Objectives in this domain

Design a flexible authorisation model using IAM users, groups, roles and policies to grant least-privilege access to AWS resources.
Section 1.1medium
Design secure access across multiple accounts using AWS Organizations, IAM Identity Center and federation with external identity providers.
Section 1.2hard
Determine when to use resource-based policies, permission boundaries and cross-account roles to control access to shared resources.
Section 1.3medium
Design network segmentation and edge protection using VPC security groups, network ACLs, AWS WAF and AWS Shield.
Section 1.4medium
Manage application secrets and credentials securely using AWS Secrets Manager, Systems Manager Parameter Store and Amazon Cognito.
Section 1.5medium
Select managed threat-detection and posture-management services such as Amazon GuardDuty, Amazon Inspector, AWS Security Hub and Amazon Macie.
Section 1.6medium
Design encryption at rest and key management using AWS KMS, envelope encryption and AWS CloudHSM.
Section 1.7hard
Protect data in transit using TLS, AWS Certificate Manager and secure connectivity options.
Section 1.8medium
Determine appropriate data security controls including S3 access controls, data classification and lifecycle protection.
Section 1.9medium

Sample question from this domain

Free sampleDesign Secure Architecturesmedium

A company runs an application on Amazon EC2 instances that must read objects from a specific Amazon S3 bucket. Developers currently store long-lived IAM user access keys in the application configuration file. A solutions architect must remove the static credentials while granting only the access the application needs. Which approach best meets these requirements?

AAttach an IAM role to the EC2 instances with a policy that allows the s3:GetObject action on the specific bucket, and have the application use the role credentials. Correct
BCreate an IAM user with an S3 read-only managed policy and embed its access key and secret key in the EC2 instance user data at launch.
CAttach an IAM role to the EC2 instances that grants the AdministratorAccess managed policy so the application can reach the bucket without stored keys.
DStore the IAM user access keys in AWS Secrets Manager and have the running application retrieve the same long-lived keys at startup.

Use IAM roles with instance profiles to give EC2 workloads scoped temporary credentials instead of storing long-lived access keys. An IAM role attached through an instance profile delivers short-lived credentials retrieved from the instance metadata service and rotated automatically, eliminating static keys, while a resource-scoped s3:GetObject policy enforces least privilege.

Why A is correct: An instance profile role supplies automatically rotated temporary credentials and a scoped GetObject policy on one bucket grants least privilege without any static keys.

Why B is wrong: Moving the key to user data still relies on long-lived static credentials that can leak, so it fails the requirement to remove static credentials entirely.

Why C is wrong: A role does remove static keys, but AdministratorAccess grants far more than the read access needed and violates the least-privilege requirement badly.

Why D is wrong: Secrets Manager protects the keys at rest, but the application still authenticates with long-lived IAM user credentials rather than removing them as required.

Other domains in this exam

Design Resilient Architectures26% of the exam
Design High-Performing Architectures24% of the exam
Design Cost-Optimized Architectures20% of the exam

See also the SAA-C03 cert hub, the study guide, and the cheat sheet.