SCS-C03 — AWS Certified Security – Specialty Cheat Sheet

Scenario Decoder

    flowchart TD
	    A[Security scenario] --> B{Need prevention, detection, or response?}
	    B -->|Prevention| C{Identity, network, or data?}
	    C -->|Identity| D[IAM policy, SCP, boundary, resource policy]
	    C -->|Network| E[SG, NACL, WAF, Network Firewall, endpoint]
	    C -->|Data| F[KMS, S3 controls, Secrets Manager, Macie]
	    B -->|Detection| G{What signal?}
	    G -->|API| H[CloudTrail]
	    G -->|Config drift| I[AWS Config]
	    G -->|Threat finding| J[GuardDuty / Inspector / Macie]
	    B -->|Response| K[EventBridge, Lambda, SSM, isolation, key rotation]

This page is IT Mastery exam-prep support. It is not affiliated with AWS and does not replace the official exam guide, AWS documentation, or hands-on practice.

1. Read the decision rules first. The exam often tests which AWS security service or control best fits a scenario.
2. Review the traps. Many wrong answers are plausible but fail because they are too broad, too manual, not centralized, or do not meet least-privilege requirements.
3. Practice immediately afterward. Use original practice questions and topic drills to test whether you can apply the rules under exam-style pressure.
4. Read explanations carefully. For SCS-C03, the explanation is often more valuable than the score because it exposes AWS service boundaries.

IAM Evaluation Essentials

Which IAM Mechanism Should You Choose?

Condition Keys Worth Recognizing

IAM policy evaluation: know the order conceptually

For exam questions, remember the practical rule:

An explicit deny wins. Otherwise, access requires an applicable allow, and all applicable guardrails must permit the action.

Relevant policy types may include:

IAM decision rules

Common IAM traps

• SCPs do not grant permissions. They only set maximum permissions for accounts or organizational units.
• Permissions boundaries do not grant permissions. They limit what identity policies can grant.
• Resource policies can allow cross-account access, but the principal side may also need permission depending on the service and scenario.
• KMS access is special. Having S3 or EBS permissions is not enough if the data is encrypted with a KMS key the principal cannot use.
• iam:PassRole is high risk. If a user can pass a powerful role to a service they can control, they may indirectly escalate.
• Avoid long-term access keys for workloads. Prefer roles and temporary credentials.
• Do not solve least privilege with AdministratorAccess. Exam scenarios often include a clue requiring narrowly scoped permissions.

KMS Policy and Access Model

Envelope Encryption

High-yield point: KMS commonly does not encrypt large payloads directly. AWS services request data keys, encrypt data locally, and store the encrypted data key with the ciphertext.

S3 Encryption Choices

KMS Key Policy Pattern

Use kms:ViaService when the key should be used only through a specific AWS service.

{
  "Sid": "AllowAppRoleUseThroughS3",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:role/AppRole"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "s3.us-east-1.amazonaws.com"
    }
  }
}

S3 Bucket Policy Snippets

Require HTTPS:

{
  "Sid": "DenyInsecureTransport",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  }
}

Require SSE-KMS on object upload:

{
  "Sid": "DenyUploadsWithoutSSEKMS",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::example-bucket/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "aws:kms"
    }
  }
}

Restrict bucket access to a VPC endpoint:

{
  "Sid": "DenyAccessOutsideExpectedEndpoint",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "StringNotEquals": {
      "aws:SourceVpce": "vpce-0123456789abcdef0"
    }
  }
}

Secrets and Parameter Storage

AWS KMS essentials

AWS Key Management Service is a frequent SCS-C03 focus. Know the difference between who can administer a key, who can use a key, and which service uses the key on behalf of a principal.

KMS policy decision points

Envelope encryption concept

The application stores the encrypted data and encrypted data key. To decrypt, it asks KMS to decrypt the encrypted data key, subject to KMS permissions and key policy.

S3 data protection

Database and storage encryption

Secrets management

Data protection traps

• Encryption does not equal authorization. You still need IAM, resource policies, and network controls.
• SSE-S3 and SSE-KMS have different control and audit implications.
• KMS key policy can block otherwise valid IAM permissions.
• Cross-account encrypted access often fails because the KMS key policy was forgotten.
• Secrets Manager is usually the better answer when automatic rotation is required.
• Do not expose S3 buckets publicly to serve private content. Use CloudFront access controls and signed URLs/cookies when appropriate.

Security Group vs NACL

VPC Endpoint Choices

Common Network Architectures

VPC security controls

Security group vs NACL

Public, private, and isolated subnet review

VPC endpoint decision rules

Edge and application protection

Infrastructure traps

• A private subnet is not private just because of its name. Routes determine reachability.
• Security groups are stateful; NACLs are stateless. Many exam questions hinge on return traffic.
• NAT gateway is outbound-focused. It is not a secure inbound access method.
• Use Systems Manager Session Manager instead of public bastion hosts when the scenario emphasizes reduced exposure and auditability.
• VPC endpoints can need multiple policy layers. Endpoint policy, IAM policy, resource policy, and KMS key policy may all matter.
• WAF is Layer 7. It inspects HTTP/S request attributes, not arbitrary TCP payloads.

Detection Service Selection

CloudTrail High-Yield Points

Core logging services

CloudTrail review

Detection service distinctions

Alerting and response pattern

    flowchart LR
	    A[Security event or finding] --> B[EventBridge rule]
	    B --> C{Type of issue}
	    C -->|Known safe remediation| D[Lambda or SSM Automation]
	    C -->|Needs approval| E[Ticket / notification / manual review]
	    C -->|Incident severity high| F[Containment playbook]
	    D --> G[Log result and notify]
	    E --> G
	    F --> G

Common monitoring traps

• CloudTrail is not a network packet capture tool.
• VPC Flow Logs do not show payload contents.
• GuardDuty findings are detective, not preventive. Pair with EventBridge and remediation if the scenario requires automated response.
• Security Hub aggregates and normalizes findings. It does not replace the services that generate specialized findings.
• AWS Config records configuration state and changes. It is not a complete audit log for every API call.
• CloudWatch alarms need metrics. Logs may need metric filters or embedded metrics before alarming.

Compromised EC2 Instance

Suspicious S3 Public Exposure

Ransomware or Destructive Deletion Risk

Incident response priorities

For AWS security scenarios, prefer responses that preserve evidence, contain impact, and automate repeatable steps.

EC2 containment pattern

    flowchart TD
	    A[Potentially compromised EC2 instance] --> B[Do not terminate immediately]
	    B --> C[Attach restrictive isolation security group]
	    C --> D[Preserve evidence: snapshots, logs, metadata]
	    D --> E[Investigate from forensic account or isolated environment]
	    E --> F[Eradicate, rebuild from trusted image, rotate credentials]
	    F --> G[Document lessons and automate controls]

Incident response traps

• Do not terminate first if evidence is required. Snapshot and isolate.
• Do not log in and change the compromised host casually. You may alter evidence.
• Do not reuse compromised credentials. Rotate secrets and keys.
• Containment should reduce blast radius quickly. Security group isolation is a common answer for EC2.
• Use EventBridge for automated response. For known findings, automated containment or notification is often expected.
• Rebuild from known-good artifacts. Do not simply “clean” a compromised instance and return it to service without confidence.

SCP Patterns

High-yield trap: an SCP attached to an OU can make an administrator appear “broken” even when IAM policies allow the action. Check SCPs when an allowed IAM principal still receives AccessDenied.

AWS Organizations and multi-account security

Multi-account design is central to AWS security. The exam often expects you to isolate workloads, centralize logging, and apply guardrails consistently.

Organization-level traps

• Do not put logs in the same account as the workload only. Central log accounts reduce tampering risk.
• Do not rely on SCPs for resource-level detail if an IAM policy or resource policy is the better control.
• Do not forget delegated administrators. Many AWS security services can be managed centrally across accounts.
• Use separate accounts to reduce blast radius. VPC separation alone is not always enough.

Lambda

Containers

Compute identity patterns

Lambda security review

Container security review

CI/CD security traps

• Deployment roles should be scoped. Avoid giving pipelines unrestricted administrator access.
• Secrets should not be stored in source control or plaintext build logs.
• Artifact integrity matters. Use trusted repositories, signing/verification where appropriate.
• Separate build, deploy, and runtime permissions.
• Use temporary credentials for automation whenever possible.

Fast final review checklist

Before practice, make sure you can answer these without notes:

• What is the difference between identity-based policies, resource-based policies, SCPs, and permissions boundaries?
• Why does an explicit deny override an allow?
• When does a cross-account role need a trust policy?
• Why is iam:PassRole sensitive?
• What is the difference between CloudTrail, CloudWatch, Config, and VPC Flow Logs?
• Which service detects suspicious account or workload behavior?
• Which service aggregates security findings?
• Which service scans for vulnerabilities?
• Which service discovers sensitive data in S3?
• How do you secure S3 against public access?
• What extra permission is needed to read KMS-encrypted data?
• How do VPC gateway endpoints and interface endpoints differ?
• Why are security groups stateful and NACLs stateless?
• What should you do first with a compromised EC2 instance when evidence matters?
• Which services help enforce security centrally across multiple AWS accounts?
• How do you avoid long-term credentials for applications?
• When should you choose Secrets Manager over Parameter Store?
• How do WAF, Shield, Network Firewall, and security groups differ?
• What logs would you inspect for suspected S3 data exfiltration?
• How would you build an automated response to a GuardDuty finding?

Least-privilege review checklist

• Scope Action to required API calls.
• Scope Resource to specific ARNs when the service supports it.
• Add Condition keys for context, such as MFA, tags, network path, encryption, or organization.
• Avoid wildcard administrative permissions.
• Separate human, workload, and break-glass access.
• Review unused permissions with access analysis tools.
• Protect policy editing permissions because they can become privilege escalation paths.

Overlooking policy intersections

A principal may need several permissions to complete one operation.

Example: reading an encrypted S3 object may require:

• S3 permission to read the object.
• Bucket policy that does not deny access.
• KMS permission to decrypt using the key.
• KMS key policy that allows or delegates that access.
• Network or endpoint policy that permits the request path.
• No applicable SCP or permissions boundary blocking the action.

Missing the “centralized” clue

If a scenario says “multiple accounts,” “organization-wide,” “central security team,” or “consistent enforcement,” consider:

• AWS Organizations.
• SCPs.
• Delegated administrator.
• Security Hub aggregation.
• GuardDuty organization configuration.
• AWS Config aggregator.
• Firewall Manager.
• Centralized logging account.

Missing the “automated” clue

If the requirement says “automatically remediate,” “near real time,” or “without manual intervention,” consider:

• EventBridge rule.
• Lambda remediation.
• Systems Manager Automation.
• AWS Config remediation.
• Security Hub custom actions or automation patterns.
• Step Functions for multi-step workflows.