Plain-English definitions of the terms that come up most often in AWS Certified Security - Specialty (SCS-C03) study. Definitions are simplified for learning; AWS documentation is authoritative.
| Term | Definition |
|---|---|
| Shared responsibility model | The split of duties: AWS secures the cloud infrastructure; you secure what you build in it. The line moves depending on the service type. |
| IAM (Identity and Access Management) | The AWS service that controls who (principals) can do what (actions) on which resources, via JSON policies. |
| Identity-based policy | A policy attached to a user, group or role that says what that identity may do. |
| Resource-based policy | A policy attached to a resource (like an S3 bucket) that says who may access it - essential for cross-account access. |
| Service control policy (SCP) | An AWS Organizations guardrail that limits the maximum permissions in member accounts. It never grants access, only bounds it. |
| Permissions boundary | A per-identity limit on the maximum permissions an IAM user or role can have, regardless of its attached policies. |
| Explicit deny | A Deny statement in any applicable policy. It always wins over every allow. |
| Implicit deny | The default outcome when no policy allows a request. |
| IAM role | An identity with temporary credentials that trusted principals can assume - the standard way to grant access to applications and cross-account users. |
| AWS STS | Security Token Service - issues the temporary credentials behind role assumption and federation. |
| External ID | A shared secret in a role’s trust policy that prevents the “confused deputy” problem in cross-account third-party access. |
| IAM Identity Center | AWS’s workforce single sign-on: central human access to many accounts with short-lived credentials (successor to AWS SSO). |
| Federation | Trusting an external identity provider (SAML/OIDC) so users log in with existing identities instead of IAM users. |
| Condition key | A policy element (like aws:PrincipalOrgID or aws:SourceIp) that makes permissions depend on request context. |
| Least privilege | Granting only the permissions a task actually needs, and tightening them over time. |
| AWS KMS | Key Management Service - creates, stores and controls the cryptographic keys that encrypt data across AWS. |
| Customer managed key (CMK) | A KMS key you create and govern: key policy, rotation, grants and deletion are yours to control and audit. |
| AWS managed key | A KMS key a service creates and manages for you - zero admin, but minimal control and no custom key policy. |
| Key policy | The resource policy on a KMS key - the primary control over who can use or administer that key. |
| KMS grant | A programmatic, temporary way to give a principal specific permissions on a KMS key without editing policies. |
| Envelope encryption | Encrypting data with a data key, then encrypting that data key with a KMS key - fast bulk crypto with centralised control. |
| Multi-Region key | A KMS key replicated across Regions with interoperable material, so data encrypted in one Region can be decrypted in another. |
| Imported key material | Bringing your own key material into KMS, keeping origin control (and deletion/expiry responsibility) with you. |
| SSE-S3 vs SSE-KMS | Two S3 server-side encryption modes: SSE-S3 is fully AWS-managed; SSE-KMS uses a KMS key, adding key-level control and CloudTrail auditability. |
| AWS Certificate Manager (ACM) | Provisions and renews TLS certificates for AWS services; public certificates are free and auto-renewing. |
| AWS Private CA | A managed private certificate authority for issuing internal certificates to your own services and devices. |
| AWS Secrets Manager | Stores secrets with encryption, fine-grained access and automatic rotation (native for several databases). |
| Parameter Store | Systems Manager’s configuration/secret store - SecureString encryption but no native rotation; the budget alternative. |
| Amazon Macie | Discovers and classifies sensitive data (like PII) in S3 using machine learning and pattern matching. |
| Data protection policy | A CloudWatch Logs / SNS feature that detects and masks sensitive data fields inside log events and messages. |
| Amazon GuardDuty | Threat detection that continuously analyses CloudTrail, VPC Flow Logs, DNS and workload sources for malicious activity. |
| AWS Security Hub | Aggregates findings from AWS and partner tools and checks your accounts against security standards. |
| Amazon Detective | Builds a behaviour graph from your logs to investigate the root cause of findings. |
| Amazon Inspector | Automated vulnerability scanning for EC2 instances, container images in ECR, and Lambda functions. |
| AWS CloudTrail | Records API calls: management events by default, data events (like S3 object access) as an opt-in. |
| Log file integrity validation | CloudTrail’s digest mechanism that lets you prove log files were not altered after delivery. |
| AWS Config | Records resource configurations over time and evaluates them against rules - your drift and compliance history. |
| VPC Flow Logs | Metadata about network traffic (source, destination, ports, accept/reject) - who talked to whom, not packet contents. |
| OCSF | Open Cybersecurity Schema Framework - a normalised format for security findings, enabling third-party tool integration (new in SCS-C03). |
| Security group | A stateful, instance-level virtual firewall with allow rules only; return traffic is automatically permitted. |
| Network ACL | A stateless, subnet-level filter with numbered allow and deny rules; both directions must be allowed explicitly. |
| AWS Network Firewall | A managed, scalable network firewall for VPCs with stateful rules and domain/IPS-style filtering. |
| AWS WAF | Web application firewall filtering HTTP(S) requests at layer 7 - rules against injection, bots and abuse patterns. |
| AWS Shield | Managed DDoS protection: Standard is automatic for everyone; Advanced adds cost protection and response support. |
| VPC endpoint | Private connectivity from a VPC to AWS services without traversing the public internet; endpoint policies restrict use. |
| Session Manager | Systems Manager feature giving audited shell access to instances with no open inbound ports, no bastion, no SSH keys. |
| IMDSv2 | The session-token version of the instance metadata service, protecting instance credentials from request-forgery abuse. |
| AWS Organizations | Multi-account management: consolidated billing, OUs, and SCP guardrails across every member account. |
| AWS Control Tower | Opinionated landing-zone service that sets up and governs a secure multi-account environment with preventive and detective controls. |
| AWS Artifact | Self-service portal for AWS compliance reports (SOC, ISO, PCI) and agreements - evidence for your auditors. |