Task Statement 1.2: Design secure workloads and applications.

📘AWS Certified Solutions Architect – (SAA-C03)

To pass the SAA-C03 exam, you must understand how different AWS security services work together to protect applications. The exam tests your ability to design secure architectures using multiple AWS services in the correct way.

This topic focuses on integrating the following services:

AWS Shield
AWS WAF
AWS IAM Identity Center
AWS Secrets Manager

You must understand:

What each service does
Where it is used
How it integrates with other AWS services
When to choose one solution over another

1️⃣ AWS Shield – Protection Against DDoS Attacks

What is AWS Shield?

AWS Shield protects applications from Distributed Denial of Service (DDoS) attacks.

A DDoS attack tries to overwhelm a server or application by sending a massive amount of traffic so that real users cannot access it.

Types of AWS Shield

1. Shield Standard (Free)

Automatically enabled for all AWS customers
Protects against common network and transport layer DDoS attacks
Protects:
- Amazon CloudFront
- Elastic Load Balancer (ELB)
- Route 53
- Global Accelerator

2. Shield Advanced (Paid)

Provides enhanced DDoS protection
24/7 access to AWS DDoS Response Team (DRT)
Real-time metrics and advanced detection
Cost protection during DDoS scaling events

How Shield Integrates with Other Services

Shield is commonly used with:

CloudFront (CDN)
Application Load Balancer (ALB)
Route 53
Global Accelerator

Exam Tip:

If a question mentions:

Large-scale DDoS protection
Financial protection during scaling
Advanced visibility and support

The correct answer is Shield Advanced.

If basic DDoS protection is required, Shield Standard is enough.

2️⃣ AWS WAF – Web Application Firewall

What is AWS WAF?

AWS WAF protects web applications from malicious HTTP requests.

It works at Layer 7 (Application Layer) and protects against:

SQL injection
Cross-site scripting (XSS)
Malicious bots
IP blocking
Geographic blocking

Where AWS WAF Can Be Attached

WAF can be integrated with:

Amazon CloudFront
Application Load Balancer (ALB)
Amazon API Gateway
AWS AppSync

Key Components of WAF

1. Web ACL (Access Control List)

A container of rules
Applied to CloudFront, ALB, etc.

2. Rules

Rules define what traffic to allow or block.

Examples:

Block specific IP addresses
Allow only certain countries
Rate-limit requests

3. Managed Rule Groups

AWS provides pre-built rule sets.
You can also use third-party rule sets from AWS Marketplace.

When to Use WAF (Exam Focus)

Use AWS WAF when:

You need to block SQL injection or XSS
You need IP-based filtering
You need rate limiting
You need country-based access control

Shield vs WAF (Very Important for Exam)

Feature	AWS Shield	AWS WAF
Protects against	DDoS	Application attacks
Layer	Network (L3/L4)	Application (L7)
Custom rules	No	Yes
SQL injection protection	No	Yes

Exam questions often test this difference.

3️⃣ AWS IAM Identity Center – Centralized Access Management

What is IAM Identity Center?

IAM Identity Center allows centralized user access to multiple AWS accounts and applications.

It was previously known as AWS SSO (Single Sign-On).

Why It Is Important

In organizations with multiple AWS accounts:

You should NOT create IAM users in every account.
You should centrally manage access.

IAM Identity Center:

Connects to Active Directory or external identity providers
Manages permissions across AWS accounts
Provides single sign-on access

Key Features

Centralized user and group management
Single sign-on to:
- AWS accounts
- SaaS applications
Temporary credentials (more secure than long-term keys)

Integration with AWS Organizations

IAM Identity Center works with AWS Organizations to:

Assign permission sets to users
Manage access across multiple AWS accounts

Permission Sets

A permission set is:

A collection of IAM policies
Assigned to users/groups
Applied to specific AWS accounts

Exam Tips

If a question says:

“Multiple AWS accounts”
“Centralized access management”
“Avoid IAM users in each account”
“Integrate with corporate Active Directory”

The answer is IAM Identity Center.

4️⃣ AWS Secrets Manager – Managing Application Secrets

What is a Secret?

A secret can be:

Database password
API key
OAuth token
Application credential

Hardcoding secrets inside applications is insecure.

What is AWS Secrets Manager?

AWS Secrets Manager securely stores and rotates secrets.

Key Features

1. Secure Storage

Secrets are encrypted using AWS KMS.

2. Automatic Rotation

Can automatically rotate:
- RDS database credentials
- Custom secrets using Lambda

3. Fine-Grained Access Control

Uses IAM policies to control who can access secrets.

4. Versioning

Keeps track of different versions of a secret.

Integration with Other AWS Services

Secrets Manager integrates with:

Amazon RDS
Lambda
ECS
EKS
EC2

Applications retrieve secrets securely at runtime.

Secrets Manager vs Parameter Store (Exam Focus)

Feature	Secrets Manager	Systems Manager Parameter Store
Automatic rotation	Yes	No (manual or custom)
Designed for secrets	Yes	General configuration
Cost	Paid	Basic tier free

If automatic rotation is required → Choose Secrets Manager.

5️⃣ How These Services Work Together (Integration Concept)

For the exam, you must understand layered security.

A secure application design may look like this:

Route 53 routes traffic.
CloudFront distributes content.
AWS Shield protects against DDoS.
AWS WAF filters malicious HTTP traffic.
ALB forwards requests to application servers.
Application retrieves database password from Secrets Manager.
Developers access AWS accounts using IAM Identity Center.

Each service protects a different layer.

Defense in Depth (Exam Concept)

AWS security is designed in layers:

Layer	Service
Network protection	Shield
Application filtering	WAF
Identity & Access	IAM Identity Center
Credential management	Secrets Manager

Exam questions often test layered architecture.

Common Exam Scenarios and What to Choose

Scenario 1:

Application is under DDoS attack
→ Use Shield Advanced

Scenario 2:

Block SQL injection attempts
→ Use AWS WAF

Scenario 3:

Centralize access to 20 AWS accounts
→ Use IAM Identity Center

Scenario 4:

Rotate database credentials automatically
→ Use AWS Secrets Manager

Important Architecture Design Principles

For SAA-C03, always design systems that are:

Secure by default
Least privilege access
Centrally managed
Automatically rotating credentials
Protected at multiple layers

Key Exam Takeaways

Shield protects from DDoS.
WAF protects from application-layer attacks.
IAM Identity Center centralizes user access.
Secrets Manager securely stores and rotates secrets.
Use multiple services together for layered security.
Always choose least privilege access.
Avoid hardcoding credentials.
Understand integration with CloudFront, ALB, API Gateway, and Organizations.