AWS Security Specialty Foundations
A structured AWS Security Specialty course covering threat detection, logging, infrastructure security, IAM, data protection, and governance, with linked practice questions.
Course progress
0 / 5
Back to courses
What you will learn
- Describe threat detection and incident response.
- Explain security logging and monitoring.
- Describe infrastructure security.
- Explain IAM and data protection.
- Describe governance and compliance.
Before you start
- Basic AWS knowledge is helpful.
- Some security fundamentals are recommended.
- No previous security certification is required.
Lesson 1 Security Foundations and Threat Detection
The AWS Certified Security - Specialty exam validates skills for securing AWS workloads, detecting threats, responding to incidents, and meeting compliance requirements. The exam covers threat detection and incident response, security logging and monitoring, infrastructure security, identity and access management, data protection, and management and governance. Amazon GuardDuty continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to detect threats such as compromised instances and cryptocurrency mining. AWS Security Hub aggregates findings across accounts, while Amazon Inspector scans EC2 instances and container images for vulnerabilities. AWS WAF filters web traffic and AWS Shield protects against DDoS attacks. Incident response should start with evidence preservation and containment, then analysis and recovery. This course connects every domain to original practice questions.
Example
Example: GuardDuty flags unusual outbound traffic from an EC2 instance, and Security Hub shows the finding alongside other account issues.Lesson 2 Logging and Monitoring
Security logging and monitoring give you visibility into AWS activity. AWS CloudTrail records API calls for auditing and can enable log file validation to detect tampering. An organization trail delivers events from all accounts to a central S3 bucket. VPC Flow Logs capture metadata about network traffic so you can analyze connections and identify suspicious flows. CloudWatch Logs stores application and operating system logs, and the CloudWatch agent collects them from EC2 instances. Metric filters turn log patterns into metrics, and CloudWatch Alarms trigger notifications when thresholds are crossed. CloudWatch Logs Insights lets you query log data interactively. Effective monitoring combines CloudTrail, Flow Logs, and CloudWatch so you can reconstruct activity, correlate events, and respond quickly to anomalies.
Example
Example: A metric filter watches for failed console logins, and a CloudWatch Alarm sends an SNS message after five failures.Lesson 3 Infrastructure Security
Infrastructure security protects the network and compute layer of AWS. Security groups are stateful instance-level firewalls with allow-only rules, while network ACLs are stateless subnet-level filters with allow and deny rules. AWS Network Firewall adds managed stateful filtering at the VPC level, and AWS WAF protects web applications. AWS PrivateLink provides private connectivity to services without crossing the internet. Transit Gateway connects many VPCs and on-premises networks through a central hub, and Site-to-Site VPN creates encrypted tunnels. Bastion hosts provide hardened administrative entry points, while Systems Manager Session Manager lets you manage instances without public SSH ports. AWS Organizations applies service control policies across accounts, and AWS Shield defends against DDoS. Designing defense in depth means combining network controls, host controls, and account governance.
Example
Example: A security group allows HTTPS from the internet, while a NACL blocks a specific suspicious subnet from reaching the database subnet.Lesson 4 IAM and Data Protection
Identity and access management controls who can do what in AWS. IAM users represent people or applications, IAM roles are identities that principals assume, and IAM policies are JSON documents that define permissions. AWS STS issues temporary credentials for roles and federated access. Trust policies define who can assume a role, and permission boundaries limit maximum permissions. Least privilege means granting only necessary actions. IAM Identity Center provides centralized workforce identity and single sign-on. MFA should be enabled for the root user and privileged roles, and conditions such as aws:MultiFactorAuthPresent can enforce it. Data protection uses AWS KMS for encryption keys, Secrets Manager for rotating secrets, ACM for SSL/TLS certificates, and CloudHSM for dedicated hardware security modules. Envelope encryption wraps data keys with master keys, TLS protects data in transit, and S3 Object Lock prevents deletion.
Example
Example: An EC2 instance assumes an IAM role with limited S3 permissions, and Secrets Manager rotates the database password automatically.Lesson 5 Governance and Compliance
Governance and compliance help organizations demonstrate secure and auditable AWS usage. AWS Organizations manages accounts and applies service control policies that limit the services and actions available in member accounts. AWS Config records resource configurations, evaluates rules, and can run remediation actions; conformance packs bundle rules for frameworks such as PCI DSS. AWS Security Hub gives a consolidated security and compliance dashboard. AWS Artifact provides compliance reports and agreements on demand. Trusted Advisor reviews accounts and gives recommendations for security, cost, performance, and reliability. Data governance includes encryption at rest with KMS, encryption in transit with TLS, access controls with IAM, and data residency decisions. A strong governance model defines guardrails, monitors drift, and produces evidence for auditors.