secure-architectures on Alperen Doc

iam-policies-roles-cross-account

Mon, 01 Jan 0001 00:00:00 +0000

IAM (Identity and Access Management) Policies, Roles and Cross-Account Access#

IAM is the backbone of every security question on the exam. If a scenario says “grant access”, the answer almost always involves IAM roles - never sharing credentials, never embedding keys.

Policy structure#

Every policy is a JSON document:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "s3:GetObject",
 "Resource": "arn:aws:s3:::my-bucket/*",
 "Condition": {
 "StringEquals": {"aws:RequestedRegion": "eu-central-1"}
 }
 }
 ]
}

The four levers you can pull: Effect (Allow/Deny), Action (what API call), Resource (which ARN (Amazon Resource Name)), Condition (when/where/from which IP).

identity-federation-and-cognito

Mon, 01 Jan 0001 00:00:00 +0000

Identity Federation and Cognito#

Creating IAM (Identity and Access Management) users inside AWS for every employee is a management nightmare - and the exam knows it. The right answer for “our 500 employees use Active Directory” is always federation: let an external identity provider handle the humans, and give them temporary AWS credentials.

Federation with SAML (Security Assertion Markup Language) 2.0 (corporate identities)#

The scenario keyword is Active Directory / ADFS / Okta / Azure AD. Pattern:

kms-encryption-deep-dive

Mon, 01 Jan 0001 00:00:00 +0000

KMS (Key Management Service) and Encryption Deep Dive#

Encryption questions on the exam come down to one choice: which encryption option and where do the keys live. AWS KMS is the default answer for almost all of them.

KMS key types#

Key	Managed by	Use case
AWS owned keys (`aws/s3`, `aws/ebs`…)	AWS	Zero setup, no key policy to manage
AWS managed key (`aws/s3` etc.)	AWS	Automatic for most services, cannot rotate on demand
Customer managed key (CMK)	You	Full control: key policy, rotation, disable, grants
Asymmetric keys	You	Sign/verify or public-key encryption outside KMS
Multi-region keys	You	Global tables, cross-region DR (disaster recovery) with one key

Automatic rotation: customer managed keys rotate once a year (you can trigger early rotation). You cannot export the key material - KMS is the boundary.

secrets-manager-vs-parameter-store

Mon, 01 Jan 0001 00:00:00 +0000

Secrets Manager vs SSM (Systems Manager) Parameter Store#

The exam loves this comparison - a scenario mentions database passwords or API keys, and you must pick the right vault. Both store secrets encrypted with KMS (Key Management Service), but the differences decide the answer.

Side by side#

	AWS Secrets Manager	SSM Parameter Store
Purpose	Secrets (DB creds, API keys)	Config + secrets
Rotation	Built-in (Lambda-backed, automatic)	DIY (custom automation)
Cross-account	Native (resource policy)	Via IAM (Identity and Access Management), more work
Pricing	~$0.40/secret/month + API calls	Standard tier: free; Advanced: $0.05/param
Size limit	64 KB	Standard 4 KB / Advanced 8 KB
Versioning	Automatic versions + staging labels (`AWSCURRENT`)	Labeled versions
Integration	RDS (Relational Database Service), Redshift, DocumentDB native	Everything via SSM API

Decision rule#

“Passwords must be rotated automatically” → Secrets Manager, no question
“Cross-account secret sharing” → Secrets Manager
“App config, feature flags, non-secret parameters, budget-conscious” → Parameter Store
“Database credentials for RDS/Redshift/DocumentDB” → Secrets Manager (it integrates and rotates them out of the box)

How Secrets Manager rotation works#

sequenceDiagram
 participant SM as Secrets Manager
 participant L as Rotation Lambda
 participant DB as RDS/Aurora
 SM->>L: trigger rotation
 L->>DB: create new password
 L->>SM: store new version (AWSPENDING)
 L->>DB: test connection
 L->>SM: label as AWSCURRENT

The app keeps asking Secrets Manager for the secret by name - it always gets the current version, so the app never knows the password changed.

s3-security-and-access-points

Mon, 01 Jan 0001 00:00:00 +0000

S3 (Simple Storage Service) Security and Access Points#

S3 security questions usually start with “an object was accidentally made public” or “only this VPC (Virtual Private Cloud) may access the bucket”. The answer set is small: Block Public Access, bucket policies, IAM (Identity and Access Management), and Access Points.

The access control toolkit#

Mechanism	What it does	Exam note
Block Public Access	Master switch; overrides everything	Turn on account-wide, “prevent any public access”
Bucket policy	Resource-based JSON on the bucket	Cross-account access, VPC-only access
IAM policies	Identity-based permissions	Same-account access for users/roles
ACLs	Legacy per-object permissions	“ACL disabled / Object Ownership: Bucket owner enforced” is the modern answer
Access Points	Per-workload entry point with its own policy	Huge buckets, many teams/VPCs
Pre-signed URLs	Time-limited URL signed with credentials	“Share a private object for 1 hour”

Handy labs: aws-s3-bucket, presigned-urls.

network-security-sg-nacl-vpc-endpoints

Mon, 01 Jan 0001 00:00:00 +0000

Network Security: Security Groups, NACLs (Network Access Control List) and VPC (Virtual Private Cloud) Endpoints#

Two firewall layers and one private connectivity mechanism - and the exam will absolutely ask you to compare the first two.

Security Group vs NACL - the mandatory table#

	Security Group	NACL
Attaches to	ENI (Elastic Network Interface) / instance	Subnet
State	Stateful (reply traffic auto-allowed)	Stateless (allow + deny rules for each direction)
Rules	Allow only	Allow and deny
Evaluation	All rules evaluated	Rules in number order, lowest first
Default	Deny all inbound, allow all outbound	Allow all in/out
Use when	Instance-level filtering	Block a specific IP at subnet level

Key consequences:

security-services-waf-guardduty-inspector

Mon, 01 Jan 0001 00:00:00 +0000

Security Services: WAF (Web Application Firewall), Shield, GuardDuty, Inspector, Macie and friends#

AWS has a swarm of security services with confusingly similar names. The exam doesn’t ask how they work internally - it gives you a one-line problem and expects you to name the right one. Learn the one keyword per service.

The keyword map#

Service	What it does	Scenario keyword
WAF	Blocks bad HTTP requests (SQLi, XSS, rate limiting)	“web app attacks”, “Layer 7”, “bad bots”
Shield Standard/Advanced	DDoS protection	“volumetric attack”, “availability during DDoS”
GuardDuty	Threat detection on accounts/workloads	“compromised credentials”, “malicious IP”, “crypto mining”
Inspector	Vulnerability scanning (EC2 (Elastic Compute Cloud), ECR (Elastic Container Registry), Lambda)	“CVEs”, “software vulnerabilities”, “patch status”
Macie	Finds sensitive data (PII) in S3 (Simple Storage Service)	“credit card numbers”, “PII discovery”
Security Hub	Aggregates findings across accounts	“single dashboard”, “security standards”
Detective	Investigates findings, visualizes root cause	“why did this happen”, “investigation”
Network Firewall	Managed firewall for VPC (Virtual Private Cloud) traffic	“IPS/IDS for VPC”, “domain filtering”
Firewall Manager	Centrally manage WAF/SG (Security Group)/Network Firewall across accounts	“apply one policy to all accounts”

WAF details worth knowing#

Attaches to CloudFront, ALB (Application Load Balancer), API Gateway, AppSync - not NLB (Network Load Balancer), WAF is Layer 7
Rules: allow / block / count, plus rate-based rules (“more than N requests per 5 min from one IP → block”)
Managed rule groups cover OWASP Top 10 out of the box

Shield: Standard vs Advanced#

Standard - free, automatic for CloudFront, Route 53, ELB (Elastic Load Balancing)
Advanced - paid (~$3,000/month + usage), adds cost protection against usage spikes during an attack, 24/7 DDoS Response Team, and advanced diagnostics

“Financial protection against DDoS-driven scaling bills” → Shield Advanced. That cost-protection angle is the favorite exam hint.

governance-monitoring-organizations-config-ssm

Mon, 01 Jan 0001 00:00:00 +0000

Governance, Auditing & Operations: Organizations, Config, CloudTrail and Systems Manager#

Many security and operations questions ask “how do we prevent all accounts from doing X”, “who deleted the database yesterday”, or “how do we manage 200 EC2 (Elastic Compute Cloud) instances without opening SSH (Secure Shell)”. Each of those maps to a specific management service.

Multi-account governance: AWS Organizations & Control Tower#

flowchart TB
 root[Management Account / Root]
 root --> ou_prod[OU: Production]
 root --> ou_dev[OU: Dev / Sandbox]
 ou_prod --> acc1[Account A] & acc2[Account B]
 ou_dev --> acc3[Account C]
 scp[SCP: Deny non-EU regions] -.->|attached to| ou_prod & ou_dev

AWS Organizations groups multiple AWS accounts into Organizational Units (OUs) with consolidated billing (one bill + shared volume discounts, RIs (Reserved Instance) and Savings Plans across accounts).
SCP (Service Control Policy) defines the maximum allowed permissions for member accounts (including the account’s root user!).
- SCPs never grant permissions — you still need IAM (Identity and Access Management) policies inside the account.
- SCPs do not apply to the management (master) account itself.
- Default strategy: FullAWSAccess attached everywhere + explicit Deny SCPs (e.g., deny leaving Organizations, deny disabling CloudTrail, restrict regions with aws:RequestedRegion).
AWS Control Tower sets up a multi-account Landing Zone automatically using Organizations, IAM Identity Center, Config and CloudTrail, enforcing preventive guardrails (SCPs) and detective guardrails (Config rules).
AWS RAM (Resource Access Manager) shares specific resources across accounts without duplicating them: Transit Gateway, Subnets, Route 53 Resolver rules, License Manager.

Not: Sınavda “tüm alt hesaplarda root dahil kimse X bölgesinde kaynak açamasın veya CloudTrail’i kapatamasın” deniyorsa cevap her zaman AWS Organizations + SCP‘dir. SCP izin vermez, sadece üst sınır çizer.