AWS Certified Security – Specialty Cheat Sheet (SCS-C03)
Every in-scope security service, detection pattern, IAM and data-protection decision the SCS-C03 exam actually tests — organised by the six exam domains with policy patterns and runbooks
About This Cheat Sheet
- 15 pages
- Every in-scope SCS-C03 service
- For 3–5 years of experience securing cloud solutions
- 22 answer-pattern scenarios
- 4 step-by-step runbooks
- Updated April 2026
Exam domains
Share of the scored SCS-C03 content
- Detection16%
- Incident Response14%
- Infrastructure Security18%
- Identity and Access Management20%
- Data Protection18%
- Security Foundations and Governance14%
Services covered
Identity & access management
- IAM
- IAM Identity Center
- STS
- Organizations
- Control Tower
- Directory Service
- Cognito
- Verified Permissions
Detection
- GuardDuty
- Inspector
- Macie
- Detective
- Security Hub
- Config
- CloudTrail
- CloudTrail Lake
- Security Lake
- CloudWatch
- OpenSearch
- Athena
- Managed Grafana
- User Notifications
Incident response
- Automated Forensics Orchestrator for EC2
- Incident Manager
- FIS
- AWS Backup
- Resilience Hub
- Application Recovery Controller
Infrastructure security
- VPC
- Network Access Analyzer
- Network Firewall
- Firewall Manager
- WAF
- Shield
- PrivateLink
- Verified Access
- Route 53 Resolver DNS Firewall
- CloudFront
Data protection
- KMS
- CloudHSM
- ACM
- Private CA
- Secrets Manager
- Parameter Store
Show 31 more servicesShow fewer
Compute workload security
- EC2
- EC2 Instance Connect
- Session Manager
- Image Builder
- Nitro Enclaves
- EKS
- Lambda
- API Gateway
- EMR
- IoT Core
- Device Defender
- Data Lifecycle Manager
Data stores
- S3
- RDS
- Aurora
- DynamoDB
- EFS
- FSx for Lustre
- DataSync
AI & developer services
- SageMaker AI
- Bedrock
- Q Business
- Q Developer
- CodeGuru Security
Security foundations & governance
- Artifact
- Well-Architected Tool
- Trusted Advisor
- Audit Manager
- Service Catalog
- CloudFormation
- Systems Manager
Feature details
- Organizations
- SCPs · RCPs · Permission boundaries · Session policies · Explicit evaluation order
- IAM
- Principals · Condition keys · ABAC · Access Analyzer · Credentials report · Access advisor
- IAM Identity Center
- Workforce SSO with external IdP via SAML + SCIM
- STS
- External ID · Session tags · Regional endpoints
- KMS
- Key types · Algorithms · Multi-Region keys · Key policy anatomy · Grants · kms:ViaService · Envelope encryption · Rotation
- CloudHSM
- Custom key store
- GuardDuty
- All protection plans including Runtime Monitoring + Malware Protection · GuardDuty EKS Runtime
- Inspector
- EC2 + ECR + Lambda
- Macie
- S3 PII
- Detective
- Graph-based investigation
- Security Hub
- FSBP / CIS / PCI / NIST standards
- Config
- Conformance Packs
- Security Lake
- OCSF
- EC2
- IMDSv2
- EKS
- IRSA/Pod Identity · SG-for-Pods
- Lambda
- Code signing
- API Gateway
- Auth + mTLS
- EMR
- Security configurations
- S3
- Block Public Access · KMS · Object Lock · Access Points · Macie
- Databases & analytics
- RDS / Aurora / DynamoDB / OpenSearch / Athena encryption · IAM DB auth
- Bedrock
- Bedrock Guardrails
Concepts covered
- Foundations
- Shared responsibility · Secrets Manager vs Parameter Store decision · Security & compliance services matrix
- Policies & keys
- 7 canonical policy patterns · IAM evaluation logic + condition operators · KMS key policy anatomy
- Detection & response
- Event-driven auto-remediation pattern · AWS Backup restore testing · Logging reference architecture (org-wide CloudTrail + Security Lake)
- Specialised workloads
- Lambda · EKS · SageMaker · Bedrock · IoT
- Compliance frameworks
- PCI DSS v4 · HIPAA · SOC 2 · FedRAMP · ISO 27001 · NIST 800-53 Rev 5 · GDPR
- Runbooks
- Compromised IAM key · Public S3 with sensitive data · Root account misuse · Suspicious STS assumptions
- Exam practice
- 22-scenario Answer Patterns · 13 common pitfalls
Built from the official SCS-C03 exam guide; every service on its in-scope list is audited present.
What's Inside
Shared Responsibility & Governance
Where AWS security duties end and the customer’s begin, and the services that help prove compliance.
- AWS responsibility: security of the cloud; customer responsibility: security in the cloud
- Degree-of-responsibility slider by service type (IaaS → SaaS)
- Artifact for compliance reports: SOC, PCI, ISO, FedRAMP, HIPAA
- Well-Architected Tool Security pillar + lenses
- Trusted Advisor security checks
- Audit Manager for automated evidence collection mapped to frameworks
Organizations, SCPs, RCPs & Landing Zone
The secure multi-account layout, the policy types that cap permissions, and how they combine at evaluation.
- Canonical secure multi-account layout: Management, Log Archive, Audit/Security Tooling OUs
- Plus Networking, Identity and Workloads OU
- Policy ceilings: SCPs (principals), RCPs (resources)
- Permission boundaries (max identity-based grant), session policies
- Full evaluation order, with explicit deny winning always
- Control Tower landing zone: preventive (SCP) and detective (Config) guardrails
- Account Factory + AFT for IaC-driven provisioning
Identity & Access Management
IAM policy mechanics, the condition keys answers hinge on, workforce federation and safe cross-account access.
- IAM principals, policy elements, ABAC vs RBAC
- Condition keys: aws:PrincipalOrgID, aws:PrincipalTag, aws:SourceIp, aws:SourceVpce
- Condition keys: aws:SecureTransport, aws:MultiFactorAuthPresent, kms:ViaService
- IAM Access Analyzer: external + unused + custom policy checks + policy generation
- Access Advisor, Credentials Report
- IAM Identity Center with SAML + SCIM + external IdP (Okta, Entra, Ping)
- Permission Sets as auto-provisioned IAM roles
- STS AssumeRole chains with ExternalId to prevent confused deputy
- Session tags for downstream ABAC
Encryption & Key Management
KMS in depth, plus CloudHSM, certificates and secrets: the encryption choices behind most data-protection answers.
- KMS key types: AWS-owned, AWS-managed, customer-managed
- Key material: KMS-generated, imported BYOK, CloudHSM-backed custom key store
- Symmetric + asymmetric + HMAC + SM2 algorithms; multi-Region keys
- Key policy anatomy: root account grant is mandatory; key users vs administrators
- Service use via grants; kms:ViaService condition
- Envelope encryption with DEKs; annual auto-rotation
- CloudHSM: FIPS 140-2 Level 3, PKCS#11, JCE, CNG/KSP
- Certificate Manager (free public TLS) + Private CA (internal X.509 hierarchy, CRL + OCSP)
- Secrets Manager: automatic rotation + cross-Region replication
- vs Parameter Store: free SecureString with KMS
Detection Services
Every detection service, what it watches, and how findings come together for investigation and querying.
- GuardDuty across CloudTrail / VPC Flow / DNS / EKS audit / S3 / RDS / Lambda
- GuardDuty Runtime Monitoring + Malware Protection
- Inspector continuous CVE + network reachability scanning on EC2 / ECR / Lambda
- Macie for S3 PII / credentials / regulatory data
- Detective for graph-based incident investigation
- Security Hub aggregator: AWS FSBP, CIS v1.4 + v3.0, PCI DSS v3.2.1 + v4.0.1
- Security Hub NIST SP 800-53 Rev 5 standard; Config + Conformance Packs
- CloudTrail + CloudTrail Lake: SQL over up-to-10-year event history, federated queries
- Security Lake normalising OCSF Parquet in S3 for SIEM / Athena / OpenSearch subscribers
Incident Response & Forensics
Automated remediation, forensics and recovery: what runs when a detection fires.
- Event-driven auto-remediation: GuardDuty / Config / CloudWatch Alarm / CloudTrail → EventBridge
- Remediation targets: SSM Automation / Lambda / Step Functions / Incident Manager
- Automated Forensics Orchestrator for EC2: isolate SG, snapshot EBS
- Capture memory via SSM; preserve evidence in forensic account with chain-of-custody
- Incident Manager: on-call rotas, response plans, chat channel auto-populated
- Fault Injection Service for controlled chaos with CloudWatch stop conditions
- AWS Backup restore testing + vault lock for ransomware-proof retention
- Resilience Hub RTO/RPO scoring
- Application Recovery Controller for deterministic Region failover
Infrastructure Security
Network-layer controls from subnet design to edge protection, including zero-trust access without a VPN.
- VPC segmentation: public / private / isolated subnets, VPC endpoints
- NACLs stateless; Security Groups stateful with SG-to-SG references
- PrivateLink; Network Access Analyzer for org-wide policy checks
- Network Firewall (managed Suricata + TLS inspection)
- Firewall Manager for org-wide policies; Shield Standard + Advanced
- WAF: Bot Control, ATP/ACFP, Fraud Control
- Verified Access: zero-trust with identity + device posture, no VPN
- Route 53 Resolver DNS Firewall with AWS-managed threat domain feeds
- CloudFront edge TLS + signed URLs + field-level encryption + OAC
Compute Workload Security
Hardening EC2, containers, Lambda, APIs, EMR and IoT workloads, service by service.
- EC2 IMDSv2 required: token-based, blocks SSRF
- Instance Connect (temporary SSH keys); Session Manager shell without SSH / bastion / open ports
- EC2 Image Builder pipeline with Inspector scanning; Data Lifecycle Manager snapshot policies
- Nitro Enclaves: isolated CPU/RAM with KMS attestation for key handling
- Containers: ECR Enhanced scanning via Inspector + Signer signing
- EKS IAM Roles for Service Accounts / Pod Identity, Security Groups for Pods
- GuardDuty EKS Runtime Monitoring (eBPF)
- Lambda: least-privilege execution role + KMS env vars + Code Signing
- API Gateway auth + mTLS; EMR security configurations
- IoT Core with X.509 cert + Device Defender
Data Protection
Protecting data in S3, databases, analytics and file storage, and in AI services where customer data stays private and is not used for training.
- S3: Block Public Access (account + bucket default), Versioning + MFA Delete
- SSE-S3 / SSE-KMS / SSE-C / DSSE-KMS with Bucket Keys
- Bucket policies (prefer over ACLs: BucketOwnerEnforced)
- Object Lock (Governance / Compliance), Access Points, Multi-Region Access Points
- Presigned URLs; Replication with RTC
- RDS / Aurora KMS + TLS + IAM DB auth + Database Activity Streams
- DynamoDB KMS + fine-grained IAM; OpenSearch at-rest + node-to-node + in-transit
- Athena workgroup encryption; EFS + FSx for Lustre with KMS
- AWS Backup vault lock; DataSync with TLS + PrivateLink
- SageMaker AI, Bedrock Guardrails, Amazon Q Business, Amazon Q Developer, CodeGuru Security
Policy Patterns
Seven canonical patterns you must recognise at a glance, with the condition keys and actions that give each away.
- Deny non-TLS S3 (aws:SecureTransport=false)
- Enforce CMK encryption on PutObject
- Restrict by aws:PrincipalOrgID
- Restrict API to VPC endpoint via aws:SourceVpce
- MFA-required action with aws:MultiFactorAuthPresent / MultiFactorAuthAge
- Confused-deputy prevention with sts:ExternalId + aws:SourceAccount / aws:SourceArn
- Log integrity via CloudTrail log-file validation
- SCP that denies disabling security services: guardduty:DeleteDetector / config:DeleteConfigurationRecorder / cloudtrail:StopLogging / securityhub:DisableSecurityHub
Scenario → Answer Patterns
22 SCS-C03 scenarios, each mapped to the AWS default answer.
- Logging: centralised tamper-proof logs, immutable log chain, preventing CloudTrail deletion, root-login audit
- S3: public S3 remediation, preventing S3 exfiltration, S3 ransomware defence
- Identity: anomalous console logins, exposed IAM keys, MFA for admin
- Accounts: blocking root in members, cross-account secret sharing
- Keys and secrets: enforced KMS encryption, RDS credential rotation, HSM-boundary keys
- Compute: EC2 compromise forensics, IMDSv1 enforcement, DNS tunnelling detection
- Governance: PCI DSS evidence automation, central WAF across accounts
- Access: zero-trust internal apps, Private CA for mTLS
Compliance Frameworks
The AWS primary controls that map to each compliance framework the exam names.
- PCI DSS v4: Security Hub PCI, Audit Manager PCI framework, KMS + CloudHSM
- HIPAA: BAA via Artifact, HIPAA-eligible services, Macie for PHI
- SOC 2: Audit Manager, FSBP, Change Manager
- FedRAMP Moderate/High: GovCloud High or commercial
- ISO 27001: Audit Manager ISO
- NIST 800-53 Rev 5: Security Hub standard + Conformance Pack
- GDPR: Region data residency, DPA, Macie + Lake Formation for data-subject requests
Why This Cheat Sheet Helps
SCS-C03 tests how to build and run secure multi-account AWS with the exact AWS-prescribed pattern for each scenario. Questions reliably distinguish services with overlapping surface (Macie vs Inspector vs GuardDuty, CloudTrail Lake vs Athena vs OpenSearch, Security Hub vs Security Lake, Secrets Manager vs Parameter Store, KMS CMK vs CloudHSM), the precise IAM / KMS / resource policy combination for a given access path, and the event-driven auto-remediation fabric (EventBridge + SSM Automation) that AWS wants you to use. This cheat sheet puts those decisions side by side with the ASFF / CIS / FSBP vocabulary examiners use.
It assumes you already know security fundamentals and AWS shared-responsibility. Use it in the final weeks to reinforce the policy evaluation order (explicit deny, SCP, RCP, identity, resource, permission boundary, session, VPC endpoint), the KMS key policy anatomy, and the canonical detection → response → forensics pipeline AWS expects in real incidents.
How to Use It
Skim the whole sheet once to see how the six domains map to sections. Then hammer practice exams — for each wrong answer, find the relevant section and study the tables and policy patterns. Pay extra attention to sections 2–3 (Orgs + IAM), 4 (KMS), 5 (Detection), 6 (Incident Response), 9 (Data Protection), 11 (policy patterns), 12 (Scenario → Answer Patterns), 13 (Pitfalls), and 14–15 (IAM + KMS deep dives).
In the final week, walk through the six domain weights against your confidence: Detection (16%) → section 5; Incident Response (14%) → sections 6, 19; Infrastructure Security (18%) → section 7; IAM (20%) → sections 3, 11, 14; Data Protection (18%) → sections 4, 9; Foundations & Governance (14%) → sections 1, 2, 10, 18. Pair with CloudNinja's free SCS-C03 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS Security Specialty cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the SCS-C03 exam.
How much experience do I need before SCS-C03?
AWS recommends five or more years of IT security experience plus two or more years of AWS. The exam is policy-dense and assumes fluent reading of IAM / KMS / resource policies with condition keys. If you do not already work in security or have hands-on experience with IAM Identity Center, KMS CMKs, GuardDuty / Security Hub, and incident response runbooks, build that foundation first — ideally via Solutions Architect Associate + a security-focused role.
How is SCS-C03 different from general security on AWS?
SCS-C03 tests the AWS-prescribed pattern for each scenario, not just "a secure answer." It cares which service owns each layer: Macie for S3 PII, Inspector for CVEs, GuardDuty for behavioural threats, Security Hub as the aggregator, Security Lake as the OCSF data lake, Audit Manager for compliance evidence, CloudTrail Lake for forensic SQL, CloudHSM only when FIPS 140-2 Level 3 is a hard requirement. Expect IAM / resource / KMS policy questions where one condition key is the difference between pass and fail.
Is this cheat sheet updated for the current SCS-C03 exam?
Yes, it is built directly from the current SCS-C03 exam guide (security-specialty-03) and audited against the full in-scope services list. It reflects current services — AWS CloudTrail Lake, Amazon Security Lake, AWS Verified Access, Amazon Verified Permissions, GuardDuty Runtime Monitoring + Malware Protection + RDS + Lambda + EKS, Inspector for Lambda, AWS User Notifications, Amazon Application Recovery Controller, Automated Forensics Orchestrator for Amazon EC2, Amazon Q Business / Q Developer, Amazon Bedrock Guardrails, Amazon CodeGuru Security, and Resource Control Policies alongside SCPs.
Keep Studying
Recommended courses
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.