Amazon SAP-C02: Security, Identity & Compliance — Study Guide
Part of the AWS Solutions Architect Professional SAP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Identity and Access Management: principled control and federation
Identity management should be designed around short-lived, least-privilege credentials and clear separation of identity trust versus permission grants. Use IAM roles for all compute and cross-account access, avoid long-lived IAM user access keys, and leverage STS for temporary credentials. For enterprise SAML or OIDC federation, configure a centralized identity provider and enable attribute-based access using session tags so permissions follow users and groups without per-account user management. IAM Identity Center (IAM Identity Center) provides organization-wide permission sets, SCIM provisioning to push groups into AWS, and integrates with MFA enforcement from the IdP to meet strong-auth requirements. Complement identity controls with permission boundaries and managed policies to limit privilege escalation, and run IAM Access Analyzer to detect unintended resource access. Service Control Policies (SCPs) in AWS Organizations offer guardrails by denying entire categories of actions across OUs, but they do not grant permissions—trust policies and permission policies remain necessary. Common traps include overbroad wildcard actions or principals, relying on the root account, missing external IDs for third-party access, and role chaining that lengthens effective session scope. Trade-offs are operational overhead vs tighter granularity: highly granular roles require more management but significantly reduce blast radius.
Keys, secrets, and encryption: lifecycle and cross-account patterns
Encryption is foundational for both at-rest and in-transit controls; decisions should balance key ownership, operational control, and performance. Use AWS KMS customer-managed CMKs when you need granular key policies, cross-account grants, auditability, or automatic rotation. For service-managed convenience, AWS-managed keys reduce operational overhead but limit policy control. Envelope encryption mitigates performance impact for large payloads by using a data key for bulk encryption and KMS for wrapping. Cross-account or cross-Region use requires explicit key policies and Grants; avoid giving IAM permissions alone without the corresponding key policy. Secrets Manager offers rotation workflows and native integration with RDS and other services, while SSM Parameter Store (SecureString) is a lower-cost option for smaller needs; both should use VPC endpoints to avoid public egress. Common architect traps include granting kms:* or wide Decrypt rights in key policies, forgetting to allow Lambda execution roles both IAM and KMS permissions, and neglecting multi-Region replication for keys used by globally distributed workloads. Cost-performance trade-offs include the per-request KMS cost and slight added latency versus the security benefits of customer-managed key control.
Detection, monitoring and auditing: telemetry, detective controls and automation
Detective controls are as important as preventative ones; instrumentation should be centralized, immutable, and searchable. Enable multi-Region, multi-account AWS CloudTrail with log file validation and deliver logs to a centralized, access-controlled S3 account with lifecycle policies. Feed CloudTrail, VPC Flow Logs, and DNS logs into a centralized analytics pipeline—CloudWatch Logs, Kinesis Data Firehose, and an SIEM—for retention and alerting. GuardDuty provides managed threat detection for account and workload behaviors; designate a delegated administrator to aggregate findings across the Organization and automate response via EventBridge to trigger Lambda playbooks or Systems Manager Automation. Security Hub aggregates standards and findings (CIS, PCI, custom rules) and can orchestrate prioritized remediation. AWS Config and Config Rules enable continuous compliance checks and drift detection, with remediation using SSM Automation. Typical traps include single-region CloudTrail, insufficient retention or immutable logs, noisy alerts without tuning, and lack of delegated admins to scale detection. Trade-offs hinge on retention costs versus forensic and compliance needs: longer retention aids investigations but increases S3 and querying costs.
Application-layer defense, WAF, Shield and multi-account governance
Protecting internet-facing applications requires layered controls and centralized policy management. Place AWS WAF at the edge (CloudFront) and/or regional ALBs to filter OWASP-class threats, bot traffic, and to implement rate limiting. For multi-account rule management, use AWS Firewall Manager with a delegated security account to roll out WAFv2 rule groups, Shield Advanced subscriptions, and centralized security policies across OUs. Shield Advanced provides DDoS mitigation and cost-protection for large-scale events but is costly; weigh the SLA and DDoS exposure of your application against subscription price. Use centralized Web ACLs, managed rule groups, and fine-grained IP set updates to reduce operational overhead and avoid inconsistent protections. Architectural traps include relying solely on security groups at the network layer, failing to centralize rule deployment (leading to drift), or placing WAF only regionally when global CDN protection is needed. Performance trade-offs include potential added latency for inspection and complexity of custom rules versus the resilience gained by blocking malicious traffic before it reaches origin servers. Ensure WAF logging, metrics, and integration with Security Hub/GuardDuty for cohesive incident response.
Practical Problem: Use-Case Scenario
Scenario: OmniApps Ltd. has an AWS Organization with a management account, a centralized network account hosting a Transit Gateway, and multiple workload accounts in eu-west-1 and us-east-1. They run private application stacks in VPCs with ALBs in private subnets exposed through CloudFront and require centralized identity and security controls.
Challenge: OmniApps must centralize access with corporate SAML-based MFA, enforce organization-wide security guardrails, manage WAF rules and DDoS protection across accounts, and keep secrets and keys accessible only via private network paths.
Recommended Approach:
- Enable IAM Identity Center in the management account and connect to the corporate SAML IdP with MFA enforced; configure SCIM provisioning and create permission sets for least-privilege cross-account access.
- Implement Service Control Policies in Organizations to deny unmanaged root actions and require CloudTrail/Config; designate a security account as delegated admin for Security Hub, GuardDuty, and Firewall Manager.
- Use AWS Firewall Manager from the security account to deploy AWS WAFv2 Web ACLs and AWS Managed Rules to CloudFront distributions and ALBs across accounts; evaluate Shield Advanced subscription per critical app.
- Centralize CloudTrail logs into a secure logging account encrypted with a multi-Region CMK in the security account, grant decrypt via explicit KMS key policy and Grants to logging processors, and enable VPC endpoints for KMS and Secrets Manager for private access.
Rationale: Centralized identity and delegated security administration reduce administrative friction and blast radius, while Firewall Manager and centralized logging provide consistent policy enforcement and forensic capabilities aligned with professional architecture best practices.
← Networking · All domains · Compute →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →