AWS Security Specialty Study Roadmap

Domain 1: Threat Detection (GuardDuty findings, CloudWatch anomaly detection, VPC Flow Logs analysis)

Domain 1: Detection Mechanisms (AWS Config rules, Security Hub, custom detection with Lambda)

Domain 2: Incident Response (IR plans, compromised EC2/IAM/S3, forensic snapshot isolation)

Domain 2: Logging & Monitoring (CloudTrail integrity, centralized logging, CloudWatch Logs Insights)

Domain 3: Edge Security (CloudFront signed URLs, WAF rules, Shield Advanced, DDoS mitigation)

Domain 3: Network & Compute Security (VPC design, NACLs, security groups, Systems Manager patching)

Domain 4: IAM Deep Dive (Permission boundaries, SCPs, ABAC, identity federation, SAML/OIDC)

Domain 4: Advanced IAM (Cross-account roles, IAM Access Analyzer, resource-based policies)

Domain 5: Data Protection (KMS CMKs, key policies, envelope encryption, Macie, S3 encryption)

Domain 5: Data in Transit (ACM, TLS termination, VPN encryption, Secrets Manager rotation)

Domain 6: Governance (AWS Organizations, Control Tower, Config conformance packs, Audit Manager)

Full Review: Practice exams, Scenario walkthroughs, Weak areas, Exam logistics