AWS SAA · Domain 1 of 4

AWS SAA Domain 1: Design Secure Architectures

Security is the largest SAA-C03 domain. It covers designing secure access with IAM and federation, protecting workloads and applications, and applying the right data security controls, all within the AWS shared responsibility model.

Exam format
30%
Official task statements
3
Assessment estimate
~15
Suggested study time estimate
30–40 hrs

About 11 min read Reviewed October 2026

Overview

Domain 1 covers designing secure AWS architectures. It has three task statements. Designing secure access covers IAM users, roles and policies, cross-account access, federation and IAM Identity Center, the principle of least privilege, the shared responsibility model and AWS global infrastructure. Designing secure workloads and applications covers securing application tiers, VPC security with security groups and network ACLs, secure connectivity, and services such as WAF, Shield and Secrets Manager. Determining data security controls covers encryption at rest and in transit, key management with KMS, data classification and lifecycle, and access logging.

At 30%, this is the heaviest domain, and security concepts recur across the other three. The exam rewards knowing which service enforces which control, applying least privilege, and choosing encryption and key management correctly. It builds on the Well-Architected Framework's security pillar, which underpins the whole certification.

How it's tested

SAA-C03 questions are scenario-based, asking for the solution that BEST meets requirements. In this domain they describe an access, workload or data-protection need and ask which AWS security service or design fits, usually favoring least privilege and managed services over custom or over-broad solutions.

  • Least-privilege access

    An access requirement is described, and you choose IAM roles and scoped policies over broad permissions or long-lived keys.

  • Right security control

    A workload or network protection need is described, and you choose the matching service, such as WAF, security groups or Secrets Manager.

  • Encryption and keys

    A data-protection requirement is described, and you choose encryption at rest or in transit and the correct KMS key model.

Reasoning it through

An application on EC2 needs to read from an S3 bucket. Embedding IAM user access keys on the instance is tempting, but it creates long-lived credentials to protect and rotate. The AWS-preferred design attaches an IAM role to the EC2 instance, granting a scoped, temporary-credential policy with least privilege, so no keys are stored and access is limited to the specific bucket actions needed.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

1.1 Design secure access to AWS resourcesIAM, federation, cross-account access, least privilege and the shared responsibility model.
What it means
This covers IAM users, groups, roles and policies, cross-account access, federated access and IAM Identity Center, multi-factor authentication, the principle of least privilege, AWS global infrastructure such as Regions and Availability Zones, and the shared responsibility model.
What to understand
IAM roles with temporary credentials are preferred over long-lived access keys, especially for AWS services and EC2 instances. Least privilege means granting only the actions and resources needed. Federation and IAM Identity Center provide single sign-on without creating IAM users for everyone. The shared responsibility model divides security between AWS and the customer.
How it shows up
An access scenario is described, and you must choose IAM roles, federation or the least-privilege policy rather than broad permissions or stored keys.
Common confusion
Confusing IAM roles with IAM users. Roles provide temporary credentials and are assumed by services or federated identities, while users have long-lived credentials.
1.2 Design secure workloads and applicationsVPC security, security groups, network ACLs, and protective services such as WAF and Secrets Manager.
What it means
This covers securing application components and tiers, VPC design with security groups and network access control lists, secure connectivity such as VPN and PrivateLink, and protective services including AWS WAF, AWS Shield, AWS Secrets Manager and Systems Manager Parameter Store.
What to understand
Security groups are stateful and operate at the instance level, allowing rules only; network ACLs are stateless and operate at the subnet level, allowing and denying. WAF protects web applications at layer 7, and Shield protects against DDoS. Secrets Manager stores and rotates secrets so they are not hard-coded.
How it shows up
A workload or network protection need is described, and you must choose the right control and know the difference between security groups and network ACLs.
Common confusion
Confusing stateful security groups with stateless network ACLs, and expecting a security group to deny traffic, which it cannot do.
1.3 Determine appropriate data security controlsEncryption at rest and in transit, KMS key management, and data classification and logging.
What it means
This covers encrypting data at rest and in transit, key management with AWS KMS including customer managed keys and AWS managed keys, envelope encryption, data classification and lifecycle, and access logging and monitoring for data stores.
What to understand
Encryption at rest protects stored data, and encryption in transit protects data moving over the network, often with TLS. KMS manages keys, and customer managed keys give control over rotation and policy, while AWS managed keys are simpler but less controllable. Many services encrypt with a single setting backed by KMS.
How it shows up
A data-protection requirement is described, and you must choose encryption at rest or in transit and the appropriate KMS key type.
Common confusion
Confusing encryption at rest with encryption in transit, and assuming one covers the other.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • IAM role vs. IAM user

    Roles provide temporary credentials assumed by services or federated identities; users have long-lived credentials.

    Remember
    Prefer roles for AWS services and EC2 over stored access keys.
    Tested as
    Access design questions.
    Trap
    Embedding user access keys on an instance.

  • Principle of least privilege

    Granting only the permissions needed for a task.

    Remember
    Scope policies to specific actions and resources.
    Tested as
    IAM policy questions.
    Trap
    Granting broad or wildcard permissions.

  • IAM Identity Center and federation

    Single sign-on and federated access without creating IAM users for everyone.

    Remember
    Use federation for workforce and cross-account access.
    Tested as
    Access at scale questions.
    Trap
    Creating individual IAM users where federation fits.

  • Shared responsibility model

    AWS secures the cloud; the customer secures what they put in it.

    Remember
    Know which side owns a given control.
    Tested as
    Foundational security questions.
    Trap
    Assuming AWS secures customer data and configuration.

  • Security group vs. network ACL

    Security groups are stateful and instance-level; network ACLs are stateless and subnet-level.

    Remember
    Security groups allow only; network ACLs allow and deny.
    Tested as
    VPC security questions.
    Trap
    Expecting a security group to deny traffic.

  • AWS WAF

    A web application firewall protecting against layer-7 attacks.

    Remember
    It protects web applications, not general network traffic.
    Tested as
    Web protection questions.
    Trap
    Using a security group for web application attacks.

  • AWS Shield

    DDoS protection, with Standard included and Advanced as a paid tier.

    Remember
    It defends availability against DDoS.
    Tested as
    DDoS protection questions.
    Trap
    Confusing it with WAF.

  • Secrets Manager vs. Parameter Store

    Secrets Manager stores and rotates secrets; Parameter Store holds configuration and secrets, with rotation needing more setup.

    Remember
    Secrets Manager offers built-in rotation.
    Tested as
    Secret handling questions.
    Trap
    Hard-coding secrets in code or configuration.

  • Encryption at rest vs. in transit

    At rest protects stored data; in transit protects data moving over the network.

    Remember
    They are separate controls and both may be required.
    Tested as
    Data protection questions.
    Trap
    Assuming one covers the other.

  • KMS customer managed vs. AWS managed keys

    Customer managed keys give control over policy and rotation; AWS managed keys are simpler but less controllable.

    Remember
    Choose customer managed keys when control is required.
    Tested as
    Key management questions.
    Trap
    Using AWS managed keys where custom policy or rotation is needed.

  • Envelope encryption

    Encrypting data with a data key that is itself encrypted by a KMS key.

    Remember
    It is how KMS scales encryption efficiently.
    Tested as
    Encryption design questions.
    Trap
    Expecting KMS to encrypt large data directly.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

IAM role vs. IAM user vs. federation

ConceptMeaningKey differenceCommon trap
IAM role Temporary credentials assumed by services or identities No long-lived keys Using a user where a role fits
IAM user An identity with long-lived credentials Credentials must be protected and rotated Creating users for applications
Federation External identities access AWS via a trusted provider Single sign-on without IAM users Creating individual users instead

Security group vs. network ACL

ConceptMeaningKey differenceCommon trap
Security group Instance-level, stateful firewall Allow rules only, stateful Expecting it to deny traffic
Network ACL Subnet-level, stateless filter Allow and deny, stateless Forgetting it needs both inbound and outbound rules

KMS customer managed vs. AWS managed keys

ConceptMeaningKey differenceCommon trap
Customer managed key A KMS key you create and control Control over policy and rotation Using it when simplicity suffices
AWS managed key A KMS key AWS creates for a service Simple but limited control Using it where custom policy is required

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Keys on the instance

    What candidates pick
    Store IAM user access keys on an EC2 instance for AWS access.
    Why it looks right
    It is a familiar way to authenticate.
    Why it's wrong
    It creates long-lived credentials to protect and rotate. An IAM role attached to the instance provides temporary credentials with least privilege.

    Clue to watch for An EC2 instance or AWS service needs to access another AWS resource.

  2. Wildcard policy

    What candidates pick
    Grant a broad policy with wildcard actions for convenience.
    Why it looks right
    It avoids permission errors.
    Why it's wrong
    It violates least privilege. Scope the policy to the specific actions and resources needed.

    Clue to watch for The scenario asks for secure or least-privilege access.

  3. Security group denies

    What candidates pick
    Use a security group to explicitly block an IP range.
    Why it looks right
    Security groups filter traffic.
    Why it's wrong
    Security groups only allow; to deny specific traffic you use a network ACL.

    Clue to watch for The requirement is to deny or block specific traffic.

  4. WAF for network traffic

    What candidates pick
    Use AWS WAF to filter general network traffic.
    Why it looks right
    WAF is a firewall.
    Why it's wrong
    WAF protects web applications at layer 7. Network-level filtering uses security groups, network ACLs or Network Firewall.

    Clue to watch for The threat is general network traffic, not web requests.

  5. Hard-coded secrets

    What candidates pick
    Store database credentials in application configuration.
    Why it looks right
    It is simple.
    Why it's wrong
    Secrets Manager stores and rotates secrets securely, removing hard-coded credentials.

    Clue to watch for The scenario involves storing or rotating credentials.

  6. One encryption covers all

    What candidates pick
    Assume encryption at rest also protects data in transit.
    Why it looks right
    Both are encryption.
    Why it's wrong
    At rest protects stored data; in transit protects moving data. Both may be required.

    Clue to watch for The requirement spans both stored and transmitted data.

Answer framework

For any Domain 1 security scenario, use these steps to find the answer SAA-C03 expects.

  1. Apply the shared responsibility model to confirm the control is the customer's to design, then prefer managed AWS security services.
  2. For access, use IAM roles with temporary credentials and least-privilege policies, and federation or IAM Identity Center at scale, rather than long-lived keys.
  3. For network and workload protection, choose the right control, distinguishing stateful security groups from stateless network ACLs and using WAF for web attacks.
  4. For data, apply encryption at rest and in transit as required, choosing customer managed KMS keys when control over policy and rotation is needed.
  5. Store secrets in Secrets Manager or Parameter Store rather than hard-coding them, and prefer the least-privilege, most-managed option overall.

Practice question

An application running on Amazon EC2 needs read access to objects in a specific Amazon S3 bucket. What is the MOST secure way to grant this access?

Want more like this? The AWS SAA practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most study time, since it is 30% of the exam and its concepts recur everywhere. Start with IAM, the heart of AWS security. Practice writing least-privilege policies and using roles for EC2 and service access, and learn federation and IAM Identity Center for workforce and cross-account scenarios. Make the shared responsibility model automatic.

Next, learn VPC security, drilling the stateful security group versus stateless network ACL distinction until it is second nature, and know where WAF, Shield and Secrets Manager fit. Then study data protection: encryption at rest versus in transit, and the KMS key models, including envelope encryption.

Hands-on practice in a free-tier AWS account, creating roles, policies, security groups and KMS keys, cements these far faster than reading. Afterwards, move to Domain 2, resilient architectures, which builds availability and scalability on this secure foundation. Hands-on practice in a free-tier AWS account cements these choices cements these patterns, and reviewing missed questions by domain shows where to focus next.

FAQ

How much of SAA-C03 is Domain 1?

Design Secure Architectures is 30% of the scored content, the largest domain, and its concepts appear across the other three.

Why use an IAM role instead of access keys on EC2?

A role provides temporary, automatically rotated credentials scoped with least privilege, so no long-lived keys are stored on the instance to be stolen or managed.

What is the difference between a security group and a network ACL?

A security group is stateful, operates at the instance level and allows rules only. A network ACL is stateless, operates at the subnet level and supports both allow and deny rules.

What is the shared responsibility model?

AWS is responsible for security of the cloud, such as the infrastructure, while the customer is responsible for security in the cloud, such as data, configuration and access.

When should I use a customer managed KMS key?

When you need control over the key policy, rotation schedule or auditing. AWS managed keys are simpler but offer less control.

Where should application secrets be stored?

In AWS Secrets Manager, which stores and automatically rotates secrets, or Parameter Store for configuration, rather than hard-coded in the application.

How does Domain 1 connect to the rest of the exam?

Security underpins the resilient, high-performing and cost-optimized domains, so IAM, encryption and VPC security recur throughout the exam.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered secure access with IAM, workload and network protection, and data security controls. Test whether you can choose the least-privilege, managed option under exam conditions.

Take the AWS SAA practice test Check your AWS SAA readiness

Keep going