How to Study for AWS Security (IAM, KMS, and Encryption)

Security is the #1 weighted domain on most AWS exams. On the Solutions Architect Associate, it's 30% of the exam. Master security, and you're a third of the way to passing.

Why Security Is Critical

AWS operates on the Shared Responsibility Model:

• AWS is responsible for: Security OF the cloud (physical, network, hypervisor)
• You are responsible for: Security IN the cloud (data, access, configuration)

Understanding this distinction is fundamental to every security question.

Core Security Services

IAM (Identity and Access Management)

The most important security service. Understand:

Identities

• Users (people)
• Groups (collection of users)
• Roles (assumed by services/applications)

Policies

• Identity-based policies (attached to users/groups/roles)
• Resource-based policies (attached to resources)
• Permission boundaries
• Service control policies (SCPs)

Policy Evaluation Logic

1. Explicit Deny → Always wins
2. Explicit Allow → Grants access
3. Implicit Deny → Default (no statement)

KMS (Key Management Service)

AWS encryption key management:

• Customer Managed Keys (CMK) - You control
• AWS Managed Keys - AWS manages for you
• AWS Owned Keys - Fully AWS managed

Key Concepts

• Envelope encryption
• Key rotation
• Key policies vs IAM policies
• Grants for temporary access

Other Security Services

AWS WAF - Web application firewall AWS Shield - DDoS protection AWS GuardDuty - Threat detection AWS Inspector - Vulnerability assessment AWS Macie - Data discovery and protection AWS Secrets Manager - Secrets rotation AWS Certificate Manager - SSL/TLS certificates

The Shared Responsibility Model

AWS Responsibility (Security OF the Cloud)

• Physical security of data centers
• Network infrastructure
• Hypervisor security
• Hardware maintenance

Your Responsibility (Security IN the Cloud)

• IAM configuration
• Data encryption
• Network configuration (security groups, NACLs)
• Operating system patches
• Application security

Varies by Service Type

IAM Deep Dive

IAM Policies Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::mybucket/*",
      "Condition": {
        "IpAddress": {"aws:SourceIp": "192.168.1.0/24"}
      }
    }
  ]
}

Know each element:

• Effect: Allow or Deny
• Action: What operations
• Resource: Which resources
• Condition: When to apply

IAM Roles vs Users

Use Roles when:

• EC2 instances need AWS access
• Lambda functions need permissions
• Cross-account access needed
• Federated users

Use Users when:

• Long-term individual access
• Programmatic access with keys
• Console access needed

IAM Best Practices

1. Never use root account for daily tasks
2. Enable MFA on root and all users
3. Use groups to assign permissions
4. Grant least privilege - minimum necessary
5. Use roles for applications
6. Rotate credentials regularly
7. Use policy conditions for extra security

Encryption in AWS

Encryption at Rest

S3

• SSE-S3 (S3-managed keys)
• SSE-KMS (KMS-managed keys)
• SSE-C (customer-provided keys)

EBS

• KMS encryption
• Encrypted snapshots

RDS

• KMS encryption
• Must enable at creation

Encryption in Transit

• HTTPS/TLS for data transfer
• VPN for network traffic
• Client-side encryption

Key Management Decisions

Security Best Practices by Service

S3 Security

1. Block public access (account level)
2. Use bucket policies for access control
3. Enable versioning
4. Enable MFA Delete
5. Use VPC endpoints for private access
6. Enable access logging

EC2 Security

1. Use security groups (least privilege)
2. Use IAM roles, not access keys
3. Keep AMIs patched
4. Use Systems Manager for patch management
5. Enable detailed monitoring

RDS Security

1. Deploy in private subnets
2. Use security groups
3. Enable encryption at creation
4. Enable automated backups
5. Use IAM database authentication

Common Exam Scenarios

Scenario 1: "Developers need temporary access to production"

Answer: IAM roles with time-limited sessions, or temporary credentials from STS

Scenario 2: "Ensure S3 objects are encrypted with company-managed keys"

Answer: SSE-KMS with customer-managed CMK, or bucket policy requiring encryption

Scenario 3: "Third-party needs access to specific S3 bucket"

Answer: Cross-account IAM role or bucket policy with external account

Scenario 4: "Audit all API calls in AWS account"

Answer: AWS CloudTrail enabled for all regions

Scenario 5: "Automatically detect compromised credentials"

Answer: AWS GuardDuty for threat detection

Security Study Checklist

• Memorize Shared Responsibility Model
• Understand IAM policy evaluation logic
• Know encryption options for each service
• Practice writing IAM policies
• Understand KMS key types
• Know when to use each security service
• Complete hands-on IAM labs

Hands-On Labs

Essential security labs:

1. Create IAM users, groups, and policies
2. Set up MFA for users
3. Create IAM roles for EC2
4. Configure S3 bucket policies
5. Enable KMS encryption for S3
6. Set up CloudTrail logging

Identify Your Security Gaps

Security is 30% of most AWS exams. Do you know where you stand?

StudyTech AI's AI identifies your exact security gaps:

• IAM policies, roles, and evaluation logic
• Encryption options (KMS, SSE-S3, SSE-C)
• Shared Responsibility Model scenarios
• Security service selection (WAF, Shield, GuardDuty)

Over 1,000 learners are using StudyTech AI to master AWS security faster. Our AI creates a personalized study plan in 10 minutes.

Don't let security questions be the reason you fail. Know your gaps before exam day.