Security Engineering on AWS
Please not that this is not a prep course for the “AWS Certified Security - Specialty” certification!
This document contains links mentioned in the “Security Engineering on AWS” course.
Module 0: Course Overview
Full name: Security Engineering on AWS
Product code: 200-SISECO-33
These links are based on the course version 3.3.20.
Online and classroom course options: Security Engineering on AWS
The official course material: eVantage Bookshelf (VitalSource)
Security Engineering on AWS- Online Course Supplement (free)
Security Engineering on AWS - Supplemental Lab Playlist (skillbuilder subscription required)
Security: Network and Infrastructure Security Jam Journey (skillbuilder subscription required)
Security: Data Protection and Data Encryption Jam Journey (skillbuilder subscription required)
AWS Security Champion - Knowledge Badge Readiness Path
Exam Prep Plan: AWS Certified Security - Specialty (SCS-C02 - English)
Module 1: Security Overview
Websites
- Applying the AWS Shared Responsibility Model to your GxP Solution
- AWS Managed Service Provider Program
- AWS Well-Architected Framework Design Principles
- How to approach threat modeling
Videos
- Well-Architected for Security: Advanced Session (AWS Public Sector Summit Australia 2017)
- Security Best Practices the Well-Architected Way (SDD318) (re:Inforce 2019)
- A Practitioner’s Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) (re:Invent 2018)
Module 2: Access and Authorizations on AWS
Websites
- AWS service endpoints
- AWS Signature Version 4 for API requests
- AWS services that work with IAM
- Tasks that require root user credentials
- AWS account root user
- Secure API access with MFA
- IAM Roles Anywhere concepts
- AWS services that work with IAM
- AWS Policy Generator
- AWS Policy Simulator
- Policy summary (list of services)
- Policy evaluation logic
- IAM JSON policy element reference
- Session policies
- Working with resource-based IAM policies in Lambda
- Create fine-grained session permissions using IAM managed policies
- Working with CloudTrail Event history
- CloudTrail supported services and integrations
- Validating CloudTrail log file integrity
- How AWS uses automated reasoning to help you achieve security at scale
Videos
- Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) (re:Invent 2018)
- AWS Knowledge Center Live: IAM Best Practices and Design Decisions
- Augmenting Security & Improving Operational Health w/ AWS CloudTrail (SEC323) (re:Invent 2018)
- Security & Compliance for Modern Serverless Applications (re:Invent 2018)
Module 3: Account Management and Provisioning on AWS
Websites
- Benefits of using multiple AWS accounts
- SCPs and guardrails in your AWS Organization
- Organizing your AWS Control Tower landing zone with nested OUs
- AWS Control Tower
- How AWS Control Tower Works
- Strategies for consolidating AWS environments
- Enabling self-service provisioning of AWS resources with AWS Control Tower
- Enabling SAML for your AWS resources
- Roles, terms and concepts
- Introducing AWS IAM Identity Center
- Common Amazon Cognito scenarios
- Working with adaptive authentication
Videos
- Deep Dive: Security and Governance Across a Multi-Account Strategy (SAC320) (re:Invent 2016)
- Architecting Security and Governance Across a Multi-Account Stra (SID331) (re:Invent 2017)
- Centrally Monitoring Resource Configuration & Compliance (ENT332-R1) (re:Invent 2018)
- Managing Multi-Account AWS Environments Using AWS Organizations (FND314) (re:Inforce 2019)
- Using AWS Control Tower to Govern Multi-Account AWS Environments (GRC313-R) (re:Inforce 2019)
Module 4: Managing Keys and Secrets on AWS
Websites
- Protecting data with encryption
- What is the AWS Encryption SDK?
- AWS Key Management Service introduces new HMAC API
- Using AWS KMS encryption with AWS services
- Grants in AWS KMS
- External key stores
- Multi-Region keys in AWS KMS
- AWS CloudHSM clusters
- AWS Key Management Service
- Are KMS custom key stores right for you?
- Database Credentials, Lambda Functions and AWS Secrets Manager
- What is AWS Secrets Manager?
- Identity-based policies
- Managing Parameter Store parameter tiers
Videos
- Encryption and Key Management in AWS (SEC304) (re:Invent 2013)
- Get the Most from AWS KMS: Architecting Applications for High Security (SEC303) (re:Invent 2016)
Module 5: Data Security
Websites
- Using access points
- Correlate IAM Access Analyzer findings with Amazon Macie
- Client-side and server-side encryption
- Creating security groups
- Amazon VPC Security Groups
- Securing your data in Amazon EFS
- Encryption at Rest
- S3 Glacier Vault Lock
Videos
- How Encryption Works in AWS (FND310-R) (re:Inforce 2019)
- Data Protection: Encryption, Availability, Resiliency, & Durability (SEC325-R1) (re:Invent 2018)
Module 6: Infrastructure and Edge Protection
Websites
- Amazon VPC now supports an AWS-managed prefix list for Amazon CloudFront
- AWS Best Practices for DDoS Resiliency
- Combinations Calculator (nCr)
Videos
- A Day in the Life of a Billion Packets (CPN401) (re:Invent 2013)
- Another Day, Another Billion Packets (NET403) (re:Invent 2015)
- Another Day, Another Billion Flows (NET405) (re:Invent 2017)
- Another Day, Another Billion Packets (AWS Summit London 2017)
- Another Day in the Life of a Cloud Network Engineer at Netflix (NET312) (re:Invent 2018)
- AWS Shield—A Managed DDoS Protection Service (SAC322) (re:Invent 2016)
- DDoS Attack Detection at Scale (SDD408) (re:Inforce 2019)
Module 7: Monitoring and Collecting Logs on AWS
Websites
- Multi-Account Multi-Region Data Aggregation
- Supported Resource Types
- AWS Config Managed Rules
- AWS Config Custom Rules
- Logging IP traffic using VPC Flow Logs
- CloudWatch Logs Insights query syntax
- Access logs for your Application Load Balancer
- Amazon S3 server access log format
- EventBridge is the evolution of Amazon CloudWatch Events
- How to Receive Notifications When Your AWS Account’s Root Access Keys Are Used
- Instance metrics
- Amazon Data Firehose / CreateDeliveryStream
- Analyzing Data in S3 using Amazon Athena
- What is Amazon Athena?
- Amazon Athena / Encryption at rest
- Query flow logs using Amazon Athena
- OpenSearch Documentation
- Build a Log Analytics Solution on AWS
- Centralized Logging with OpenSearch
- Centralized Logging with OpenSearch (implementation guide)
Videos
- Easily Transform Compliance to Code Using AWS Config, Config Rules, and the Rules Development Kit
- Centrally Monitoring Resource Configuration & Compliance (ENT332-R1) (re:Invent 2018)
- Monitoring and Remediating Non-Compliant Resources with AWS Config
- Security Automation using AWS Management Tools (AWS Public Sector Summit Washington DC 2018)
- Build a Dashboard Using Serverless Security Analytics (SDD201) (re:Inforce 2019)
- Build Your Own Log Analytics Solutions on AWS (ANT323-R1) (re:Invent 2018)
- Demo: Centralized Logging with OpenSearch - Logging solutions in 20 minutes
Module 8: Responding to Threats
Websites
- AWS Security Incident Response Guide
- Penetration Testing
- Amazon SNS message data protection
- Automated Security Response on AWS
- What is Amazon GuardDuty?
- Cyber Threat Intelligence (CTI)
- Overview of the behavior graph data structure
- What is Amazon Detective?
- AWS Security Blog
- Automated Forensics Orchestrator for Amazon EC2
Videos
- Incident Response in the Cloud (119678) (AWS Public Sector Summit 2016)
- Automating Incident Response and Forensics in AWS (AWS Summit Canberra 2018)
- Incident Response in the Cloud (SEC404) (re:Invent 2014)
- Incident Response in the Cloud (SID319) (re:Invent 2017)
- Threat Detection and Remediation in the Cloud (AWS Summit 2016)
- Threat Detection on AWS: An Introduction to Amazon GuardDuty (FND216) (re:Inforce 2019)
Module 9: Course Wrap-Up
Websites
- Serverless Architectures with AWS Lambda
- How AWS Pricing Works
- Back to Basics
- AWS Support
- AWS Certification exam preparation
- AWS Certification
- AWS Certification exams
- AWS Recertification
- Schedule an Exam
- AWS Ramp-Up Guides
Courses
- Advanced Developing on AWS
- Developing Serverless Solutions on AWS
- Build Modern Applications with AWS NoSQL Databases
- Getting Started with DevOps on AWS
- AWS Cloud Development Kit Primer
- AWS Skill Builder
- AWS Skill Builder courses
- AWS Builder Labs
- AWS Workshops
- Classroom training