Design Secure Architectures
Secure VPC and Application Access
CoreDesign segmented VPC/application boundaries and choose preventive, detective, and external-connectivity controls.
Aligned to the current SAA-C03 exam guide, verified August 16, 2026.
Why this matters
Secure architecture puts a control at the boundary where the threat exists. The decision combines routing, stateful and stateless filtering, private service access, application protection, identity, secrets, detection, and hybrid transport.
Must Know
- A public subnet has a route to an internet gateway; a resource is not internet-reachable merely because it is placed there. Private tiers use controlled egress only when required.
- Security groups are stateful resource-level firewalls. Network ACLs are stateless subnet filters, so both traffic directions must be allowed.
- A NAT gateway provides outbound connectivity for private IPv4 resources; it is not a private path to AWS services. VPC endpoints privately reach supported services.
- Gateway endpoints serve supported services such as S3 and DynamoDB; interface endpoints use PrivateLink and private IPs for supported services.
- Amazon Cognito provides customer-facing application sign-up, sign-in, federation, and app identity. Application end users are never IAM users.
- WAF filters supported Layer 7 web requests; Shield addresses DDoS protection. Secrets Manager stores and can rotate supported secrets; KMS and IAM protect them.
- GuardDuty detects suspicious activity, Inspector finds supported workload vulnerabilities, Macie discovers sensitive S3 data, and Security Hub aggregates findings.
Compare and Distinguish
- Security group vs NACL: use stateful resource rules for normal flows; use stateless subnet rules for coarse boundaries or explicit denies.
- VPC endpoint vs NAT: endpoints win for supported AWS services that must stay private; NAT wins for general outbound internet or unsupported public endpoints.
- Cognito vs Identity Center vs IAM roles: choose Cognito for application end users, Identity Center for workforce access to AWS accounts and business applications, and roles for temporary workload, service, or cross-account authorization.
- PrivateLink vs peering/Transit Gateway: PrivateLink exposes a specific service without broad routing; the others connect routed networks.
- WAF vs Shield vs Network Firewall: choose HTTP request filtering, DDoS protection, or stateful VPC traffic inspection according to the attack layer.
- GuardDuty vs Inspector vs Macie vs Security Hub: suspicious activity, vulnerabilities, S3 data discovery, and consolidated findings are distinct.
- VPN vs Direct Connect: VPN is encrypted over the internet and quick to establish; Direct Connect is dedicated and more consistent but is not encrypted by default.
Scenario examples
- Scenario: Private workers call S3 and download internet updates. Think: use an S3 gateway endpoint for service traffic and NAT only for internet destinations.
- Scenario: A customer-facing mobile application needs user registration and authentication. Think: use Amazon Cognito, not IAM users.
- Scenario: A public application must block SQL injection. Think: the threat is HTTP content—use WAF on a supported endpoint while retaining network controls.
- Scenario: A provider exposes one service privately to customer VPCs. Think: the service-specific boundary points to PrivateLink.
- Scenario: Hybrid connectivity must be encrypted and available quickly. Think: Site-to-Site VPN meets those hard requirements; add Direct Connect when dedicated consistency justifies it.
Exam traps
- Subnet names do not decide public/private behavior; routes do.
- NAT does not make AWS service access private or accept unsolicited inbound traffic.
- Security groups are stateful and NACLs are stateless.
- Security Hub does not replace source detection services.
- Direct Connect alone does not satisfy an encryption-in-transit requirement.
Key takeaways
- Map source, destination, protocol, route, return path, and identity for every flow.
- Use endpoints for supported private service access and NAT for required general egress.
- Layer network, application, identity, secret, and detective controls.
- Match the threat or evidence type to the security service.
How it works
- Internet gateways provide a VPC edge path; routing and addressing determine which resources can use it.
- NAT translates outbound flows without creating an inbound listener.
- Security groups track allowed flows; NACLs evaluate packets in each direction.
- WAF, Shield, and findings services act at different layers and can be combined.
When to use it
- Use tiered subnets and narrow security-group references for multi-tier applications.
- Use gateway or interface endpoints for supported private service paths.
- Use Secrets Manager for centrally stored credentials and supported rotation.
- Use Network Firewall for stateful VPC inspection and Firewall Manager for central policy rollout.
Security and governance implications
- Minimize public addressing and expose only intended entry points.
- Grant secret retrieval only to the workload role that needs it.
- Combine preventive controls with logs, detection, vulnerability management, and triage.
- Preserve least privilege when administering policies across accounts.
Operational and diagnostic signals
- For failed connections, check DNS, route, security group, both NACL directions, endpoint policy, and service authorization.
- For unexpected NAT use, confirm a suitable endpoint exists and DNS/routes select it.
- For an aggregated finding, investigate the producing service and affected resource.
More detail
- Routes determine reachability; security controls determine whether the intended flow is permitted.
- Interface endpoints create private endpoint network interfaces and still require applicable endpoint and service authorization.
- Application access may require both network reachability and identity permission; passing one never implies the other.
- Preventive controls reduce attack surface; detective findings require an operational response.
Ready for the quiz?
- What makes a subnet public?
- When does an endpoint beat NAT?
- Why inspect both NACL directions?
- Which clue separates WAF, Shield, and Network Firewall?
- How do GuardDuty, Inspector, Macie, and Security Hub complement one another?
Related objectives
- D1.2.K1
- D1.2.K2
- D1.2.K3
- D1.2.K4
- D1.2.K5
- D1.2.K6
- D1.2.S1
- D1.2.S2
- D1.2.S3
- D1.2.S4