SCS-C03 Domain 3: Infrastructure Security (18%)
Infrastructure Security is 18% of the SCS-C03 exam. It covers three areas: the network edge (CloudFront, WAF, Shield), compute workloads (AMIs, containers, patching, administrative access) and network controls inside and between VPCs.
Weight on the exam: 18%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.
Tasks and skills tested
Task 3.1: Design, implement, and troubleshoot security controls for network edge services
- Define and select edge security strategies based on anticipated threats and attacks.
- Implement appropriate network edge protection (for example, CloudFront headers, AWS WAF, AWS IoT policies, protecting against OWASP Top 10 threats, Amazon S3 cross-origin resource sharing [CORS], Shield Advanced).
- Design and implement AWS edge controls and rules based on requirements (for example, geography, geolocation, rate limiting, client fingerprinting).
- Configure integrations with AWS edge services and third-party services (for example, by ingesting data in Open Cybersecurity Schema Framework [OCSF] format, by using third-party WAF rules).
Task 3.2: Design, implement, and troubleshoot security controls for compute workloads
- Design and implement hardened Amazon EC2 AMIs and container images to secure compute workloads and embed security controls (for example, Systems Manager, EC2 Image Builder).
- Apply instance profiles, service roles, and execution roles appropriately to authorize compute workloads.
- Scan compute resources for known vulnerabilities (for example, scan container images and Lambda functions by using Amazon Inspector, monitor compute runtimes by using GuardDuty).
- Deploy patches across compute resources to maintain secure and compliant environments by automating update processes and by integrating continuous validation (for example, Systems Manager Patch Manager, Amazon Inspector).
- Configure secure administrative access to compute resources (for example, Systems Manager Session Manager, EC2 Instance Connect).
- Configure security tools to discover and remediate vulnerabilities within a pipeline (for example, Amazon Q Developer, Amazon CodeGuru Security).
- Implement protections and guardrails for generative AI applications (for example, by applying GenAI OWASP Top 10 for LLM Applications protections).
Task 3.3: Design and troubleshoot network security controls
- Design and troubleshoot appropriate network controls to permit or prevent network traffic as required (for example, security groups, network ACLs, AWS Network Firewall).
- Design secure connectivity between hybrid and multi-cloud networks (for example, AWS Site-to-Site VPN, AWS Direct Connect, MAC Security [MACsec]).
- Determine and configure security workload requirements for communication between hybrid environments and AWS (for example, by using AWS Verified Access).
- Design network segmentation based on security requirements (for example, north/south and east/west traffic protections, isolated subnets).
- Identify unnecessary network access (for example, AWS Verified Access, Network Access Analyzer, Amazon Inspector network reachability findings).
Services and tools to master
- AWS WAF
- AWS Shield Advanced
- Amazon CloudFront
- AWS Network Firewall
- Security groups and NACLs
- Amazon Inspector
- EC2 Image Builder
- Systems Manager Patch Manager
- Systems Manager Session Manager
- AWS Verified Access
- Site-to-Site VPN and Direct Connect
Key facts for domain 3
Short summaries; each links to the study topic with the full note and its official source.
- Security group vs NACL — Security groups are STATEFUL (the response is allowed automatically); NACLs are STATELESS: you must also allow the return traffic.
- NACL rule order — NACL rules (1 to 32766) are evaluated from the lowest number to the highest, and the first match is applied and evaluation stops.
- NACL association — Every subnet must have a NACL; if you don't associate one, it uses the default NACL.
- What SGs and NACLs don't filter — Neither security groups nor NACLs filter traffic to/from Amazon DNS, DHCP, instance metadata (IMDS), the Time Sync Service or the reserved VPC router IPs.
- Security group best practices — Don't open SSH (22) or RDP (3389) to 0.0.0.0/0 or ::/0: restrict to specific ranges.
- Session Manager — Session Manager gives access to nodes with no inbound ports, no bastion hosts and no SSH keys, controlled only with IAM policies.
- Session Manager logging limits — Session logging is NOT available when you connect through port forwarding or SSH, because SSH encrypts everything inside the TLS tunnel.
- S3 gateway endpoint — The S3 gateway endpoint has no charge and works through a route table entry, with no internet gateway or NAT.
- aws:SourceIp doesn't work with endpoints — You cannot use aws:SourceIp in policies for S3 requests that go through a VPC endpoint; use aws:VpcSourceIp.
- A sourceVpce policy cuts off the console — A bucket policy that denies everything except a specific VPC endpoint also blocks access from the management console.
- Rate-based rules — A rate-based rule counts requests grouped by your criteria and limits those arriving too fast.
- WCU cost of rate-based rules — A rate-based rule costs 2 WCU as a base, plus 30 WCU for each custom aggregation key, plus whatever its scope-down statement costs.
Practice Domain 3
Answer practice questions, read the explanation and review your mistakes with spaced repetition.