2.3 Security Controls (New Solutions)
Official task mapping
SAP-C02 task 2.3: Network, identity and encryption knowledge; least-privilege and attack mitigation design. This lesson applies the official task to an original design exercise; it is not an exhaustive exam syllabus.
Prerequisites
Review IAM, private access and Secrets Manager. Be able to explain the relevant failure boundary and access/cost model before choosing a service.
Controls by boundary
Authenticate human users separately from workload identities. Use roles instead of embedded keys, scope resource access and store application credentials in a suitable secret-management service. Rotation must update and test the backend credential as well as the secret value.
VPC endpoints provide supported private service paths; gateway endpoints serve S3/DynamoDB, while interface endpoints have per-service support, security groups, DNS and charges. Endpoint policies complement, not replace, identity/resource policies. A private endpoint does not automatically make application requests authorized.
WAF filters supported application-layer traffic. Its supported associations extend beyond ALB/CloudFront, including appropriate API Gateway and AppSync resources. Shield addresses DDoS protection; neither replaces application authentication, least privilege or secure patching. Cognito user pools provide application user authentication, whereas identity pools can broker AWS credentials.
Endpoint and authentication comparison
| Endpoint | Connectivity | Cost/access limits |
|---|---|---|
| Gateway | Supported S3/DynamoDB route-table path | No endpoint fee; not transitive on-prem VPN/DX access |
| Interface | Supported PrivateLink service endpoints | AZ-hours/GB; DNS, SG and endpoint policy |
| Public service endpoint | Authorized internet/public AWS path | Network reachability is not identity authorization |
For on-premises private S3 access, evaluate supported interface endpoints and DNS or an explicitly designed proxy; do not assume a VPC gateway endpoint is reachable transitively. Interface endpoints require supported service/Region and private DNS decisions.
Shield Standard supplies baseline supported DDoS protection; Advanced has subscription/support/protection eligibility and cost-protection conditions. Do not promise automatic refunds for every scaling charge. Check current subscription pricing and eligibility rather than assuming one universal monthly amount.
Cognito user pools authenticate application users and issue tokens. Identity pools can exchange supported identities for scoped temporary AWS credentials. API authorization still needs correctly validated claims, scopes and resource permissions; the shorthand “user pool authentication, identity pool all authorization” hides important controls.
Access Analyzer can help identify external/internal/unused access under its analyzer types. A permissions boundary helps delegate identity creation within limits; it does not grant the developer every action up to that boundary. Review successful and denied examples at the API, endpoint, resource and KMS layers.
Scenario and rationale
A healthcare API serves external users while its processors access an encrypted private database. Authenticate users at the API, restrict backend roles and database connectivity, manage credentials with tested rotation, and log access without patient data in plaintext. Choose WAF/rate controls at a supported ingress and privately route eligible AWS dependencies.
Reject putting database passwords in Lambda environment configuration as the entire rotation strategy. Reject a permissive endpoint policy on the theory that “private means trusted.” Reject opening every database port to the VPC CIDR when specific source identities/groups can suffice.
Practice drill
Build a threat/control matrix for stolen user tokens, leaked workload credentials, injection, network exposure and unpatched instances. Trace an authorized request and three denied requests across identity, endpoint, key and network policies. Record operational owners, rotation failure alerts and patch windows before any sandbox test.
References
- Official Domain 2 task guide
- VPC endpoint policy limits
- WAF supported resources
- Secret rotation workflow
Return to Domain 2. The drill is proposed study work, not a claim of a completed deployment.