AWS Security Specialty Study Roadmap

Domain 1: Threat Detection — GuardDuty findings, CloudWatch anomaly detection, VPC Flow Logs analysis

Domain 1: Detection Mechanisms — AWS Config rules, Security Hub, custom detection with Lambda

Domain 2: Incident Response — IR plans, compromised EC2/IAM/S3, forensic snapshot isolation

Domain 2: Logging & Monitoring — CloudTrail integrity, centralized logging, CloudWatch Logs Insights

Domain 3: Edge Security — CloudFront signed URLs, WAF rules, Shield Advanced, DDoS mitigation

Domain 3: Network & Compute Security — VPC design, NACLs, security groups, Systems Manager patching

Domain 4: IAM Deep Dive — Permission boundaries, SCPs, ABAC, identity federation, SAML/OIDC

Domain 4: Advanced IAM — Cross-account roles, IAM Access Analyzer, resource-based policies

Domain 5: Data Protection — KMS CMKs, key policies, envelope encryption, Macie, S3 encryption

Domain 5: Data in Transit — ACM, TLS termination, VPN encryption, Secrets Manager rotation

Domain 6: Governance — AWS Organizations, Control Tower, Config conformance packs, Audit Manager

Full Review: Practice exams, Scenario walkthroughs, Weak areas, Exam logistics