Security Study Guide — DVA-C02

Security Domain – AWS DVA-C02 Study Guide

This domain (26% of the exam) tests your ability to implement authentication, authorization, encryption, and secrets management using AWS services. Expect scenario-based questions where you must choose the right service or configuration given specific constraints—least privilege, rotation requirements, federation use cases, and encryption scope.

AWS IAM: Policies, Roles, and Boundaries

Policy evaluation logic is heavily tested. The order: explicit Deny → SCPs → resource-based policies → identity-based policies → permission boundaries → session policies. An explicit Deny anywhere wins.

• Trust policies define who can assume a role (the principal). Without a correct trust policy, even a correctly permissioned role can't be assumed.
• Permission boundaries cap the maximum permissions an identity-based policy can grant—they don't grant permissions themselves. A developer with a boundary set can't escalate past it even if you attach a broader policy.
• Resource-based policies (e.g., S3 bucket policy, KMS key policy) allow cross-account access without requiring the target account to also have an identity-based policy—this is a key distinction from identity-based policies alone.

Trap: If an IAM user in Account A needs access to an S3 bucket in Account B, both the bucket policy (resource-based) AND the IAM policy (identity-based) must allow it—unless the bucket policy explicitly grants the specific principal, which can be sufficient.

Amazon Cognito User Pools vs. Identity Pools

User Pools handle authentication (sign-up, sign-in, MFA). They issue JWT tokens (ID token, access token, refresh token). Use User Pools when your app needs to verify who the user is.

Identity Pools handle authorization to AWS resources—they exchange a token (from User Pool, Google, Facebook, SAML, etc.) for temporary AWS credentials via STS. Use Identity Pools when your app needs to call AWS services directly (e.g., S3 from a mobile app).

Common pattern: User Pool authenticates → returns JWT → Identity Pool exchanges JWT for STS credentials → app calls AWS directly.

• Hosted UI provides a pre-built sign-in page; supports OAuth 2.0 flows.
• Lambda triggers (pre-signup, post-confirmation, pre-token generation) let you customize the auth flow—know which trigger fires when.
• Trap: A Cognito Authorizer in API Gateway validates the JWT from a User Pool. An Identity Pool is not used for API Gateway authorization directly.

AWS STS

Three operations to know:

STS credentials are temporary and short-lived. Default session duration for AssumeRole is 1 hour (max 12 hours if role allows). GetSessionToken max is 36 hours for IAM users.

API Gateway Authorization

Three authorizer types:

• IAM Authorization: Caller signs request with Sig v4. Use for machine-to-machine or internal AWS service calls.
• Cognito Authorizer: Validates JWT from a Cognito User Pool. No custom code needed. Best for user-facing apps already using Cognito.
• Lambda Authorizer: Custom logic—validate any token, API key, or header. Returns an IAM policy. Can cache the policy (TTL configurable). Use when you have a third-party identity provider not supported natively.