handles renewal for in-use certificates
Manual Renewal - Required for imported certificates
Renewal Timeline - Attempts renewal 60 days before expiration
Validation Required - DNS/email validation must remain valid

Certificate Deletion

# Delete certificate (only if not in use)
aws acm delete-certificate \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"

5. Integration with AWS Services

CloudFront Integration

# Create CloudFront distribution with ACM certificate
aws cloudfront create-distribution \
 --distribution-config '{
 "CallerReference": "my-distribution-2024",
 "Aliases": {
 "Quantity": 1,
 "Items": ["example.com"]
 },
 "DefaultRootObject": "index.html",
 "Origins": {
 "Quantity": 1,
 "Items": [{
 "Id": "my-origin",
 "DomainName": "my-bucket.s3.amazonaws.com",
 "S3OriginConfig": {
 "OriginAccessIdentity": ""
 }
 }]
 },
 "DefaultCacheBehavior": {
 "TargetOriginId": "my-origin",
 "ViewerProtocolPolicy": "redirect-to-https",
 "TrustedSigners": {
 "Enabled": false,
 "Quantity": 0
 },
 "ForwardedValues": {
 "QueryString": false,
 "Cookies": {"Forward": "none"}
 }
 },
 "ViewerCertificate": {
 "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
 "SSLSupportMethod": "sni-only",
 "MinimumProtocolVersion": "TLSv1.2_2021"
 },
 "Enabled": true
 }'

Application Load Balancer Integration

# Create HTTPS listener with ACM certificate
aws elbv2 create-listener \
 --load-balancer-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890123456" \
 --protocol HTTPS \
 --port 443 \
 --certificates CertificateArn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --default-actions Type=forward,TargetGroupArn="arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-targets/1234567890123456"

API Gateway Integration

# Create custom domain for API Gateway
aws apigateway create-domain-name \
 --domain-name "api.example.com" \
 --certificate-arn "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012" \
 --security-policy TLS_1_2

6. Private Certificate Authority (PCA)

Create Private CA

# Create private certificate authority
aws acm-pca create-certificate-authority \
 --certificate-authority-configuration '{
 "KeyAlgorithm": "RSA_2048",
 "SigningAlgorithm": "SHA256WITHRSA",
 "Subject": {
 "Country": "US",
 "Organization": "Example Corp",
 "OrganizationalUnit": "IT Department",
 "CommonName": "Example Corp Root CA"
 }
 }' \
 --certificate-authority-type ROOT \
 --tags Key=Environment,Value=Production

Issue Private Certificate

# Issue certificate from private CA
aws acm-pca issue-certificate \
 --certificate-authority-arn "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012" \
 --csr fileb://certificate-request.csr \
 --signing-algorithm SHA256WITHRSA \
 --validity Value=365,Type=DAYS

Private CA Use Cases

Internal applications and services
IoT device certificates
Code signing certificates
Custom certificate hierarchies
Air-gapped environments

7. Certificate Import

Import Third-Party Certificate

# Import certificate from external CA
aws acm import-certificate \
 --certificate fileb://certificate.pem \
 --private-key fileb://private-key.pem \
 --certificate-chain fileb://certificate-chain.pem \
 --tags Key=Source,Value=ThirdParty

Certificate Requirements

Certificate Format - PEM-encoded X.509
Private Key - RSA or ECC private key
Certificate Chain - Intermediate certificates (if any)
Key Size - Minimum 1024-bit RSA or 224-bit ECC

Import Validation

Certificate and private key must match
Certificate must be valid (not expired)
Certificate chain must be complete
Private key must not be encrypted

8. Monitoring and Compliance

CloudWatch Integration

Certificate expiration monitoring
Custom metrics for certificate status
Alarms for certificate renewal failures

Certificate Expiration Monitoring

import boto3
from datetime import datetime, timedelta

def check_certificate_expiration():
 """Monitor certificate expiration dates"""
 
 acm = boto3.client('acm')
 cloudwatch = boto3.client('cloudwatch')
 
 # List all certificates
 response = acm.list_certificates(CertificateStatuses=['ISSUED'])
 
 for cert in response['CertificateSummaryList']:
 cert_arn = cert['CertificateArn']
 
 # Get certificate details
 cert_details = acm.describe_certificate(CertificateArn=cert_arn)
 
 # Check expiration
 not_after = cert_details['Certificate']['NotAfter']
 days_until_expiry = (not_after - datetime.now()).days
 
 # Send metric to CloudWatch
 cloudwatch.put_metric_data(
 Namespace='ACM/Certificates',
 MetricData=[
 {
 'MetricName': 'DaysUntilExpiry',
 'Dimensions': [
 {
 'Name': 'CertificateArn',
 'Value': cert_arn
 }
 ],
 'Value': days_until_expiry,
 'Unit': 'Count'
 }
 ]
 )

CloudTrail Integration

All ACM API calls logged
Certificate lifecycle events
Compliance and audit trails

Config Integration

Track certificate configuration changes
Compliance rules for certificate management
Automated remediation actions

9. Security Best Practices

Certificate Security

Use strong key algorithms (RSA 2048+ or ECC 256+)
Enable perfect forward secrecy
Use modern TLS versions (1.2+)
Implement HSTS headers
Regular security assessments

Access Control

Use IAM policies for ACM access
Principle of least privilege
Separate roles for certificate management
Monitor certificate operations

Operational Security

Automate certificate deployment
Monitor certificate expiration
Implement certificate rotation procedures
Document certificate management processes

10. Automation and DevOps

Infrastructure as Code

# CloudFormation template for ACM certificate
AWSTemplateFormatVersion: '2010-09-09'
Resources:
 SSLCertificate:
 Type: AWS::CertificateManager::Certificate
 Properties:
 DomainName: example.com
 SubjectAlternativeNames:
 - '*.example.com'
 - api.example.com
 ValidationMethod: DNS
 DomainValidationOptions:
 - DomainName: example.com
 HostedZoneId: !Ref HostedZone
 - DomainName: '*.example.com'
 HostedZoneId: !Ref HostedZone
 Tags:
 - Key: Environment
 Value: Production

Terraform Configuration

# Terraform configuration for ACM certificate
resource "aws_acm_certificate" "example" {
 domain_name = "example.com"
 subject_alternative_names = ["*.example.com", "api.example.com"]
 validation_method = "DNS"

 lifecycle {
 create_before_destroy = true
 }

 tags = {
 Environment = "Production"
 }
}

resource "aws_acm_certificate_validation" "example" {
 certificate_arn = aws_acm_certificate.example.arn
 validation_record_fqdns = [for record in aws_route53_record.example : record.fqdn]
}

Automated Certificate Deployment

import boto3

def deploy_certificate_to_alb(cert_arn, alb_arn):
 """Deploy certificate to Application Load Balancer"""
 
 elbv2 = boto3.client('elbv2')
 
 # Get existing listeners
 listeners = elbv2.describe_listeners(LoadBalancerArn=alb_arn)
 
 # Update HTTPS listener with new certificate
 for listener in listeners['Listeners']:
 if listener['Protocol'] == 'HTTPS':
 elbv2.modify_listener(
 ListenerArn=listener['ListenerArn'],
 Certificates=[{'CertificateArn': cert_arn}]
 )
 print(f"Updated listener {listener['ListenerArn']} with certificate {cert_arn}")

11. Cost Optimization

ACM Pricing

Public Certificates - Free for AWS services
Private Certificates - Charged per certificate issued
Private CA - Monthly fee per CA
API Calls - No additional charges

Cost Optimization Strategies

Use public certificates when possible
Consolidate domains with wildcard certificates
Monitor private certificate usage
Automate certificate lifecycle management
Regular cleanup of unused certificates

12. Multi-Region Considerations

Regional Availability

ACM is available in most AWS regions
Certificates are region-specific
CloudFront requires certificates in us-east-1
Cross-region certificate replication not supported

Global Applications

# Request certificate in us-east-1 for CloudFront
aws acm request-certificate \
 --region us-east-1 \
 --domain-name "global.example.com" \
 --validation-method DNS

# Request certificate in application region for ALB
aws acm request-certificate \
 --region us-west-2 \
 --domain-name "app.example.com" \
 --validation-method DNS

13. Common Exam Scenarios

Scenario 1: Enable HTTPS for web application

Solution:

AWS Compliance and Governance

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Compliance Framework

Shared responsibility model for compliance
AWS manages infrastructure compliance
Customers responsible for data and application compliance
Extensive compliance certifications and attestations

Key Compliance Programs

SOC 1/2/3 - Service Organization Control reports
PCI DSS - Payment Card Industry Data Security Standard
HIPAA - Health Insurance Portability and Accountability Act
FedRAMP - Federal Risk and Authorization Management Program
ISO 27001 - Information Security Management System
GDPR - General Data Protection Regulation

Governance Principles

Accountability - Clear ownership and responsibility
Transparency - Visibility into operations and decisions
Compliance - Adherence to regulations and standards
Risk Management - Identification and mitigation of risks
Continuous Improvement - Regular assessment and enhancement

2. AWS Config for Compliance

What is AWS Config?

Configuration management and compliance service
Tracks resource configurations and changes
Evaluates configurations against compliance rules
Provides configuration history and change notifications

Config Rules

AWS Managed Rules - Pre-built compliance checks
Custom Rules - Lambda-based custom logic
Conformance Packs - Collection of related rules
Organizational Rules - Rules applied across AWS Organizations

Common Compliance Rules

# Enable required tags rule
aws configservice put-config-rule \
 --config-rule '{
 "ConfigRuleName": "required-tags",
 "Source": {
 "Owner": "AWS",
 "SourceIdentifier": "REQUIRED_TAGS"
 },
 "InputParameters": "{\"tag1Key\":\"Environment\",\"tag2Key\":\"Owner\"}"
 }'

Remediation Actions

# CloudFormation template for Config remediation
Resources:
 RemediationConfiguration:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref ConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID

3. AWS Organizations for Governance

Organizational Structure

Management Account - Central billing and administration
Member Accounts - Individual AWS accounts in organization
Organizational Units (OUs) - Logical groupings of accounts
Service Control Policies (SCPs) - Guardrails for account permissions

Service Control Policies

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyRootAccess",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "*",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:PrincipalType": "Root"
 }
 }
 },
 {
 "Sid": "RequireSSLRequestsOnly",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::*/*",
 "arn:aws:s3:::*"
 ],
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 }
 ]
}

Account Management

# Create new account in organization
aws organizations create-account \
 --email "newaccount@example.com" \
 --account-name "Production Account" \
 --role-name "OrganizationAccountAccessRole"

# Move account to OU
aws organizations move-account \
 --account-id "123456789012" \
 --source-parent-id "r-examplerootid111" \
 --destination-parent-id "ou-exampleou111"

4. AWS Control Tower

What is Control Tower?

Landing zone setup and governance service
Pre-configured multi-account environment
Guardrails for compliance and security
Account Factory for standardized account provisioning

Guardrails

Preventive Guardrails - SCPs that prevent actions
Detective Guardrails - Config rules that detect violations
Mandatory Guardrails - Cannot be disabled
Strongly Recommended - Best practice guardrails
Elective Guardrails - Optional additional controls

Account Factory

# Service Catalog product for new accounts
Parameters:
 AccountName:
 Type: String
 Description: Name for the new account
 AccountEmail:
 Type: String
 Description: Email address for the new account
 OrganizationalUnit:
 Type: String
 Description: OU to place the account in
 AllowedValues:
 - Production
 - Development
 - Sandbox

Customizations

# Custom Control Tower customization
import boto3

def deploy_custom_guardrail():
 """Deploy custom guardrail across organization"""
 
 config = boto3.client('config')
 organizations = boto3.client('organizations')
 
 # Get all accounts in organization
 accounts = organizations.list_accounts()
 
 for account in accounts['Accounts']:
 if account['Status'] == 'ACTIVE':
 # Deploy Config rule to each account
 deploy_config_rule_to_account(account['Id'])

def deploy_config_rule_to_account(account_id):
 """Deploy Config rule to specific account"""
 # Implementation for cross-account Config rule deployment
 pass

5. AWS CloudTrail for Audit

CloudTrail Configuration

Management Events - Control plane operations
Data Events - Data plane operations (S3, Lambda)
Insight Events - Unusual activity patterns
Multi-Region Trails - Global event logging

Compliance Logging

# Create compliance trail
aws cloudtrail create-trail \
 --name "ComplianceTrail" \
 --s3-bucket-name "compliance-audit-logs" \
 --s3-key-prefix "cloudtrail-logs/" \
 --include-global-service-events \
 --is-multi-region-trail \
 --enable-log-file-validation \
 --kms-key-id "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"

Log Analysis

import boto3
import json

def analyze_compliance_events():
 """Analyze CloudTrail events for compliance violations"""
 
 s3 = boto3.client('s3')
 
 # List CloudTrail log files
 response = s3.list_objects_v2(
 Bucket='compliance-audit-logs',
 Prefix='cloudtrail-logs/'
 )
 
 violations = []
 
 for obj in response.get('Contents', []):
 # Download and analyze log file
 log_data = s3.get_object(Bucket='compliance-audit-logs', Key=obj['Key'])
 
 # Parse CloudTrail events
 events = json.loads(log_data['Body'].read())
 
 for event in events.get('Records', []):
 if is_compliance_violation(event):
 violations.append(event)
 
 return violations

def is_compliance_violation(event):
 """Check if event represents compliance violation"""
 # Implement compliance checking logic
 return False

6. Data Protection and Privacy

Data Classification

Public - No restrictions on access
Internal - Restricted to organization
Confidential - Restricted to specific individuals
Restricted - Highest level of protection

Data Encryption

# CloudFormation template for encrypted resources
Resources:
 EncryptedS3Bucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: aws:kms
 KMSMasterKeyID: !Ref KMSKey
 BucketKeyEnabled: true
 
 EncryptedRDSInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 StorageEncrypted: true
 KmsKeyId: !Ref KMSKey
 
 EncryptedEBSVolume:
 Type: AWS::EC2::Volume
 Properties:
 Encrypted: true
 KmsKeyId: !Ref KMSKey

Data Loss Prevention

import boto3

def implement_dlp_controls():
 """Implement data loss prevention controls"""
 
 # Enable GuardDuty for threat detection
 guardduty = boto3.client('guardduty')
 guardduty.create_detector(Enable=True)
 
 # Enable Macie for data discovery
 macie = boto3.client('macie2')
 macie.enable_macie()
 
 # Configure CloudWatch for monitoring
 cloudwatch = boto3.client('cloudwatch')
 cloudwatch.put_metric_alarm(
 AlarmName='UnauthorizedDataAccess',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=1,
 MetricName='UnauthorizedAPICallsCount',
 Namespace='CloudTrailMetrics',
 Period=300,
 Statistic='Sum',
 Threshold=10.0,
 ActionsEnabled=True,
 AlarmActions=['arn:aws:sns:us-east-1:123456789012:security-alerts']
 )

7. Identity and Access Management Governance

IAM Best Practices

Least Privilege - Minimum necessary permissions
Regular Reviews - Periodic access reviews
Role-Based Access - Use roles instead of users
MFA Enforcement - Multi-factor authentication
Password Policies - Strong password requirements

Access Reviews

import boto3
from datetime import datetime, timedelta

def perform_access_review():
 """Perform regular IAM access review"""
 
 iam = boto3.client('iam')
 
 # Get all users
 users = iam.list_users()
 
 inactive_users = []
 
 for user in users['Users']:
 username = user['UserName']
 
 # Check last activity
 last_used = get_user_last_activity(username)
 
 if last_used and (datetime.now() - last_used).days > 90:
 inactive_users.append(username)
 
 return inactive_users

def get_user_last_activity(username):
 """Get user's last activity date"""
 iam = boto3.client('iam')
 
 try:
 response = iam.get_user(UserName=username)
 return response['User'].get('PasswordLastUsed')
 except:
 return None

Permission Boundaries

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::allowed-bucket/*"
 },
 {
 "Effect": "Deny",
 "Action": [
 "iam:*",
 "organizations:*",
 "account:*"
 ],
 "Resource": "*"
 }
 ]
}

8. Compliance Monitoring and Reporting

Automated Compliance Checks

import boto3

def run_compliance_checks():
 """Run automated compliance checks"""
 
 config = boto3.client('config')
 
 # Trigger Config rule evaluations
 rules = config.describe_config_rules()
 
 results = {}
 
 for rule in rules['ConfigRules']:
 rule_name = rule['ConfigRuleName']
 
 # Get compliance status
 compliance = config.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name
 )
 
 results[rule_name] = {
 'compliant': len([r for r in compliance['EvaluationResults'] 
 if r['ComplianceType'] == 'COMPLIANT']),
 'non_compliant': len([r for r in compliance['EvaluationResults'] 
 if r['ComplianceType'] == 'NON_COMPLIANT'])
 }
 
 return results

Compliance Dashboard

import boto3
import json

def generate_compliance_dashboard():
 """Generate compliance dashboard data"""
 
 # Collect compliance data from various sources
 config_compliance = get_config_compliance()
 security_findings = get_security_hub_findings()
 access_analyzer_findings = get_access_analyzer_findings()
 
 dashboard_data = {
 'timestamp': datetime.now().isoformat(),
 'config_compliance': config_compliance,
 'security_findings': security_findings,
 'access_findings': access_analyzer_findings,
 'overall_score': calculate_compliance_score(
 config_compliance, security_findings, access_analyzer_findings
 )
 }
 
 return dashboard_data

def calculate_compliance_score(config_data, security_data, access_data):
 """Calculate overall compliance score"""
 # Implementation for compliance scoring
 return 85.5 # Example score

9. Incident Response and Forensics

Incident Response Plan

Detection - Identify security incidents
Analysis - Assess impact and scope
Containment - Limit damage and spread
Eradication - Remove threats
Recovery - Restore normal operations
Lessons Learned - Improve processes

Forensic Data Collection

import boto3

def collect_forensic_data(incident_id, start_time, end_time):
 """Collect forensic data for incident investigation"""
 
 # Collect CloudTrail logs
 cloudtrail_logs = collect_cloudtrail_logs(start_time, end_time)
 
 # Collect VPC Flow Logs
 vpc_flow_logs = collect_vpc_flow_logs(start_time, end_time)
 
 # Collect GuardDuty findings
 guardduty_findings = collect_guardduty_findings(start_time, end_time)
 
 # Create forensic package
 forensic_package = {
 'incident_id': incident_id,
 'collection_time': datetime.now().isoformat(),
 'cloudtrail_logs': cloudtrail_logs,
 'vpc_flow_logs': vpc_flow_logs,
 'guardduty_findings': guardduty_findings
 }
 
 # Store in secure S3 bucket
 store_forensic_data(forensic_package)
 
 return forensic_package

Automated Response

import boto3

def automated_incident_response(finding):
 """Automated response to security findings"""
 
 if finding['severity'] == 'HIGH':
 # Isolate affected resources
 isolate_compromised_instance(finding['resource_id'])
 
 # Create snapshot for forensics
 create_forensic_snapshot(finding['resource_id'])
 
 # Notify security team
 send_security_alert(finding)
 
 elif finding['severity'] == 'MEDIUM':
 # Log for investigation
 log_security_event(finding)
 
 # Apply remediation if available
 apply_automated_remediation(finding)

def isolate_compromised_instance(instance_id):
 """Isolate compromised EC2 instance"""
 ec2 = boto3.client('ec2')
 
 # Create isolation security group
 isolation_sg = create_isolation_security_group()
 
 # Apply isolation security group
 ec2.modify_instance_attribute(
 InstanceId=instance_id,
 Groups=[isolation_sg]
 )

10. Regulatory Compliance Frameworks

Data Protection by Design - Privacy built into systems
Data Subject Rights - Access, rectification, erasure
Data Processing Records - Documentation of processing activities
Data Protection Impact Assessments - Risk assessments

HIPAA Compliance

Administrative Safeguards - Policies and procedures
Physical Safeguards - Physical access controls
Technical Safeguards - Access controls and encryption
Business Associate Agreements - Third-party compliance

PCI DSS Compliance

Build and Maintain Secure Networks - Firewalls and security
Protect Cardholder Data - Encryption and access controls
Maintain Vulnerability Management - Security testing and updates
Implement Strong Access Control - Authentication and authorization

11. Common Exam Scenarios

Scenario 1: Implement organization-wide compliance monitoring

Solution:

AWS IAM (Identity and Access Management)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is IAM?

Web service for securely controlling access to AWS resources
Centralized management of users, groups, roles, and permissions
Global service (not region-specific)
Free service - no additional charges

Key Components

Users - Individual identities for people or applications
Groups - Collections of users with shared permissions
Roles - Temporary credentials for services or cross-account access
Policies - JSON documents defining permissions
Identity Providers - External identity systems (SAML, OIDC)

Core Principles

Least Privilege - Grant minimum permissions needed
Defense in Depth - Multiple layers of security
Principle of Separation - Separate duties and responsibilities
Regular Auditing - Monitor and review access patterns

2. Users and Groups

IAM Users

Permanent identity with long-term credentials
Used for people or applications needing AWS access
Maximum 5,000 users per AWS account
Can have access keys, passwords, MFA devices

User Creation

# Create user
aws iam create-user --user-name john-doe

# Create access key
aws iam create-access-key --user-name john-doe

# Set password
aws iam create-login-profile --user-name john-doe --password MyPassword123!

IAM Groups

Collection of users with shared permissions
Users inherit group permissions
Maximum 300 groups per account
Users can belong to multiple groups (max 10)

Group Management

# Create group
aws iam create-group --group-name developers

# Add user to group
aws iam add-user-to-group --user-name john-doe --group-name developers

# Attach policy to group
aws iam attach-group-policy --group-name developers --policy-arn arn:aws:iam::aws:policy/PowerUserAccess

3. IAM Roles

What are Roles?

Temporary security credentials
No permanent credentials (no access keys)
Assumed by users, applications, or services
Cross-account access mechanism

Role Types

Service Roles - For AWS services (EC2, Lambda, etc.)
Cross-Account Roles - Access between AWS accounts
Identity Provider Roles - For federated users
Instance Profiles - Container for EC2 service roles

Role Creation

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Service": "ec2.amazonaws.com"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

Assume Role Process

# Assume role
aws sts assume-role \
 --role-arn arn:aws:iam::123456789012:role/MyRole \
 --role-session-name MySession

# Use temporary credentials
export AWS_ACCESS_KEY_ID=ASIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...

4. IAM Policies

Policy Types

AWS Managed Policies - Created and maintained by AWS
Customer Managed Policies - Created by you
Inline Policies - Embedded directly in user/group/role

Policy Structure

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowS3Access",
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject"
 ],
 "Resource": "arn:aws:s3:::my-bucket/*",
 "Condition": {
 "StringEquals": {
 "s3:x-amz-server-side-encryption": "AES256"
 }
 }
 }
 ]
}

Policy Elements

Version - Policy language version (2012-10-17)
Statement - Array of permission statements
Effect - Allow or Deny
Action - API actions (s3:GetObject)
Resource - ARN of resources
Principal - Who the policy applies to
Condition - When the policy applies

Policy Evaluation Logic

Explicit Deny - Always wins
Explicit Allow - Required for access
Default Deny - No explicit allow = deny

5. Multi-Factor Authentication (MFA)

MFA Device Types

Virtual MFA - Smartphone apps (Google Authenticator, Authy)
Hardware MFA - Physical tokens (YubiKey, Gemalto)
SMS MFA - Text message (not recommended for root)

Enable MFA

# Create virtual MFA device
aws iam create-virtual-mfa-device --virtual-mfa-device-name MyMFA --outfile QRCode.png

# Enable MFA for user
aws iam enable-mfa-device \
 --user-name john-doe \
 --serial-number arn:aws:iam::123456789012:mfa/MyMFA \
 --authentication-code1 123456 \
 --authentication-code2 789012

MFA Policy Enforcement

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Deny",
 "NotAction": [
 "iam:CreateVirtualMFADevice",
 "iam:EnableMFADevice",
 "iam:GetUser",
 "iam:ListMFADevices"
 ],
 "Resource": "*",
 "Condition": {
 "BoolIfExists": {
 "aws:MultiFactorAuthPresent": "false"
 }
 }
 }
 ]
}

6. Identity Federation

Federation Types

SAML 2.0 - Enterprise identity providers
OpenID Connect (OIDC) - Web identity providers
Custom Identity Broker - Your own authentication system

SAML Federation

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Federated": "arn:aws:iam::123456789012:saml-provider/MyProvider"
 },
 "Action": "sts:AssumeRoleWithSAML",
 "Condition": {
 "StringEquals": {
 "SAML:aud": "https://signin.aws.amazon.com/saml"
 }
 }
 }
 ]
}

Web Identity Federation

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Federated": "arn:aws:iam::123456789012:oidc-provider/accounts.google.com"
 },
 "Action": "sts:AssumeRoleWithWebIdentity",
 "Condition": {
 "StringEquals": {
 "accounts.google.com:aud": "my-app-id"
 }
 }
 }
 ]
}

7. Cross-Account Access

Cross-Account Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111122223333:root"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": "unique-external-id"
 }
 }
 }
 ]
}

External ID Pattern

Additional security for cross-account access
Prevents confused deputy problem
Shared secret between accounts

Cross-Account Access Steps

Create role in target account
Define trust policy with source account
Attach permissions policy to role
Source account assumes role
Use temporary credentials

8. IAM Best Practices

Security Best Practices

Enable MFA for all users
Use roles instead of users for applications
Rotate access keys regularly
Use least privilege principle
Enable CloudTrail logging
Regular access reviews

Operational Best Practices

Use groups for permission management
Use AWS managed policies when possible
Tag IAM resources for organization
Use policy conditions for fine-grained control
Implement break-glass procedures

Development Best Practices

Use IAM roles for EC2 instances
Use temporary credentials in applications
Don’t embed credentials in code
Use AWS SDKs for credential management
Implement proper error handling

9. IAM Conditions

Common Condition Keys

aws:RequestedRegion - Restrict by region
aws:SourceIp - Restrict by IP address
aws:CurrentTime - Time-based access
aws:userid - User identifier
aws:username - User name

IP Address Restriction

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "*",
 "Resource": "*",
 "Condition": {
 "IpAddress": {
 "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
 }
 }
 }
 ]
}

Time-Based Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "s3:GetObject",
 "Resource": "*",
 "Condition": {
 "DateGreaterThan": {
 "aws:CurrentTime": "2024-01-01T00:00:00Z"
 },
 "DateLessThan": {
 "aws:CurrentTime": "2024-12-31T23:59:59Z"
 }
 }
 }
 ]
}

10. IAM Access Analyzer

What is Access Analyzer?

Identifies resources shared with external entities
Uses provable security (mathematical analysis)
Generates findings for review
Validates policies against security best practices

Access Analyzer Features

External Access Findings - Resources accessible outside account
Policy Validation - Check policy syntax and logic
Policy Generation - Generate policies from CloudTrail logs
Unused Access - Identify unused permissions

Enable Access Analyzer

# Create analyzer
aws accessanalyzer create-analyzer \
 --analyzer-name MyAnalyzer \
 --type ACCOUNT

# List findings
aws accessanalyzer list-findings \
 --analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/MyAnalyzer

11. IAM Credential Reports

Credential Report Contents

User creation date
Password last used
Password last changed
Password next rotation
MFA device status
Access key status and usage

Generate Report

# Generate credential report
aws iam generate-credential-report

# Get credential report
aws iam get-credential-report --output text --query Content | base64 -d > credential-report.csv

Access Advisor

Shows service permissions granted to user/role
Shows last accessed information
Helps identify unused permissions
Available via console or API

12. IAM Identity Center (formerly AWS SSO)

Full coverage in dedicated file: IAM-Identity-Center-General.md

AWS IAM Identity Center

Sun, 04 Oct 2026 00:00:00 +0000

Naming: AWS IAM Identity Center is the current name. It was called AWS Single Sign-On (AWS SSO) until July 2022. The exam may use either name — they are the same service. Any file in this repo that still says “AWS SSO” means IAM Identity Center.

1. Overview

What it is: The centralized workforce identity service for AWS. One place to manage who can access which AWS accounts and applications, using which permissions, with a single login experience.

AWS KMS (Key Management Service)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is KMS?

Managed service for creating and controlling encryption keys
Integrates with most AWS services for encryption
FIPS 140-2 Level 2 validated hardware security modules (HSMs)
Regional service with global key management capabilities

Key Benefits

Centralized Key Management - Single place to manage encryption keys
Integration - Native integration with AWS services
Compliance - Meets various compliance requirements
Audit Trail - All key usage logged in CloudTrail
Cost Effective - Pay per use model

Use Cases

Encrypt data at rest in AWS services
Encrypt data in transit
Digital signing and verification
Generate random data
Compliance requirements (HIPAA, PCI DSS, etc.)

2. KMS Key Types

Customer Managed Keys (CMK)

Created and managed by you
Full control over key policies and permissions
Can be enabled/disabled, rotated, deleted
Used for most encryption scenarios

AWS Managed Keys

Created and managed by AWS services
Used automatically by AWS services
Cannot be deleted or disabled
Automatic rotation every year
Key alias format: aws/service-name

AWS Owned Keys

Owned and managed by AWS
Used by AWS services for internal operations
Not visible in your account
No additional charges

Key Specifications

Symmetric Keys - Same key for encrypt/decrypt (AES-256)
Asymmetric Keys - Key pair for encrypt/decrypt or sign/verify
HMAC Keys - Hash-based message authentication codes

3. Key Creation and Management

Create Symmetric Key

# Create customer managed key
aws kms create-key \
 --description "My encryption key" \
 --key-usage ENCRYPT_DECRYPT \
 --key-spec SYMMETRIC_DEFAULT

# Create key alias
aws kms create-alias \
 --alias-name alias/my-key \
 --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Create Asymmetric Key

# Create RSA key for encryption
aws kms create-key \
 --description "RSA encryption key" \
 --key-usage ENCRYPT_DECRYPT \
 --key-spec RSA_2048

# Create ECC key for signing
aws kms create-key \
 --description "ECC signing key" \
 --key-usage SIGN_VERIFY \
 --key-spec ECC_NIST_P256

Key Policy Example

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "Enable IAM User Permissions",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::123456789012:root"
 },
 "Action": "kms:*",
 "Resource": "*"
 },
 {
 "Sid": "Allow use of the key",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::123456789012:role/MyRole"
 },
 "Action": [
 "kms:Encrypt",
 "kms:Decrypt",
 "kms:ReEncrypt*",
 "kms:GenerateDataKey*",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 }
 ]
}

4. Encryption Operations

Data Encryption

# Encrypt small data (up to 4KB)
aws kms encrypt \
 --key-id alias/my-key \
 --plaintext "Hello World" \
 --output text \
 --query CiphertextBlob

# Decrypt data
aws kms decrypt \
 --ciphertext-blob fileb://encrypted-data \
 --output text \
 --query Plaintext | base64 -d

Data Key Operations

# Generate data key for large data encryption
aws kms generate-data-key \
 --key-id alias/my-key \
 --key-spec AES_256

# Generate data key without plaintext
aws kms generate-data-key-without-plaintext \
 --key-id alias/my-key \
 --key-spec AES_256

Envelope Encryption Pattern

Generate data key using KMS
Use plaintext data key to encrypt large data
Store encrypted data key with encrypted data
Discard plaintext data key from memory
To decrypt: decrypt data key first, then use it to decrypt data

5. Key Rotation

Automatic Rotation

Available for customer managed symmetric keys
Rotates key material annually
Old key material retained for decryption
No impact on applications (same key ID/ARN)

# Enable automatic rotation
aws kms enable-key-rotation --key-id alias/my-key

# Check rotation status
aws kms get-key-rotation-status --key-id alias/my-key

Manual Rotation

Create new key with new key material
Update applications to use new key
Keep old key for decrypting existing data
More control but requires application changes

Rotation Best Practices

Enable automatic rotation for symmetric keys
Plan manual rotation for asymmetric keys
Test rotation process in non-production
Monitor rotation events in CloudTrail
Update key aliases to point to new keys

6. Cross-Account Access

Cross-Account Key Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "Allow external account access",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111122223333:root"
 },
 "Action": [
 "kms:Encrypt",
 "kms:Decrypt",
 "kms:ReEncrypt*",
 "kms:GenerateDataKey*",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 }
 ]
}

Cross-Account Grants

# Create grant for cross-account access
aws kms create-grant \
 --key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \
 --grantee-principal arn:aws:iam::111122223333:role/MyRole \
 --operations Encrypt Decrypt GenerateDataKey

Cross-Region Considerations

KMS keys are regional resources
Cannot use key from one region in another
Must copy encrypted data and re-encrypt with regional key
Use AWS services that handle cross-region encryption

7. Integration with AWS Services

S3 Integration

# Upload with KMS encryption
aws s3 cp file.txt s3://my-bucket/ \
 --sse aws:kms \
 --sse-kms-key-id alias/my-key

# Set default encryption on bucket
aws s3api put-bucket-encryption \
 --bucket my-bucket \
 --server-side-encryption-configuration '{
 "Rules": [{
 "ApplyServerSideEncryptionByDefault": {
 "SSEAlgorithm": "aws:kms",
 "KMSMasterKeyID": "alias/my-key"
 }
 }]
 }'

EBS Integration

# Create encrypted EBS volume
aws ec2 create-volume \
 --size 10 \
 --volume-type gp3 \
 --availability-zone us-east-1a \
 --encrypted \
 --kms-key-id alias/my-key

RDS Integration

# Create encrypted RDS instance
aws rds create-db-instance \
 --db-instance-identifier mydb \
 --db-instance-class db.t3.micro \
 --engine mysql \
 --storage-encrypted \
 --kms-key-id alias/my-key

Lambda Integration

import boto3
import os

# Lambda function with KMS encrypted environment variables
def lambda_handler(event, context):
 # Decrypt environment variable
 kms = boto3.client('kms')
 encrypted_value = os.environ['ENCRYPTED_VALUE']
 
 decrypted = kms.decrypt(CiphertextBlob=encrypted_value)
 plaintext_value = decrypted['Plaintext'].decode('utf-8')
 
 return {'statusCode': 200, 'body': 'Success'}

8. KMS Grants

What are Grants?

Alternative to key policies for temporary access
Programmatically created and managed
Can be constrained by conditions
Persist until explicitly retired (retire-grant) or revoked (revoke-grant) - they are NOT auto-cleaned

Grant Operations

# Create grant
aws kms create-grant \
 --key-id alias/my-key \
 --grantee-principal arn:aws:iam::123456789012:role/MyRole \
 --operations Encrypt Decrypt GenerateDataKey \
 --constraints EncryptionContextSubset='{Department=Finance}'

# List grants
aws kms list-grants --key-id alias/my-key

# Retire grant
aws kms retire-grant \
 --key-id alias/my-key \
 --grant-token AQpAM2RhZTk1MGMyNzEyMWI2N2VjODg4MzMzMzMzMzMzMzM

Grant Constraints

EncryptionContextEquals - Exact match required
EncryptionContextSubset - Subset match required
Used to limit grant usage to specific contexts

9. Encryption Context

What is Encryption Context?

Additional authenticated data (AAD)
Key-value pairs that provide additional security
Not secret but provides integrity protection
Logged in CloudTrail for auditing

Using Encryption Context

# Encrypt with context
aws kms encrypt \
 --key-id alias/my-key \
 --plaintext "sensitive data" \
 --encryption-context Department=Finance,Project=Alpha

# Decrypt requires same context
aws kms decrypt \
 --ciphertext-blob fileb://encrypted-data \
 --encryption-context Department=Finance,Project=Alpha

Best Practices

Use meaningful key-value pairs
Include resource identifiers
Don’t include sensitive information
Use for access control and auditing
Consistent naming conventions

10. Multi-Region Keys

What are Multi-Region Keys?

Primary key in one region with replica keys in other regions
Same key material and key ID across regions
Encrypt in one region, decrypt in another
Useful for global applications and disaster recovery

Create Multi-Region Key

# Create multi-region key
aws kms create-key \
 --description "Multi-region key" \
 --multi-region \
 --key-usage ENCRYPT_DECRYPT

# Replicate to another region
aws kms replicate-key \
 --key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \
 --replica-region us-west-2 \
 --description "Replica in us-west-2"

Multi-Region Use Cases

Global applications with regional data
Cross-region backup and disaster recovery
Content distribution networks
Multi-region database replication

11. Custom Key Stores

CloudHSM Key Store

Use AWS CloudHSM cluster as key store
FIPS 140-2 Level 3 validation
Single-tenant hardware security modules
Full control over HSM and key material

External Key Store (XKS)

Use external key management system
Keys remain in your infrastructure
KMS proxies requests to external system
Ultimate control over key material

Setup CloudHSM Key Store

# Create custom key store
aws kms create-custom-key-store \
 --custom-key-store-name MyCloudHSMKeyStore \
 --cloud-hsm-cluster-id cluster-1234567890abcdef0 \
 --trust-anchor-certificate file://customerCA.crt \
 --key-store-password MyPassword123!

12. Monitoring and Logging

CloudTrail Integration

All KMS API calls logged
Key usage events recorded
Encryption context included in logs
Cross-account access visibility

Key Usage Monitoring

{
 "eventTime": "2024-01-15T10:30:00Z",
 "eventName": "Decrypt",
 "eventSource": "kms.amazonaws.com",
 "userIdentity": {
 "type": "AssumedRole",
 "principalId": "AIDACKCEVSQ6C2EXAMPLE",
 "arn": "arn:aws:sts::123456789012:assumed-role/MyRole/MySession"
 },
 "requestParameters": {
 "keyId": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab",
 "encryptionContext": {
 "Department": "Finance"
 }
 }
}

CloudWatch Metrics

No native KMS metrics
Create custom metrics from CloudTrail logs
Monitor key usage patterns
Alert on unusual activity

13. Security Best Practices

Key Management

Use customer managed keys for sensitive data
Enable automatic rotation when possible
Implement least privilege access
Use encryption context for additional security
Regular key policy reviews

Access Control

Use IAM policies and key policies together
Implement separation of duties
Use grants for temporary access
Monitor cross-account access
Audit key usage regularly

Operational Security

Enable CloudTrail logging
Monitor key usage patterns
Implement key lifecycle management
Test disaster recovery procedures
Document key management procedures

14. Cost Optimization

KMS Pricing Components

Customer Managed Keys - $1/month per key
API Requests - $0.03 per 10,000 requests
AWS Managed Keys - Free (requests still charged)
Custom Key Stores - Additional HSM costs

Cost Optimization Strategies

Use AWS managed keys when appropriate
Consolidate keys where possible
Monitor API request patterns
Use data key caching
Implement efficient key rotation

Data Key Caching

import boto3
from aws_encryption_sdk import encrypt, decrypt
from aws_encryption_sdk.caches import LocalCryptoMaterialsCache
from aws_encryption_sdk.key_providers.kms import KMSMasterKeyProvider

# Setup caching to reduce KMS API calls
cache = LocalCryptoMaterialsCache(capacity=100)
key_provider = KMSMasterKeyProvider(key_ids=['alias/my-key'])

# Encrypt with caching
ciphertext, _ = encrypt(
 source=b'my data',
 key_provider=key_provider,
 materials_manager=cache
)

15. Common Exam Scenarios

Scenario 1: Cross-account S3 bucket encryption

Solution:

AWS Secrets Manager

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is Secrets Manager?

Managed service for storing, retrieving, and rotating secrets
Centralized secret management across AWS services and applications
Automatic rotation capabilities for supported services
Integration with RDS, DocumentDB, Redshift, and other services

Key Benefits

Automatic Rotation - Built-in rotation for database credentials
Fine-grained Access Control - IAM and resource-based policies
Encryption - Secrets encrypted at rest and in transit
Audit Trail - CloudTrail integration for compliance
Cross-Region Replication - Disaster recovery and multi-region apps

Use Cases

Database credentials rotation
API keys and tokens management
Application configuration secrets
Third-party service credentials
Certificate and private key storage

2. Secret Types and Structure

Supported Secret Types

Database Credentials - RDS, Aurora, DocumentDB, Redshift
Other Credentials - API keys, OAuth tokens, certificates
Arbitrary Text - JSON, plain text, binary data
Key-Value Pairs - Structured configuration data

Secret Structure

{
 "username": "admin",
 "password": "MySecretPassword123!",
 "engine": "mysql",
 "host": "mydb.cluster-xyz.us-east-1.rds.amazonaws.com",
 "port": 3306,
 "dbname": "production"
}

Secret Versions

Each secret can have multiple versions
AWSCURRENT - Current active version
AWSPENDING - Version being rotated to
AWSPREVIOUS - Previous version (for rollback)
Custom version stages for testing

3. Creating and Managing Secrets

Create Database Secret

# Create RDS secret with automatic rotation
aws secretsmanager create-secret \
 --name "prod/db/mysql" \
 --description "Production MySQL credentials" \
 --secret-string '{
 "username": "admin",
 "password": "MyPassword123!",
 "engine": "mysql",
 "host": "mydb.cluster-xyz.us-east-1.rds.amazonaws.com",
 "port": 3306,
 "dbname": "production"
 }'

Create API Key Secret

# Create API key secret
aws secretsmanager create-secret \
 --name "prod/api/external-service" \
 --description "External service API key" \
 --secret-string '{
 "api_key": "sk-1234567890abcdef",
 "api_url": "https://api.example.com",
 "timeout": 30
 }'

Update Secret Value

# Update secret value
aws secretsmanager update-secret \
 --secret-id "prod/db/mysql" \
 --secret-string '{
 "username": "admin",
 "password": "NewPassword456!",
 "engine": "mysql",
 "host": "mydb.cluster-xyz.us-east-1.rds.amazonaws.com",
 "port": 3306,
 "dbname": "production"
 }'

4. Retrieving Secrets

Get Secret Value

# Retrieve current secret
aws secretsmanager get-secret-value \
 --secret-id "prod/db/mysql" \
 --query SecretString \
 --output text

Application Integration

import boto3
import json

def get_secret(secret_name, region_name="us-east-1"):
 session = boto3.session.Session()
 client = session.client(
 service_name='secretsmanager',
 region_name=region_name
 )
 
 try:
 response = client.get_secret_value(SecretId=secret_name)
 secret = json.loads(response['SecretString'])
 return secret
 except Exception as e:
 print(f"Error retrieving secret: {e}")
 return None

# Usage
db_credentials = get_secret("prod/db/mysql")
if db_credentials:
 username = db_credentials['username']
 password = db_credentials['password']
 host = db_credentials['host']

Batch Retrieval

# Get multiple secrets
aws secretsmanager batch-get-secret-value \
 --secret-id-list "prod/db/mysql" "prod/api/external-service"

5. Automatic Rotation

Supported Services

Amazon RDS - MySQL, PostgreSQL, Oracle, SQL Server
Amazon Aurora - MySQL, PostgreSQL
Amazon DocumentDB - MongoDB-compatible
Amazon Redshift - Data warehouse

Enable Rotation for RDS

# Enable automatic rotation
aws secretsmanager rotate-secret \
 --secret-id "prod/db/mysql" \
 --rotation-rules AutomaticallyAfterDays=30 \
 --rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:SecretsManagerRDSMySQLRotationSingleUser

Rotation Configuration

{
 "AutomaticallyAfterDays": 30,
 "RotationLambdaARN": "arn:aws:lambda:us-east-1:123456789012:function:SecretsManagerRDSMySQLRotationSingleUser"
}

Rotation Process

Create New Version - Generate new password
Set Secret - Update database with new password
Test Secret - Verify new credentials work
Finish Secret - Mark new version as current

6. Custom Rotation with Lambda

Lambda Rotation Function

import boto3
import json
import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
 """Custom rotation function for API keys"""
 
 client = boto3.client('secretsmanager')
 secret_arn = event['SecretId']
 token = event['ClientRequestToken']
 step = event['Step']
 
 try:
 if step == "createSecret":
 create_secret(client, secret_arn, token)
 elif step == "setSecret":
 set_secret(client, secret_arn, token)
 elif step == "testSecret":
 test_secret(client, secret_arn, token)
 elif step == "finishSecret":
 finish_secret(client, secret_arn, token)
 else:
 logger.error(f"Invalid step parameter: {step}")
 
 except Exception as e:
 logger.error(f"Rotation failed: {e}")
 raise e

def create_secret(client, secret_arn, token):
 """Create new secret version"""
 try:
 # Get current secret
 current_secret = client.get_secret_value(
 SecretId=secret_arn,
 VersionStage="AWSCURRENT"
 )
 
 # Generate new API key (example)
 new_secret = json.loads(current_secret['SecretString'])
 new_secret['api_key'] = generate_new_api_key()
 
 # Store new version
 client.put_secret_value(
 SecretId=secret_arn,
 ClientRequestToken=token,
 SecretString=json.dumps(new_secret),
 VersionStages=['AWSPENDING']
 )
 
 except client.exceptions.ResourceExistsException:
 logger.info("Secret version already exists")

def generate_new_api_key():
 """Generate new API key - implement your logic"""
 import secrets
 return f"sk-{secrets.token_hex(16)}"

Rotation Lambda Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "secretsmanager:DescribeSecret",
 "secretsmanager:GetSecretValue",
 "secretsmanager:PutSecretValue",
 "secretsmanager:UpdateSecretVersionStage"
 ],
 "Resource": "arn:aws:secretsmanager:*:*:secret:*"
 }
 ]
}

7. Cross-Region Replication

Enable Replication

# Replicate secret to another region
aws secretsmanager replicate-secret-to-regions \
 --secret-id "prod/db/mysql" \
 --add-replica-regions Region=us-west-2,KmsKeyId=alias/aws/secretsmanager

Replication Configuration

{
 "ReplicationStatus": [
 {
 "Region": "us-west-2",
 "KmsKeyId": "alias/aws/secretsmanager",
 "Status": "InSync",
 "StatusMessage": "Replication successful"
 }
 ]
}

Multi-Region Application

import boto3

def get_secret_multi_region(secret_name, preferred_regions):
 """Get secret from multiple regions with failover"""
 
 for region in preferred_regions:
 try:
 client = boto3.client('secretsmanager', region_name=region)
 response = client.get_secret_value(SecretId=secret_name)
 return json.loads(response['SecretString'])
 except Exception as e:
 print(f"Failed to get secret from {region}: {e}")
 continue
 
 raise Exception("Failed to retrieve secret from all regions")

# Usage with failover
regions = ['us-east-1', 'us-west-2', 'eu-west-1']
secret = get_secret_multi_region("prod/db/mysql", regions)

8. Access Control and Security

Resource-Based Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowApplicationAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::123456789012:role/MyApplicationRole"
 },
 "Action": "secretsmanager:GetSecretValue",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "secretsmanager:VersionStage": "AWSCURRENT"
 }
 }
 }
 ]
}

IAM Policy for Applications

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "secretsmanager:GetSecretValue"
 ],
 "Resource": [
 "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/*",
 "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/api/*"
 ],
 "Condition": {
 "StringEquals": {
 "secretsmanager:VersionStage": "AWSCURRENT"
 }
 }
 }
 ]
}

Encryption Configuration

# Create secret with custom KMS key
aws secretsmanager create-secret \
 --name "prod/db/mysql" \
 --kms-key-id "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" \
 --secret-string '{"username":"admin","password":"MyPassword123!"}'

9. Integration Patterns

RDS Integration

import boto3
import pymysql

def connect_to_rds():
 """Connect to RDS using Secrets Manager"""
 
 # Get database credentials
 secret = get_secret("prod/db/mysql")
 
 # Connect to database
 connection = pymysql.connect(
 host=secret['host'],
 user=secret['username'],
 password=secret['password'],
 database=secret['dbname'],
 port=secret['port']
 )
 
 return connection

Lambda Environment Variables

import os
import boto3
import json

def lambda_handler(event, context):
 """Lambda function using Secrets Manager"""
 
 secret_name = os.environ['SECRET_NAME']
 
 # Get secret
 client = boto3.client('secretsmanager')
 response = client.get_secret_value(SecretId=secret_name)
 secret = json.loads(response['SecretString'])
 
 # Use secret in application logic
 api_key = secret['api_key']
 
 return {'statusCode': 200, 'body': 'Success'}

ECS Task Definition

{
 "family": "my-app",
 "taskRoleArn": "arn:aws:iam::123456789012:role/MyTaskRole",
 "containerDefinitions": [
 {
 "name": "my-container",
 "image": "my-app:latest",
 "secrets": [
 {
 "name": "DB_PASSWORD",
 "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/mysql:password::"
 },
 {
 "name": "API_KEY",
 "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/api/external:api_key::"
 }
 ]
 }
 ]
}

10. Monitoring and Logging

CloudTrail Events

{
 "eventTime": "2024-01-15T10:30:00Z",
 "eventName": "GetSecretValue",
 "eventSource": "secretsmanager.amazonaws.com",
 "userIdentity": {
 "type": "AssumedRole",
 "principalId": "AIDACKCEVSQ6C2EXAMPLE",
 "arn": "arn:aws:sts::123456789012:assumed-role/MyRole/MySession"
 },
 "requestParameters": {
 "secretId": "prod/db/mysql",
 "versionStage": "AWSCURRENT"
 },
 "responseElements": null
}

CloudWatch Metrics

No native Secrets Manager metrics
Create custom metrics from CloudTrail logs
Monitor secret access patterns
Alert on unusual activity

Custom Monitoring

import boto3
import json

def monitor_secret_access():
 """Monitor secret access patterns"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Put custom metric
 cloudwatch.put_metric_data(
 Namespace='SecretsManager/Usage',
 MetricData=[
 {
 'MetricName': 'SecretAccess',
 'Dimensions': [
 {
 'Name': 'SecretName',
 'Value': 'prod/db/mysql'
 }
 ],
 'Value': 1,
 'Unit': 'Count'
 }
 ]
 )

11. Cost Optimization

Pricing Components

Secret Storage - $0.40 per secret per month
API Requests - $0.05 per 10,000 requests
Replication - Additional storage costs per region

Cost Optimization Strategies

Consolidate related secrets
Use secret caching in applications
Monitor API request patterns
Clean up unused secrets
Optimize rotation frequency

Secret Caching

import boto3
import time
from functools import lru_cache

class SecretCache:
 def __init__(self, cache_ttl=300): # 5 minutes
 self.cache = {}
 self.cache_ttl = cache_ttl
 self.client = boto3.client('secretsmanager')
 
 def get_secret(self, secret_name):
 """Get secret with caching"""
 current_time = time.time()
 
 # Check cache
 if secret_name in self.cache:
 cached_secret, timestamp = self.cache[secret_name]
 if current_time - timestamp < self.cache_ttl:
 return cached_secret
 
 # Fetch from Secrets Manager
 response = self.client.get_secret_value(SecretId=secret_name)
 secret = json.loads(response['SecretString'])
 
 # Update cache
 self.cache[secret_name] = (secret, current_time)
 
 return secret

# Usage
cache = SecretCache(cache_ttl=600) # 10 minutes
secret = cache.get_secret("prod/db/mysql")

12. Disaster Recovery

Backup Strategies

Cross-region replication
Export secrets for backup
Document rotation procedures
Test recovery processes

Export Secrets

# Export secret for backup
aws secretsmanager get-secret-value \
 --secret-id "prod/db/mysql" \
 --query SecretString \
 --output text > backup-secret.json

Recovery Procedures

# Restore secret from backup
aws secretsmanager create-secret \
 --name "prod/db/mysql-restored" \
 --secret-string file://backup-secret.json \
 --kms-key-id alias/aws/secretsmanager

13. Common Exam Scenarios

Scenario 1: RDS password rotation

Solution:

AWS WAF & Shield

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS WAF (Web Application Firewall)

Layer 7 firewall for web applications
Protects against common web exploits and attacks
Integrates with CloudFront, ALB, API Gateway, AppSync
Rule-based filtering with custom and managed rules

AWS Shield

DDoS (Distributed Denial of Service) protection service
Shield Standard - Free, automatic protection
Shield Advanced - Enhanced protection with 24/7 support
Protects against network and transport layer attacks

Key Benefits

Real-time Protection - Immediate threat response
Scalable - Handles traffic spikes automatically
Cost Effective - Pay for what you use
Integration - Native AWS service integration
Monitoring - CloudWatch metrics and logging

2. AWS WAF Core Concepts

Web ACLs (Access Control Lists)

Container for rules that define traffic filtering
Associated with AWS resources (CloudFront, ALB, etc.)
Default action: Allow or Block
Rule evaluation order matters

Rules and Rule Groups

Rules - Individual filtering logic
Rule Groups - Collection of related rules
Managed Rule Groups - AWS and marketplace rules
Custom Rule Groups - Your own rules

Rule Actions

Allow - Permit the request
Block - Block the request (403 Forbidden)
Count - Count but don’t block (monitoring mode)
CAPTCHA - Challenge with CAPTCHA
Challenge - JavaScript challenge

3. WAF Rule Types

Rate-Based Rules

Limit requests from single IP address
Configurable rate limit (requests per 5 minutes)
Automatic blocking when threshold exceeded

{
 "Name": "RateLimitRule",
 "Priority": 1,
 "Statement": {
 "RateBasedStatement": {
 "Limit": 2000,
 "AggregateKeyType": "IP"
 }
 },
 "Action": {
 "Block": {}
 }
}

Geographic Rules

Block or allow traffic from specific countries
Based on source IP geolocation
Useful for compliance requirements

{
 "Name": "GeoBlockRule",
 "Priority": 2,
 "Statement": {
 "GeoMatchStatement": {
 "CountryCodes": ["CN", "RU", "KP"]
 }
 },
 "Action": {
 "Block": {}
 }
}

IP Set Rules

Match against list of IP addresses or CIDR blocks
Reusable across multiple rules
Support for IPv4 and IPv6

{
 "Name": "IPBlockRule",
 "Priority": 3,
 "Statement": {
 "IPSetReferenceStatement": {
 "ARN": "arn:aws:wafv2:us-east-1:123456789012:global/ipset/BlockedIPs/12345678-1234-1234-1234-123456789012"
 }
 },
 "Action": {
 "Block": {}
 }
}

String Match Rules

Match specific strings in request components
Case sensitive or insensitive matching
Multiple transformation options

{
 "Name": "SQLInjectionRule",
 "Priority": 4,
 "Statement": {
 "ByteMatchStatement": {
 "SearchString": "union select",
 "FieldToMatch": {
 "Body": {}
 },
 "TextTransformations": [
 {
 "Priority": 0,
 "Type": "LOWERCASE"
 }
 ],
 "PositionalConstraint": "CONTAINS"
 }
 },
 "Action": {
 "Block": {}
 }
}

4. Managed Rule Groups

AWS Managed Rules

Core Rule Set - General OWASP protection
Known Bad Inputs - Common malicious patterns
SQL Database - SQL injection protection
Linux Operating System - Linux-specific attacks
Windows Operating System - Windows-specific attacks
PHP Application - PHP-specific vulnerabilities

Marketplace Rules

Third-party security vendors
Specialized protection (e.g., bot management)
Additional cost beyond WAF pricing

Rule Group Configuration

# Create Web ACL with managed rules
aws wafv2 create-web-acl \
 --name "MyWebACL" \
 --scope CLOUDFRONT \
 --default-action Allow={} \
 --rules '[
 {
 "Name": "AWSManagedRulesCommonRuleSet",
 "Priority": 1,
 "OverrideAction": {"None": {}},
 "Statement": {
 "ManagedRuleGroupStatement": {
 "VendorName": "AWS",
 "Name": "AWSManagedRulesCommonRuleSet"
 }
 },
 "VisibilityConfig": {
 "SampledRequestsEnabled": true,
 "CloudWatchMetricsEnabled": true,
 "MetricName": "CommonRuleSetMetric"
 }
 }
 ]'

5. WAF Integration

CloudFront Integration

Global protection at edge locations
Lowest latency for users worldwide
Cached content protection

# Associate WAF with CloudFront distribution
aws cloudfront update-distribution \
 --id E1234567890123 \
 --distribution-config '{
 "WebACLId": "arn:aws:wafv2:us-east-1:123456789012:global/webacl/MyWebACL/12345678-1234-1234-1234-123456789012"
 }'

Application Load Balancer Integration

Regional protection for ALB
Protects backend applications
Integration with Auto Scaling

# Associate WAF with ALB
aws wafv2 associate-web-acl \
 --web-acl-arn "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012" \
 --resource-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890123456"

API Gateway Integration

Protect REST and HTTP APIs
Rate limiting and request filtering
Integration with Lambda authorizers

# Associate WAF with API Gateway
aws apigateway update-stage \
 --rest-api-id abc123 \
 --stage-name prod \
 --patch-ops op=replace,path=/webAclArn,value="arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012"

6. AWS Shield Standard

Automatic Protection

Included free with all AWS accounts
Protects against common DDoS attacks
Layer 3 and 4 protection (network/transport)
Always-on detection and mitigation

Protected Services

CloudFront - Global edge locations
Route 53 - DNS service
Elastic Load Balancing - ALB, NLB, CLB
AWS Global Accelerator - Network optimization

Attack Types Covered

SYN/UDP Floods - Network layer attacks
Reflection Attacks - Amplification attacks
Layer 3/4 Attacks - Network and transport layer

7. AWS Shield Advanced

Enhanced Protection

$3,000/month per organization
24/7 access to DDoS Response Team (DRT)
Advanced attack diagnostics and mitigation
DDoS cost protection (scaling charges)

Additional Features

Real-time Attack Notifications - SNS integration
Attack Forensics - Detailed attack analysis
Proactive Engagement - DRT monitors your resources
Global Threat Environment Dashboard - Attack visibility

Enable Shield Advanced

# Subscribe to Shield Advanced
aws shield subscribe-to-proactive-engagement \
 --proactive-engagement-status ENABLED \
 --emergency-contact-list '[
 {
 "EmailAddress": "security@example.com",
 "PhoneNumber": "+1-555-123-4567",
 "ContactNotes": "Primary security contact"
 }
 ]'

Protected Resources

# Enable protection for specific resource
aws shield create-protection \
 --name "MyALBProtection" \
 --resource-arn "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890123456"

8. Monitoring and Logging

CloudWatch Metrics

AllowedRequests - Requests allowed by WAF
BlockedRequests - Requests blocked by WAF
CountedRequests - Requests counted but not blocked
SampledRequests - Sample of requests for analysis

WAF Logs

{
 "timestamp": 1576280412771,
 "formatVersion": 1,
 "webaclId": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012",
 "terminatingRuleId": "RateLimitRule",
 "terminatingRuleType": "RATE_BASED",
 "action": "BLOCK",
 "httpSourceName": "ALB",
 "httpSourceId": "123456789012-app/my-alb/1234567890123456",
 "ruleGroupList": [],
 "rateBasedRuleList": [
 {
 "rateBasedRuleId": "RateLimitRule",
 "limitKey": "IP",
 "maxRateAllowed": 2000
 }
 ],
 "nonTerminatingMatchingRules": [],
 "httpRequest": {
 "clientIp": "192.0.2.44",
 "country": "US",
 "headers": [
 {
 "name": "Host",
 "value": "example.com"
 }
 ],
 "uri": "/path",
 "args": "arg1=value1&arg2=value2",
 "httpVersion": "HTTP/1.1",
 "httpMethod": "GET",
 "requestId": "rid"
 }
}

Enable Logging

# Enable WAF logging to S3
aws wafv2 put-logging-configuration \
 --logging-configuration '{
 "ResourceArn": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MyWebACL/12345678-1234-1234-1234-123456789012",
 "LogDestinationConfigs": [
 "arn:aws:s3:::my-waf-logs-bucket"
 ],
 "RedactedFields": [
 {
 "SingleHeader": {
 "Name": "authorization"
 }
 }
 ]
 }'

9. Security Automations

Automated Response to Attacks

import boto3
import json

def lambda_handler(event, context):
 """Automated WAF rule updates based on CloudWatch alarms"""
 
 wafv2 = boto3.client('wafv2')
 
 # Parse CloudWatch alarm
 message = json.loads(event['Records'][0]['Sns']['Message'])
 
 if message['NewStateValue'] == 'ALARM':
 # Block suspicious IP
 suspicious_ip = extract_ip_from_alarm(message)
 
 # Update IP set
 response = wafv2.update_ip_set(
 Scope='REGIONAL',
 Id='blocked-ips-set-id',
 Addresses=[suspicious_ip + '/32'],
 LockToken='lock-token'
 )
 
 print(f"Blocked IP: {suspicious_ip}")
 
 return {'statusCode': 200}

def extract_ip_from_alarm(message):
 """Extract IP address from alarm details"""
 # Implementation depends on alarm configuration
 return "192.0.2.100"

Rate Limiting Automation

import boto3

def update_rate_limit(web_acl_id, rule_name, new_limit):
 """Update rate limit based on traffic patterns"""
 
 wafv2 = boto3.client('wafv2')
 
 # Get current Web ACL
 response = wafv2.get_web_acl(
 Scope='REGIONAL',
 Id=web_acl_id
 )
 
 web_acl = response['WebACL']
 
 # Update rate limit rule
 for rule in web_acl['Rules']:
 if rule['Name'] == rule_name:
 rule['Statement']['RateBasedStatement']['Limit'] = new_limit
 
 # Update Web ACL
 wafv2.update_web_acl(
 Scope='REGIONAL',
 Id=web_acl_id,
 DefaultAction=web_acl['DefaultAction'],
 Rules=web_acl['Rules'],
 LockToken=response['LockToken']
 )

10. Cost Optimization

WAF Pricing Components

Web ACL - $1.00 per month
Rules - $0.60 per rule per month
Requests - $0.60 per million requests
Rule Group - $1.50 per rule group per month

Shield Advanced Pricing

Monthly Fee - $3,000 per organization
Data Transfer - Standard rates apply
DDoS Cost Protection - Covers scaling charges during attacks

Cost Optimization Strategies

Use managed rule groups efficiently
Monitor rule effectiveness and remove unused rules
Optimize rule priorities for performance
Use sampling for logging to reduce costs
Regular review of protection requirements

11. Best Practices

Security Best Practices

Start with managed rule groups
Use count mode for testing new rules
Implement rate limiting for APIs
Monitor and analyze WAF logs regularly
Keep rules updated with threat intelligence

Performance Best Practices

Order rules by likelihood of match
Use specific match conditions
Avoid overly broad rules
Monitor rule evaluation metrics
Test rules in staging environment

Operational Best Practices

Automate rule updates based on threat intelligence
Implement incident response procedures
Regular security assessments
Document rule purposes and configurations
Train team on WAF management

12. Common Exam Scenarios

Scenario 1: Protect web application from SQL injection

Solution:

Resource Control Policies (RCPs)

Sun, 04 Oct 2026 00:00:00 +0000

New in 2024. RCPs are a type of AWS Organizations policy that controls the maximum permissions that can be granted to resources in member accounts. They are the resource-side complement to SCPs (which control the principal side).

1. Overview

What it is: An Organizations policy type that sets a permission ceiling on AWS resources (not principals). Where an SCP limits what a principal can do, an RCP limits what can be done to a resource — regardless of who is making the request.