AWS Security Specialty study materials
AWS Security Specialty study resources

AWS Security Specialty case studies

AWS Security Specialty · Put your knowledge to work in context.

The AWS Certified Security – Specialty is an advanced AWS credential aimed at security practitioners who already design, operate, and audit workloads on AWS. It suits cloud security engineers, DevSecOps and platform engineers, security architects, and consultants who are expected to make judgement calls rather than recite service names. The certification is not an entry-level cloud badge: the questions assume working fluency with IAM policy evaluation, VPC design, KMS key management, and CloudTrail and GuardDuty operations, and they often ask you to choose the least-privilege, most operationally sound option among several that would technically work. The exam spans six domains: threat detection and incident response, security logging and monitoring, infrastructure security, identity and access management, data protection, and management and security governance. The AWS Security Specialty case studies are 5 cases and about 4,420 words.

1

Three Miners Behind an Auto Scaling Group

The organization spans 41 accounts. GuardDuty, delegated to the security account, raises CryptoCurrency:EC2/BitcoinTool.B!

892 words, about 4 min
2

Fifteen-Minute Attribution on a Two-Billion-Request Bucket

A 60-account organization delivers its CloudTrail organization trail, management events only, to a central log archive bucket. One data-lake bucket in the analytics account takes roughly 2 billion GET and 400 million PUT requests per month.

866 words, about 4 min
3

Intermittent Timeouts After the Batch Fleet Arrives

A three-tier VPC in us-east-1 hosts a payment service: public 10.0.0.0/24, app 10.0.10.0/24, data 10.0.20.0/24, no NAT gateway. App instances reach S3 through a gateway endpoint and Secrets Manager through an interface endpoint.

886 words, about 4 min
4

Access Denied on a Tagged Cross-Account Role

A build account (222233334444) runs a CI pipeline that authenticates through an OIDC provider and assumes DataPipelineProcessor in the data account (33334444555). The role's identity policy allows s3:PutObject on the payments prefix of the data lake.

830 words, about 4 min
5

Vendor Decrypt Access and the Bucket Key Audit Gap

A data account stores 900 TB of objects in S3 under SSE-KMS with a customer managed key. Five consumer accounts decrypt through key policy statements naming their roles.

946 words, about 5 min