AWS Security Specialty (SCS-C03) case studies
AWS Security Specialty (SCS-C03) · Put your knowledge to work in context.
The AWS Certified Security – Specialty is an advanced credential for people who already build and operate workloads on AWS and want to demonstrate depth in securing them. It suits cloud security engineers, security architects, DevSecOps practitioners, and senior engineers who own logging, identity, encryption, and incident response decisions rather than simply consuming controls someone else designed. The AWS Security Specialty (SCS-C03) case studies are 5 cases and about 4,606 words.
1Stolen Instance Credentials at 02:14 - Contain, Preserve, Prevent Recurrence
At 02:14 UTC, GuardDuty raises UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS for role web-app-role, used by instance i-0a1b2c3d in account 111122223333 (us-east-1). The instance sits behind an ALB in an Auto Scaling group (min 4, max 12) launched from a launch template.
919 words, about 5 min2A 47-Minute Hole in an Organization Trail
Your organization has 40 accounts in a single OU. An organization trail delivers management events to a centralized bucket in the log-archive account (222233334444), encrypted with a customer managed KMS key, with log file validation enabled.
880 words, about 4 min3Half the Requests Time Out - Flow Logs Point at the Wrong Layer
A retail platform runs a three-tier VPC in us-east-1. Public subnets (10.0.1.0/24, 10.0.2.0/24) hold an internet-facing ALB; private app subnets (10.0.11.0/24 in AZ-a, 10.0.12.0/24 in AZ-b) hold EC2 instances; RDS lives in isolated subnets.
894 words, about 4 min4Cross-Account AssumeRole Fails in Production Only
Account A (111122223333) hosts a CodePipeline/CodeBuild deployment. CodeBuild runs as arn:aws:iam::111122223333:role/ci-build and deploys to staging (444455556666) and production (777788889999) by assuming a role named DeployRole in each target account.
923 words, about 5 min5Cross-Account Read Fails After Replication - and the KMS Bill Is Climbing
A SaaS company stores customer documents in bucket corp-docs-prod (us-east-1), encrypted with SSE-KMS using key alias/corp-docs. Objects replicate to corp-docs-prod-eu in eu-west-1 using Cross-Region Replication with a separate replica key, alias/corp-docs-eu (single-Region).
990 words, about 5 min