AWS authorization is difficult when policy documents are treated as independent switches. An identity policy can allow an action and the request can still be […]
SCS-C03 — Security Specialty
Amazon AWS SCS-C03: WAF, Shield, Network Firewall, and Firewall Manager
AWS WAF, AWS Shield, AWS Network Firewall, and AWS Firewall Manager are often grouped together as “firewall services,” but they operate at different layers and […]
Amazon AWS SCS-C03: Choosing an AWS Security Log Platform
AWS security logging is not a choice between three interchangeable log stores. CloudTrail Lake, CloudWatch Logs, and Amazon Security Lake were designed around different data […]
Amazon AWS SCS-C03: Certificate Manager vs Private CA
AWS Certificate Manager and AWS Private Certificate Authority solve related problems, but they sit at different layers of public-key infrastructure. Certificate Manager, usually called ACM, […]
Amazon AWS SCS-C03: Config, Security Hub, or Audit Manager?
AWS Config, AWS Security Hub, and AWS Audit Manager can all appear in a cloud-governance architecture, but they answer different questions. Config records how AWS […]
Amazon AWS SCS-C03: GuardDuty, Security Hub, and Detective
Amazon GuardDuty, AWS Security Hub CSPM, AWS Security Hub, and Amazon Detective can operate together, but they solve distinct detection, posture, correlation, and investigation problems. […]
Amazon AWS SCS-C03: KMS Key Policies, IAM Policies, or Grants?
AWS KMS permissions can be confusing because access to a KMS key can involve more than one authorization mechanism. Every KMS key has a key […]
Amazon AWS SCS-C03: Security Groups, NACLs, and Network Firewall
AWS security groups, network ACLs, and AWS Network Firewall all control network traffic, but they operate at different points and with different state models. Security […]
Amazon AWS SCS-C03: Incident Response for Compromised EC2
A potentially compromised EC2 instance creates a conflict between two goals: Stop the attacker. Preserve enough evidence to understand what happened. A rushed response can […]
Amazon AWS SCS-C03: Macie for S3 Data Protection
Amazon Macie helps security teams understand where sensitive data exists in Amazon S3. It does not replace S3 permissions, encryption, or data-loss-prevention policy. Its primary […]