SAA-CO3 Grind

IAM

identity and access management for AWS tools, controls who can do what in three different ways (group, user, role) not the root user, adds policies

IAM User vs Role

iam users are specific users you want to add to ur aws account and give perms to, roles are temporary access keys for instances and other tools

IAM Policy

json perms document for iam users with allow/ deny → deny overrules allow always …

least privileged

always give users the least amount of permissions possible

iam role for ec2

attach via iam role so it gets temp perms automatically, never hard code access keys to an instance

aws sts

security token system, issues temporary credentials for role assumption, federation, cross acc access

aws organizations

manage multiple aws acc using one organization (billing, governing) just anything related to multi account environments

SCP

service control policy, sets the maximum permissions for member accounts, but doesn’t give permissions (remember denys always get upper hand)

aws control tower

sets up + governs secure multi acc environments using guardrails (max perms)

iam identity center

central sign on for multiple aws accounts (exam clue: aws central/ federated access for employees)

aws directory service

managed microsoft directory service (exam clue: integrate aws with microsoft ad)

aws RAM

resource access manager, share aws resources across accounts without having to duplicate them

aws service catalog

create and govern approved portfolios of all the aws product templates for your users (exam clue: let team only use approved configs of instances)

security group

stateful virtual firewall with only “Allow” attached to instances (exam: instance level outbound/ inbound filtering)

NACL

network access control list, virtual firewall stateless, allows and denies, lowest rule number checked first → must explicitly allow return traffic

security group vs nacl

sg is stateful and for resources

nacl is stateless and has denies (can be used to explicitly block)

aws kms

key management service, control and create encryption keys w aws services

aws managed / customer managed kms

aws → service managed (less control)

customer → u control policy, aliases, rotation, grants (choose for more control / auditing)

KMS envelope

data encrypted w/ data key which is encrypted w/ KMS key (to avoid sending too much data to KMS)

AWS CloudHSM

cloud hardware security model, single tenant hardware model you control, used for strict compliance and control of cryptographic keys, more management

KMS vs CloudHSM

kms → pre managed and integrated

CHsm → more operation and control work (choose if requires dedicated hsm)

aws secrets manager

security stores secrets like db passwords or api keys and has auto rotation (which means it auto updates as u edit the keys)

secrets manager vs parameter store

sm → secrets + built in rotation → higher cost

ps → config values but u have to auto update

ACM

AWS certification manager, provision and manage tls/ssl certs for aws services (exam clue: https certificate management)

aws cognito

identity of application users (sign in + access aws services) this is for ppl who are logging into whatever u created type

cognito user vs identity user

cognito → authenticate users and create user directories and tokens

identity → give users temporary credentials and access to aws resources

aws waf

web application firewall, filters https requests using rules (basically not allowing injections n shi)

aws shield

managed ddos (hacking by botting) protection

standard → auto baseline protection

advanced → enhanced protection for important workloads (when u need more)

waf vs shield

waf → filter out malicious attacks (injection/ bad url pattern)

shield → ddos protection (volumetric hacking)

aws firewall manager

manage and deploy all security protocols (waf, shield, firewalls) on multiple accounts

AWS network firewall

managed firewall for vpc attacks (choose if u need centralized advanced protection beyond sg/nacl)

Amazon GuardDuty

threat detection from AWS logs using Analytics and ML (ids basically) js detects threats

Amazon Inspector

automatic vulnerability management and scanning for EC2 and instances (exam clue: CVE/ software vulnerabilities)

Amazon Macie

discovers and classifies sensitive data in Amazon S3s using pattern matching n ML

(exam clue: find sensitive data in S3)

Amazon Detective

Investigates + analyses security findings to find root cause of data issues

AWS Security Hub

central dashboard that sorts data findings across AWS services

AWS Artifact

portal for downloading AWS compliance reports and agreements

AWS Audit Manager

automates collections of evidence for audits and maps frameworks to evidence

Amazon VPC

Virtual Private Cloud, service that lets you run AWS resources in a private isolated virtual network u create

Public vs Private Subnet

subnets are segments of a VPC IP address

public → can route to internet gateway

private → can not route to igw

it takes more than js a public IP to make a subnet public

IGW

internet gateway, horizontally scaled VPC Component that allows internet connection for resources if route table points to it

NAT gateway

network address translation, let’s resources in private subnets access internet while preventing unsolicited internet connections (place in public subnet)

IGW vs NAT gateway

igw → gives public subnet internet with public subnet

nat → gives private subnet internet without direct exposure

route table

rules determining where subnet traffic is directed (specific most matching route wins)

vpc endpoint

private access from vpc to supported services without igw or nat or internet

Gateway Endpoint

freestyle vpc endpoint for S3 and DynamoDB without NAT cost