AWS Security Specialty (SCS-C03) study guide
AWS Security Specialty (SCS-C03) · Work through your exam, one topic at a time.
The AWS Certified Security – Specialty is an advanced credential for people who already build and operate workloads on AWS and want to demonstrate depth in securing them. It suits cloud security engineers, security architects, DevSecOps practitioners, and senior engineers who own logging, identity, encryption, and incident response decisions rather than simply consuming controls someone else designed. The AWS Security Specialty (SCS-C03) study guide has 6 sections and about 2,499 words.
01Threat Detection and Incident Response
Amazon GuardDuty is a managed detector: it continuously analyzes VPC Flow Logs, CloudTrail management and S3 data events, Route 53 Resolver DNS query logs, and EKS audit logs, and optionally EBS volume scans, Lambda network activity, and RDS login activity. It emits typed findings such as UnauthorizedAccess:EC2/SSHBruteForce , retains them for 90 days, and takes no agents for the core detectors.
405 words, about 2 min02Security Logging and Monitoring
CloudTrail records API activity. Management events are recorded by default on a trail you create, but S3 object-level and Lambda Invoke data events are not - they are high volume and must be enabled explicitly.
416 words, about 2 min03Infrastructure Security
Security groups are stateful, allow-only, attached to ENIs, and can reference other security groups as a source - the clean way to express "the app tier accepts 443 only from the web tier." Network ACLs are stateless, subnet-level, evaluate rules in ascending number order, and support explicit deny; because they are stateless you must allow ephemeral ports (1024–65535) in both directions. AWS Network Firewall provides stateful inspection with Suricata-compatible rules, domain allow-listing via TLS SNI, and centralized egress control from a shared inspection VPC.
414 words, about 2 min04Identity and Access Management
Every request is evaluated against: explicit deny anywhere (identity policy, resource policy, SCP, permission boundary, session policy) → SCPs, which must allow → an allow in the identity policy or resource policy → permission boundary and session policy, which must also allow. Two rules cover most questions: an explicit deny always wins, and permission boundaries and SCPs never grant anything - they only cap what identity policies can grant.
444 words, about 2 min05Data Protection
A KMS customer managed key has a key policy (the root of all authorization for that key), optional grants, and IAM policies that only take effect if the key policy delegates to IAM. Envelope encryption means a data key encrypts the object and the CMK encrypts the data key.
421 words, about 2 min06Management and Security Governance
AWS Organizations is the root of governance: OUs structure accounts, SCPs enforce preventive controls, tag policies standardize tagging, backup policies centralize AWS Backup, and consolidated billing rolls up cost. Delegate administration for GuardDuty, Security Hub, Config, and Macie to a security account so the management account stays out of the day-to-day path.
399 words, about 2 min