CloudPath Academy

Your guide to AWS certification success

Amazon Web Services AWS Broken Labs

AWS Certified Solutions Architect Associate (SAA-C03) Domain 1

Design Secure Architectures

Official Exam Guide: SAA-C03 Exam Guide
Skill Builder: Solutions Architect Learning Plan

Domain Overview

Domain Weight: 30% of the exam (largest domain)

This domain tests your ability to design secure access to AWS resources, secure application architectures, and implement appropriate security controls.

Task 1.1: Design secure access to AWS resources

Identity and Access Management (IAM)

IAM Users, Groups, and Roles

Key Concepts:

Best Practices:

Common Scenarios:

AWS Documentation:

Federated Access

Key Concepts:

Use Cases:

AWS Documentation:

Multi-Factor Authentication (MFA)

Key Concepts:

Implementation:

Task 1.2: Design secure application tiers

Network Security

VPC Security

Key Components:

Security Groups vs NACLs:

Feature Security Groups Network ACLs
Level Instance Subnet
State Stateful Stateless
Rules Allow only Allow and Deny
Evaluation All rules Rules in order
Default Deny all Allow all

Best Practices:

AWS Documentation:

VPC Endpoints

Types:

Use Cases:

AWS Documentation:

Application Security

AWS WAF (Web Application Firewall)

Key Features:

Integration:

AWS Documentation:

AWS Shield

Protection Levels:

AWS Documentation:

Task 1.3: Select appropriate data security options

Encryption

Encryption at Rest

S3 Encryption:

EBS Encryption:

RDS Encryption:

Best Practices:

AWS Documentation:

Encryption in Transit

Key Technologies:

Implementation:

AWS Documentation:

AWS Key Management Service (KMS)

Key Concepts:

Use Cases:

AWS Documentation:

AWS Secrets Manager

Key Features:

vs Systems Manager Parameter Store:

AWS Documentation:

Data Protection

S3 Security

Access Control:

Additional Security:

Best Practices:

AWS Documentation:

Database Security

RDS Security:

DynamoDB Security:

AWS Documentation:

Monitoring and Compliance

AWS CloudTrail

Key Features:

Best Practices:

AWS Documentation:

Amazon GuardDuty

Key Features:

AWS Documentation:

AWS Config

Key Features:

AWS Documentation:

Common Security Architectures

Three-Tier Web Application

Architecture:

Internet → ALB (public subnet)
         ↓
      Web Tier (private subnet with NAT)
         ↓
      App Tier (private subnet)
         ↓
       DB Tier (private subnet, Multi-AZ RDS)

Security Measures:

Secure S3 Data Lake

Architecture:

Exam Tips

Common Question Patterns:

  1. “Most secure way to…“ → Usually involves encryption, least privilege, and isolation
  2. “EC2 needs to access S3…“ → Use IAM role, not access keys
  3. “Prevent accidental deletion…“ → S3 versioning + MFA delete
  4. “Encrypt data at rest…“ → Enable encryption for storage services
  5. “Monitor API calls…“ → CloudTrail
  6. “Detect threats…“ → GuardDuty
  7. “Protect web application…“ → WAF + Shield

Security Best Practices to Remember:

Final Thoughts

Domain 1 (Design Secure Architectures) is 30% of the exam - the largest domain. Security is fundamental to every architecture on AWS.

Master these topics:

  1. IAM (users, groups, roles, policies)
  2. Security Groups vs NACLs
  3. S3 security (encryption, policies, Block Public Access)
  4. Encryption (KMS, at rest, in transit)
  5. Network security (VPC, endpoints, private subnets)
  6. Monitoring (CloudTrail, GuardDuty, Config)

Security is never an afterthought - it’s designed in from the start!