AWS Shared File Storage — EFS vs FSx Decision Guide

Shared file storage appears in 51+ questions across SAA-C03 and SOA-C03. The exam tests when to use EFS (Linux NFS), which FSx variant (Windows/Lustre/ONTAP/OpenZFS), and performance class selection. This post covers the complete decision framework.

Detailed Comparison

EFS Performance Classes

EFS Storage Classes & Lifecycle

• Standard: Frequently accessed data. Multi-AZ durability.
• Infrequent Access (IA): 92% cheaper storage, per-access retrieval fee. Auto-tiered via lifecycle policy.
• One Zone: Single-AZ (20% cheaper than Standard). Good for dev/test or data that can be recreated.
• One Zone-IA: Cheapest option. Single AZ + infrequent access pricing.
• Lifecycle policy: Move files to IA after 7/14/30/60/90 days of no access. Can transition back on access.

FSx for Lustre — S3 Integration

• S3-linked: FSx Lustre filesystem linked to S3 bucket. Data lazy-loaded on first access.
• Scratch: Temporary, no replication. Highest performance. Use for short-term processing (ML training job).
• Persistent: Data replicated within AZ. Use for longer-term workloads needing durability.
• Write-back: Modified files automatically exported back to S3.
• Pattern: S3 (durable storage) → FSx Lustre (high-performance processing) → results back to S3

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company runs a content management system on multiple EC2 Linux instances behind an ALB. The instances need shared access to uploaded media files. The storage must auto-scale as content grows and support Multi-AZ for high availability. Which storage solution fits?

1. Amazon EBS with Multi-Attach enabled
2. Amazon EFS with Standard storage class (Regional)
3. Amazon S3 with s3fs mount on each instance
4. FSx for Lustre linked to an S3 bucket

Question 2:

A machine learning team needs to train models on a 10TB dataset stored in S3. Training jobs require sub-millisecond read latency and 50+ GB/s aggregate throughput across hundreds of GPU instances. Training runs last 3-4 hours. Which storage is optimal?

1. EFS with Elastic Throughput mode
2. FSx for Lustre (Scratch) linked to the S3 bucket
3. EBS gp3 volumes attached to each instance with data copied from S3
4. FSx for Windows File Server with SSD storage

Question 3:

A company is migrating their Windows file server to AWS. The file server uses NTFS permissions, DFS namespaces, and integrates with their Active Directory for access control. Which AWS service provides native support for all these features?

1. Amazon EFS with POSIX permissions mapped to Windows
2. Amazon FSx for Windows File Server with Active Directory integration
3. Amazon S3 with IAM policies mimicking NTFS permissions
4. FSx for ONTAP with SMB protocol

Question 4:

A company stores 50TB in EFS but only 5TB is accessed regularly. They want to reduce costs without changing application behavior or access patterns. Which approach achieves the highest cost reduction?

1. Switch to EFS One Zone storage class
2. Enable EFS Intelligent-Tiering lifecycle policy — automatically moves files not accessed for 14 days to Infrequent Access (IA) storage class
3. Move the entire EFS to S3 and use File Gateway
4. Migrate to FSx for Lustre which is cheaper at scale

Question 5:

A company needs shared file storage accessible from both Linux and Windows instances simultaneously. They also need snapshot capabilities and data compression to reduce storage costs. Which service supports all requirements?

1. EFS (supports Linux) + FSx for Windows (supports Windows) — two separate systems
2. FSx for ONTAP — supports NFS (Linux), SMB (Windows), snapshots, and inline compression/deduplication
3. S3 with separate mount tools for Linux and Windows
4. EBS Multi-Attach with a cluster file system

Related Posts

• Storage Gateway vs DataSync vs Snow
• S3 vs EBS vs EFS Compared
• Three-Tier Web Architecture
• Container Platform Architecture

References

• Amazon EFS User Guide
• FSx for Windows File Server Guide
• FSx for Lustre Guide
• Choosing the Right File System — AWS Blog

Frequently Asked Questions

EFS vs FSx for ONTAP — both support NFS. Which should I choose?

EFS: Simpler, serverless (no capacity planning), auto-scales, cheaper for large elastic workloads, native Lambda support. FSx ONTAP: Multi-protocol (NFS+SMB+iSCSI), compression/dedup, NetApp features (FlexClone, SnapMirror), better for hybrid/on-prem integration. Choose EFS for pure Linux NFS with auto-scaling needs. Choose ONTAP when you need multi-protocol, compression, or NetApp-compatible features.

When is FSx for Lustre better than EFS?

When you need extreme throughput (100s GB/s) and sub-millisecond latency for parallel workloads: ML training, HPC simulations, video rendering. Also when data lives in S3 and you need a high-performance processing layer on top (S3-linked Lustre). EFS maxes at ~10 GB/s and has millisecond latency — fine for web/general purpose, not enough for HPC.

AWS Storage Gateway & DataSync — Overview

Hybrid storage and data transfer is a core SAA-C03 topic appearing in 73+ questions. The key decision is: Storage Gateway (on-premises access to cloud storage) vs DataSync (one-time or scheduled data migration/sync). This post covers all gateway types, DataSync patterns, Snow Family decisions, and the Transfer Family for protocol-based access.

Storage Gateway Types

Storage Gateway vs DataSync — Decision

DataSync — Key Features

• Agent: Deploy on-premises (VMware/Hyper-V/EC2) to connect to source storage
• Sources: NFS, SMB, HDFS, self-managed object storage, S3-compatible
• Destinations: S3 (all classes), EFS, FSx (Windows/Lustre/ONTAP/OpenZFS)
• Scheduling: One-time or recurring (hourly, daily, weekly)
• Incremental: Only transfers changed files (compares metadata)
• Bandwidth throttling: Configurable to avoid saturating network links
• Between AWS: Can sync between AWS services (S3 → EFS, cross-region S3 → S3)
• Verification: Data integrity verification after transfer

Snow Family — When Network Is Not Enough

Decision rule: Calculate transfer time. If network transfer takes > 1 week, use Snow Family. Formula: DataSize(GB) × 8 / BandwidthMbps / 86400 = days.

Transfer Family

• What: Managed SFTP, FTPS, FTP, and AS2 servers that store data directly in S3 or EFS
• Use case: Partners/vendors who require SFTP to send/receive files. No changes to their workflow.
• Authentication: AWS Directory Service, custom Lambda authorizer, or service-managed users
• Exam note: “Third-party partners upload files via SFTP to S3” → Transfer Family

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company’s on-premises applications access files via NFS. They want to store this data in S3 for durability and cost savings, but applications must continue using NFS without modification. Which solution provides this?

1. AWS DataSync to copy files to S3 on a schedule
2. AWS S3 File Gateway presenting S3 as an NFS mount point with local caching
3. Mount S3 directly using s3fs-fuse on Linux
4. AWS Transfer Family with NFS protocol

Question 2:

A company needs to migrate 50TB from their on-premises NAS (NFS) to Amazon EFS. Their internet connection is 1 Gbps. They want the migration completed within 1 week with minimal disruption. Which approach is fastest?

1. AWS Snowball Edge — ship device, load data, ship back
2. AWS DataSync agent on-premises → EFS over Direct Connect or internet (transfers at near line speed)
3. S3 File Gateway — let it sync over time
4. rsync over SSH to an EC2 instance with EFS mounted

Question 3:

A company’s backup software writes to a tape library using iSCSI VTL interface. They want to eliminate physical tapes and store backups in AWS at the lowest long-term cost. The backup software cannot be modified. Which solution fits?

1. S3 File Gateway with lifecycle policy to Glacier
2. Tape Gateway — presents virtual tapes via iSCSI VTL, archives to S3 Glacier Deep Archive
3. DataSync scheduled backup to S3 Glacier
4. AWS Backup with custom vault in Glacier

Question 4:

A company needs to transfer 200TB of data to S3. Their internet bandwidth is 100 Mbps. Transfer would take approximately 185 days over the network. Which approach completes the transfer fastest?

1. Provision AWS Direct Connect (10 Gbps) and use DataSync
2. Order multiple Snowball Edge devices (80TB each), load in parallel, ship to AWS
3. Use S3 Transfer Acceleration with multipart upload
4. Increase internet bandwidth to 1 Gbps and use DataSync

Question 5:

A company’s partners upload daily files via SFTP. Currently this goes to an on-premises server. The company wants to move to AWS with minimal partner disruption — partners must continue using their existing SFTP clients and credentials. Files should land in S3. Which service provides this?

1. EC2 instance running OpenSSH SFTP server with S3 mounted via s3fs
2. AWS Transfer Family with SFTP protocol, configured to store files in S3
3. S3 File Gateway with SFTP enabled
4. API Gateway with a custom SFTP-to-S3 Lambda function

Related Posts

• AWS IoT Core – MQTT, Device Shadow & Rules Engine
• Hybrid Cloud Networking
• Migration Architecture (7Rs)
• Disaster Recovery Architecture
• Data Lake & Analytics Architecture

References

• Storage Gateway User Guide
• AWS DataSync User Guide
• DataSync vs Storage Gateway — AWS Blog

Frequently Asked Questions

Storage Gateway vs DataSync — which do I need?

Storage Gateway: When on-premises applications need ongoing access to cloud storage (NFS/SMB/iSCSI interface). It’s a persistent access point. DataSync: When you need to move or synchronize data between locations (migration, backup, replication). It’s a transfer tool. If apps need to read/write → Gateway. If you need to copy data → DataSync.

When should I use Snow Family vs DataSync?

Calculate network transfer time: DataSize(GB) × 8 ÷ BandwidthMbps ÷ 86400 = days. If transfer takes more than 1 week, consider Snow Family. Typical break-even: 10-50TB at 100 Mbps → borderline. 100TB+ at 100 Mbps → definitely Snow. Also consider: ongoing costs of higher bandwidth vs one-time Snow device rental.

What is the difference between Volume Gateway Cached vs Stored?

Cached: Primary data lives in S3, local cache stores frequently accessed data. Best when dataset is too large for local storage. Stored: Full dataset lives locally, asynchronous snapshots uploaded to S3. Best when you need low-latency access to entire dataset and S3 is just for backup/DR. Cached saves local storage; Stored provides better local performance.

GenAI Observability & Evaluation — Overview

Monitoring and evaluation are tested in AIP-C01 Domains 4 & 5 (23% combined). The exam tests FM-specific observability (token usage, latency, model drift), evaluation methods (automated metrics, LLM-as-Judge, human evaluation), and continuous testing patterns.

SageMaker Clarify for FM Evaluation

• Automated FM Evaluation — Evaluate foundation models for accuracy, robustness, toxicity, and factual consistency using built-in benchmark datasets.
• Model Comparison — Compare multiple FMs (from JumpStart or Bedrock) side-by-side on the same evaluation criteria to select the best fit.
• Custom Evaluation Criteria — Define domain-specific evaluation metrics beyond standard benchmarks (e.g., certification-specific accuracy).
• Human Evaluation Workflows — Integrate human reviewers via SageMaker Ground Truth for subjective quality assessment.
• Bias Detection in FMs — Detect bias in model outputs across demographic groups, including stereotyping, toxicity, and representational harms.
• Explainability for FM Responses — Token-level attribution showing which parts of the prompt influenced specific output segments.
• Continuous Monitoring — Integrate with Model Monitor for ongoing evaluation of deployed FM endpoints (prompt drift, output quality degradation).

Key Metrics for GenAI Applications

Model Evaluation Methods

Bedrock Model Invocation Logging

• Enable: Bedrock settings → Model invocation logging → S3 and/or CloudWatch Logs
• Captures: Full prompt, full response, model ID, token counts, latency, request metadata
• Use for: Debugging, compliance audit, prompt regression detection, cost attribution
• Privacy: Can contain PII — ensure encryption (KMS), access control, retention policies

X-Ray Tracing for GenAI

• End-to-end trace: User request → API Gateway → Lambda → Bedrock API → response
• Subsegments: RAG retrieval time, agent reasoning loops, tool call duration, guardrail processing
• Service map: Visualize dependencies between GenAI components
• Annotations: Tag traces with model ID, prompt template version, user segment for filtering

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company needs to evaluate the quality of their GenAI chatbot’s responses at scale (1000+ responses daily). Human reviewers can only check 50 per day. Which approach provides comprehensive quality assessment?

1. Only evaluate the 50 human-reviewed responses and extrapolate
2. Use Bedrock model evaluation with LLM-as-Judge to automatically score all responses on coherence, relevance, and helpfulness
3. Count the number of tokens in each response as a quality proxy
4. Use BLEU score for all responses

Question 2:

After updating a prompt template, a company notices their chatbot’s responses have degraded for certain query types. They need to detect such regressions automatically before deploying prompt changes. Which approach provides this?

1. A/B test every prompt change with 50% of production traffic
2. Maintain a regression test suite of queries with expected outputs, run automatically on every prompt change, alert if scores drop below threshold
3. Monitor token output length — shorter responses indicate regression
4. Wait for user complaints to identify issues

Question 3:

A development team needs to debug why their Bedrock Agent sometimes takes 30+ seconds to respond. The response eventually works but is too slow. Which observability tool shows where time is being spent?

1. CloudWatch Logs Insights querying for slow requests
2. AWS X-Ray tracing showing subsegments for each agent step (FM call, tool invocation, knowledge base retrieval)
3. Bedrock console metrics dashboard
4. CloudTrail showing API call sequence

Related Posts

• GenAI Cost & Performance Optimization
• Agentic AI Architecture
• Responsible AI & Guardrails
• MLOps Pipeline Architecture

References

• Bedrock Model Evaluation — AWS Docs
• Model Invocation Logging — AWS Docs
• Monitor Bedrock with CloudWatch — AWS Blog

Frequently Asked Questions

What is LLM-as-Judge?

A technique where a powerful FM evaluates another FM’s outputs against defined criteria (relevance, coherence, safety, helpfulness). You provide the evaluation prompt (rubric), the original question, and the FM’s response. The judge FM scores it. Bedrock supports this natively in model evaluation. It scales to thousands of evaluations per hour without human reviewers.

Which metrics should I monitor for a GenAI chatbot?

Essential: (1) Latency — TTFT and total response time. (2) Token usage — input/output per request (cost tracking). (3) Error/throttle rate — availability. (4) Guardrail intervention rate — safety. (5) User satisfaction — thumbs up/down if available. (6) Retrieval relevance — for RAG applications. Create CloudWatch dashboard combining all six.

AWS Network Firewall & Traffic Inspection — Overview

Network Firewall covers the “infrastructure security” domain of SCS-C03 (18% of exam). Questions test deep packet inspection, North-South vs East-West traffic patterns, centralized firewall deployment with Transit Gateway, and integration with third-party IDS/IPS tools via Traffic Mirroring.

AWS Network Firewall — Features

North-South vs East-West Traffic

Deployment Patterns

Pattern 1: Centralized Inspection (TGW)

• Single Inspection VPC with Network Firewall
• TGW route tables force ALL inter-VPC and internet-bound traffic through the Inspection VPC
• Best for: Multi-account environments needing consistent inspection
• Managed by: Central security team via Firewall Manager

Pattern 2: Distributed (Per-VPC)

• Network Firewall endpoints in each VPC
• VPC route tables direct traffic through firewall endpoints
• Best for: Single-account or when latency-sensitive (avoids TGW hop)

Pattern 3: Gateway Load Balancer (Third-Party)

• GWLB distributes traffic to third-party firewall appliances (Palo Alto, Fortinet, Check Point)
• Transparent inspection — traffic flows through appliance without source IP change
• Best for: Organizations with existing third-party IDS/IPS investments

VPC Traffic Mirroring

• What: Copy network traffic from ENIs to monitoring targets (out-of-band inspection)
• Use case: IDS/IPS that needs to see raw packets but shouldn’t be inline (passive monitoring)
• Targets: NLB (distributes mirrored traffic to monitoring fleet) or another ENI
• Filters: Mirror only specific traffic (source/dest IPs, ports, protocols)
• Limitation: Not supported on all instance types (requires Nitro). Additional network bandwidth cost.
• Exam note: “Passive inspection without affecting traffic flow” → Traffic Mirroring. “Inline inspection” → Network Firewall or GWLB.

Network Firewall vs Security Groups vs NACLs vs WAF

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company needs to inspect all traffic between VPCs (East-West) for malicious patterns using IDS/IPS signatures. They have 20 spoke VPCs connected via Transit Gateway. Which architecture provides centralized inspection?

1. Deploy Network Firewall in each spoke VPC
2. Create a dedicated Inspection VPC with Network Firewall, configure TGW route tables to route all inter-VPC traffic through it
3. Use Security Groups with deny rules between VPCs
4. Enable VPC Flow Logs and analyze with GuardDuty

Question 2:

A security team needs to allow EC2 instances to access only specific approved domains (e.g., *.github.com, *.amazonaws.com) and block all other outbound internet traffic. Which service provides this domain-based filtering?

1. Security Groups with domain names in rules
2. AWS Network Firewall with stateful domain list rules
3. Route 53 Resolver DNS Firewall with block rules
4. NACLs with domain-based rules

Question 3:

A company uses third-party Palo Alto firewall appliances for deep inspection. They want to route VPC traffic through these appliances transparently without changing source/destination IPs. Which AWS service enables this?

1. Network Load Balancer in front of firewall instances
2. Gateway Load Balancer (GWLB) with GENEVE encapsulation
3. ALB with forwarding rules to firewall targets
4. Transit Gateway with static routes to firewall instances

Question 4:

A security team needs to passively monitor network traffic on specific EC2 instances for forensic analysis without affecting application performance or traffic flow. Which approach achieves this?

1. Deploy Network Firewall inline with alerting-only mode
2. Configure VPC Traffic Mirroring from the instance ENIs to a monitoring NLB target
3. Enable enhanced VPC Flow Logs with packet capture
4. Install tcpdump on each instance and send to S3

Question 5:

A company’s compliance requires inspecting HTTPS traffic for data exfiltration. They need to decrypt outbound TLS, inspect the content, then re-encrypt before forwarding. Certain financial and healthcare domains must be exempted from inspection. Which solution provides this?

1. CloudFront with Lambda@Edge inspecting request bodies
2. AWS Network Firewall with TLS inspection policy and domain exception list
3. WAF with body inspection rules on all outbound traffic
4. Install proxy servers (Squid) on EC2 instances with SSL bump

Related Posts

• AWS ALB – Application Load Balancer Features & Routing Rules
• DDoS & Edge Protection Architecture
• VPC Connectivity Decision Guide
• Zero Trust Architecture
• Centralized Logging Architecture

References

• AWS Network Firewall Guide
• Network Firewall Deployment Models — AWS Blog
• VPC Traffic Mirroring Guide
• Gateway Load Balancer for Inspection — AWS Blog

Frequently Asked Questions

Network Firewall vs WAF — when to use which?

Network Firewall: Inspects all network traffic (any protocol, any direction). Works at VPC level. Use for IDS/IPS, domain filtering, TLS inspection, East-West traffic. WAF: Inspects HTTP/HTTPS requests only. Works at ALB/CloudFront/API Gateway. Use for web application attacks (SQLi, XSS, bot control). Most architectures need both: WAF for web-layer protection, Network Firewall for network-layer inspection.

What is Gateway Load Balancer used for?

GWLB transparently inserts third-party network appliances (Palo Alto, Fortinet, Check Point) into your traffic path. It handles scaling, HA, and traffic distribution across appliance fleet. Traffic passes through appliances with original source/destination IPs preserved (GENEVE encapsulation). Use when you have existing third-party security tools or need features not available in AWS Network Firewall.

Can Network Firewall inspect encrypted (HTTPS) traffic?

Yes — Network Firewall supports TLS inspection. It decrypts traffic using an ACM certificate, inspects the decrypted content with your stateful rules, then re-encrypts before forwarding. You can exempt specific domains from inspection (compliance requirement for financial/healthcare traffic). Without TLS inspection, Network Firewall can still filter by TLS SNI (domain name) but cannot inspect the encrypted payload.

AWS Secrets & Certificate Management — Overview

Secrets management appears in 81+ questions across SCS-C03 (Data Protection) and SAP-C02/DOP-C02. The core decisions are: Secrets Manager vs Parameter Store (when to use which), automatic rotation patterns, ACM certificate management, and mTLS enforcement. This post covers all patterns exam questions test.

Detailed Comparison

Secrets Rotation — How It Works

Secrets Manager rotation uses a Lambda function that executes 4 steps:

1. createSecret: Generate new credentials, store as AWSPENDING version
2. setSecret: Update the database/service with the new credentials
3. testSecret: Verify the new credentials work (connect to DB)
4. finishSecret: Move AWSPENDING → AWSCURRENT, old current → AWSPREVIOUS

Rotation Strategies

AWS Certificate Manager (ACM)

mTLS (Mutual TLS) Patterns

• API Gateway + mTLS: Configure custom domain with mutual TLS. Upload truststore (CA bundle) to S3. Clients present certificate signed by your CA.
• ALB + mTLS: ALB verifies client certificates. Configure trust store with your CA. Supports certificate revocation (CRL/OCSP).
• Service Mesh (App Mesh): Envoy proxies handle mTLS between microservices automatically. ACM Private CA issues short-lived certificates.
• Exam note: “Verify client identity at API level” → mTLS. “Verify client identity at network level” → VPN with certificate auth.

Integration Patterns

• RDS + Secrets Manager: Native rotation for MySQL, PostgreSQL, Oracle, SQL Server, MariaDB. Secrets Manager auto-manages the DB password.
• Lambda + Secrets Manager: Cache secrets using AWS Parameters and Secrets Lambda Extension (reduces API calls, adds caching layer).
• ECS + Secrets Manager: Reference secrets in task definition as environment variables. ECS agent fetches at container start.
• CloudFormation + Secrets Manager: Generate random password at deploy: {{resolve:secretsmanager:my-secret:SecretString:password}}
• CodePipeline/CodeBuild: Reference Parameter Store/Secrets Manager for build secrets. Never hardcode in buildspec.

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company’s application connects to an RDS MySQL database using hardcoded credentials in the application configuration file. The security team requires automatic credential rotation every 30 days without application downtime. Which solution meets these requirements with the LEAST development effort?

1. Store credentials in SSM Parameter Store SecureString, write a Lambda function to rotate the DB password and update the parameter every 30 days
2. Enable Secrets Manager with native RDS rotation using the alternating users strategy, update application to retrieve credentials from Secrets Manager at runtime
3. Use IAM database authentication instead of passwords
4. Store credentials in a KMS-encrypted S3 file, rotate manually every 30 days

Question 2:

Multiple AWS accounts in an Organization need to access a shared database credential stored in a central security account. The credential must be accessible without creating IAM users or access keys in the security account. Which approach enables this?

1. Store in Parameter Store and share via RAM
2. Store in Secrets Manager and add a resource policy allowing the member accounts’ roles to retrieve it
3. Replicate the secret to each account using Secrets Manager multi-Region replication
4. Store in S3 with a bucket policy allowing cross-account access

Question 3:

A company needs to issue short-lived certificates for internal microservices running on ECS. The certificates must be automatically rotated, and the private keys must be exportable so the application can use them directly. Public CAs should NOT be involved. Which service provides this?

1. ACM public certificates with auto-renewal
2. ACM Private CA issuing short-lived certificates (configured with 1-7 day validity)
3. Self-signed certificates generated by a Lambda function
4. Let’s Encrypt certificates with certbot automation

Question 4:

A security engineer discovers that application developers are storing database passwords in Lambda environment variables (visible in the console). They need a solution that encrypts secrets at rest, restricts access via IAM, and allows the Lambda function to retrieve the secret without code changes to the environment variable approach. Which solution achieves this?

1. Encrypt environment variables using a KMS key and grant Lambda’s execution role kms:Decrypt
2. Store secrets in Secrets Manager, reference them in Lambda environment variables using dynamic resolution
3. Use the AWS Parameters and Secrets Lambda Extension to cache Secrets Manager values, update code to read from extension cache
4. Store secrets in S3 encrypted with KMS, have Lambda download at startup

Question 5:

A company requires that their API Gateway verifies the identity of each calling client using certificates (not just API keys or tokens). Clients must present a certificate issued by the company’s internal CA. How should this be configured?

1. Configure API Gateway with a Lambda authorizer that validates certificate headers
2. Configure a custom domain on API Gateway with mutual TLS enabled, upload the company’s CA certificate bundle as a truststore to S3
3. Put CloudFront in front of API Gateway and configure CloudFront to validate client certificates
4. Configure a VPN connection and require VPN client certificates

Related Posts

• AWS IoT Core – MQTT, Device Shadow & Rules Engine
• Data Encryption Architecture (KMS & CloudHSM)
• IAM Security Architecture
• Incident Response Architecture
• CI/CD Pipeline Architecture

References

• AWS Secrets Manager User Guide
• SSM Parameter Store Guide
• ACM Private CA User Guide
• mTLS for API Gateway — AWS Security Blog

Frequently Asked Questions

When should I use Secrets Manager vs Parameter Store?

Use Secrets Manager when you need: automatic rotation (especially for RDS), cross-account access (resource policy), or built-in password generation. Use Parameter Store for: configuration values (not secrets), feature flags, when cost matters (free tier), or when you need hierarchical paths. You can reference Secrets Manager secrets from Parameter Store paths for compatibility.

How does Secrets Manager rotation work without downtime?

Use the alternating users strategy: create two DB users (user_1, user_2). Secrets Manager rotates one at a time. While user_1’s password is being changed, user_2 still works. Applications that cache credentials continue working with the previous valid user until they refresh. The AWSPREVIOUS version remains valid during the rotation window.

Can I use ACM certificates on EC2 instances?

ACM public certificates cannot be exported (no private key access), so they can’t be installed directly on EC2. They work only with integrated services (ELB, CloudFront, API Gateway). ACM Private CA certificates CAN be exported and installed on EC2, on-premises servers, IoT devices, or anywhere you need the private key.

AWS DDoS & Edge Protection Architecture — Overview

Edge protection is tested across SCS-C03 (Domain 3: Infrastructure Security) and SAP-C02. The architecture combines CloudFront (CDN/edge), AWS WAF (Layer 7 rules), AWS Shield (DDoS mitigation), and AWS Firewall Manager (centralized management). This post covers the full defense stack, rule design, and automated response patterns.

AWS WAF — Rule Types & Strategy

AWS Shield — Standard vs Advanced

AWS Firewall Manager — Centralized Policy

• Purpose: Deploy and manage security rules across ALL accounts in an Organization from a single admin account
• Manages: WAF rules, Shield Advanced protections, Security Groups, Network Firewall rules, Route 53 Resolver DNS Firewall
• Auto-remediation: Automatically applies policies to new resources/accounts (no manual setup per account)
• Prerequisite: AWS Organizations + Config enabled in all accounts
• Exam key: “Deploy WAF rules consistently across all accounts” → Firewall Manager

Protection Patterns by Attack Type

Best Practice Architecture

• Always front with CloudFront: Absorbs volumetric attacks at edge, hides origin IP, enables WAF without additional latency
• Origin protection: Security group on ALB allows only CloudFront managed prefix list IPs + custom origin header validation
• WAF on CloudFront: Deploy WAF at CloudFront (not ALB) — blocks attacks at the edge before they reach your region
• Rate limiting at multiple levels: WAF rate rules (per-IP), API Gateway throttling (per-API key), application-level
• Auto-scaling behind protection: Even with DDoS protection, ensure ASG/ALB can handle legitimate traffic spikes

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company’s web application behind an ALB is experiencing an HTTP flood attack (thousands of requests per second from distributed IPs targeting the /login endpoint). Shield Standard is not mitigating it. What combination provides the fastest protection?

1. Enable Shield Advanced on the ALB and wait for automatic mitigation
2. Add a WAF rate-based rule on the ALB limiting requests to /login per IP, and deploy CloudFront in front of the ALB
3. Increase ALB capacity and add more EC2 instances behind the ASG
4. Block all international traffic using Security Group rules

Question 2:

A company needs to deploy identical WAF rules (OWASP protections + rate limiting) across 30 AWS accounts in their Organization. When new accounts are added, the rules must be automatically applied. Which approach requires the LEAST ongoing effort?

1. Create a CloudFormation StackSet that deploys WAF WebACLs to all accounts
2. Use AWS Firewall Manager with a WAF policy applied to the Organization
3. Create a central Lambda function that deploys WAF rules to each account via cross-account roles
4. Document the WAF rules and require each account team to implement them manually

Question 3:

A company wants to ensure their ALB origin is NEVER directly accessible from the internet — all traffic must flow through CloudFront. They also want to verify that requests actually came from their CloudFront distribution (not someone else’s). Which controls achieve this?

1. ALB security group allowing only CloudFront managed prefix list + custom origin header in CloudFront that ALB validates
2. Private ALB in a private subnet with no internet gateway
3. WAF on ALB blocking requests without CloudFront headers
4. Shield Advanced protecting the ALB directly

Question 4:

During a DDoS attack, a company’s Auto Scaling group scales up significantly, tripling their EC2 and data transfer costs. They have Shield Advanced. After the attack, how can they recover these costs?

1. File a support ticket requesting a general AWS credit
2. Request DDoS cost protection credit through Shield Advanced — AWS refunds scaling costs attributed to the DDoS attack
3. Shield Advanced automatically credits the account without any action
4. Costs cannot be recovered; Shield Advanced only prevents future attacks

Question 5:

A security engineer needs to block requests from a specific list of 10,000 malicious IPs updated daily by a threat intelligence feed. The block must apply to CloudFront distributions across all accounts. What is the most operationally efficient solution?

1. Manually update Security Groups daily in each account
2. Create a WAF IP set, use a Lambda function to update it daily from the threat feed, deploy via Firewall Manager across all accounts
3. Use Network Firewall with stateful rules in each VPC
4. Configure Route 53 to not resolve DNS for those IPs

Related Posts

• Global Traffic Management – Route 53, GA & CloudFront
• Security Services Architecture
• IAM Security Architecture
• Centralized Logging Architecture
• Data Encryption Architecture

References

• AWS WAF Developer Guide
• AWS Shield Developer Guide
• Three Most Important WAF Rate-Based Rules — AWS Security Blog
• AWS Firewall Manager Guide

Frequently Asked Questions

Do I need Shield Advanced if I have WAF?

Shield Standard (free) handles L3/L4 DDoS automatically. WAF handles L7 (application) attacks with rules you define. Shield Advanced adds: L7 automatic mitigation, DRT team access during attacks, cost protection (refund for DDoS-caused scaling), and near real-time visibility. For most applications, Shield Standard + WAF is sufficient. Shield Advanced is for high-profile targets needing DRT support and cost protection.

Where should I deploy WAF — on CloudFront or ALB?

Deploy WAF on CloudFront when possible. Attacks are blocked at the edge (closer to attacker, further from your infrastructure). If you need different WAF rules per path/domain on the same ALB, add WAF on ALB too. CloudFront WAF is global (one WebACL for all edge locations). ALB WAF is regional. You can have WAF on both simultaneously.

What is the difference between WAF rate-based rules and API Gateway throttling?

WAF rate-based rules: Block by source IP when requests exceed threshold (e.g., 100 per 5 minutes). Applied at CloudFront/ALB level. API Gateway throttling: Limit by API key, stage, or method (e.g., 1000 req/sec per API key). Applied per API. Use both: WAF for DDoS/abuse protection, API Gateway for fair-use rate limiting per customer.

AWS IAM Security Architecture — Overview

IAM is the largest exam domain on SCS-C03 (20%) and appears heavily on SAP-C02. This post covers the layered access control model: SCPs (organization guardrails) → Permission Boundaries (delegation limits) → Identity Policies (actual permissions) → Resource Policies (resource-level control). Understanding policy evaluation order and interaction is critical.

Service Control Policies (SCPs)

Common SCP Patterns (Exam Favorites)

• Prevent leaving Organization: Deny organizations:LeaveOrganization
• Prevent disabling CloudTrail: Deny cloudtrail:StopLogging, cloudtrail:DeleteTrail
• Prevent deleting GuardDuty: Deny guardduty:DeleteDetector, guardduty:DisassociateFromMasterAccount
• Restrict regions: Deny all actions unless aws:RequestedRegion is in allowed list (with exceptions for global services)
• Require encryption: Deny s3:PutObject unless s3:x-amz-server-side-encryption is present
• Prevent root user access: Deny all actions when aws:PrincipalArn matches root (doesn’t affect management account)

Permission Boundaries

• Purpose: Allow administrators to delegate user/role creation safely. The boundary sets maximum permissions that any identity policy can grant.
• Intersection model: Effective permissions = Identity Policy ∩ Permission Boundary. If boundary doesn’t allow s3:*, even AdministratorAccess policy can’t grant S3.
• Use case: DevOps team can create roles for their applications, but boundary ensures they can’t create roles with more permissions than they have themselves (privilege escalation prevention).
• Exam trap: Permission boundaries ONLY affect identity-based policies. Resource policies (like S3 bucket policy) bypass the boundary check.

ABAC (Attribute-Based Access Control)

• ABAC advantage: One policy works for all projects/teams. Tag a user with Project=Alpha, resources with Project=Alpha → access granted automatically.
• ABAC + SCPs: Use SCP to require tags on resource creation (aws:RequestTag must include Project)
• Session tags: SAML federation can pass tags (department, team) from IdP → IAM role → ABAC policy evaluation

IAM Policy Evaluation Logic

For same-account requests:

1. Explicit Deny? → DENIED (anywhere in any policy = final denial)
2. SCP allows? → If SCP doesn’t allow, DENIED
3. Resource policy allows? → If resource policy grants access (same-account), ALLOWED (skip remaining checks)
4. Permission boundary allows? → If boundary set and doesn’t include action, DENIED
5. Session policy allows? → If session policy set and doesn’t include action, DENIED
6. Identity policy allows? → If identity policy grants, ALLOWED. Otherwise, implicit DENIED.

For cross-account requests:

• BOTH sides must allow: Account A’s identity policy (or resource policy) must allow AND Account B’s resource policy must allow
• Exception: If Account B’s resource policy specifies Account A’s role ARN directly, Account A’s identity policy is not needed
• SCPs apply to the requesting principal’s account

Session Policies & Roles Anywhere

• Session policies: Passed when assuming role (AssumeRole API). Further restricts the role’s permissions for that session only. Effective = Role Policy ∩ Session Policy.
• IAM Roles Anywhere: Workloads OUTSIDE AWS (on-premises servers) can get temporary credentials by presenting a certificate from a registered CA trust anchor. Eliminates long-term access keys for hybrid workloads.
• Amazon Verified Permissions: Fine-grained authorization for applications using Cedar policy language. Externalize authorization logic from application code.

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company wants to allow their development team to create IAM roles for Lambda functions, but prevent them from creating roles with more permissions than their own (privilege escalation). The solution must not require security team approval for each role creation. Which approach achieves this?

1. Create an SCP denying iam:CreateRole for the development OU
2. Require developers to attach a specific permission boundary to any role they create, enforced by a condition in their IAM policy
3. Create a Lambda execution role and require all functions use only this role
4. Use AWS Service Catalog to manage approved role configurations

Question 2:

An organization wants to ensure NO AWS account (except the management account) can disable CloudTrail or leave the organization, regardless of what IAM permissions exist in those accounts. How should this be implemented?

1. Remove iam:* from all accounts to prevent admin access
2. Apply an SCP at the organization root denying cloudtrail:StopLogging, cloudtrail:DeleteTrail, and organizations:LeaveOrganization
3. Create AWS Config rules to detect and auto-remediate these actions
4. Create EventBridge rules in each account to block these API calls

Question 3:

A company uses SAML federation from their on-premises Active Directory. They need engineers tagged with “Department=Engineering” in AD to only access EC2 instances tagged with “Department=Engineering” — without creating separate policies per department. Which approach provides this?

1. Create separate IAM roles per department, each with hardcoded resource ARNs
2. Use SAML session tags to pass Department attribute, then use ABAC policy with aws:PrincipalTag/Department condition matching aws:ResourceTag/Department
3. Use permission boundaries per department limiting resource access
4. Create resource policies on each EC2 instance allowing specific department groups

Question 4:

Account B has an S3 bucket with a bucket policy allowing Account A’s role to PutObject. However, when Account A’s role tries to upload, it gets AccessDenied. The role has s3:* in its identity policy. Account A has an SCP that allows all S3 actions. What is the most likely cause?

1. The bucket policy needs to specify the role ARN, not the account
2. Account B’s SCP is blocking the PutObject action
3. Account A’s permission boundary on the role doesn’t include s3:PutObject
4. S3 requires the request to include server-side encryption headers

Question 5:

A company has on-premises servers that need to call AWS APIs (S3, DynamoDB) without storing long-term access keys on the servers. The servers have certificates issued by the company’s private CA. Which solution eliminates long-term credentials?

1. Create an IAM user with access keys, rotate keys every 90 days
2. Set up a Site-to-Site VPN and use the VPC’s IAM capabilities
3. Configure IAM Roles Anywhere with the company’s private CA as trust anchor, servers present certificates to get temporary credentials
4. Use AWS SSO (IAM Identity Center) with SAML for machine-to-machine auth

Related Posts

• Multi-Account Architecture (Organizations & Control Tower)
• Zero Trust Architecture
• Data Encryption Architecture (KMS & CloudHSM)
• Centralized Logging Architecture
• DDoS & Edge Protection Architecture

References

• Permission Boundaries — AWS Docs
• Service Control Policies — AWS Docs
• ABAC for AWS — AWS Docs
• Least Privilege with StackSets — AWS Security Blog

Frequently Asked Questions

What is the difference between SCPs and Permission Boundaries?

SCPs apply to an entire AWS account (all principals within it). They set the maximum permissions for the account. Permission Boundaries apply to a specific IAM user or role. They limit what that specific principal can do. SCPs are set by the Organization admin; boundaries are set by the account admin. Both use the intersection model — effective permissions must be allowed by both.

Does the management account get restricted by SCPs?

No. The management account is always exempt from SCPs. This is by design — you can’t accidentally lock yourself out of the Organization. Because of this, best practice is to NOT run workloads in the management account. Use it only for Organization management, billing, and account creation.

How does ABAC scale better than RBAC?

With RBAC, you need N policies for N projects/teams (one policy per team specifying resource ARNs). With ABAC, you need ONE policy that uses tag conditions. When a new project starts, just tag the resources and users — no policy changes. The policy Condition: aws:ResourceTag/Project == ${aws:PrincipalTag/Project} automatically works for all current and future projects.

AWS Data Encryption Architecture — Overview

Data encryption is the largest topic on the SCS-C03 exam (Domain 5: 18%). Every scenario involves choosing between KMS and CloudHSM, selecting the right key type, designing cross-account key access, and implementing rotation. This post covers the complete encryption decision framework — from key hierarchy to cross-account patterns to exam traps around key policies.

KMS vs CloudHSM — Detailed Comparison

KMS Key Policy — The Critical Exam Topic

KMS key policies are the #1 exam trap. Unlike all other AWS resources, KMS keys have their own resource policy that MUST explicitly grant access — IAM policies alone are insufficient unless the key policy allows it.

• Default key policy: Allows the root principal to perform all actions → enables IAM policies to control access
• Without root principal statement: IAM policies cannot grant access to the key (even AdministratorAccess won’t work!)
• Key administrators: Can manage the key (enable/disable, delete, rotate) but CANNOT use it for encrypt/decrypt
• Key users: Can use the key for encrypt/decrypt/generate data key operations
• Grants: Delegated, temporary access to a key (used by AWS services internally, e.g., EBS attaching encrypted volume)

Cross-Account KMS Key Access

Two things must be true for cross-account KMS access:

1. Key policy in Account A must allow Account B’s root (or specific role): "Principal": {"AWS": "arn:aws:iam::ACCOUNT_B:root"}
2. IAM policy in Account B must allow the role to use the key: "Resource": "arn:aws:kms:region:ACCOUNT_A:key/key-id"

Exam trap: If the key policy only lists specific principals (no root principal), IAM policies in Account A won’t work either. The key policy is the primary gatekeeper.

Key Rotation

Encryption Patterns — At Rest

Encryption in Transit

• ELB: Configure security policies (TLS 1.2+ enforced). Use ACM certificates. ALB terminates TLS, can re-encrypt to backend.
• S3: Bucket policy with aws:SecureTransport: false denies HTTP. Forces HTTPS only.
• RDS: rds.force_ssl = 1 (MySQL) or rds.force_ssl = true (PostgreSQL). Download RDS CA bundle.
• API Gateway: HTTPS only by default. Can configure mutual TLS (mTLS) with custom domain.
• VPC: VPN (IPsec) or PrivateLink for private connectivity. All inter-region VPC peering is encrypted.

Envelope Encryption (Data Key Pattern)

• How it works: KMS generates a Data Encryption Key (DEK). Plaintext DEK encrypts your data. KMS encrypts the DEK with the CMK. Store encrypted DEK alongside encrypted data.
• Why: KMS has a 4KB limit on direct encrypt. Envelope encryption allows encrypting any size data. Only the small DEK crosses the network to KMS.
• GenerateDataKey: Returns both plaintext DEK (use to encrypt) and encrypted DEK (store alongside data)
• Decrypt flow: Send encrypted DEK to KMS → get plaintext DEK → decrypt data locally
• Exam relevance: “Encrypt 1GB file with KMS” → must use envelope encryption (GenerateDataKey), NOT Encrypt API

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company stores sensitive financial data in S3. Compliance requires that all decryption events are logged in CloudTrail, the encryption key can be disabled immediately if compromised, and only specific IAM roles can decrypt. Which encryption configuration meets ALL these requirements?

1. SSE-S3 (Amazon S3-managed keys)
2. SSE-KMS with an AWS managed key (aws/s3)
3. SSE-KMS with a customer managed key and restrictive key policy
4. SSE-C (customer-provided keys)

Question 2:

Account A has an encrypted EBS snapshot that needs to be shared with Account B. The snapshot is encrypted with a customer managed KMS key. What steps are required for Account B to use this snapshot?

1. Share the snapshot with Account B. Account B copies it using their own KMS key. No key policy change needed.
2. Modify the KMS key policy to allow Account B access. Share the snapshot. Account B creates a volume or copies with their own key.
3. Create an unencrypted copy of the snapshot, then share the unencrypted version with Account B.
4. Export the KMS key to Account B using key material import.

Question 3:

A company’s compliance team requires that encryption keys used for sensitive workloads are stored in hardware that AWS personnel cannot access, while still using the KMS API for integration with AWS services. Which configuration achieves this?

1. KMS with customer managed keys (standard)
2. KMS with imported key material
3. KMS custom key store backed by CloudHSM cluster
4. Client-side encryption with keys stored in Secrets Manager

Question 4:

A developer tries to use a KMS key to encrypt data but receives “AccessDeniedException.” Their IAM policy has kms:* on the key ARN. The key policy only contains a statement allowing the key administrator to manage the key. What is the issue?

1. The IAM policy must specify the exact actions (kms:Encrypt) not wildcard
2. The key policy does not include the root principal statement, so IAM policies cannot grant access
3. The developer needs to be added as a key administrator
4. KMS keys require explicit Deny removal before access works

Question 5:

A company needs to encrypt a 50MB file using KMS. When they call the kms:Encrypt API with the file, they receive an error that the payload exceeds the 4KB limit. How should they encrypt this file?

1. Split the file into 4KB chunks and encrypt each chunk separately with kms:Encrypt
2. Use kms:GenerateDataKey to get a data encryption key, encrypt the file locally with the plaintext key, store the encrypted key alongside the encrypted file
3. Increase the KMS payload limit through a service quota increase request
4. Use CloudHSM instead, which has no payload size limit

Related Posts

• Centralized Logging Architecture
• Security Services Architecture
• Multi-Account Architecture
• Zero Trust Architecture
• Secrets & Certificate Management
• Incident Response Architecture

References

• AWS KMS Concepts — AWS Docs
• KMS Key Policies — AWS Docs
• KMS and IAM Security Policies — AWS Security Blog
• CloudHSM User Guide — AWS Docs

Frequently Asked Questions

When should I use CloudHSM vs KMS?

Use KMS for most workloads — it integrates natively with 100+ AWS services, is fully managed, and costs $1/key/month. Use CloudHSM when you need: FIPS 140-2 Level 3 compliance, single-tenant HSM (regulatory requirement), full exclusive key control (AWS cannot access), or custom cryptographic algorithms. You can combine both via KMS Custom Key Store.

Can I use one KMS key across multiple accounts?

Yes, but both the key policy AND an IAM policy must allow it. The key policy grants the other account’s root principal (or specific role) access. Then an IAM policy in the consuming account allows the role to call KMS. Without BOTH, cross-account access fails. AWS managed keys (aws/s3, aws/ebs) cannot be shared cross-account — only customer managed keys.

What happens when I rotate a KMS key?

AWS creates new key material but keeps the old material. The key ID and ARN don’t change. New data encrypts with new material. Old data still decrypts fine (KMS tracks which version encrypted each ciphertext). You don’t need to re-encrypt existing data. This is automatic and transparent — no application changes needed.

AWS Centralized Logging Architecture — Overview

Centralized logging is a foundational security requirement across all AWS certifications. The SCS-C03 exam tests your ability to design multi-account logging architectures that aggregate, correlate, and alert on security events. This post covers the complete logging pipeline: from source collection (CloudTrail, VPC Flow Logs, DNS logs) through aggregation (Security Lake, CloudWatch) to analysis (Athena, OpenSearch, SIEM).

Log Sources — What to Collect

Organization CloudTrail Trail

• Setup: Create from the management account → automatically applies to ALL member accounts
• Storage: Central S3 bucket in Log Archive account with bucket policy allowing organization trail delivery
• Protection: S3 Object Lock (WORM), MFA Delete, bucket policy denying s3:DeleteObject, KMS encryption
• Validation: CloudTrail log file integrity validation (SHA-256 hash chain). Detects if log files are modified/deleted.
• Key exam trap: Member accounts can see the trail but CANNOT modify or delete it. Only the management account can.

Cross-Account Log Aggregation Patterns

Amazon Security Lake (OCSF)

• What: Centralized security data lake that automatically collects logs from 80+ AWS and third-party sources
• Schema: Normalizes ALL data to Open Cybersecurity Schema Framework (OCSF) — single schema regardless of source
• Storage: S3 with Apache Iceberg tables (efficient querying, time-travel)
• Sources: CloudTrail, VPC Flow Logs, Route 53, Security Hub, Lambda execution, S3 data events, EKS audit, WAF
• Subscribers: Query via Athena, or grant data access to third-party SIEMs (Splunk, Datadog, CrowdStrike)
• Multi-account: Delegated administrator collects from all Organization member accounts automatically
• Regions: Rollup regions — aggregate from multiple regions into one central region
• Exam relevance: “Normalize logs from multiple sources into a unified schema” → Security Lake

CloudWatch Logs — Real-Time Analysis

• Metric Filters: Parse log events → extract metrics → create alarms (e.g., count of “UnauthorizedAccess” → alarm if > 5/min)
• Subscription Filters: Stream logs in real-time to Lambda, Kinesis, Firehose, or OpenSearch
• Cross-Account Subscriptions: Source account creates subscription filter → sends to destination in central account (Kinesis/Firehose)
• Insights Queries: SQL-like queries across log groups. Find patterns, anomalies, top talkers.
• Data Protection: Mask sensitive data (SSN, credit cards) in logs automatically using data protection policies
• Retention: Configure per log group (1 day to 10 years, or never expire). Exam: default is never expire (costs money!).

Log Protection — Integrity & Access Control

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A security engineer needs to ensure that API activity logs from all 50 AWS accounts in the organization cannot be modified or deleted, even by administrators in those accounts. The logs must be retained for 7 years. Which solution meets these requirements?

1. Create individual CloudTrail trails in each account sending to a local S3 bucket with versioning enabled
2. Create an organization trail sending to an S3 bucket in a dedicated Log Archive account with S3 Object Lock in Compliance mode
3. Create an organization trail sending to CloudWatch Logs with a 7-year retention policy
4. Create individual trails with log file integrity validation enabled and MFA Delete on each bucket

Question 2:

A company needs to detect within 1 minute when someone disables CloudTrail logging in any account. The detection must trigger an automated Lambda function to re-enable the trail. Which approach achieves this?

1. AWS Config rule checking CloudTrail status with auto-remediation via SSM
2. Organization trail → CloudWatch Logs → metric filter for StopLogging → alarm → SNS → Lambda
3. EventBridge rule in each member account for StopLogging/DeleteTrail events → central event bus → Lambda
4. GuardDuty finding for “Stealth:IAMUser/CloudTrailLoggingDisabled” → EventBridge → Lambda

Question 3:

A company wants to aggregate security logs from CloudTrail, VPC Flow Logs, Route 53 DNS logs, and GuardDuty findings into a single data store. They need to query all sources with a unified schema. Third-party security tools must also access this data. Which solution provides this?

1. Send all logs to a central S3 bucket, create Glue crawlers for each source, query with Athena
2. Send all logs to CloudWatch Logs in a central account, use CloudWatch Logs Insights
3. Enable Amazon Security Lake with delegated administrator, configure subscriber access for third-party tools
4. Send all logs to Amazon OpenSearch Service with custom index templates per source

Question 4:

A security team needs to analyze VPC Flow Logs across 100 accounts to find connections to known malicious IPs. The logs are stored in S3 in a central account. They want the lowest-cost query solution that doesn’t require infrastructure management. Which approach is best?

1. Import logs into Amazon OpenSearch Service and create dashboards
2. Use Amazon Athena with partitioned tables (by account, date, region) to query directly from S3
3. Stream to Amazon Kinesis Data Analytics for real-time threat detection
4. Load into Amazon Redshift for analytics queries

Question 5:

A company’s CloudWatch Logs contain sensitive PII (Social Security numbers) from application logs. The security team needs to ensure PII is masked in log output while still allowing full log access for authorized incident responders. Which approach meets both requirements?

1. Create a Lambda function to process logs before ingestion, redacting PII patterns
2. Configure CloudWatch Logs data protection policy to mask SSN patterns, grant unmask permission to incident response IAM role
3. Encrypt logs with KMS key accessible only to incident responders
4. Create two separate log groups — one with PII (restricted) and one without (general access)

Related Posts

• Config vs CloudTrail vs CloudWatch Compared
• Security Services Architecture – GuardDuty & Security Hub
• Multi-Account Architecture
• Data Lake & Analytics Architecture
• Incident Response Architecture
• IAM Security Architecture

References

• Creating an Organization Trail — AWS Docs
• Amazon Security Lake User Guide
• Centralized Flow Log Data — AWS Security Blog
• Log Archive Account — AWS Security Reference Architecture

Frequently Asked Questions

What is the difference between CloudTrail and VPC Flow Logs?

CloudTrail logs API calls (who created/modified/deleted AWS resources). VPC Flow Logs capture network traffic metadata (source/destination IPs, ports, accepted/rejected). CloudTrail tells you “who changed the security group rule.” Flow Logs tell you “what traffic is flowing through the network.” Both are essential for security — they answer different questions.

Security Lake vs manually sending logs to S3?

Security Lake automatically collects from 80+ sources, normalizes everything to the OCSF schema (unified format), partitions data for efficient querying, and supports direct subscriber access for SIEMs. Manual S3 aggregation requires you to set up each source individually, manage different schemas, and build custom integrations. Security Lake is the managed approach for organizations with multiple log sources and SIEM requirements.

How do I protect logs from being deleted by compromised admin accounts?

Three layers: (1) Separate Log Archive account — workload account admins have no access. (2) S3 Object Lock Compliance mode — even root cannot delete until retention expires. (3) Organization trail — member accounts cannot modify or delete it. Additionally, enable log file integrity validation to detect tampering, and create EventBridge rules to alert on any StopLogging/DeleteTrail API calls.

AWS Migration Architecture — Overview

Migration to AWS follows a structured lifecycle: Assess → Mobilize → Migrate → Modernize. AWS provides purpose-built tools for each phase. Domain 4 of SAP-C02 (20% of the exam) focuses entirely on migration strategy selection, tool choice, and modernization decisions.

The 7 Rs — Migration Strategy Selection

Discovery & Assessment Tools

Exam tip: Agentless Collector = VMware only, less detailed. Discovery Agent = any OS, full detail (processes, network connections). Use Agent when you need network dependency mapping to group servers into applications.

Migration Tools — Which to Use When

Large-Scale Migration Patterns

Wave Planning

Group servers into migration waves based on dependencies and priority:

• Wave 1: Simple, independent apps (prove the process)
• Wave 2-N: Increasingly complex apps, grouped by dependency
• Final wave: Most critical/complex applications

Migration Factory

Standardized, repeatable migration process for large-scale (100+ servers):

• Playbooks — Step-by-step runbooks per application type
• Automation — CloudFormation/CDK for landing zone, MGN for replication, SSM for post-migration config
• Testing — Non-disruptive test launches from MGN before cutover
• Cutover windows — Scheduled maintenance windows with rollback plan

Zero-Downtime Server Migration (MGN)

1. Install replication agent on source servers → continuous block replication to AWS staging area
2. Test launches — Launch test EC2 instances from replicated data. Validate. Terminate test instances.
3. Cutover — Stop source server → Final sync (seconds) → Launch production EC2 → Update DNS/LB
4. Downtime — Only during final sync + DNS switch (minutes)

Data Transfer Decision Guide

Rule of thumb: If transfer over network takes >1 week, consider Snow Family. Formula: Data(TB) × 1024 × 8 / Bandwidth(Mbps) / 86400 = days.

Post-Migration Modernization Path

• Rehost first, then modernize: Get to AWS fast (lift & shift), then iteratively improve
• Database: EC2-hosted DB → RDS (managed) → Aurora Serverless (auto-scale) → DynamoDB (if key-value)
• Compute: EC2 → Containers (ECS/Fargate) → Serverless (Lambda) where appropriate
• Decouple: Monolith → Extract services using SQS/SNS/EventBridge for async communication
• Storage: Block (EBS) → Object (S3) for unstructured data, shared file (EFS/FSx) for lift-and-shift NAS

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A company needs to migrate 500 on-premises VMs to AWS with minimal downtime. They want to replicate servers continuously and perform non-disruptive test launches before the actual cutover. Which service provides this?

1. AWS DataSync with scheduled replication
2. AWS Application Migration Service (MGN) with continuous replication and test mode
3. VM Import/Export to create AMIs from each VM
4. AWS Database Migration Service with full load

Question 2:

A company has 80TB of file data on an on-premises NAS (NFS). Their internet bandwidth is 200 Mbps. They need the data in S3 within 2 weeks and want ongoing daily synchronization after the initial transfer. What approach is MOST efficient?

1. AWS DataSync over the internet for initial + ongoing sync
2. AWS Snowball Edge for initial bulk load + DataSync for ongoing daily sync
3. S3 Transfer Acceleration for initial upload + S3 replication for ongoing
4. Direct Connect provisioning + DataSync over Direct Connect

Question 3:

A company is planning migration of 1,000 servers across 50 applications. They need to understand server dependencies (which servers communicate with which) to group them into migration waves. Their infrastructure is a mix of physical servers and VMware VMs. Which discovery approach provides this information?

1. Deploy the Agentless Collector virtual appliance in VMware vCenter
2. Deploy the AWS Application Discovery Agent on each server
3. Use AWS Migration Hub import template with manually gathered data
4. Run AWS Config in the on-premises environment

Question 4:

A company runs 200 VMware VMs on-premises. Their operations team is heavily invested in VMware tools (vCenter, NSX, vSAN). They want to move to AWS quickly without retraining the team or changing their operational model. Which migration strategy and service fits?

1. Rehost — Use Application Migration Service to migrate each VM to EC2
2. Relocate — Use VMware Cloud on AWS with HCX for live migration
3. Replatform — Convert VMs to containers on ECS Fargate
4. Refactor — Rebuild applications as serverless on Lambda

Question 5:

After migrating a monolithic web application to EC2 (rehost), a company wants to modernize it incrementally. The application has a tightly coupled order processing module that causes cascading failures. What is the recommended FIRST modernization step?

1. Rewrite the entire application as Lambda functions
2. Extract the order processing module into a separate service, decouple with SQS
3. Move the entire application to EKS with microservices
4. Replace the application with a SaaS solution

Related Posts

• AWS DMS – Database Migration Service, CDC & Replication
• Database Migration Architecture (DMS & SCT)
• Hybrid Cloud Networking
• Multi-Account Architecture (Landing Zone)
• Container Platform Architecture
• Serverless API Architecture

References

• Large Migration Guide — AWS Prescriptive Guidance
• 6 Strategies for Migrating to the Cloud — AWS Blog
• Application Migration Service User Guide
• Automating Large-Scale Migrations with Migration Hub — AWS Blog

Frequently Asked Questions

What is the difference between Application Migration Service and DMS?

Application Migration Service (MGN) migrates entire servers (OS, applications, data) by replicating block storage — the result is an EC2 instance running the same workload. DMS migrates only database data between database engines with optional schema conversion. Use MGN for server migration (lift-and-shift). Use DMS for database-specific migration with schema conversion or engine change.

When should I use Snowball vs DataSync?

Use DataSync when your network can transfer the data within your timeframe (typically <10TB or adequate bandwidth). Use Snowball when network transfer would take too long (>1 week at available bandwidth) or when you have 10TB+ with limited connectivity. The break-even point depends on your bandwidth — calculate transfer time first.

How do I start a migration to AWS?

Follow the migration lifecycle: (1) Assess — Deploy Discovery Agent/Agentless Collector, gather data in Migration Hub, evaluate TCO with Migration Evaluator. (2) Decide strategy — Apply 7Rs per application (most will be Rehost initially). (3) Set up landing zone — Control Tower for multi-account, networking, security baseline. (4) Pilot — Migrate 2-3 simple apps to validate process. (5) Scale — Migration Factory for remaining waves.