Based on the SAA-C03 exam guideReport an error
The KMS, Secrets Manager, Cognito, WAF, Shield, GuardDuty, Inspector, Macie, Detective, and Security Hub we covered this week are each independent services, but in real SAA exam questions and in production, two or more almost always collaborate inside a single architecture. Take a requirement that looks simple — "a mobile app user uploads an image to S3." Behind it, a Cognito User Pool (user authentication) + Identity Pool (STS Role) + S3 SSE-KMS (encryption at rest) + Macie (post-upload PII scan) + WAF (blocking malicious traffic) + GuardDuty (detecting abnormal access) all run at once.
In this article we'll work through every tool from this week by combining them at the scenario level. We'll cover 12 scenarios that come up often in the SAA security domain (30% weight — the largest area on the exam), and for each we'll explain "why this answer, and why not the others." Training yourself to recall scenario → combination, rather than memorizing single services, helps directly with both the exam and real-world security design.
If we re-sort this week's tools along the 4 axes of "block / detect / analyze / integrate" and the 3 axes of "encryption / secrets / users," we get the following.
| Axis | Tool | Core Role |
|---|---|---|
| Key management | KMS | Envelope encryption; CMK / AWS Managed / CloudHSM classification |
| Secrets & config | Secrets Manager / Parameter Store / CloudHSM | Auto rotation / free config / FIPS L3 dedicated |
| User authentication | Cognito User Pool | Directory, JWT, social, SAML SSO |
| User authorization | Cognito Identity Pool | Temporary STS Role delegation |
| Block (L7) | WAF | OWASP, Rate Limit, Bot Control |
| Block (L3/L4) | Shield Standard / Advanced | DDoS, Cost Protection |
| Detect (behavior) | GuardDuty | CloudTrail / VPC Flow / DNS ML analysis |
| Detect (vulnerability) | Inspector | EC2 / ECR / Lambda CVE scan |
| Detect (PII) | Macie | S3 object content classification |
| Analyze | Detective | Graph-based root cause |
| Integrate | Security Hub | Multi-service + compliance score |
| Org guardrail | Firewall Manager | Org-wide WAF / Shield / SG in bulk |
Pulling out the pairs from this table that get confused most often:
| Confusing Pair | Distinguishing Key |
|---|---|
| KMS vs CloudHSM | multi-tenant vs single-tenant; AWS-attested vs customer-attested |
| Secrets Manager vs Parameter Store | auto rotation / paid vs free / no rotation |
| User Pool vs Identity Pool | JWT issuance (for your own API) vs STS credentials (for AWS APIs) |
| Cognito vs IAM Identity Center | external app users vs employee AWS console SSO |
| WAF vs Shield | L7 application attacks vs L3/L4 DDoS |
| GuardDuty vs Inspector | behavior-based detection vs static vulnerability scan |
| GuardDuty vs Macie | threat detection (VPC/CloudTrail) vs PII detection (S3 content) |
| Security Hub vs Detective | integrated score & dashboard vs root-cause graph |
| Firewall Manager vs WAF | org-wide policy enforcement vs individual Web ACL |
[ Full-Stack Security Architecture ]
Internet
│ Shield Standard (automatic, L3/L4)
│ + Shield Advanced (Cost Protection)
CloudFront ── WAF (Managed Rules + Rate Limit + Geo Block)
│
ALB ── (optional) WAF, Cognito integrated auth
│
ECS Fargate (Task Role / IRSA, Secrets Manager env var injection)
│
RDS Aurora (KMS SSE, Secrets Manager auto rotation 30 days, RDS Proxy)
│
S3 (SSE-KMS + Bucket Keys, BPA, OAC, Macie PII scan)
User authentication:
Mobile/Web → Cognito User Pool (or SAML SSO)
→ Identity Pool → STS Role → some direct AWS API calls
Monitoring:
GuardDuty (threats) + Inspector (CVE) + Macie (PII) + Config (configuration)
→ Security Hub (CIS/AFSBP score)
→ EventBridge → Lambda/SNS automated response
→ Detective (post-incident analysis)
Org guardrail:
Firewall Manager enforces WAF/Shield/SG across all accounts in bulk
💡 Related theory: This kind of layered structure is called defense in depth, or the swiss cheese model (James Reason, 1990). No single security layer is perfect (like holes in the cheese), but stack several layers and the odds of the holes lining up in a straight line become vanishingly small. Even if CloudFront's WAF misses an SQLi, the ALB's WAF catches it; if both miss it, RDS IAM DB Auth + Secrets Manager rotation limits the impact of a leaked password; and if data leaks anyway, SSE-KMS blocks disk exfiltration. Cloud security is not "one strong tool" but "a combination of several lightweight tools."
🔍 Going deeper: The security domain carries the largest weight on the SAA-C03 exam at 30%, but scenario questions usually reduce to a simple "this keyword → this service" mapping. There are just two traps — ① "the exact one among similar services" (e.g., GuardDuty vs Inspector vs Macie), and ② "picking a single-service answer when a combination is required" (e.g., mobile S3 upload = User Pool alone is wrong, Identity Pool is needed). To avoid both, memorize clearly "which service's definition this keyword maps to," and check every requirement in the scenario without missing one.
Before working the scenario questions, let's flag the five security anti-patterns you see most often in both production and on the exam.
| Anti-Pattern | Problem | Correct Pattern |
|---|---|---|
| Hardcoding secrets in code / env vars in plaintext | git exposure, log leakage | Secrets Manager + IAM permissions |
| S3 bucket Public Read/Write | the #1 cause of data-leak incidents | BPA (Block Public Access) + OAC + CloudFront |
| Baking an IAM User key into EC2 | unlimited permissions if the key leaks | IAM Instance Profile |
| SSE-KMS with an AWS Managed Key + no permission separation | every IAM principal can decrypt | CMK + key policy + kms:ViaService |
| Assuming a single-region DR | can't decrypt during a region outage | Multi-Region Keys + Secrets Manager Replication |
⚠️ Pitfall: Even when a scenario says "minimize cost," you must not downgrade security. For example, when the wording is "I want to reduce S3 SSE-KMS cost," "switch to SSE-S3" is almost never the answer. The correct answer is usually "enable S3 Bucket Keys," which keeps the security level intact while cutting KMS call costs by 99%.
Click a choice to reveal the answer and explanation.
Question 1
A mobile game went global and then got hit by a DDoS attack. CloudFront traffic spiked to 200x normal, and the AWS bill came in $80,000 higher than expected. The company wants a refund for the extra cost in future incidents like this. What is the most suitable solution?
Question 2
A fintech company, pursuing PCI DSS compliance, was required to have "key material that not even AWS employees can access, with FIPS 140-2 Level 3 certification under the company's own name." What is the most suitable key store?
Question 3
A company wants to auto-rotate the admin password of an RDS Aurora PostgreSQL database every 90 days, with zero downtime during rotation. What is the most suitable solution?
Question 4
A company's SPA web app needs to temporarily grant authenticated users permission to upload images directly to S3. What is the most suitable authentication/authorization flow?
Question 5
A company wants to allow sign-up only with a corporate-domain email (@mycompany.com), and after sign-up, automatically sync user info to its own DynamoDB. What is the most suitable solution?
Question 6
A company wants to automatically detect which objects in an S3 bucket contain PII such as credit card numbers or national ID numbers, and when found, immediately quarantine them and alert SecOps. What is the most suitable solution?
Question 7
A company wants to automatically assess whether a newly disclosed Log4Shell-class CVE affects the OS/packages on 500 EC2 instances, and integrate the results into a compliance dashboard. What is the most suitable combination?
Question 8
A SaaS company wants employees to log into its SaaS with the company's internal Okta SSO. It wants to keep the user directory in Cognito itself, but password management should be handled by Okta. What is the most suitable configuration?
Question 9
A company runs active-active across us-east-1 and ap-northeast-2. An S3 object encrypted with SSE-KMS in one region must be immediately decryptable after being replicated (CRR) to the other region, and the RDS password must stay identical across both regions. What is the most suitable combination?
Question 10
A company wants to, in front of a global web service, automatically block OWASP Top 10 attacks, classify bot traffic, block anything over 2,000 requests per IP in 5 minutes, and block all countries except South Korea, the US, and Japan. What is the most suitable configuration?
Question 11
A company wants that when GuardDuty raises an "EC2 communicating with a known crypto-mining pool" finding, it automatically moves the instance to a quarantine SG within 5 minutes, traces the IAM Role's activity in a graph for post-incident analysis, and integrates the results into a SecOps dashboard. What is the most suitable combination?
Question 12
An enterprise runs 80 accounts with AWS Organizations and needs ① the same WAF Managed Rule enforced on every ALB/CloudFront across all accounts, ② Shield Advanced auto-applied to all accounts, ③ auto-applied to new accounts too, and ④ integrated monitoring of CIS/AFSBP standard scores. What is the most suitable combination?
Next week is Week 9 — monitoring and operations. If this week's security services produce "the findings that alert you when an incident happens," next week's CloudWatch, CloudTrail, Config, SSM, and X-Ray cover "how the system behaves day to day" and "how you trace and recover when an incident happens."
| Day | Topic |
|---|---|
| Day 41 | CloudWatch Metrics / Logs / Alarms / Dashboards — the fundamental axes of observability |
| Day 42 | CloudTrail / Config — auditing and configuration compliance |
| Day 43 | Systems Manager (Session Manager / Patch Manager / Automation) — operations automation |
| Day 44 | X-Ray / OpenTelemetry — distributed tracing |
| Day 45 | Week 9 wrap-up scenarios |
In particular, since the GuardDuty, Inspector, and Macie findings we saw this week all flow into CloudWatch Events (EventBridge), and GuardDuty analyzes CloudTrail logs, security and operations effectively share the same data pipeline. Before starting next week's material, it helps to work through this week's 12 scenarios one more time.
Additional Explanation: The security domain of SAA-C03 (30%) is the largest area on the exam, but 90% of scenarios are solved by keyword → service mapping. ① "auto rotation" = Secrets Manager, ② "PII detection" = Macie, ③ "behavior-based threat" = GuardDuty, ④ "CVE scan" = Inspector, ⑤ "L7 attack" = WAF, ⑥ "L3/L4 DDoS + Cost Protection" = Shield Advanced, ⑦ "direct mobile S3 upload" = Cognito Identity Pool, ⑧ "enterprise SAML SSO" = User Pool + SAML, ⑨ "Multi-Region encryption" = Multi-Region Keys, ⑩ "org-wide security in bulk" = Firewall Manager, ⑪ "integrated compliance score" = Security Hub, ⑫ "root-cause graph" = Detective. Memorize these 12 mappings and you can answer nearly every security-domain scenario quickly. And remember just two additional traps — ① "minimize cost" does not mean downgrading security (a cost-optimization option like S3 Bucket Keys is the answer), and ② in scenarios that require a combination of two services (like User Pool + Identity Pool), don't pick a single-service answer.