Security Engineering on AWS course material links

Please not that this is not a prep course for the “AWS Certified Security - Specialty” certification!

This document contains links mentioned in the “Security Engineering on AWS” course.

Module 0: Course Overview

Full name: Security Engineering on AWS

Product code: 200-SISECO-33

These links are based on the course version 3.3.20.

Online and classroom course options: Security Engineering on AWS

The official course material: eVantage Bookshelf (VitalSource)

Security Engineering on AWS- Online Course Supplement (free)

Security Engineering on AWS - Supplemental Lab Playlist (skillbuilder subscription required)

Security: Identity Management and Access Control (Advanced) Jam Journey (skillbuilder subscription required)

Security: Network and Infrastructure Security Jam Journey (skillbuilder subscription required)

Security: Data Protection and Data Encryption Jam Journey (skillbuilder subscription required)

AWS Security Champion - Knowledge Badge Readiness Path

Exam Prep Plan: AWS Certified Security - Specialty (SCS-C02 - English)

Module 1: Security Overview

Websites

• Applying the AWS Shared Responsibility Model to your GxP Solution
• AWS Managed Service Provider Program
• AWS Well-Architected Framework Design Principles
• How to approach threat modeling

Videos

• Well-Architected for Security: Advanced Session (AWS Public Sector Summit Australia 2017)
• Security Best Practices the Well-Architected Way (SDD318) (re:Inforce 2019)
• A Practitioner’s Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) (re:Invent 2018)

Module 2: Access and Authorizations on AWS

Websites

• AWS service endpoints
• AWS Signature Version 4 for API requests
• AWS services that work with IAM
• Tasks that require root user credentials
• AWS account root user
• Secure API access with MFA
• IAM Roles Anywhere concepts
• AWS services that work with IAM
• AWS Policy Generator
• AWS Policy Simulator
• Policy summary (list of services)
• Policy evaluation logic
• IAM JSON policy element reference
• Session policies
• Working with resource-based IAM policies in Lambda
• Create fine-grained session permissions using IAM managed policies
• Working with CloudTrail Event history
• CloudTrail supported services and integrations
• Validating CloudTrail log file integrity
• How AWS uses automated reasoning to help you achieve security at scale

Videos

• Become an IAM Policy Master in 60 Minutes or Less (SEC316-R1) (re:Invent 2018)
• AWS Knowledge Center Live: IAM Best Practices and Design Decisions
• Augmenting Security & Improving Operational Health w/ AWS CloudTrail (SEC323) (re:Invent 2018)
• Security & Compliance for Modern Serverless Applications (re:Invent 2018)

Module 3: Account Management and Provisioning on AWS

Websites

• Benefits of using multiple AWS accounts
• SCPs and guardrails in your AWS Organization
• Organizing your AWS Control Tower landing zone with nested OUs
• AWS Control Tower
• How AWS Control Tower Works
• Strategies for consolidating AWS environments
• Enabling self-service provisioning of AWS resources with AWS Control Tower
• Enabling SAML for your AWS resources
• Roles, terms and concepts
• Introducing AWS IAM Identity Center
• Common Amazon Cognito scenarios
• Working with adaptive authentication

Videos

• Deep Dive: Security and Governance Across a Multi-Account Strategy (SAC320) (re:Invent 2016)
• Architecting Security and Governance Across a Multi-Account Stra (SID331) (re:Invent 2017)
• Centrally Monitoring Resource Configuration & Compliance (ENT332-R1) (re:Invent 2018)
• Managing Multi-Account AWS Environments Using AWS Organizations (FND314) (re:Inforce 2019)
• Using AWS Control Tower to Govern Multi-Account AWS Environments (GRC313-R) (re:Inforce 2019)

Module 4: Managing Keys and Secrets on AWS

Websites

• Protecting data with encryption
• What is the AWS Encryption SDK?
• AWS Key Management Service introduces new HMAC API
• Using AWS KMS encryption with AWS services
• Grants in AWS KMS
• External key stores
• Multi-Region keys in AWS KMS
• AWS CloudHSM clusters
• AWS Key Management Service
• Are KMS custom key stores right for you?
• Database Credentials, Lambda Functions and AWS Secrets Manager
• What is AWS Secrets Manager?
• Identity-based policies
• Managing Parameter Store parameter tiers

Videos

• Encryption and Key Management in AWS (SEC304) (re:Invent 2013)
• Get the Most from AWS KMS: Architecting Applications for High Security (SEC303) (re:Invent 2016)

Module 5: Data Security

Websites

• Using access points
• Correlate IAM Access Analyzer findings with Amazon Macie
• Client-side and server-side encryption
• Creating security groups
• Amazon VPC Security Groups
• Securing your data in Amazon EFS
• Encryption at Rest
• S3 Glacier Vault Lock

Videos

• How Encryption Works in AWS (FND310-R) (re:Inforce 2019)
• Data Protection: Encryption, Availability, Resiliency, & Durability (SEC325-R1) (re:Invent 2018)

Module 6: Infrastructure and Edge Protection

Websites

• Amazon VPC now supports an AWS-managed prefix list for Amazon CloudFront
• AWS Best Practices for DDoS Resiliency
• Combinations Calculator (nCr)

Videos

• A Day in the Life of a Billion Packets (CPN401) (re:Invent 2013)
• Another Day, Another Billion Packets (NET403) (re:Invent 2015)
• Another Day, Another Billion Flows (NET405) (re:Invent 2017)
• Another Day, Another Billion Packets (AWS Summit London 2017)
• Another Day in the Life of a Cloud Network Engineer at Netflix (NET312) (re:Invent 2018)
• AWS Shield—A Managed DDoS Protection Service (SAC322) (re:Invent 2016)
• DDoS Attack Detection at Scale (SDD408) (re:Inforce 2019)

Module 7: Monitoring and Collecting Logs on AWS

Websites

• Multi-Account Multi-Region Data Aggregation
• Supported Resource Types
• AWS Config Managed Rules
• AWS Config Custom Rules
• Logging IP traffic using VPC Flow Logs
• CloudWatch Logs Insights query syntax
• Access logs for your Application Load Balancer
• Amazon S3 server access log format
• EventBridge is the evolution of Amazon CloudWatch Events
• How to Receive Notifications When Your AWS Account’s Root Access Keys Are Used
• Instance metrics
• Amazon Data Firehose / CreateDeliveryStream
• Analyzing Data in S3 using Amazon Athena
• What is Amazon Athena?
• Amazon Athena / Encryption at rest
• Query flow logs using Amazon Athena
• OpenSearch Documentation
• Build a Log Analytics Solution on AWS
• Centralized Logging with OpenSearch
• Centralized Logging with OpenSearch (implementation guide)

Videos

• Easily Transform Compliance to Code Using AWS Config, Config Rules, and the Rules Development Kit
• Centrally Monitoring Resource Configuration & Compliance (ENT332-R1) (re:Invent 2018)
• Monitoring and Remediating Non-Compliant Resources with AWS Config
• Security Automation using AWS Management Tools (AWS Public Sector Summit Washington DC 2018)
• Build a Dashboard Using Serverless Security Analytics (SDD201) (re:Inforce 2019)
• Build Your Own Log Analytics Solutions on AWS (ANT323-R1) (re:Invent 2018)
• Demo: Centralized Logging with OpenSearch - Logging solutions in 20 minutes

Module 8: Responding to Threats

Websites

• AWS Security Incident Response Guide
• Penetration Testing
• Amazon SNS message data protection
• Automated Security Response on AWS
• What is Amazon GuardDuty?
• Cyber Threat Intelligence (CTI)
• Overview of the behavior graph data structure
• What is Amazon Detective?
• AWS Security Blog
• Automated Forensics Orchestrator for Amazon EC2

Videos

• Incident Response in the Cloud (119678) (AWS Public Sector Summit 2016)
• Automating Incident Response and Forensics in AWS (AWS Summit Canberra 2018)
• Incident Response in the Cloud (SEC404) (re:Invent 2014)
• Incident Response in the Cloud (SID319) (re:Invent 2017)
• Threat Detection and Remediation in the Cloud (AWS Summit 2016)
• Threat Detection on AWS: An Introduction to Amazon GuardDuty (FND216) (re:Inforce 2019)

Module 9: Course Wrap-Up

Websites

• Serverless Architectures with AWS Lambda
• How AWS Pricing Works
• Back to Basics
• AWS Support
• AWS Certification exam preparation
• AWS Certification
• AWS Certification exams
• AWS Recertification
• Schedule an Exam
• AWS Ramp-Up Guides

Courses

• Advanced Developing on AWS
• Developing Serverless Solutions on AWS
• Build Modern Applications with AWS NoSQL Databases
• Getting Started with DevOps on AWS
• AWS Cloud Development Kit Primer
• AWS Skill Builder
• AWS Skill Builder courses
• AWS Builder Labs
• AWS Workshops
• Classroom training

Videos

• Tech Talks