aws saa-c03

"An application on EC2 needs to write to DynamoDB. What's the MOST secure way to provide credentials?"

IAM role attached to the instance (instance profile) — never access keys on the box.

"A Lambda function must read from an S3 bucket. How should it authenticate?"

Lambda execution role with S3 read permissions — same costume pattern, serverless flavor.

Users in Account A need temporary access to resources in Account B.

Create a role in Account B with a trust policy trusting Account A; users AssumeRole via STS — "temporary" + "another account" = cross-account role.

A user's identity policy allows s3:PutObject, but uploads fail with Access Denied.

Look for an explicit Deny — bucket policy, SCP, or permission boundary — explicit Deny always beats Allow.

An action works in a standalone account but fails in an account inside AWS Organizations.

A Service Control Policy is blocking it — "Organizations" is the tell.

Developers may create IAM roles for their apps, but security wants a guarantee those roles can never exceed a defined permission set.

Permission boundaries — "maximum permissions" / "cannot exceed" is the signal.

5,000 employees with existing Active Directory logins need access to multiple AWS accounts without creating IAM users."

IAM Identity Center with SAML federation to AD — "existing corporate directory" + "multiple accounts" + "no IAM users".

An application needs short-lived credentials that expire automatically." → STS AssumeRole

temporary/short-lived credentials" is literally STS's product.

Require that users can only terminate EC2 instances if they've signed in with MFA.

Policy Condition with aws:MultiFactorAuthPresent — sensitive action + MFA = that condition key.

A new AWS account was just created. What should be done FIRST to secure it?

Enable MFA on the root user, delete/avoid root access keys, create an admin user for daily work.

EC2/app needs AWS access, "most secure"

Instance role (instance profile), never keys

Lambda needs permissions

Execution role

Hardcoded / stored access keys

Wrong — replace with a role

Temporary / short-lived credentials

STS AssumeRole

Access across AWS accounts

Role in target account + trust policy

Third party assumes your role safely

ExternalId in trust policy

Role exists but "can't be assumed"

Fix the trust policy

Allow exists but action denied

Explicit Deny / SCP / permission boundary

Org-wide restriction, applies even to root

SCP (AWS Organizations)

Cap max permissions of ONE user/role

Permission boundary

Policy on the resource, has a Principal

Resource-based policy (e.g., bucket policy)

Legacy S3 grant mechanism, avoid

S3 ACL (≠ Network ACL)

SSO, one login → many AWS accounts

IAM Identity Center

Federate Okta / Azure AD / corporate AD

IAM Identity Center + SAML 2.0

Federate app customers (Google/Facebook login)

Cognito

Require MFA for an action

Condition: aws:MultiFactorAuthPresent

Root account

MFA on, no access keys, don't use daily

Who is my resource shared with externally?

IAM Access Analyzer

Find unused users / stale permissions

Credentials report / access advisor

Compliance data accessed about twice a year; auditors must receive it within 10 minutes. Most cost-effective class?

Glacier Flexible Retrieval (Deep Archive can never beat 12 hr; Instant passes but costs more; Flexible Expedited = 1–5 min).

Records retained 7 years, almost never accessed, retrieval within 2 business days is acceptable. Cheapest?

Glacier Deep Archive (deadline ≥ 12 hr finally lets the cheapest class survive).

Access patterns are unknown and unpredictable; minimize cost without performance impact.

Intelligent-Tiering ("unknown/unpredictable" is its one and only signal).

Thumbnails can be regenerated from originals at any time; store infrequently accessed copies cheaply.

One Zone-IA ("can be regenerated" = single-AZ risk is acceptable).

Processing artifacts are deleted after 20 days. Cheapest class?

S3 Standard (under every minimum duration — IA/Glacier would bill 30–180 days anyway).

Security must audit exactly when each encryption key was used, and control key rotation

SSE-KMS ("audit key usage" is the KMS keyword; add S3 Bucket Key if the question moans about KMS request costs).

Regulatory requirement: data must be impossible to delete for 5 years — even by administrators.

Object Lock, Compliance mode ("even administrators" rules out Governance).

Objects must be preserved indefinitely while litigation is pending

Legal Hold ("lawsuit" + no fixed end date).

Users on every continent upload multi-GB video files to a single S3 bucket; speed up uploads.

Transfer Acceleration + multipart upload (global UPLOAD to one bucket; global download would be CloudFront).

All objects must be encrypted in transit.

Bucket policy denying requests where aws:SecureTransport is false (in transit = HTTPS/TLS, not KMS).

Enable access logging for a bucket — what's the key configuration rule?

Deliver logs to a DIFFERENT bucket (same bucket = infinite logging loop); query them with Athena.

Replication was enabled but existing objects didn't copy over

S3 Batch Replication (CRR/SRR only replicate NEW objects).

Frequently accessed / hot

S3 Standard

Lives < 30 days

Standard (minimum-duration charges kill the rest)

Infrequent + instant retrieval

Standard-IA

"Can be regenerated / secondary copy"

One Zone-IA

"Unknown / unpredictable access"

Intelligent-Tiering

Known pattern over time

Lifecycle rule (beats Intelligent-Tiering)

Archive + milliseconds retrieval

Glacier Instant Retrieval

Archive + minutes-to-hours OK

Glacier Flexible (Expedited 1–5 min / Std 3–5 hr / Bulk 5–12 hr)

Cheapest, 12+ hr retrieval OK

Glacier Deep Archive (never faster than 12 hr)

Object > 5 GB (or > 100 MB)

Multipart upload (required / recommended)

Accidental delete/overwrite protection

Versioning (+ MFA Delete for root-MFA-gated deletes)

Copy to another region, DR/compliance

CRR (versioning on both sides)

Aggregate logs / copy within region

SRR

Replicate EXISTING objects

S3 Batch Replication

Default encryption, zero effort

SSE-S3

"Audit key usage" / control rotation

SSE-KMS (in CloudTrail)

KMS request costs too high

S3 Bucket Key (~99% fewer KMS calls, coarser audit)

Customer supplies key per request

SSE-C (HTTPS mandatory)

"AWS must never see plaintext"

Client-side encryption

Encrypt in transit / enforce HTTPS

Deny aws:SecureTransport = false

Encrypt EXISTING objects

S3 Batch Operations

WORM, "not even root can delete"

Object Lock — Compliance mode

WORM, privileged users may bypass

Object Lock — Governance mode

"Lawsuit," indefinite hold

Legal Hold

Temporary download link, no AWS account

Presigned URL (creator's perms, ≤ 7 days)

Public policy exists but access fails

Block Public Access is on

S3 reachable only via CloudFront

OAC

Who accessed — cheap/complete/delayed

S3 Server Access Logs (different bucket! + Athena)

Who accessed — real-time + IAM identity

CloudTrail data events

More requests/sec

More prefixes (3,500 PUT / 5,500 GET per prefix)

Global UPLOADS to one bucket

Transfer Acceleration (pay only if faster)

Global DOWNLOADS

CloudFront

Download part of an object

Byte-range fetch

"When object uploaded, trigger..."

Event notification → Lambda/SQS/SNS/EventBridge

SQL on ONE object

S3 Select

SQL across S3 data sets

Athena