Design Secure Architectures

The module starts with principal identity and permission boundaries in a secure cross-account design. Learners distinguish role trust, role permissions, resource policies, and SCP ceilings. They then trace requests through a public entry point to private application and database tiers without opening unnecessary ports. A second case evaluates S3 gateway endpoints and WAF at the appropriate HTTP layer while retaining application validation. The final lesson protects data in transit, at rest, and during recovery: an encrypted copy alone does not prove that a recovery account can decrypt and restore it. Worked cases and exercises produce access tables or network diagrams with both allowed and denied tests. AWS documentation supports service behavior; regional names and figures are fictional training inputs.

Read the whole first subject without an account: its lessons, summary and review questions.