Over five days we've seen KMS, Secrets Manager, Parameter Store, Cognito, WAF, Shield, ACM — seemingly unconnected services. But they're actually one picture: the defense-in-depth layers a single request traverses from the internet through to application data. Shield absorbs DDoS, WAF filters malicious HTTP patterns, Cognito proves identity, ACM wraps transport, Secrets Manager protects passwords, KMS guards the keys that unlock those passwords. Once you can sketch this path in your head, nearly every Week 9 problem collapses to "at which layer do I stop this?"
DVA-C02's security is tough not because concepts are hard but because the boundary between two similar services is subtle