AWS DVA · Domain 2 of 4

AWS DVA Domain 2: Security

This domain covers securing applications on AWS: implementing authentication and authorization with IAM, Cognito and STS, encrypting data with KMS, and managing secrets and sensitive data in application code.

Exam format
26%
Official tasks
3
Assessment estimate
~13
Suggested study time estimate
20–25 hrs

About 10 min read Reviewed October 2026

Overview

Security is the second-largest DVA domain and the one where many developers quietly lose points. It has three tasks. Authentication and authorization covers IAM roles and policies, temporary credentials with STS, and Amazon Cognito user pools and identity pools for application sign-in and AWS access. Encryption covers KMS, envelope encryption, and client-side versus server-side encryption. Managing sensitive data covers storing secrets with Secrets Manager and Parameter Store, protecting personally identifiable information, and keeping credentials out of code.

At 26%, security is bigger than deployment, and it recurs across every other domain. The exam rewards knowing the difference between Cognito user pools and identity pools, how envelope encryption works, when to use IAM roles over long-lived keys, and how to keep secrets out of source code. These are developer security patterns, applied in code, rather than infrastructure security design.

How it's tested

DVA-C02 questions describe an authentication, encryption or secret-handling need in an application and ask which AWS mechanism to use. This domain rewards temporary credentials over long-lived keys, the right Cognito pool, correct KMS usage, and managed secret storage. Read the exact security need before choosing.

  • Right credential model

    An access need is described, and you choose IAM roles with STS temporary credentials over stored keys.

  • Cognito pool choice

    A sign-in or AWS-access need is described, and you choose a user pool, an identity pool, or both.

  • Protect the data

    An encryption or secret need is described, and you choose KMS, envelope encryption or Secrets Manager.

Reasoning it through

A mobile app must let users sign in and then call AWS services such as S3 directly with scoped, temporary permissions. A Cognito user pool handles the sign-in and issues tokens, but tokens are not AWS credentials. A Cognito identity pool exchanges the user pool token for temporary AWS credentials scoped by an IAM role, so both are used together: the user pool authenticates and the identity pool authorizes AWS access.

Tasks 3

Official tasks from the Amazon Web Services outline, in outline order.

2.1 Implement authentication and/or authorization for applications and AWS servicesIAM roles and policies, STS temporary credentials, and Cognito user and identity pools.
What it means
This covers IAM roles and policies for least-privilege access, temporary credentials with AWS Security Token Service (STS) and role assumption, and Amazon Cognito user pools for application authentication and identity pools for granting temporary AWS credentials, plus token handling.
What to understand
IAM roles with STS provide temporary credentials, preferred over long-lived access keys. Cognito user pools authenticate users and issue tokens; identity pools exchange those tokens for temporary AWS credentials scoped by an IAM role. Authentication (who you are) is distinct from authorization (what you may do).
How it shows up
An access scenario is described, and you must choose IAM roles, STS or the correct Cognito pool.
Common confusion
Confusing Cognito user pools with identity pools; user pools authenticate users, while identity pools grant temporary AWS credentials.
2.2 Implement encryption by using AWS servicesKMS, envelope encryption, and client-side versus server-side encryption.
What it means
This covers encryption with AWS KMS, envelope encryption using a data key protected by a KMS master key, client-side versus server-side encryption, encrypting data at rest and in transit, and using customer managed versus AWS managed keys.
What to understand
Envelope encryption encrypts data with a data key, then encrypts the data key with a KMS key, which is how KMS scales to large data. Server-side encryption has AWS encrypt data; client-side encryption encrypts before sending. Customer managed keys give control over rotation and policy.
How it shows up
An encryption requirement is described, and you must choose KMS usage, the encryption location, or the key type.
Common confusion
Confusing client-side with server-side encryption; client-side encrypts before upload, while server-side encrypts after the service receives the data.
2.3 Manage sensitive data in application codeSecrets Manager, Parameter Store, PII protection, and keeping credentials out of code.
What it means
This covers storing secrets with AWS Secrets Manager and Systems Manager Parameter Store, rotating secrets, accessing application configuration with AppConfig, protecting personally identifiable information, and ensuring credentials are never hard-coded in source.
What to understand
Secrets Manager stores and automatically rotates secrets such as database credentials. Parameter Store holds configuration and secrets, with rotation needing more setup. Both keep secrets out of code. Credentials should come from roles or secret stores at runtime, never be committed to source control.
How it shows up
A secret or sensitive-data need is described, and you must choose Secrets Manager, Parameter Store or AppConfig.
Common confusion
Hard-coding secrets or using Parameter Store without rotation when Secrets Manager offers built-in rotation.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • IAM roles and STS

    Temporary credentials from assuming a role.

    Remember
    Preferred over long-lived access keys.
    Tested as
    Access questions.
    Trap
    Hard-coding access keys.

  • Cognito user pool

    Authenticates application users and issues tokens.

    Remember
    It handles sign-in, not AWS access.
    Tested as
    Auth questions.
    Trap
    Confusing it with an identity pool.

  • Cognito identity pool

    Exchanges tokens for temporary AWS credentials.

    Remember
    It grants scoped AWS access.
    Tested as
    Authorization questions.
    Trap
    Confusing it with a user pool.

  • Least privilege

    Granting only the permissions needed.

    Remember
    A core developer security practice.
    Tested as
    Access questions.
    Trap
    Granting broad permissions.

  • KMS

    Managed encryption key service.

    Remember
    Customer managed keys give control.
    Tested as
    Encryption questions.
    Trap
    Using AWS managed keys where control is needed.

  • Envelope encryption

    Data encrypted with a data key, which is encrypted by a KMS key.

    Remember
    It is how KMS scales encryption.
    Tested as
    Encryption questions.
    Trap
    Expecting KMS to encrypt large data directly.

  • Client-side vs. server-side encryption

    Encrypt before sending versus after the service receives it.

    Remember
    Choose by where trust must hold.
    Tested as
    Encryption questions.
    Trap
    Confusing the two.

  • Secrets Manager

    Stores and rotates secrets.

    Remember
    Built-in rotation removes hard-coded credentials.
    Tested as
    Secret questions.
    Trap
    Hard-coding secrets.

  • Parameter Store

    Stores configuration and secrets.

    Remember
    Rotation needs more setup than Secrets Manager.
    Tested as
    Configuration questions.
    Trap
    Expecting automatic rotation.

  • AppConfig

    Manages and deploys application configuration safely.

    Remember
    It validates and rolls out config changes.
    Tested as
    Configuration questions.
    Trap
    Hard-coding configuration.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Cognito user pool vs. identity pool

ConceptMeaningKey differenceCommon trap
User pool Authenticates users, issues tokens Sign-in and user directory Confusing it with an identity pool
Identity pool Grants temporary AWS credentials Scoped AWS access Confusing it with a user pool

Client-side vs. server-side encryption

ConceptMeaningKey differenceCommon trap
Client-side Encrypt before uploading Service never sees plaintext Confusing with server-side
Server-side Service encrypts after receiving Simpler, service manages it Expecting the service never sees plaintext

Secrets Manager vs. Parameter Store vs. AppConfig

ConceptMeaningKey differenceCommon trap
Secrets Manager Stores and rotates secrets Built-in rotation Hard-coding secrets
Parameter Store Configuration and secrets Rotation needs setup Expecting auto rotation
AppConfig Deploys application configuration Safe config rollout Using it as a secret store

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Hard-coded credentials

    What candidates pick
    Store AWS access keys in the application source code.
    Why it looks right
    It is simple to wire up.
    Why it's wrong
    Credentials belong in IAM roles or a secret store; hard-coding them risks exposure in source control.

    Clue to watch for The application needs AWS credentials at runtime.

  2. User pool grants AWS access

    What candidates pick
    Use a Cognito user pool token directly as AWS credentials.
    Why it looks right
    The user pool authenticated the user.
    Why it's wrong
    User pool tokens are not AWS credentials; an identity pool exchanges them for temporary AWS credentials.

    Clue to watch for The app must call AWS services after sign-in.

  3. KMS encrypts the large object

    What candidates pick
    Send a large object directly to KMS to encrypt.
    Why it looks right
    KMS does encryption.
    Why it's wrong
    KMS encrypts small data keys; envelope encryption uses a data key to encrypt the large object.

    Clue to watch for The data to encrypt is large.

  4. Parameter Store for rotation

    What candidates pick
    Use Parameter Store expecting automatic secret rotation.
    Why it looks right
    It can store secrets.
    Why it's wrong
    Secrets Manager provides built-in rotation; Parameter Store needs more setup.

    Clue to watch for The secret must rotate automatically.

  5. Client-side when server-side fits

    What candidates pick
    Build complex client-side encryption when server-side would meet the requirement.
    Why it looks right
    Client-side feels more secure.
    Why it's wrong
    Server-side encryption is simpler and sufficient unless the service must never see plaintext.

    Clue to watch for There is no requirement that the service never sees plaintext.

Answer framework

For any Domain 2 scenario, use these steps to find the answer DVA-C02 expects.

  1. Separate authentication from authorization, and prefer IAM roles with STS temporary credentials over long-lived keys.
  2. For application sign-in, use a Cognito user pool, and add an identity pool when the app must obtain temporary AWS credentials.
  3. For encryption, use KMS with envelope encryption for large data, and choose client-side only when the service must never see plaintext.
  4. Choose customer managed KMS keys when you need control over rotation and policy.
  5. Store secrets in Secrets Manager with rotation, or Parameter Store, and never hard-code credentials in source. Where two options seem to fit, pick the one that most precisely matches the behavior the scenario requires.

Practice question

A web application authenticates users with an Amazon Cognito user pool. After sign-in, the application must let each user upload files directly to Amazon S3 with temporary, scoped AWS permissions. What should the developer add?

Want more like this? The AWS DVA practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Front-load this domain, because at 26% it is larger than deployment and security mistakes sink many candidates. Start with authentication and authorization: IAM roles with STS over long-lived keys, and the crucial Cognito distinction, user pools authenticate users while identity pools grant temporary AWS credentials. Practice the pattern of using both together.

Next, master encryption: how envelope encryption uses a data key under a KMS key, client-side versus server-side encryption, and when control requires a customer managed key. Then learn secret management, keeping Secrets Manager (with rotation), Parameter Store and AppConfig distinct, and internalize that credentials never belong in source code.

Because security questions appear across all domains, strong patterns here lift your whole score. Hands-on practice wiring Cognito and reading a secret from Secrets Manager cements it. Afterwards, move to Domain 3, deployment. Hands-on coding against the AWS SDK in a free-tier account cements these developer patterns far faster than reading, and reviewing missed practice questions by domain shows where to focus next.

FAQ

How much of DVA-C02 is Domain 2?

Security is 26% of the scored content, the second-largest domain, and security themes recur across the other domains.

What is the difference between a Cognito user pool and an identity pool?

A user pool authenticates users and issues tokens. An identity pool exchanges those tokens for temporary AWS credentials scoped by an IAM role, so the app can call AWS services.

What is envelope encryption?

Encrypting data with a data key, then encrypting that data key with a KMS key. It lets KMS secure large amounts of data efficiently without encrypting the whole object directly.

When should I use Secrets Manager versus Parameter Store?

Use Secrets Manager when you need built-in automatic rotation of secrets. Parameter Store can hold secrets and configuration but requires more setup to rotate.

Should I ever hard-code credentials?

No. Use IAM roles for AWS access and a secret store such as Secrets Manager for other credentials, so nothing sensitive is committed to source control.

What is the difference between client-side and server-side encryption?

Client-side encryption encrypts data before sending it, so the service never sees plaintext. Server-side encryption has the service encrypt the data after receiving it.

How does Domain 2 connect to the rest of the exam?

Security applies to the code written in Domain 1, the pipelines in Domain 3 and the systems observed in Domain 4, so it threads through the whole exam.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered authentication, authorization, encryption and secret management. Test whether you can choose the secure, least-privilege pattern under exam conditions.

Take the AWS DVA practice test Check your AWS DVA readiness

Keep going