AWS Security Specialty (SCS-C03) cheat sheet

GuardDuty severity bands: 7.0–8.9 High, 4.0–6.9 Medium, 0.1–3.9 Low; automated containment should only trigger at a band whose false-positive rate you have measured.

GuardDuty is regional and opt-in per account and Region; a delegated administrator account in Organizations aggregates findings and centralizes suppression rules and threat lists.

GuardDuty protection plans include S3 Protection, EKS Audit Logs, RDS login activity, Lambda network activity, and Malware Protection for EC2 EBS volumes.

Malware Protection scans an isolated replica of the EBS volume rather than the running production volume; matches surface as Execution:EC2/MaliciousFile finding types.

EC2 containment sequence: swap security groups for an isolation group with no ingress or egress rules, snapshot attached EBS volumes, capture memory before stopping or terminating.

Amazon Detective builds a behavior graph from CloudTrail, VPC Flow Logs, EKS audit logs and GuardDuty findings, retaining data for up to one year.

Security Hub ingests and normalizes findings in ASFF; cross-Region aggregation designates a home Region linked to other Regions and member accounts.

NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication and recovery; post-incident activity.

CloudTrail log file integrity validation relies on SHA-256 digests and RSA signatures stored in digest files; the digest files must be retained alongside the logs.

CloudTrail logs management events by default; S3 object-level and Lambda Invoke data events require explicit enablement per trail and add cost per event.

Trail delivery to S3 is typically within about 5 minutes but can take up to 15 minutes, so sub-minute alerting must not depend on CloudTrail alone.

CloudTrail Insights baselines write-management API volume per trail and emits Insights events when call rates deviate significantly from the baseline.

VPC Flow Logs capture IP-level metadata only, never packet payload, and can target S3, CloudWatch Logs, or Firehose; scope is VPC, subnet, or ENI.

Default flow log aggregation interval is 1 minute (10 minutes maximum); NODATA records mean no traffic was observed and SKIPDATA means records were skipped.

Standard detection chain: CloudWatch Logs metric filter to CloudWatch alarm to SNS or EventBridge to Lambda remediation.

Log immutability: S3 Object Lock in compliance mode on a dedicated archive bucket plus a bucket policy denying delete actions for all principals.

Cross-account centralization options: CloudWatch Logs subscription filters pointing at a destination with a KMS key, or an organization trail writing to a central S3 bucket.

AWS Config records resource configuration changes and evaluates rules on configuration change, on a periodic schedule, or both.

Security groups are stateful, allow-only, and deny by default; NACLs are stateless with numbered allow and deny rules evaluated from the lowest number.

Gateway VPC endpoints exist only for S3 and DynamoDB, attach to route tables, and carry no hourly charge; other services use interface endpoints backed by PrivateLink ENIs with hourly and data charges.

Enforce IMDSv2 with metadata options HttpTokens=required and HttpPutResponseHopLimit=1 to defeat SSRF-based credential theft.

Session Manager requires the SSM agent, an instance profile with AmazonSSMManagedInstanceCore, and outbound 443 to SSM endpoints; no inbound ports, bastion, or public IP is needed.

AWS WAF attaches to CloudFront, ALB, API Gateway REST APIs, and AppSync; rate-based rules count requests per source IP over a rolling 5-minute window.

Shield Standard is automatic and free; Shield Advanced adds the DDoS Response Team, cost protection, and included WAF usage for a fixed subscription.

AWS Network Firewall provides stateful and stateless rule groups plus domain-name filtering at the VPC level, whereas security groups filter at the ENI level.

Inspector scans EC2 instances through the SSM agent, ECR container images, and Lambda functions for CVEs and network reachability exposure.

VPC peering is non-transitive; hub-and-spoke or many-to-many topologies require AWS Transit Gateway.

Evaluation order: explicit deny wins, otherwise an explicit allow is required, otherwise the request is implicitly denied.

SCPs never grant permissions and do not apply to the management account or to service-linked roles; they cap the maximum permissions in member accounts.

A permissions boundary sets the maximum permissions an identity-based policy can grant but grants nothing itself; effective permissions are the intersection.

Role chaining caps the resulting session at 1 hour; a direct role session defaults to 1 hour and can be raised to 12 hours with MaximumSessionDuration.

Cross-account access normally requires both a trust policy allowing sts:AssumeRole and an identity policy in the calling account permitting that call.

IAM Access Analyzer identifies resources shared with external entities, validates policies against best practices, and generates policies from CloudTrail activity.

ABAC uses condition keys such as aws:PrincipalTag and aws:ResourceTag so one policy scales across many resources without enumerating ARNs.

IAM Identity Center provides SAML/OIDC federation, permission sets, and multi-account access from an external directory.

Instance profiles deliver temporary role credentials to EC2 through IMDS; long-term access keys should not be stored on instances.

KMS key tiers: AWS owned, AWS managed (aws/service-name), and customer managed; only customer managed keys allow custom key policies, grants, and rotation control.

Envelope encryption: KMS GenerateDataKey returns a plaintext key plus a ciphertext blob; encrypt locally, discard plaintext, store the blob, and call Decrypt to unwrap.

Scheduled KMS key deletion has a mandatory 7–30 day waiting period; disabling a key is reversible, deletion is not.

To force encryption type, add a bucket policy denying s3:PutObject when s3:x-amz-server-side-encryption is absent or does not equal aws:kms.

SSE-KMS with an S3 Bucket Key generates a bucket-level key that reduces KMS request volume, cost, and throttling risk.

SSE-C keys are supplied per request and never stored by S3; without the client key the objects cannot be decrypted.

S3 Object Lock requires versioning; compliance mode cannot be bypassed by any principal, governance mode requires s3:BypassGovernanceRetention.

Block Public Access has four settings and can be applied account-wide; BucketOwnerEnforced disables ACLs entirely.

Secrets Manager supports scheduled Lambda-based rotation and cross-Region replicas; Parameter Store SecureString uses KMS but has no built-in rotation schedule.

Macie classifies S3 objects using managed and custom data identifiers and publishes findings to EventBridge for automated response.

In Organizations, SCPs are the preventive control applied at OU or account level; the management account cannot be restricted by SCPs.

Control Tower guardrails map preventive controls to SCPs and detective controls to Config rules across the landing zone and Account Factory accounts.

Config conformance packs bundle Config rules with remediation actions (SSM Automation documents) and can be deployed to an entire organization.

Security Hub standards such as AWS Foundational Security Best Practices, CIS AWS Foundations, and PCI DSS generate controls with ASFF compliance findings.

AWS Audit Manager automates evidence collection against frameworks like SOC 2, PCI DSS, and HIPAA and produces assessment reports.

AWS Artifact supplies on-demand compliance reports and agreements such as SOC and ISO reports without opening a support case.

Trusted Advisor security checks cover unrestricted ports, public S3 buckets, and access key age; full checks and API access require Business or Enterprise support.

Tag policies standardize tag keys and values but do not block resource creation; enforce tagging with SCP conditions on aws:RequestTag.