Skip to content

AWS security engineering

The engineer's deep dive into securing AWS: the exact IAM evaluation model and the permission combinations that become admin, managed detection with GuardDuty and Security Hub wired to a response pipeline, KMS envelope encryption and S3/Macie data protection, VPC segmentation and egress control, and org guardrails plus a rehearsed incident-response and forensics runbook. Assumes the intermediate AWS course.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

IAM depth & escalation paths

3 lessonsTest yourself

01The IAM evaluation modelDeny wins, ceilings are conjunctive, grants additive.35 min 02PassRole & escalation pathsThe permission combinations that become admin.35 min 03Federation & killing static keysIdentity Center for humans, OIDC for CI, roles on instances.35 min

02

Threat detection & findings

3 lessonsTest yourself

01GuardDuty threat detectionAgentless findings from CloudTrail, flow, and DNS.30 min 02Security Hub & standardsAggregate, normalize, and score against CIS/FSBP.30 min 03Detection as code & responseEventBridge to SIEM/SOAR and auto-containment.35 min

03

Data protection & encryption

3 lessonsTest yourself

01KMS & envelope encryptionData keys, key policies, rotation, and the kill switch.35 min 02S3 data protectionBlock Public Access, TLS/encryption policies, Object Lock.30 min 03Macie & Secrets ManagerFind sensitive data; rotate secrets by identity.30 min

04

Network security & segmentation

3 lessonsTest yourself

01VPC segmentationIdentity-referenced SGs, private subnets, blast radius.30 min 02Egress control & Network FirewallDomain allowlists, DNS Firewall, exfiltration defense.35 min 03Private endpoints & east-west TLSPrivateLink, endpoint policies, mTLS internally.30 min

05

Guardrails, IR & forensics

3 lessonsTest yourself

01SCP guardrails & landing zonesPreventive limits and secure-by-default accounts.30 min 02Org trails & immutable loggingOne trail to a locked account, tamper-evident.30 min 03Incident response & forensicsContain, revoke sessions, preserve, hunt persistence.35 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam