Step 5 — Security, Monitoring & Architecture

This final step covers the layers that protect, observe, and govern your AWS workloads — plus the architectural patterns that tie everything together. Security and the Well-Architected Framework appear throughout the entire exam, not just in their dedicated domains.

AWS Security Services

KMS — Key Management Service

KMS manages encryption keys used to protect data across AWS services. It’s the answer to almost every “how do you encrypt data at rest?” exam question.

Customer Managed Keys (CMK)
  ├── You create and manage the key
  ├── Full audit trail in CloudTrail
  ├── Rotate automatically once per year
  └── ~$1/month per key + $0.03/10,000 API calls

AWS Managed Keys
  ├── Created by AWS on your behalf (e.g., "aws/s3", "aws/rds")
  ├── Cannot use directly — only via integrated services
  └── Free, rotated every year automatically

AWS Owned Keys
  └── Fully controlled by AWS. You have no visibility. Free.

Envelope Encryption — The pattern KMS uses:

1. Generate a Data Encryption Key (DEK) from KMS
2. Use DEK to encrypt your data (fast, local)
3. KMS encrypts the DEK with your CMK (key-encrypting-key)
4. Store encrypted DEK alongside encrypted data
5. To decrypt: KMS decrypts the DEK, then DEK decrypts the data

This way KMS never sees your raw data. Only the small DEK passes through KMS.

KMS Multi-Region Keys — Replicate a key to secondary regions. Decryption in region B works with ciphertext encrypted in region A. Used for global Aurora databases and cross-region data compliance.

Secrets Manager vs SSM Parameter Store

Secrets Manager                       │  SSM Parameter Store
──────────────────────────────────────┼──────────────────────────────────────
Specifically for secrets              │  General config + secrets
Auto-rotation built-in (RDS, Redshift)│  Rotation via Lambda (manual setup)
~$0.40/secret/month                   │  Free (Standard); $0.05/advanced
Cross-account access via resource     │  Limited cross-account
Better for database credentials       │  Better for non-secret config

Exam pattern: “RDS credentials need to rotate automatically” → Secrets Manager. “Store EC2 configuration values” → SSM Parameter Store.

WAF, Shield, and GuardDuty

AWS WAF (Web Application Firewall) — Filters HTTP/HTTPS traffic based on rules: block SQL injection, XSS, specific IPs, geo locations, rate limits. Deploys in front of ALB, API Gateway, or CloudFront.

AWS Shield

• Standard (free, automatic) — Protects against most common Layer 3/4 DDoS attacks
• Advanced ($3,000/month) — 24/7 DRT support, cost protection, enhanced detection, protects ALB/EC2/CloudFront/Route 53

Amazon GuardDuty — Threat detection service. Analyzes CloudTrail logs, VPC Flow Logs, DNS logs for suspicious patterns (crypto mining, credential theft, unusual API calls). No agents required. Findings sent to EventBridge.

Amazon Inspector — Automated vulnerability scanning for EC2 instances and container images (ECR). Scans for CVEs, network reachability issues. Integrates with Security Hub.

Amazon Macie — Uses ML to discover and protect sensitive data in S3 (PII, financial data, credentials). Sends findings to Security Hub and EventBridge.

IAM Advanced Concepts

Permission Boundaries — Maximum permissions a user or role can have, regardless of what their policies allow. Use to delegate administration: “Allow a developer to create IAM roles, but only with permissions that don’t exceed X.”

Service Control Policies (SCPs) — Applied at the AWS Organizations account or OU level. Cap maximum permissions for all principals in that account. Even the root user is subject to SCPs.

IAM Access Analyzer — Identifies resources (S3 buckets, IAM roles, KMS keys) that are accessible from outside your account or organization. Run before every production deployment.

ABAC (Attribute-Based Access Control) — Tag-based permissions: “Allow EC2 actions if the resource tag Project matches the user’s tag Project.” Scales better than RBAC for large teams.

CloudWatch — Observability

CloudWatch is the unified monitoring platform for AWS. It covers metrics, logs, alarms, dashboards, and synthetic monitoring.

CloudWatch Metrics

Every AWS service publishes metrics automatically (EC2 CPU, RDS connections, Lambda errors). Key details:

• Default EC2 metrics: every 5 minutes
• Detailed Monitoring (opt-in): every 1 minute, adds to cost
• Custom Metrics — Push your own application metrics via SDK. Standard resolution (1 min) or High Resolution (1 second, extra cost)

CloudWatch Alarms

Metric ──► Alarm Threshold ──► State Change ──► Action
                                    │
                         ├── OK (metric within threshold)
                         ├── ALARM (metric breached threshold)
                         └── INSUFFICIENT_DATA (not enough data)

Actions:
  ├── SNS notification (email, SMS, Lambda trigger)
  ├── Auto Scaling action (add/remove instances)
  └── EC2 action (stop, terminate, reboot)

Composite Alarms — Combine multiple alarms with AND/OR logic. Suppress alarm noise: “only alert if CPU > 80% AND disk > 90%.”

CloudWatch Logs

Collect, store, and search log data from any source:

Log Group (e.g., /aws/lambda/my-function)
  └── Log Streams (one per function instance or EC2 instance)
          └── Log Events (individual log lines with timestamp)

Log Insights — SQL-like query language to analyze logs. Search across multiple log groups in a single query.

Subscription Filters — Stream log data in real-time to Kinesis Data Streams, Kinesis Firehose, or Lambda for processing/archiving.

Metric Filters — Extract numeric values from log lines and turn them into CloudWatch metrics. Example: count “ERROR” occurrences per minute → alarm when > 5.

Log Retention — Default: never expires. Set explicit retention (7 days to 10 years) to control cost. Logs that expire are automatically deleted.

CloudTrail — Audit and Compliance

CloudTrail records every API call made in your AWS account — who did what, from where, and when.

API Call: "alice@company.com deleted S3 bucket my-bucket at 14:32:07 UTC from IP 203.0.113.5"
             │                                                                │
         CloudTrail Management Event                                       Recorded in
                                                                      CloudTrail Event History
                                                                      (90-day free retention)
                                                                      CloudTrail Trail → S3 bucket
                                                                      (unlimited, you pay for S3)

Trail Types

Management Events — Control plane operations (create/delete/modify resources). Logged by default. Free for first copy.

Data Events — Data plane operations (S3 object-level: GetObject, PutObject; Lambda invocations). Must be explicitly enabled. Additional cost.

Insights Events — Automatically detects unusual write API activity. Alerts when call rates deviate from baseline.

CloudTrail Lake — Managed audit log storage with SQL query capability. Retention up to 7 years. Replaces the old pattern of CloudTrail → S3 → Athena.

Multi-Region Trail — A single trail that captures events from all regions. Best practice for compliance. Enable “Include global service events” to capture IAM, STS, CloudFront events (which always log to us-east-1).

Cost Optimization Deep Dive

EC2 Cost Strategies

On-Demand          Best for: unpredictable, short-term workloads. No discount.
Reserved Instances Best for: steady-state 24/7 workloads. 30–60% savings.
Savings Plans      Best for: flexible compute across EC2/Fargate/Lambda. 20–66% savings.
Spot Instances     Best for: fault-tolerant batch/ML. Up to 90% savings.

Rightsizing — Use Compute Optimizer (free) to identify oversized instances. A t3.large running at 5% CPU average is burning money. Rightsizing alone typically saves 20–30% of EC2 costs.

Cost Allocation Tags — Tag resources with Project, Team, Environment. Enable cost allocation tags in the Billing console. Then filter Cost Explorer by tag to see which team is spending what.

AWS Budgets — Set budgets for cost, usage, reservations, or Savings Plans. Alert via email or SNS when forecasted spend exceeds threshold.

Trusted Advisor — Automated checks across cost optimization, security, fault tolerance, performance, service limits. Free tier has 7 checks; Business/Enterprise support unlocks all 115+.

Data Transfer Costs (Often Overlooked)

Inbound to AWS:               FREE
Within same AZ (same region): FREE (between EC2 and other services)
Between AZs (same region):    $0.01/GB each direction
Between Regions:              $0.02–0.09/GB
To the internet:              $0.09/GB (first 10 TB/month)

Design implication: If your application has high cross-AZ data transfer, consolidating hot data access within one AZ can save meaningfully. EFS, S3, and managed services are regional by design and don’t incur AZ-crossing costs.

Well-Architected Framework — Design Patterns

The Well-Architected Framework provides architectural best practices across six pillars. The exam maps many questions directly to these principles.

Reliability Design Patterns

Multi-AZ Everything — RDS Multi-AZ, ALB spanning AZs, ASG across subnets in multiple AZs. Single-AZ is a single point of failure.

Circuit Breaker — If downstream service fails, stop calling it temporarily. Prevents cascading failures. Implemented via Application Load Balancer health checks or service mesh.

Bulkhead — Isolate resources to prevent one failing component from consuming all capacity. Separate thread pools, separate queues, separate Lambda concurrency reservations per function.

Performance Efficiency Patterns

Caching Architecture:

User ──► CloudFront ──► API Gateway ──► Lambda ──► ElastiCache ──► RDS
          (CDN cache)   (API cache)                 (data cache)    (source of truth)

Each cache layer reduces calls to the next, expensive layer.

Serverless First — Lambda + DynamoDB scales from 0 to millions of requests automatically. No idle EC2 costs. Default choice for event-driven, API, and scheduled workloads.

Security Design Patterns

Defence in Depth:

Internet ──► WAF ──► CloudFront ──► ALB (Security Group) ──► EC2 (Security Group)
                                                               └── Private Subnet
                                                                   (NACL, No IGW)
                                                                   └── RDS (Security Group)

Zero Trust Networking — Never trust, always verify. Use IAM roles for service-to-service auth. Use VPC endpoints to keep traffic off the public internet. Enable PrivateLink for SaaS integrations.

Operational Excellence Patterns

Infrastructure as Code — CloudFormation or CDK. Every resource created in console manually is a risk. Reproducible, version-controlled infrastructure is a first-class exam answer for “how to manage environments consistently.”

Runbooks as Lambda Functions — Automate operational tasks (rotate keys, restart failed services, clear cache) via Lambda triggered by CloudWatch alarms. Reduces mean time to resolution (MTTR).

Cost Optimization Patterns

Serverless for Bursty Workloads — Lambda is free at zero load; EC2 isn’t. Match billing model to workload shape.

S3 Intelligent-Tiering + Lifecycle — Let AWS manage storage class transitions instead of manually predicting access patterns.

Spot + On-Demand Hybrid ASG — Base capacity on On-Demand Reserved Instances, overflow on Spot. This architecture achieves 50–70% cost reduction vs all-on-demand at high scale.

SAA-C03 Exam Summary: The Pattern Library

The SAA-C03 exam is a pattern recognition test. Here are the most frequently tested mappings:

Study these patterns until you can answer in under 10 seconds. That’s the pace the exam requires.