AWS Security Specialty study guide
AWS Security Specialty · Work through your exam, one topic at a time.
The AWS Certified Security – Specialty is an advanced AWS credential aimed at security practitioners who already design, operate, and audit workloads on AWS. It suits cloud security engineers, DevSecOps and platform engineers, security architects, and consultants who are expected to make judgement calls rather than recite service names. The AWS Security Specialty study guide has 6 sections and about 2,052 words.
01Threat Detection and Incident Response
GuardDuty is the core service that detects threats by itself: it continuously analyses VPC flow logs, CloudTrail management events, DNS query logs and EKS audit logs (plus opt-in S3 data events, EBS malware scans and RDS login activity) and emits severity-ranked findings. It never blocks traffic - that is the most common trap.
355 words, about 2 min02Security Logging and Monitoring
CloudTrail records API activity. Management events are logged by default and visible in Event history for only 90 days - creating a trail is what gives durable delivery to S3 and CloudWatch Logs.
328 words, about 2 min03Infrastructure Security
Security groups are stateful, allow-only, and attached to ENIs/instances, so return traffic is automatic and there is no deny rule. NACLs are stateless, evaluated by rule number (lowest first, first match wins), and attached to subnets - you must allow both the request port and the ephemeral return range 1024–65535.
322 words, about 2 min04Identity and Access Management
Every request passes through layers, and an explicit Deny anywhere wins. Top-down: SCPs (Organizations) → resource-based policy → permission boundary and session policy (they intersect, they never grant) → identity-based policy.
355 words, about 2 min05Data Protection
A KMS customer managed key is governed by its key policy, which is the root of trust: an IAM policy alone cannot grant access unless the key policy delegates to IAM (the default policy does, for the account). KMS uses envelope encryption - a data key encrypts the object, the CMK encrypts the data key.
352 words, about 2 min06Management and Security Governance
AWS Organizations gives consolidated billing, SCPs, tag policies and backup policies, and lets you designate delegated administrators for GuardDuty, Security Hub, Config and Macie so a security account can manage the whole estate. SCPs are preventive: they cap what principals in member accounts can do, do not affect the management account, and never grant anything.
340 words, about 2 min