Master Study Guide: Automating Security Controls & Data Protection

This guide covers Domain 6: Security and Compliance for the AWS Certified DevOps Engineer Professional (DOP-C02). It focuses on the transition from manual security configurations to automated, scalable, and self-healing security architectures.

---

Learning Objectives

After studying this guide, you should be able to:

• Automate credential rotation and identity management at scale.
• Implement network security components including WAF, Shield, and Network Firewall using IaC.
• Design multi-account security governance using AWS Control Tower and Organizations.
• Orchestrate data protection workflows including encryption and sensitive data discovery with Amazon Macie.
• Apply defense-in-depth strategies across multi-region environments.

---

Key Terms & Glossary

• SCP (Service Control Policy): A type of organization policy used to manage permissions in your organization, acting as a guardrail for member accounts.
• AWS STS (Security Token Service): A web service that enables you to request temporary, limited-privilege credentials for users.
• ACM (AWS Certificate Manager): A service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates.
• Amazon Macie: A fully managed data security and data privacy service that uses machine learning to discover and protect sensitive data.
• AWS Security Hub: A security center that provides a comprehensive view of your security state and helps you check your environment against security industry standards.

---

The "Big Idea"

[!IMPORTANT] The fundamental shift in the DevOps Professional domain is from reactive security (responding to incidents) to proactive automation (preventing incidents through code). In a multi-account environment, manual security is impossible. Automation ensures that every account, regardless of when it was created, inherits a baseline security posture (guardrails) automatically.

---

Formula / Concept Box

IAM Policy Evaluation Logic

In AWS, the evaluation of permissions follows a specific hierarchy. If a single policy contains an explicit Deny, the request is denied, regardless of how many Allow statements exist.

---

Hierarchical Outline

1. Identity and Access at Scale
   • Machine Identities: Automating rotation via AWS Secrets Manager (e.g., RDS credentials).
   • Federation: Using IAM Identity Center for centralized SSO.
   • Guardrails: Implementing SCPs to restrict regions or sensitive API calls (e.g., s3:DeleteBucket).
2. Infrastructure and Network Security
   • Edge Protection: Deploying AWS WAF for Layer 7 and AWS Shield for DDoS protection.
   • VPC Security: Layering Security Groups (stateful) and Network ACLs (stateless).
   • Centralized Inspection: Using AWS Network Firewall for deep packet inspection across VPCs.
3. Data Protection & Encryption
   • Discovery: Scaling Amazon Macie to identify PII (Personally Identifiable Information) in S3.
   • At Rest: Using AWS KMS (Key Management Service) with automated key rotation.
   • In Transit: Automating certificate renewal via ACM.

---

Visual Anchors

Automated Security Governance Flow

This diagram illustrates how a new account is secured automatically when joined to the Organization.

Defense in Depth (TikZ)

---

Definition-Example Pairs

• Credential Rotation: The process of changing a password or key at regular intervals.
  • Example: Configuring AWS Secrets Manager to rotate an RDS database password every 30 days using a Lambda function.
• Data Classification: Categorizing data based on its sensitivity level.
  • Example: Using Amazon Macie to tag S3 buckets as "Internal" or "Confidential" based on the presence of credit card numbers.
• Stateful Inspection: A firewall feature that tracks the state of active connections.
  • Example: A Security Group that automatically allows return traffic for an outgoing request without needing an explicit inbound rule.

---

Worked Examples

Example 1: Automating Remediation of Public S3 Buckets

Scenario: You need to ensure no S3 bucket is ever public.

1. Detection: Create an AWS Config Rule s3-bucket-public-read-prohibited.
2. Trigger: When the rule detects a non-compliant bucket, it triggers an Amazon EventBridge event.
3. Action: The event targets an AWS Systems Manager (SSM) Automation Document.
4. Remediation: The SSM document runs a script to set the bucket access to private.

Example 2: Cross-Account KMS Encryption

Scenario: Account A needs to encrypt data that Account B will decrypt.

1. In Account A, create a Customer Managed Key (CMK).
2. Update the Key Policy in Account A to grant kms:Decrypt and kms:DescribeKey permissions to the IAM Role in Account B.
3. In Account B, ensure the IAM Role has the necessary identity-based permissions to call Account A's KMS Key ARN.

---

Checkpoint Questions

1. What is the main difference between an IAM Policy and an SCP in an AWS Organization?
2. Which service should you use to automatically discover unencrypted S3 buckets across 50 AWS accounts?
3. How does AWS Secrets Manager differ from Systems Manager Parameter Store regarding credentials?
4. True/False: A Network ACL is stateful, meaning it remembers connection states.

▶Click for Answers

1. IAM Policies grant permissions to users/roles; SCPs act as guardrails that limit the maximum possible permissions for an account.
2. AWS Security Hub (aggregated findings) or AWS Config (multi-account/multi-region aggregator).
3. Secrets Manager supports built-in rotation and secret generation; Parameter Store is primarily for configuration storage (though it can store encrypted strings).
4. False. Network ACLs are stateless; Security Groups are stateful.

---

Muddy Points & Cross-Refs

• ACM Public vs. Private: Remember that ACM can provide free public certificates for CloudFront/ALB, but for internal microservices, you often need ACM Private CA, which has a monthly cost.
• KMS Key Policy vs. IAM: A KMS key must have a key policy. Even if an IAM policy allows access, if the key policy doesn't explicitly allow the account (or the specific user), access is denied.
• WAF vs. Network Firewall: WAF is for Web (HTTP/S) Layer 7. Network Firewall is for the VPC level (IP/Port/Protocols) and can filter non-web traffic like SSH or SMTP.

---

Comparison Tables

Security Groups vs. Network ACLs

AWS KMS vs. AWS CloudHSM