Domain 1 of the AWS Certified Solutions Architect – Associate (SAA-C03) exam — Design Secure Architectures — is worth 30% of your score, more than any other domain. That single fact should reshape how you study: if you’re strong on Auto Scaling and load balancers but shaky on IAM policy evaluation, encryption options, and the difference between a security group and a network ACL, you are leaving the biggest pile of points on the table.
The frustrating part is that security questions rarely look like security questions. They arrive disguised as “a company needs to give an application running on EC2 access to an S3 bucket” or “an auditor requires all data encrypted with keys the company controls.” The exam is testing whether you reach for the AWS-native, least-privilege answer instead of the tempting-but-wrong one (hardcoded credentials, a wide-open bucket policy, or a self-managed key on a server).
This guide walks through all four tasks in Domain 1 the way a practitioner reasons about them, with the decision patterns that turn a plausible-looking distractor into an obviously wrong answer. If you want the broader exam picture first, start with our AWS Solutions Architect Associate guide for 2026 and the weighted domain strategy.
What Domain 1 Actually Covers
AWS breaks Domain 1 into four tasks. Keep this map in your head — the exam draws roughly evenly from all four.
| Task | Focus | Core services |
|---|---|---|
| 1.1 Design secure access to AWS resources | Who can do what | IAM, STS, IAM Identity Center, Organizations/SCPs, Cognito |
| 1.2 Design secure workloads and applications | Protecting the app tier | Security groups, WAF, Shield, Secrets Manager, ACM |
| 1.3 Determine appropriate data security controls | Protecting data at rest & in transit | KMS, S3 encryption, Macie, ACM, backups |
| 1.4 Design networks with security in mind | Network isolation & edge | VPC, subnets, NACLs, VPC endpoints, Network Firewall |
Task 1.1 — Secure Access to AWS Resources
IAM is the foundation, and roles beat keys every time
The single most repeated theme in this domain: when an AWS service (EC2, Lambda, ECS) needs to call another AWS service, use an IAM role, never an access key. If an answer option involves storing an access key ID and secret in a config file, on an instance, or in application code, it is almost always the wrong answer. The AWS-endorsed pattern is an IAM role attached through an instance profile (for EC2) or an execution role (for Lambda/ECS tasks). Credentials are then delivered and rotated automatically via the instance metadata service.
Know the four IAM building blocks cold:
- Users — long-lived identities for humans or legacy apps. Minimize them.
- Groups — a way to attach policies to a set of users. Groups cannot be nested and are not a principal you can
AssumeRoleinto. - Roles — temporary credentials assumed by a principal (a service, a user, another account, or a federated identity). The heart of secure design.
- Policies — JSON documents that grant or deny permissions. Identity-based (attached to a principal) or resource-based (attached to a resource like an S3 bucket or KMS key).
Least privilege and how policies are evaluated
The exam loves policy-evaluation logic. Commit this order to memory:
- Explicit
Denyanywhere always wins. - Otherwise, an explicit
Allowis required to permit an action. - Default is implicit deny — no matching allow means denied.
Add the guardrails layered on top: Service Control Policies (SCPs) in AWS Organizations set the maximum permissions an account can have (they don’t grant anything on their own), and permission boundaries cap what an identity-based policy can effectively allow. A user can have AdministratorAccess attached and still be blocked because an SCP or permission boundary doesn’t allow the action.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowReadOnlyToOneBucket",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::reports-prod",
"arn:aws:s3:::reports-prod/*"
]
}
]
}That policy is least privilege in action: one bucket, read-only, nothing else. When a question offers "Action": "s3:*" versus a scoped action list, the scoped list is the secure design.
Cross-account access and federation
Two more high-frequency patterns:
- Cross-account access: create a role in the target account with a trust policy naming the source account, and let principals in the source account
sts:AssumeRole. Do not create IAM users in every account or share long-lived keys. - Workforce federation: use IAM Identity Center (formerly AWS SSO) for centralized human access across many accounts, or SAML 2.0 federation with an existing corporate IdP. For web/mobile app users, use Amazon Cognito (user pools for sign-up/sign-in, identity pools for temporary AWS credentials) — not IAM users.
Protect the root account: enable MFA, remove root access keys, and use it only for the handful of tasks that require it. This shows up as a “how do you secure the account” question surprisingly often.
For a deeper walkthrough, our IAM guide for the SAA-C03 drills into roles, trust policies, and STS.
Task 1.2 — Secure Workloads and Applications
Stateful vs stateless: security groups and NACLs
This distinction is the most common “gotcha” in the entire exam. Memorize the table and you’ll never miss it.
| Feature | Security Group | Network ACL |
|---|---|---|
| Level | Instance / ENI | Subnet |
| State | Stateful (return traffic auto-allowed) | Stateless (must allow return traffic explicitly) |
| Rules | Allow only | Allow and Deny |
| Evaluation | All rules evaluated | Rules processed in number order, first match wins |
| Default | Deny all inbound, allow all outbound | Default NACL allows all; custom NACL denies all |
Because security groups are stateful, if you allow inbound HTTPS you do not need a matching outbound rule for the response. NACLs are stateless, so you must open the ephemeral port range (1024–65535) for return traffic. When a question involves blocking a specific malicious IP, the answer is a NACL Deny rule — security groups can’t deny.
Keeping secrets out of code
Applications need database passwords and API keys. The secure-design answers:
- AWS Secrets Manager — for secrets that need automatic rotation (RDS credentials especially). It integrates with Lambda to rotate on a schedule.
- SSM Parameter Store (SecureString) — for configuration and secrets where you don’t need built-in rotation; cheaper, and fine for most config.
Both encrypt with KMS. If the question emphasizes automatic credential rotation, choose Secrets Manager; if it emphasizes cost for plain config, choose Parameter Store.
Edge and application protection
- AWS WAF — Layer 7 filtering (SQL injection, XSS, rate limiting, geo-blocking). Attaches to CloudFront, ALB, API Gateway, or AppSync.
- AWS Shield Standard — free, automatic Layer 3/4 DDoS protection. Shield Advanced adds higher-layer protection, cost protection, and a response team for a fee.
- AWS Certificate Manager (ACM) — free public TLS certificates with automatic renewal, attached to ELB, CloudFront, and API Gateway to enforce encryption in transit.
A classic composite question: “protect a public web app from common exploits and volumetric attacks” → CloudFront + WAF + Shield.
Task 1.3 — Data Security Controls
Encryption at rest with KMS
KMS is unavoidable on this exam. Understand the key types and who controls them:
| Key type | Who manages | Rotation | Use when |
|---|---|---|---|
| AWS owned | AWS (invisible to you) | AWS | You don’t care about control |
AWS managed (aws/service) | AWS, in your account | Auto, yearly | Default SSE-KMS, no custom policy needed |
| Customer managed (CMK) | You | Optional/auto or on-demand | You need key policies, audit, or control |
When an exam question says the customer must control the keys, define who can use them, and audit usage, the answer is a customer managed KMS key. When it says “encrypt with minimal management overhead,” an AWS managed key is fine.
KMS uses envelope encryption: KMS generates a data key, that data key encrypts your data, and KMS encrypts the data key. This is why KMS scales to gigabytes of data without the data ever leaving to KMS. Access is governed by key policies (resource-based, on the key itself) combined with IAM — a principal needs permission from both sides.
S3 encryption options — know the four
| Option | Key management | Exam signal |
|---|---|---|
SSE-S3 (AES256) | AWS-managed keys, fully automatic | ”Encrypt at rest, no key management” |
| SSE-KMS | KMS key, adds audit trail & access control | ”Audit key usage / control access to keys” |
| SSE-C | Customer-provided keys per request | ”Customer supplies keys, AWS won’t store them” |
| DSSE-KMS | Dual-layer KMS encryption | Regulatory dual-encryption requirement |
Note that Amazon S3 now applies SSE-S3 by default to all new objects, so “data is unencrypted in S3” is rarely the real problem — the question is usually about which level of key control is required.
Blocking public access and finding sensitive data
- S3 Block Public Access — the account/bucket-level setting that overrides any public bucket policy or ACL. If a question describes an accidentally public bucket, this is the fix.
- Bucket policies — resource-based policies to enforce things like “deny any request not using TLS” (
aws:SecureTransport) or restrict access to a VPC endpoint. - Amazon Macie — uses ML to discover and classify PII/sensitive data in S3. When the scenario says “identify where personally identifiable information is stored,” it’s Macie.
Enforce encryption in transit with a bucket policy:
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::reports-prod/*",
"Condition": { "Bool": { "aws:SecureTransport": "false" } }
}Our S3 complete guide for the SAA-C03 covers these controls plus lifecycle and storage classes.
Task 1.4 — Designing Networks with Security in Mind
The secure VPC layout
The reference architecture the exam expects: a VPC split into public subnets (resources needing inbound internet, like an ALB or NAT gateway) and private subnets (application servers and databases with no direct internet route). Instances in private subnets reach the internet outbound only through a NAT gateway in a public subnet. Databases live in isolated private subnets reachable only from the app tier’s security group.
If a question says “the database must not be reachable from the internet,” the design answer is a private subnet with no route to an internet gateway, and a security group that only allows the app tier.
Reaching AWS services privately with VPC endpoints
A recurring high-value pattern: an EC2 instance in a private subnet needs to read from S3 or DynamoDB, but you don’t want that traffic traversing the public internet or a NAT gateway. The answer is a VPC endpoint:
- Gateway endpoints — free, for S3 and DynamoDB only, added as a route table entry.
- Interface endpoints (AWS PrivateLink) — an ENI with a private IP in your subnet, for most other AWS services (and your own services), billed hourly + per GB.
When the scenario stresses “keep traffic off the public internet” and mentions S3 or DynamoDB, choose a gateway endpoint (and note it saves NAT gateway data-processing cost too).
Instance access without SSH keys and bastions
The modern secure answer for administrative access to private instances is AWS Systems Manager Session Manager — no bastion host, no open port 22, no SSH key management, and full audit logging. If an option offers Session Manager over a bastion with a public IP, Session Manager is the more secure design.
Broader network protection
- VPC Flow Logs — capture IP traffic metadata for security analysis and troubleshooting (they log accepted/rejected traffic, not packet contents).
- AWS Network Firewall — managed stateful firewall for filtering traffic at the VPC level (deep packet inspection, domain filtering).
- Transit Gateway — hub-and-spoke connectivity for many VPCs and on-prem, replacing a mesh of peering connections at scale.
A Compact Decision Cheat Sheet
| Scenario keyword | Reach for |
|---|---|
| EC2 needs to call S3 | IAM role (instance profile), never keys |
| Block one malicious IP | NACL Deny rule |
| Auto-rotate DB password | Secrets Manager |
| Control & audit encryption keys | Customer managed KMS key |
| Encrypt S3, zero key management | SSE-S3 |
| Private EC2 → S3, off the internet | Gateway VPC endpoint |
| Accidentally public bucket | S3 Block Public Access |
| Find PII in S3 | Amazon Macie |
| Admin access, no SSH/bastion | Session Manager |
| Protect web app from exploits + DDoS | CloudFront + WAF + Shield |
| Central human access to many accounts | IAM Identity Center |
How to Practice Domain 1 Effectively
Reading about IAM and KMS builds recognition; only answering scenario questions under time pressure builds the reflex to spot the least-privilege answer among four plausible options. Security questions are especially prone to well-crafted distractors — an access key stored “securely” in Parameter Store still loses to an IAM role, and that’s exactly the kind of trap a realistic mock exam surfaces.
Work through full-length, scenario-based mock exams and read the explanation for every question — including the ones you got right — so you internalize why the secure option wins. The Sailor.sh AWS Solutions Architect Associate mock exam bundle includes 8 timed exams with 520+ questions written to mirror the SAA-C03 style, with detailed explanations that call out the security reasoning behind each answer. Pair it with a domain-weighted study plan so 30% of your practice time lands on this domain.
Frequently Asked Questions
How much of the SAA-C03 exam is security?
Domain 1 (Design Secure Architectures) is 30% of the scored questions — the largest domain. On a 65-question exam that’s roughly 20 questions, though security concepts also appear woven into resilience and performance scenarios, so the practical weight is even higher.
What’s the difference between a security group and a NACL for the exam?
Security groups are stateful, operate at the instance/ENI level, and support allow rules only. Network ACLs are stateless, operate at the subnet level, and support both allow and deny rules evaluated in order. Use a NACL when you need to explicitly block an IP; use security groups for normal instance-level allow-listing.
When should I use SSE-KMS instead of SSE-S3 for an S3 bucket?
Choose SSE-KMS when you need an audit trail of key usage (via CloudTrail) and fine-grained control over who can decrypt data through key policies. Choose SSE-S3 when you just need encryption at rest with no key-management overhead. Both encrypt data at rest; the difference is control and auditability.
Do I need to memorize IAM policy JSON for the exam?
You won’t be asked to write policies from scratch, but you must read them fluently — recognizing Effect, Action, Resource, and Condition, and applying the evaluation logic (explicit deny wins, implicit deny by default). Practice reading a handful of policies until the structure is second nature.
How do I give an EC2 instance access to AWS services securely?
Attach an IAM role via an instance profile. The instance receives temporary, automatically rotated credentials through the metadata service. Never embed long-lived access keys on an instance or in application code — that is the single most common wrong answer in this domain.
What’s the best way to keep private instances patched and accessible without opening SSH?
Use AWS Systems Manager Session Manager for shell access (no inbound ports, no bastion, full audit logging) and Systems Manager Patch Manager for patching. This is more secure than a bastion host with an open port 22 and is a frequently correct exam answer.
Conclusion
Domain 1 rewards a specific instinct: default to the AWS-native, least-privilege, encrypted-by-default option every time. Roles over keys. Scoped policies over wildcards. Customer managed keys when control and audit matter. Private subnets and VPC endpoints over public exposure. Block Public Access over hoping no one wrote a bad bucket policy. Once that instinct is automatic, the 30% of the exam that intimidates most candidates becomes the most reliable points on the test.
Build the recognition through targeted reading, then harden it with timed, scenario-based practice. Combine this guide with our resilient architectures and Well-Architected Framework breakdowns to cover security’s overlap with the rest of the exam, and you’ll walk in ready to recognize the secure design in every scenario.