Congratulations

Using AWS Security for Developers

Rahul Singh

Technical Product Manager

Which identity AWS checks

What you settled

  • Actor and principal: whose badge AWS checks
  • Explicit deny first, and no match is still a deny

A request drawn end to end. At the top a greyed, struck out box holds a long lived access key labeled AKIA. Below it, a role scoped to the job passes through AWS STS to a temporary credential labeled ASIA that expires in an hour, then into a signed request marked SigV4. That feeds a gate checked in order: an explicit deny that stops the request, a matching allow that lets it continue, and a dashed band where nothing matched, which is an implicit deny. The surviving request leaves as an AWS API call.

Using AWS Security for Developers

Which identity AWS checks

What you settled

  • Actor and principal: whose badge AWS checks
  • Explicit deny first, and no match is still a deny
  • A role and an hour, not a key and forever
  • SigV4 on every request, pre-signed for one

A request drawn end to end. At the top a greyed, struck out box holds a long lived access key labeled AKIA. Below it, a role scoped to the job passes through AWS STS to a temporary credential labeled ASIA that expires in an hour, then into a signed request marked SigV4. That feeds a gate checked in order: an explicit deny that stops the request, a matching allow that lets it continue, and a dashed band where nothing matched, which is an implicit deny. The surviving request leaves as an AWS API call.

Using AWS Security for Developers

Who may reach what

What you settled

  • User pool signs people in, identity pool hands out credentials
  • Verify the token, then doubt the claims

One request crossing every layer. A tenant user reaches Amazon Cognito, drawn as two boxes in one frame: a user pool that signs people in and an identity pool that hands out AWS credentials. The token below it is three segments, header, payload and signature, with only the signature outlined in green. It enters Amazon API Gateway, marked checked before your code runs, offering a JWT authorizer, a Lambda authorizer and IAM auth. Below that the report function takes a value from Secrets Manager and emits a masked line reading pw equals four asterisks. Three permission layers narrow underneath it: identity policy, resource policy, and a dashed permissions boundary. At the bottom, one row of a shared table is lit and tagged LeadingKeys while two other tenant rows stay dashed and grey.

Using AWS Security for Developers

Who may reach what

What you settled

  • User pool signs people in, identity pool hands out credentials
  • Verify the token, then doubt the claims
  • Identity, resource, boundary: three layers, one answer
  • One tenant condition, the Scan that walks past it, and the password out of the log

One request crossing every layer. A tenant user reaches Amazon Cognito, drawn as two boxes in one frame: a user pool that signs people in and an identity pool that hands out AWS credentials. The token below it is three segments, header, payload and signature, with only the signature outlined in green. It enters Amazon API Gateway, marked checked before your code runs, offering a JWT authorizer, a Lambda authorizer and IAM auth. Below that the report function takes a value from Secrets Manager and emits a masked line reading pw equals four asterisks. Three permission layers narrow underneath it: identity policy, resource policy, and a dashed permissions boundary. At the bottom, one row of a shared table is lit and tagged LeadingKeys while two other tenant rows stay dashed and grey.

Using AWS Security for Developers

Prove it, then ship it

What you settled

  • Encrypted by default, but which mode and whose key is yours
  • Two gates on the key, and both must open

Four bands. In transit, a client reaches Amazon S3 through a channel labeled aws:SecureTransport. At rest, a KMS key that never leaves calls GenerateDataKey to produce a data key, above two gates that must both open, an IAM policy and a key policy. Below that, what the trail kept: userIdentity, eventName, sourceIPAddress and errorCode, with a dashed band reading data events off until asked. Then a granted bar drawn dashed and wide with a small solid used segment inside it, narrowing into a tightened policy. At the bottom, six numbered questions lead into a deploy step.

Using AWS Security for Developers

Prove it, then ship it

What you settled

  • Encrypted by default, but which mode and whose key is yours
  • Two gates on the key, and both must open
  • The trail names the principal, if it was recording
  • Granted against used, then six questions

Four bands. In transit, a client reaches Amazon S3 through a channel labeled aws:SecureTransport. At rest, a KMS key that never leaves calls GenerateDataKey to produce a data key, above two gates that must both open, an IAM policy and a key policy. Below that, what the trail kept: userIdentity, eventName, sourceIPAddress and errorCode, with a dashed band reading data events off until asked. Then a granted bar drawn dashed and wide with a small solid used segment inside it, narrowing into a tightened policy. At the bottom, six numbered questions lead into a deploy step.

Using AWS Security for Developers

Where this takes you

 

  • The next service: the same six questions
  • Whatever the provider: identity, authorization, keys, evidence

A single column read top to bottom. A block labeled this course holds identity, authorization, and keys and evidence. An arrow leads down to a panel labeled the next service, where a caller passes through six questions to data and then to a trail. A second arrow leads down to a panel labeled DVA-C02, holding a four segment exam bar with the second segment filled orange and labeled Security 26%, above a row of twenty-one green ticks headed domain two skills. A dashed arrow continues down to a dashed panel reading SCS-C03, Security - Specialty, marked up next in your security journey.

Using AWS Security for Developers

Where this takes you

 

  • The next service: the same six questions
  • Whatever the provider: identity, authorization, keys, evidence
  • DVA-C02: Security is a large part of the exam, and this course covers that domain
  • After that: AWS Certified Security - Specialty, a security-only exam

A single column read top to bottom. A block labeled this course holds identity, authorization, and keys and evidence. An arrow leads down to a panel labeled the next service, where a caller passes through six questions to data and then to a trail. A second arrow leads down to a panel labeled DVA-C02, holding a four segment exam bar with the second segment filled orange and labeled Security 26%, above a row of twenty-one green ticks headed domain two skills. A dashed arrow continues down to a dashed panel reading SCS-C03, Security - Specialty, marked up next in your security journey.

Using AWS Security for Developers

Where to go next

Using AWS Security for Developers

Preparing Video For Download...