SCS-C03 — AWS Certified Security – Specialty Quick Reference

How to Use This Quick Reference

This independent Quick Reference supports preparation for the AWS Certified Security – Specialty (SCS-C03) exam. Use it to make fast decisions in scenario questions: which AWS control fits the requirement, where the control is enforced, and what common distractor looks similar but is wrong.

Scenario Decoder

    flowchart TD
	    A[Security scenario] --> B{Need prevention, detection, or response?}
	    B -->|Prevention| C{Identity, network, or data?}
	    C -->|Identity| D[IAM policy, SCP, boundary, resource policy]
	    C -->|Network| E[SG, NACL, WAF, Network Firewall, endpoint]
	    C -->|Data| F[KMS, S3 controls, Secrets Manager, Macie]
	    B -->|Detection| G{What signal?}
	    G -->|API| H[CloudTrail]
	    G -->|Config drift| I[AWS Config]
	    G -->|Threat finding| J[GuardDuty / Inspector / Macie]
	    B -->|Response| K[EventBridge, Lambda, SSM, isolation, key rotation]

Identity and Access Management

Policy Type Decision Table

IAM Evaluation Essentials

Which IAM Mechanism Should You Choose?

Condition Keys Worth Recognizing

KMS, Encryption, and Key Management

AWS KMS Decision Table

KMS Policy and Access Model

Envelope Encryption

High-yield point: KMS commonly does not encrypt large payloads directly. AWS services request data keys, encrypt data locally, and store the encrypted data key with the ciphertext.

S3 Encryption Choices

KMS Key Policy Pattern

Use kms:ViaService when the key should be used only through a specific AWS service.

{
  "Sid": "AllowAppRoleUseThroughS3",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:role/AppRole"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "s3.us-east-1.amazonaws.com"
    }
  }
}

Data Protection and Secrets

S3 Security Controls

S3 Bucket Policy Snippets

Require HTTPS:

{
  "Sid": "DenyInsecureTransport",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "Bool": {
      "aws:SecureTransport": "false"
    }
  }
}

Require SSE-KMS on object upload:

{
  "Sid": "DenyUploadsWithoutSSEKMS",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::example-bucket/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "aws:kms"
    }
  }
}

Restrict bucket access to a VPC endpoint:

{
  "Sid": "DenyAccessOutsideExpectedEndpoint",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "StringNotEquals": {
      "aws:SourceVpce": "vpce-0123456789abcdef0"
    }
  }
}

Secrets and Parameter Storage

Network and Infrastructure Security

Control Selection Matrix

Security Group vs NACL

VPC Endpoint Choices

Common Network Architectures

Logging, Monitoring, and Detection

Logging Source Selection

Detection Service Selection

CloudTrail High-Yield Points

Incident Response Playbooks

Compromised IAM Access Key

Compromised EC2 Instance

Suspicious S3 Public Exposure

Ransomware or Destructive Deletion Risk

Governance and Multi-Account Security

Organizations and Account Controls

SCP Patterns

High-yield trap: an SCP attached to an OU can make an administrator appear “broken” even when IAM policies allow the action. Check SCPs when an allowed IAM principal still receives AccessDenied.

Application and Compute Security

EC2

Lambda

Containers

Confused Deputy and Cross-Service Access

Confused Deputy Pattern

Use both source ARN and source account when allowing an AWS service principal to access your resource.

{
  "Sid": "AllowEventBridgeFromExpectedRule",
  "Effect": "Allow",
  "Principal": {
    "Service": "events.amazonaws.com"
  },
  "Action": "sns:Publish",
  "Resource": "arn:aws:sns:us-east-1:111122223333:security-topic",
  "Condition": {
    "ArnEquals": {
      "aws:SourceArn": "arn:aws:events:us-east-1:111122223333:rule/security-rule"
    },
    "StringEquals": {
      "aws:SourceAccount": "111122223333"
    }
  }
}

Cross-Account Access Checklist

Common SCS-C03 Traps

Fast Review Checklist

Before exam day, be able to answer these without hesitation:

• Which policy type grants access, and which only limits access?
• When does a cross-account request need both identity-side and resource-side permission?
• Why does KMS require key policy analysis in addition to IAM?
• Which service detects API activity, config drift, vulnerabilities, sensitive S3 data, and threats?
• When do you choose WAF, Network Firewall, security groups, NACLs, or DNS Firewall?
• How do you enforce private S3 access through a VPC endpoint?
• How do you prevent service confused deputy risk?
• What is the safe sequence for compromised IAM keys and EC2 instances?
• Which service centralizes findings, and which service investigates them?
• Which controls are preventive, detective, and responsive in a multi-account AWS environment?

Next Step

Use this Quick Reference as a decision checklist while practicing mixed AWS Certified Security – Specialty (SCS-C03) scenarios. For each missed question, classify the miss as IAM/policy evaluation, KMS/encryption, logging/detection, network control selection, governance, or incident response, then revisit the matching table above before continuing with more original practice questions.