On the Pro exam, questions that ask about only a single service are practically nonexistent. Whatever scenario unfolds, IAM (who is accessing), VPC (where it flows), and EC2/EBS/ELB (what processes that traffic) appear simultaneously. So today we revisit the three areas we studied separately during the week in the way they meet within a single scenario. This is the real way of thinking that works on the exam floor.
Today's article has three parts.
40 one-line summaries of Week 1: facts that must surface within 0.5 seconds in the exam room.
The 3-layer method: the hands-on technique of decomposing scenarios into IAM ⇒ VPC ⇒ Compute.
12 scenario questions: Pro difficulty, 30 minutes of solving time.
Practice these three as one bundle, and when you meet a scenario in the exam room your hands will move first. The "5-step decomposition" from Day 1 fires in your head within 5 seconds, and those 5 steps flow again into the 3 layers of IAM-VPC-Compute.
6 layers of permission evaluation: SCP → Permission Boundary → Identity Policy → Resource Policy → Session Policy → VPC Endpoint Policy. If any one of the 6 layers denies, it's blocked; all must allow to pass.
An explicit deny beats every allow — a single explicit Deny is the end.
Cross-account access requires Allow on both sides (Trust Policy + Resource Policy or Identity Policy).
SCPs and Permission Boundaries have deny-only semantics — they grant no permissions, they only set a ceiling.
💡 Related theory: This 3-layer approach is a direct implementation of "Complete Mediation" and "Defense in Depth" from Saltzer and Schroeder's 8 security principles (1975). Every request passes through three gates: (1) permission check at IAM, (2) network isolation at VPC, (3) workload execution at Compute. If one gate is breached, another gate blocks. The Capital One incident breached the IAM gate via SSRF, but if a VPC Endpoint Policy had also been applied, the S3 access would have been blocked.
🔍 Deeper dive: Between the three layers there is boundary translation. The IAM Principal ARN turns into a VPC Source IP (which appears externally as the same IP when going through NAT), and at Compute it is translated back into the IAM Role from instance metadata. Information gets blurred during these translations, so when tracing with CloudTrail in multi-account environments you must look at user-agent + source IP + role session name all together. With a single variable, you may not know who did it.
Scenario: "A global pharmaceutical company runs 80 accounts in AWS Organizations. The research division uses EC2 + RDS PostgreSQL to handle clinical trial data. Under FDA 21 CFR Part 11 regulations, all data access must have an audit trail, and the data must stay only in ap-northeast-2. Additionally, external SaaS providers (Veeva, Medidata) must read some of the data, and the use of access keys is prohibited. What is the most appropriate architecture?"
5-step decomposition + 3-layer mapping:
WHO: global pharma, 80 accounts, research division + external SaaS (Veeva/Medidata).
WHAT: EC2 + RDS PostgreSQL, clinical trial data.
WHY: FDA 21 CFR Part 11, data sovereignty (ap-northeast-2).
CONSTRAINTS: all access audited, access key usage prohibited.
IAM layer: SCP denies regions other than ap-northeast-2. External SaaS uses Cross-Account Role + ExternalId (avoiding access keys). Unify CloudTrail across 80 accounts with an Org Trail. Encrypt data with a KMS custom CMK + Key Policy.
VPC layer: VPC Endpoints (S3, RDS, KMS) + Endpoint Policies to block external flows. External SaaS exposed via PrivateLink behind an NLB. Block outbound internet with NACLs/SGs (no internet traversal).
Compute layer: EC2 enforces IMDSv2, EBS is KMS-encrypted, RDS is Multi-AZ + automatic backups + 35-day retention. Export RDS audit logs to CloudWatch Logs.
Almost all of Week 1's learning is packed into this one scenario. The standard solving flow in the exam room is for your hand to draw the 3 layers automatically and fill each layer with keywords.
📝 Practice Questions
Click a choice to reveal the answer and explanation.
Question 1
A company operates 100 accounts. The security team wants to "block root user logins entirely in the production OU, and also block IAM calls without MFA." The most suitable method?
Question 2
A global SaaS operates in us-east-1 and is expanding to eu-west-1. EU user data must stay in the EU per GDPR. To guarantee data isolation while keeping a single codebase?
Question 3
A fintech wants to enforce that no EC2 can use any region other than us-east-1, for PCI-DSS certification. To minimize operational burden?
Question 4
A company accesses S3 from EC2. Traffic goes through a NAT Gateway, costing $30,000/month. A PCI-DSS audit also flagged that "S3 traffic traverses the internet." How to solve?
Question 5
A media company runs global game matchmaking (WebSocket). It exposes static IPs externally, needs failover within seconds on regional failure, and handles 1 million packets per second. The suitable combination?
Question 6
A company deploys to AWS Lambda from GitHub Actions. The security team requires "no long-lived AWS Access Keys stored in GitHub Secrets." How to solve?
Question 7
A company runs 100 EC2 instances for 4 hours for a nightly ETL batch (stateless, restartable). Minimize cost + meet the SLA (complete by 09:00 the next day).
Question 8
A company applies authentication behind an ALB. The backend (Node.js) wants almost no auth code and just wants to receive user info. The most suitable method?
Question 9
A company runs RDS MySQL in us-east-1 and wants to build DR in ap-northeast-2. RPO within 1 minute, RTO within 5 minutes. The most suitable solution?
Question 10
A SaaS wants to make its service usable via private IPs inside customer VPCs. The standard pattern?
Question 11
A company has an AD with 200 employees. SSO access to 80 accounts in AWS Organizations. When an employee leaves, permissions must be revoked automatically across all accounts. The most suitable solution?
Question 12
There are 3 Private Subnets across Multi-AZ, calling external APIs. To secure availability while minimizing cost, how should NAT Gateways be placed?
Week 1 reviewed the grammar of the exam and the four core SAA areas (IAM, VPC, EC2, ELB) at Pro depth. When the 40 one-line summaries and the 3-layer method work in the exam room, your hands automatically start decomposing even a scenario you've never seen.
From Week 2 we enter multi-account architecture (Organizations, SCP, Control Tower, Identity Center) — covered in earnest only at the SAP level. It accounts for 26% of Domain 1, so it's the biggest ROI. Solve today's 12 scenario questions once more, and for the ones you got wrong, apply the decomposition method to see where you went wrong. The moment your hand draws the 5 boxes first in the exam room is the signal of a pass.