SCS-C03 Flashcards

All 50 terms

Shared responsibility model

The split of duties: AWS secures the cloud infrastructure; you secure what you build in it. The line moves depending on the service type.

IAM (Identity and Access Management)

The AWS service that controls who (principals) can do what (actions) on which resources, via JSON policies.

Identity-based policy

A policy attached to a user, group or role that says what that identity may do.

Resource-based policy

A policy attached to a resource (like an S3 bucket) that says who may access it - essential for cross-account access.

Service control policy (SCP)

An AWS Organizations guardrail that limits the maximum permissions in member accounts. It never grants access, only bounds it.

Permissions boundary

A per-identity limit on the maximum permissions an IAM user or role can have, regardless of its attached policies.

Explicit deny

A Deny statement in any applicable policy. It always wins over every allow.

Implicit deny

The default outcome when no policy allows a request.

IAM role

An identity with temporary credentials that trusted principals can assume - the standard way to grant access to applications and cross-account users.

AWS STS

Security Token Service - issues the temporary credentials behind role assumption and federation.

External ID

A shared secret in a role's trust policy that prevents the "confused deputy" problem in cross-account third-party access.

IAM Identity Center

AWS's workforce single sign-on: central human access to many accounts with short-lived credentials (successor to AWS SSO).

Federation

Trusting an external identity provider (SAML/OIDC) so users log in with existing identities instead of IAM users.

Condition key

A policy element (like aws:PrincipalOrgID or aws:SourceIp) that makes permissions depend on request context.

Least privilege

Granting only the permissions a task actually needs, and tightening them over time.

AWS KMS

Key Management Service - creates, stores and controls the cryptographic keys that encrypt data across AWS.

Customer managed key (CMK)

A KMS key you create and govern: key policy, rotation, grants and deletion are yours to control and audit.

AWS managed key

A KMS key a service creates and manages for you - zero admin, but minimal control and no custom key policy.

Key policy

The resource policy on a KMS key - the primary control over who can use or administer that key.

KMS grant

A programmatic, temporary way to give a principal specific permissions on a KMS key without editing policies.

Envelope encryption

Encrypting data with a data key, then encrypting that data key with a KMS key - fast bulk crypto with centralised control.

Multi-Region key

A KMS key replicated across Regions with interoperable material, so data encrypted in one Region can be decrypted in another.

Imported key material

Bringing your own key material into KMS, keeping origin control (and deletion/expiry responsibility) with you.

SSE-S3 vs SSE-KMS

Two S3 server-side encryption modes: SSE-S3 is fully AWS-managed; SSE-KMS uses a KMS key, adding key-level control and CloudTrail auditability.

AWS Certificate Manager (ACM)

Provisions and renews TLS certificates for AWS services; public certificates are free and auto-renewing.

AWS Private CA

A managed private certificate authority for issuing internal certificates to your own services and devices.

AWS Secrets Manager

Stores secrets with encryption, fine-grained access and automatic rotation (native for several databases).

Parameter Store

Systems Manager's configuration/secret store - SecureString encryption but no native rotation; the budget alternative.

Amazon Macie

Discovers and classifies sensitive data (like PII) in S3 using machine learning and pattern matching.

Data protection policy

A CloudWatch Logs / SNS feature that detects and masks sensitive data fields inside log events and messages.

Amazon GuardDuty

Threat detection that continuously analyses CloudTrail, VPC Flow Logs, DNS and workload sources for malicious activity.

AWS Security Hub

Aggregates findings from AWS and partner tools and checks your accounts against security standards.

Amazon Detective

Builds a behaviour graph from your logs to investigate the root cause of findings.

Amazon Inspector

Automated vulnerability scanning for EC2 instances, container images in ECR, and Lambda functions.

AWS CloudTrail

Records API calls: management events by default, data events (like S3 object access) as an opt-in.

Log file integrity validation

CloudTrail's digest mechanism that lets you prove log files were not altered after delivery.

AWS Config

Records resource configurations over time and evaluates them against rules - your drift and compliance history.

VPC Flow Logs

Metadata about network traffic (source, destination, ports, accept/reject) - who talked to whom, not packet contents.

OCSF

Open Cybersecurity Schema Framework - a normalised format for security findings, enabling third-party tool integration (new in SCS-C03).

Security group

A stateful, instance-level virtual firewall with allow rules only; return traffic is automatically permitted.

Network ACL

A stateless, subnet-level filter with numbered allow and deny rules; both directions must be allowed explicitly.

AWS Network Firewall

A managed, scalable network firewall for VPCs with stateful rules and domain/IPS-style filtering.

AWS WAF

Web application firewall filtering HTTP(S) requests at layer 7 - rules against injection, bots and abuse patterns.

AWS Shield

Managed DDoS protection: Standard is automatic for everyone; Advanced adds cost protection and response support.

VPC endpoint

Private connectivity from a VPC to AWS services without traversing the public internet; endpoint policies restrict use.

Session Manager

Systems Manager feature giving audited shell access to instances with no open inbound ports, no bastion, no SSH keys.

IMDSv2

The session-token version of the instance metadata service, protecting instance credentials from request-forgery abuse.

AWS Organizations

Multi-account management: consolidated billing, OUs, and SCP guardrails across every member account.

AWS Control Tower

Opinionated landing-zone service that sets up and governs a secure multi-account environment with preventive and detective controls.

AWS Artifact

Self-service portal for AWS compliance reports (SOC, ISO, PCI) and agreements - evidence for your auditors.